Ghost on the Radar: Aircraft Identity Deception and the Rome to Tehran Mystery Flight

On November 3, 2026, a business jet departed Rome Ciampino Airport at approximately 01:10 UTC and landed at Tehran Mehrabad Airport in Iran. The flight itself was unremarkable. What drew attention was the identity it appeared to be broadcasting - which didn’t hold up under scrutiny. Researchers at The Aviationist spent considerable time picking apart the data trail and found evidence of deliberate identity deception.

This flight is a case study in how the public aircraft tracking ecosystem can be manipulated, and why every pilot who uses FlightAware or Flightradar24 should understand the difference between what those tools show and what ATC actually knows.

What Happened on November 3, 2026

The flight originated from Ciampino, Rome’s secondary airport, heavily used by business aviation and charter operations. It flew southeast across the Mediterranean and into Iranian airspace before landing at Mehrabad, Tehran’s older airport that handles domestic and business aviation traffic.

When researchers queried the ICAO hex code the aircraft appeared to be broadcasting, they found inconsistencies: the code either pointed to an aircraft that couldn’t plausibly have been in Rome at that time, matched a registration that appeared fictitious, or showed a data trail that didn’t survive basic cross-checking. The conclusion: someone had deliberately constructed a false identity for this flight.

Iran remains under significant international sanctions. Business aviation links between Western Europe and Tehran are uncommon, and when they do occur, they tend to involve humanitarian operations, diplomatic back-channels, or activities that at least one party would prefer not to publicize. A predawn departure from Ciampino doesn’t fit the profile of routine corporate travel.

How Aircraft Identity Broadcasting Works

Every modern transponder broadcasts a 24-bit ICAO hex code - a unique identifier tied to an aircraft’s registration. Think of it as a fingerprint. No two registered aircraft are supposed to share one.

Mode A gives ATC a squawk code. Mode C adds altitude. Mode S, built into every modern transponder, adds the ICAO hex code. ADS-B Out goes further still, actively broadcasting GPS-derived position, altitude, speed, heading, and that hex code - which is what feeds FlightAware, Flightradar24, and other public trackers. Those platforms aggregate signals from a global network of ground-based ADS-B receivers, most of them operated by volunteers or the tracker companies themselves.

In theory, every aircraft with a functioning transponder leaves a traceable data trail. In practice, the Rome-to-Tehran flight demonstrated how that trail can be engineered to mislead.

The Four Techniques Used to Defeat Public Tracking

Registration fraud is the simplest approach. An aircraft is registered in a jurisdiction with loose international cross-referencing. A valid-looking hex code gets assigned to a shell company. To anyone checking a tracker, the flight appears to be a routine charter from an obscure operator.

Hex code spoofing is more technically involved. A transponder can be programmed - or modified - to broadcast a hex code belonging to a different aircraft, ideally a type-matched one that operates in the same region. The deception only unravels if someone checks whether the legitimate aircraft associated with that code could physically have been at that location at that time. When the same hex code appears in Frankfurt and Rome within two hours for a mid-size business jet, the timelines don’t add up.

Strategic transponder management falls into a legal and technical gray zone. An aircraft operates with ADS-B active over airspace with robust ATC radar coverage, then suppresses ADS-B out over regions where the signal would reach public receiver networks but where primary radar coverage is thinner. The aircraft remains visible to ATC controllers - it’s still talking on required frequencies - but disappears from public tracking feeds. ADS-B out is mandatory in U.S. controlled airspace and EU airspace, but coverage over the Eastern Mediterranean and parts of the Middle East is patchy, with meaningful gaps in the volunteer-run receiver networks.

Data blocking is a legitimate FAA mechanism that allows certain operators - military, government, and some private operators with verified security concerns - to suppress their information from public feeds. Foreign aircraft on sensitive missions can’t simply request FAA blocking, but layered corporate ownership and jurisdiction-shopping can produce similar results. The tracker platforms themselves also have varying policies on what they’ll display.

Why the Safety System Still Works

ADS-B spoofing degrades public awareness, not ATC separation. Primary surveillance radar doesn’t interrogate a transponder - it paints any object reflecting radio waves. Secondary radar relies on the transponder being honest, and the public feed sits one step further downstream. The layers of the safety system are intentionally independent.

If an aircraft is broadcasting a false identity but accurate position data, TCAS and ADS-B In traffic displays still work - collision avoidance depends on position, not registration. If an aircraft is suppressing ADS-B entirely, it won’t appear on a traffic display at all. This is precisely why see-and-avoid and ATC radar separation remain non-negotiable requirements, not optional backups.

What This Means for Pilots in Sensitive Airspace

Pilots operating in Europe, the Eastern Mediterranean, or the Gulf region should understand that not every blip on a traffic display is what it claims to be. This isn’t a theoretical concern - it’s an operational reality in corridors where public ADS-B receiver coverage has known gaps.

The public tracking infrastructure has also become a critical accountability tool. It has exposed undeclared military movements, identified aircraft connected to sanctioned entities, and contributed to accident investigations. The techniques used to defeat that tracking are not new, but they are becoming more systematic and deliberate.

The Unsolved Problem: ADS-B Has No Cryptographic Authentication

The hex code vulnerability has been documented in aviation security research for years. ADS-B spoofing is not theoretically possible - it is practically possible with off-the-shelf equipment. Regulatory authorities including the FAA are aware of this. Proposals exist for cryptographic authentication of ADS-B signals, essentially a digital signature that would make spoofing significantly harder.

The obstacle is retrofitting cryptographic authentication across a global fleet. It is an expensive, long-timeline problem with no near-term solution.

In the interim, analysts tracking sensitive aviation movements rely on the same approach serious investigators have always used: corroborating multiple independent data sources. A single tracker feed can be fooled. Cross-referencing ADS-B data with satellite imagery, radar data from published NOTAMs, departure and arrival records, and the physical constraints of range and timing tends to surface the inconsistencies. The November 3 flight from Rome to Tehran showed its seams to anyone who knew where to look.

Key Takeaways

• On November 3, 2026, a business jet flew from Rome Ciampino to Tehran Mehrabad with a falsified or spoofed ICAO hex code, identified as a tracking deception case study by The Aviationist
• Public flight trackers depend on ADS-B signals that can be manipulated; ATC radar operates on independent, more robust principles
• Four documented techniques - registration fraud, hex code spoofing, strategic transponder suppression, and data blocking - can defeat or degrade public aircraft tracking
• TCAS and collision avoidance still function when an aircraft broadcasts false identity but accurate position; they fail entirely if ADS-B is suppressed, reinforcing the value of see-and-avoid
• Cryptographic authentication of ADS-B signals remains unimplemented globally due to fleet retrofitting costs, leaving the vulnerability open-ended