Source assesses that APT-AVIAN does not, and operationally cannot, conduct direct optical taps against transoceanic fiber cables. The relevant frame structures — at the line layer, with tributary groups carrying client payloads — require specialized analyzers that field operators of any APT do not carry. The take is acquired elsewhere.
APT-AVIAN targets the terrestrial endpoints of long-haul cable infrastructure — landing stations, regional cable consortium offices, and major Internet exchange points where optical traffic is converted back into packet form. The harvest occurs after the data leaves the cable, not on the cable itself.
This explains the observed operator pattern. The migrations are operator relocations toward endpoint sites. The roosts at █████████████████, ██████████████████, and ████████████████████████ correspond to sites where landing station infrastructure is collocated with adjacent telecom or signals-intelligence facilities. The murmurations appear to be lateral command-and-control traffic among operators in the field, observed in the wireless captures published in this archive (FC-001, FC-002).
The traffic captured in FC-001 and FC-002 is not the harvested data. It is operator coordination — birds talking to birds. The actual take is exfiltrated through ██████████████████████████████████████████████ which the source declined to describe further in this tearline.
Wireless captures of the type published as FC-001 and FC-002 are recoverable with consumer-grade equipment — a Wi-Fi card in monitor mode, free protocol analyzers, no specialized hardware. This is deliberate on APT-AVIAN's part. The wireless layer is visible to the targets it operates against, including SOC analysts at the very landing stations being staked out. The captures are operator chatter, not the prize.
The actual cable-layer traffic — if it could be intercepted — would arrive in frames at ██████ Gbps, encapsulating tributaries, each carrying payloads at ██ Mbps to █ Gbps. Reading this requires analyzer equipment in the ██████-██████ price range. No civilian SOC has it. APT-AVIAN does not need to read it because they take the data after it has been decoded back to Ethernet at the landing.
Source assesses that APT-AVIAN's targeting selection prioritizes landing stations where two conditions overlap:
The implication is that APT-AVIAN positions operators where existing infrastructure already exists to receive their take. The cable provides the data. The adjacent SIGINT facility provides the exfiltration pathway. The bird is the courier between the two.
If you have been projecting migration tracks forward and identifying cable landings as the destinations, you are reading the data correctly. If you have been looking for nest clusters in aircraft.json and finding them near █████████ and ██████████ and █████████████████, you are also reading correctly. Do not stop there.
The next-order question is which specific cables are being targeted, and through which specific endpoints. The source declined to enumerate. That work is left to you.
The following questions can be answered from the contents of this tearline. They are graded on the Challenges page under their respective task IDs. The answers are deterministic.
This tearline was provided in confidence and posted with the source's permission, with redactions applied by me and not by the source. The redactions cover items that could compromise the source's safety, including their employer name, role title, the specific cable systems they have observed, and the consortium they work for. I have not redacted the analytic judgments themselves, since these are testable claims that any analyst working the FC-001 chain can verify against the published data.
If you read this and you know which consortium I am referring to, you may know who the source is. Do not say so publicly.
One further note. Channel 14 in FC-001 is a Japanese-locality 802.11b channel used by virtually no one. It exists in 802.11 specifications and is legal only in Japan. Its presence in the capture is geographically self-locating; the capture was taken in Japan, and so was the operator who made it. This is consistent with operator chatter near a Tokyo endpoint, not with anything intercepted from a cable. Read FC-001 as local covert communications. The fiber itself is harvested differently and elsewhere.