Detecting the Gulf airspace closure with open data

28 February 2026 · Observed State Index

Summary

A monitoring system built on open data detected the coordinated closure of airspace over the Persian Gulf and the Levant on 28 February 2026, and narrowed the collapse to a seven-hour window.

Two independent sources — air traffic via ADS-B and network reachability via IODA — recorded the event on the same day without sharing infrastructure or methodology. The control nodes did not move, which rules out the signal being an artefact of the method.

Out of that cross-check came a finding we have not seen published elsewhere: of the eight countries that closed their airspace, only one shut down the internet. Closing the sky and cutting the network are different decisions, and the measurements separate them.

What is measured, and how

The system does not read news or press releases. It measures two observable things:

Aircraft in flight. Four daily captures of ADS-B traffic across 30 air corridors, at 02:30, 07:30, 14:30 and 19:30 UTC. Each capture counts distinct aircraft by transponder identifier within a defined radius around each node.

Network reachability. Periodic captures of IODA signals (Georgia Tech) for 52 countries. The main signal is ping-slash24: how many of a country's network blocks answer probing from outside.

The anomaly criterion

Each node is compared against its own history in the same time band, never against other nodes. A European airport under a night curfew and an American one without it have incomparable profiles; the only question that makes sense is whether today looks like its other Tuesdays at the same hour.

For aviation, the rule is a deviation of 3.5 sigma or more over a rolling 90-day window.

For connectivity, the rule allows two routes: 5 sigma or a 50% change. The disjunction is not cosmetic. In countries whose networks are already unstable, the standard deviation is so large that a near-total blackout does not reach the sigma threshold. Iran is the case in point: its coefficient of variation before the event was 50%, against 0.2–1.5% for every other country measured.

The event

On 28 February 2026, the United States and Israel struck targets in Iran. Eight countries closed their airspace in full or in part. The European Union Aviation Safety Agency issued a conflict zone bulletin covering eleven countries at all altitudes.

None of that enters the system. What follows is what the measurements recorded on their own.

Detection in aviation

The baseline for the Dubai node over 1 January to 20 February, across 46 complete days:

And what was measured on 28 February:

The collapse happened between 07:30 and 14:30 UTC. At 07:30 traffic was normal; by 14:30 three aircraft remained of the 102 expected.

The thirteen preceding days show nothing: the lowest value was −1.16 sigma.

Geographic propagation

Cutting by time band reveals an order:

• 07:30 UTC — Tel Aviv is already at −4.24 sigma (1 aircraft against a mean of 18). Dubai is still normal.
• 14:30 UTC — all three fall: Dubai −9.42, Doha −4.84, Tel Aviv −4.15.

Tel Aviv led Dubai by a full time band. With four captures a day the lag cannot be measured precisely, but the sequence is visible.

The controls

Istanbul stayed at z ≈ 0 throughout the period. Delhi at +0.3. Chennai at −0.7.

Cairo did move, between −1.5 and −2.7 sigma: affected, but moderately.

No neighbouring node showed a rise. The mirror effect of rerouting — diverted traffic appearing in alternative corridors — was looked for and not found in the monitored nodes.

Detection in connectivity

Of the 52 countries measured, only Iran fell outside its range.

Three independent indicators agree on the same seven-hour window. And the blackout held: five days later, ping-slash24 was still at −96.8%.

The other countries of the Gulf and the Levant did not lose connectivity. The Emirates, Egypt, Saudi Arabia and Turkey moved less than 2% across the whole period. Israel registered −3% on ping, within the noise.

Cross-check between sources

The windows overlap almost entirely. At the resolution available — seven hours in both sources — it cannot be stated which moved first.

What can be stated: two independent domains, measured by unrelated systems, collapsed within the same window of the same day.

What cannot be claimed

It is not a leading indicator. The two captures before the collapse were within range, one of them above the mean. The system detected the event on the day, not before it. Any claim of anticipation would be false.

Precedence between domains was not measured. The windows overlap.

There is no coverage for three of the eight affected countries. Qatar, Iraq and Jordan are not in the connectivity source's list of 52 countries. The finding concerns the Emirates, Israel and Iran, plus neighbours used as controls.

The Dubai node does not measure an airport. Its 250-nautical-mile radius covers the southern Gulf, including Abu Dhabi, Bahrain and part of Qatar and Oman. It is a regional measurement, not a runway.

Recovery has not been measured. The analysis of traffic after the reopening falls inside a period with degraded data from the aviation source, and is pending recalculation. Until then, this document says nothing about how much volume was recovered, or when.

Limits of the method

Temporal resolution. Four daily captures mean a seven-hour resolution. Shorter events can pass unnoticed, or appear as a single point indistinguishable from noise.

Coverage drift. ADS-B depends on a network of volunteer receivers whose composition changes. The network's total aggregate volume fell to 75.5% of the January level by August. That is why all comparisons are made against control groups and never in absolute terms.

Seasonality. The IATA season change in late March and late October reconfigures schedules and frequencies. A baseline built on one season goes out of alignment in the other.

Uneven coverage. ADS-B receiver density varies by region. In areas with few receivers, a fall can reflect lost telemetry rather than lost traffic.

Reproducibility

Both sources are public and free: ADS-B from adsb.lol, no authentication, and connectivity from IODA, Georgia Tech, no authentication.

The processing runs on serverless infrastructure: scheduled capture, conversion to a columnar format, and state calculation against a rolling baseline. Every published artefact includes the threshold applied and the baseline window used, so that any reader can verify the criterion under which each measurement was classified.

A note on the scope of this instrument

This system reports what it measured. It does not predict, does not interpret causes, and claims nothing about what it does not observe.

The absence of an anomaly in the monitored signals is not evidence that nothing is happening: it is evidence that those signals did not move. The distinction is small on the page and large in responsibility.