A joke weather-balloon domain became dual-use infrastructure in the Ukraine war

SondeHub began in 2018 as a throwaway domain that simply redirected to Habhub, a hobbyist high-altitude ballooning tracker, with a filter for meteorological radiosondes. As Habhub’s servers buckled under load, the project’s operators quietly stood up their own AWS-backed ingestion and analytics stack, eventually rebuilding APIs, running their own trajectory predictor, and serving open data. A standout feature was ‘reverse prediction’: feeding a launched radiosonde’s telemetry through the wind model backwards to estimate its launch site — accurate enough to pinpoint poorly documented facilities.

That capability carried unintended weight. Because wind data also underpins artillery ranging, the reverse-prediction system began inadvertently mapping military installations and even detecting vessels at sea, prompting deletion requests from defense contacts. The stakes escalated sharply in late 2024, when a single AWS-hosted IP started hammering the prediction API. After ruling out a scraper bot and a private company, the operators concluded — and later confirmed via Ukrainian military channels — that a deep-strike team was using their open-source wind predictions to ‘surf’ fixed-wing drones toward targets inside Russia.

The episode forced genuinely novel operational and ethical calls: the team asked AWS not to block or rate-limit the offending account, warning that ‘loss of life could occur,’ while insisting the request logs never be shared lest they expose launch sites. They shipped a Docker Compose bundle so anyone could self-host the predictor and stop depending on their servers. By 2025, with the US ‘Office of the Secretary of War (Intelligence and Security)’ requesting data, the operators — reluctant to aid militaries at all — opted to charge for it. The story is a vivid case study in how a hobbyist open-source service becomes unavoidably dual-use, and how its maintainers are left improvising the governance no one designed it for.