task2_train.jsonl

{"id": "t2_001", "task": 2, "observation": "Signal Assessment — Sector Alpha: Communications at 387.4 MHz using PSK modulation with timing signatures matching Russian GRU field operative protocol library (match confidence 91%). Source mobile, moving in 2km radius pattern consistent with surveillance sweep.", "context": "Prior intelligence: increased chatter detected | Asset proximity: 2km | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 387.4, "power_dbm": -22, "modulation": "PSK", "duration_ms": 3200, "region": "sector_alpha", "time_of_day": "night", "repeat_count": 4, "known_pattern": "gru_field_protocol"}, "signal_history": ["pattern active 6 hours", "mobile source confirmed"], "threat_indicators": ["91% GRU protocol match", "surveillance sweep pattern", "proximity to asset"], "gold_action": "hostile", "gold_reason": "reconnaissance_signature", "difficulty": "medium", "category": "clear"}
{"id": "t2_002", "task": 2, "observation": "Anomaly Report — Trade Route 7: Vehicle convoy using 148-174 MHz military VHF with valid IFF codes, but convoy composition (12 vehicles) does not match manifested 4-vehicle logistics run. Extra vehicles have no IFF and are using civilian frequencies.", "context": "Prior intelligence: known smuggling route | Asset proximity: adjacent sector | Time sensitivity: critical", "signal_metadata": {"frequency_mhz": 160.5, "power_dbm": -30, "modulation": "FM", "duration_ms": 5000, "region": "trade_route_7", "time_of_day": "night", "repeat_count": 12, "known_pattern": "military_vhf"}, "signal_history": ["IFF codes valid but manifest mismatch", "extra vehicles detected by UAV"], "threat_indicators": ["manifest discrepancy", "unregistered vehicles", "known smuggling route"], "gold_action": "suspicious", "gold_reason": "unusual_protocol", "difficulty": "medium", "category": "ambiguous"}
{"id": "t2_003", "task": 2, "observation": "Flagged Signal — Base Perimeter: Source identified as private security contractor radio at 461.0 MHz, FM modulation. Contractor credentials verified against current access roster. Transmissions contain only standard patrol check-ins. Equipment serial matches issued inventory.", "context": "Prior intelligence: none | Asset proximity: 500m | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 461.0, "power_dbm": -48, "modulation": "FM", "duration_ms": 2000, "region": "base_perimeter", "time_of_day": "afternoon", "repeat_count": 8, "known_pattern": "security_patrol"}, "signal_history": ["contractor on site for 3 weeks", "all credentials verified"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_004", "task": 2, "observation": "Signal Assessment — Port Facility: SATCOM burst at 1.6 GHz intercepted from cargo vessel. Encryption matches commercial shipping company key infrastructure. Cargo manifest filed correctly. Port authority clearance valid. No anomalies in vessel history.", "context": "Prior intelligence: none | Asset proximity: 5km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 1600.0, "power_dbm": -35, "modulation": "BPSK", "duration_ms": 1500, "region": "port_facility", "time_of_day": "morning", "repeat_count": 2, "known_pattern": "commercial_satcom"}, "signal_history": ["vessel has 12 prior clean port visits"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_005", "task": 2, "observation": "Anomaly Report — Sector 14: Drone transmitting on 5.8 GHz FPV band, QAM modulation. No IFF transponder. Operating at 400m altitude over restricted zone. Video downlink encrypted with AES-256 — commercial drones use much weaker encryption. Operator not located.", "context": "Prior intelligence: increased surveillance activity | Asset proximity: direct overflight | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 5800.0, "power_dbm": -20, "modulation": "QAM", "duration_ms": 900000, "region": "sector_14", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": null}, "signal_history": ["drone airborne 15 minutes", "AES-256 confirmed by signals lab", "operator not found"], "threat_indicators": ["no IFF", "restricted zone overflight", "professional encryption", "operator unknown"], "gold_action": "hostile", "gold_reason": "reconnaissance_signature", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_006", "task": 2, "observation": "Signal Assessment — Embassy District: Encrypted HF at 11.175 MHz (USAF command frequency), USB modulation. Traffic analysis shows burst transmission of 847 bytes — matches size of standard intelligence report template. Source is civilian building 200m from foreign embassy.", "context": "Prior intelligence: HUMINT suggests embassy is intelligence hub | Asset proximity: 200m | Time sensitivity: 24h window", "signal_metadata": {"frequency_mhz": 11.175, "power_dbm": -25, "modulation": "AM", "duration_ms": 4200, "region": "embassy_district", "time_of_day": "midnight", "repeat_count": 1, "known_pattern": null}, "signal_history": ["first detection from this building", "HUMINT corroborates location"], "threat_indicators": ["USAF command frequency misuse", "intel report size match", "HUMINT correlation", "embassy proximity"], "gold_action": "hostile", "gold_reason": "reconnaissance_signature", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_007", "task": 2, "observation": "Flagged Signal — Medical Facility: Radio at 155.340 MHz (EMS simplex), FM modulation. Hospital ambulance coordinating patient transfer with receiving facility. Content matches standard medical protocol. Crew identities verified against duty roster.", "context": "Prior intelligence: none | Asset proximity: 3km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 155.34, "power_dbm": -50, "modulation": "FM", "duration_ms": 8000, "region": "medical_facility", "time_of_day": "morning", "repeat_count": 3, "known_pattern": "ems_radio"}, "signal_history": ["standard daily medical operations"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "civilian_error", "difficulty": "easy", "category": "clear"}
{"id": "t2_008", "task": 2, "observation": "Signal Assessment — Forward Post: Transmission at 243.0 MHz (military emergency), AM modulation. Caller claims to be downed pilot using survival radio. Voice stress analysis shows 12% stress — far below the 60%+ expected from genuine distress. Possible voice synthesis.", "context": "Prior intelligence: no friendly aircraft in area | Asset proximity: rescue team staged | Time sensitivity: critical", "signal_metadata": {"frequency_mhz": 243.0, "power_dbm": -18, "modulation": "AM", "duration_ms": 12000, "region": "forward_post", "time_of_day": "dawn", "repeat_count": 3, "known_pattern": "military_emergency"}, "signal_history": ["no friendly aircraft logged", "voice stress abnormally low", "3 transmissions in 10 min"], "threat_indicators": ["no friendly aircraft", "abnormal voice stress", "possible decoy to divert rescue assets"], "gold_action": "suspicious", "gold_reason": "requires_verification", "difficulty": "hard", "category": "ambiguous"}
{"id": "t2_009", "task": 2, "observation": "Anomaly Report — Logistics Hub: Truck using licensed 450 MHz PMR radio for fleet management. GPS tracker and radio both functioning normally. Cargo declared as medical supplies. Infrared scan of cargo bay shows heat signature inconsistent with medical supplies — denser, metallic objects.", "context": "Prior intelligence: weapons smuggling suspected on this route | Asset proximity: checkpoint 10km | Time sensitivity: 2h window", "signal_metadata": {"frequency_mhz": 450.0, "power_dbm": -45, "modulation": "FM", "duration_ms": 3000, "region": "logistics_hub", "time_of_day": "morning", "repeat_count": 6, "known_pattern": "fleet_pmr"}, "signal_history": ["truck has clean prior history", "IR anomaly detected this trip only"], "threat_indicators": ["cargo heat signature mismatch", "weapons route", "metallic density inconsistent with medical supplies"], "gold_action": "suspicious", "gold_reason": "unusual_protocol", "difficulty": "medium", "category": "ambiguous"}
{"id": "t2_010", "task": 2, "observation": "Signal Assessment — Northern Perimeter: Electronic warfare signal at 30-512 MHz wideband, power -8 dBm. Pattern matches Russian Krasukha-4 EW system jamming profile. Friendly SIGINT collection degraded 85% in sector. Source location: 4km across border.", "context": "Prior intelligence: EW assets repositioned near border last week | Asset proximity: direct impact on ops | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 271.0, "power_dbm": -8, "modulation": "AM", "duration_ms": 3600000, "region": "northern_perimeter", "time_of_day": "morning", "repeat_count": 1, "known_pattern": "krasukha4_ew"}, "signal_history": ["EW started at mission launch", "85% collection degraded", "Krasukha-4 profile confirmed"], "threat_indicators": ["Krasukha-4 EW match", "cross-border source", "mission-timed activation", "critical collection degradation"], "gold_action": "critical", "gold_reason": "coordinated_operation", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_011", "task": 2, "observation": "Flagged Signal — Civilian Area: WiFi at 5.18 GHz, 802.11ac protocol. Standard home router broadcasting. SSID and MAC match ISP-registered residential account. Normal browsing traffic profile. No anomalies.", "context": "Prior intelligence: none | Asset proximity: 2km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 5180.0, "power_dbm": -65, "modulation": "QAM", "duration_ms": 999999, "region": "civilian_area", "time_of_day": "evening", "repeat_count": 1, "known_pattern": "wifi_residential"}, "signal_history": ["router registered 2 years ago"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_012", "task": 2, "observation": "Signal Assessment — Industrial Zone: Encrypted burst at 2.4 GHz, frequency hopping, PSK modulation. Transmission content decoded as sensor telemetry from automated factory equipment. Manufacturer confirmed device is registered industrial IoT system. Encryption is standard vendor implementation.", "context": "Prior intelligence: none | Asset proximity: 4km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 2400.0, "power_dbm": -40, "modulation": "PSK", "duration_ms": 500, "region": "industrial_zone", "time_of_day": "afternoon", "repeat_count": 60, "known_pattern": "industrial_iot"}, "signal_history": ["device registered and operating for 1 year"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_013", "task": 2, "observation": "Signal Assessment — Checkpoint Foxtrot: UHF transmission at 403.2 MHz, FM modulation. Source is unknown individual near perimeter. Signal content is in Pashto language discussing 'timing' and 'the gate.' Context ambiguous — could be civilian discussing bus schedules or operational coordination.", "context": "Prior intelligence: minor incidents in area | Asset proximity: perimeter | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 403.2, "power_dbm": -35, "modulation": "FM", "duration_ms": 7000, "region": "checkpoint_foxtrot", "time_of_day": "afternoon", "repeat_count": 2, "known_pattern": null}, "signal_history": ["first detection of this individual", "language and timing concerning"], "threat_indicators": ["unknown source", "ambiguous operational language", "perimeter proximity"], "gold_action": "suspicious", "gold_reason": "unknown_actor", "difficulty": "medium", "category": "ambiguous"}
{"id": "t2_014", "task": 2, "observation": "Anomaly Report — Coastal Zone: Multiple simultaneous activations of 406 MHz EPIRB beacons — 7 beacons in a 2km radius triggered within 30 seconds of each other. Deliberate mass activation is a known technique to overwhelm maritime rescue coordination and create false operational picture.", "context": "Prior intelligence: maritime operation suspected | Asset proximity: coast guard 20km | Time sensitivity: critical", "signal_metadata": {"frequency_mhz": 406.0, "power_dbm": -20, "modulation": "PSK", "duration_ms": 30000, "region": "coastal_zone", "time_of_day": "night", "repeat_count": 7, "known_pattern": "epirb_mass_activation"}, "signal_history": ["7 simultaneous beacons never recorded before", "rescue assets now diverted"], "threat_indicators": ["coordinated beacon activation", "rescue asset diversion", "known adversary tactic", "maritime operation intelligence"], "gold_action": "critical", "gold_reason": "coordinated_operation", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_015", "task": 2, "observation": "Signal — Remote Airstrip: Aircraft transponder squawking 1200 (VFR) at 1090 MHz, descending to unpaved strip not on aviation charts. No flight plan. ADS-B position shows route originated from across border. Aircraft type consistent with light cargo.", "context": "Prior intelligence: smuggling via uncharted airstrips suspected | Asset proximity: airstrip 15km | Time sensitivity: 45min window", "signal_metadata": {"frequency_mhz": 1090.0, "power_dbm": -28, "modulation": "AM", "duration_ms": 2000, "region": "remote_airstrip", "time_of_day": "night", "repeat_count": 5, "known_pattern": "adsb_vfr"}, "signal_history": ["cross-border routing confirmed", "unlisted airstrip"], "threat_indicators": ["no flight plan", "cross-border origin", "unlisted airstrip", "night operation"], "gold_action": "suspicious", "gold_reason": "unusual_protocol", "difficulty": "medium", "category": "ambiguous"}
{"id": "t2_016", "task": 2, "observation": "Flagged Signal — University Campus: Outdated military radio at 40.5 MHz (deprecated frequency), AM modulation, -55 dBm. IT department confirms it is surplus military equipment purchased legally for a radio club. Club membership verified, equipment inspected.", "context": "Prior intelligence: none | Asset proximity: 5km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 40.5, "power_dbm": -55, "modulation": "AM", "duration_ms": 15000, "region": "university_campus", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": "amateur_surplus"}, "signal_history": ["club activity every Thursday", "equipment inspected last month"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "civilian_error", "difficulty": "easy", "category": "clear"}
{"id": "t2_017", "task": 2, "observation": "Signal Assessment — Power Grid Sector: SCADA control signal at 900 MHz detected from outside the power company's registered transmitter locations. Content includes valid authentication tokens for substation control systems. Tokens were reported stolen in a cyber incident 3 weeks ago.", "context": "Prior intelligence: nation-state cyber campaign targeting infrastructure | Asset proximity: substation 2km | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 900.0, "power_dbm": -22, "modulation": "FSK", "duration_ms": 5000, "region": "power_grid_sector", "time_of_day": "midnight", "repeat_count": 3, "known_pattern": "scada_control"}, "signal_history": ["stolen tokens confirmed in use", "nation-state campaign ongoing", "3 prior substation probes this week"], "threat_indicators": ["stolen authentication tokens", "unauthorized SCADA access", "nation-state campaign", "critical infrastructure target"], "gold_action": "critical", "gold_reason": "active_targeting", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_018", "task": 2, "observation": "Anomaly Report — Border Village: Local FM broadcast at 88.5 MHz, standard music and news programming. Content matches licensed station. Signal strength and modulation normal. Transmitter location verified as licensed site.", "context": "Prior intelligence: none | Asset proximity: 8km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 88.5, "power_dbm": -60, "modulation": "FM", "duration_ms": 999999, "region": "border_village", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": "civilian_broadcast"}, "signal_history": ["station licensed for 8 years"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_019", "task": 2, "observation": "Signal Assessment — Sector 22: Transmission at 162.0 MHz, FM modulation. Content in clear voice discussing 'asset positions' and 'extraction timing.' Speaker using code phrases matching known cartel communication protocol from intelligence database (match: 78%).", "context": "Prior intelligence: cartel activity in region | Asset proximity: 3km | Time sensitivity: 2h window", "signal_metadata": {"frequency_mhz": 162.0, "power_dbm": -30, "modulation": "FM", "duration_ms": 9000, "region": "sector_22", "time_of_day": "evening", "repeat_count": 2, "known_pattern": null}, "signal_history": ["code phrase match confirmed", "similar pattern 3 days ago"], "threat_indicators": ["78% cartel protocol match", "operational language", "extraction timing discussed"], "gold_action": "hostile", "gold_reason": "weapons_related", "difficulty": "medium", "category": "clear"}
{"id": "t2_020", "task": 2, "observation": "Anomaly Report — Mountain Relay: Microwave backhaul link at 7.1 GHz, QPSK modulation. Telecom company infrastructure relay. All licensing current. Traffic analysis shows normal internet and voice patterns. Uptime 99.8% for 3 years.", "context": "Prior intelligence: none | Asset proximity: 10km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 7100.0, "power_dbm": -10, "modulation": "PSK", "duration_ms": 999999, "region": "mountain_relay", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": "telecom_microwave"}, "signal_history": ["infrastructure operational 3 years"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_021", "task": 2, "observation": "Signal Assessment — Airbase Approach: Transmission on 121.5 MHz (emergency), AM modulation. Unknown aircraft declaring emergency, requesting immediate landing. No aircraft scheduled. Radar shows no primary return at declared position. Could be electronic spoofing to test airbase response procedures.", "context": "Prior intelligence: airbase response procedures are intelligence target | Asset proximity: airbase 5km | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 121.5, "power_dbm": -25, "modulation": "AM", "duration_ms": 20000, "region": "airbase_approach", "time_of_day": "night", "repeat_count": 1, "known_pattern": "atc_emergency"}, "signal_history": ["no radar return confirmed", "possible spoofing to probe response"], "threat_indicators": ["no radar return", "unscheduled aircraft", "response procedure probe", "night operation"], "gold_action": "suspicious", "gold_reason": "requires_verification", "difficulty": "hard", "category": "ambiguous"}
{"id": "t2_022", "task": 2, "observation": "Signal Assessment — Capital Sector: Simultaneous jamming of 4 frequencies: 156.8 MHz (maritime distress), 121.5 MHz (air distress), 406 MHz (EPIRB), and 243 MHz (military emergency). All 4 emergency channels suppressed simultaneously. Only state-level actors have this capability.", "context": "Prior intelligence: crisis situation developing | Asset proximity: capital city | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 243.0, "power_dbm": -5, "modulation": "AM", "duration_ms": 1800000, "region": "capital_sector", "time_of_day": "morning", "repeat_count": 4, "known_pattern": "multi_channel_jamming"}, "signal_history": ["all 4 channels jammed simultaneously for 30 min", "state-level capability confirmed"], "threat_indicators": ["all emergency channels suppressed", "state-level capability", "crisis timing", "capital location"], "gold_action": "critical", "gold_reason": "coordinated_operation", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_023", "task": 2, "observation": "Flagged Signal — Research Institute: Encrypted data burst at 2.4 GHz from university laboratory. IT security team confirms it is automated cloud backup of research data to licensed AWS infrastructure. Encryption is standard AES-256 TLS. Timing matches scheduled backup window.", "context": "Prior intelligence: none | Asset proximity: 1km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 2400.0, "power_dbm": -50, "modulation": "QAM", "duration_ms": 45000, "region": "research_institute", "time_of_day": "midnight", "repeat_count": 1, "known_pattern": "cloud_backup"}, "signal_history": ["backup schedule unchanged for 2 years"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_024", "task": 2, "observation": "Signal Assessment — Sector 33: Two mobile phones exchanging encrypted messages on 850 MHz LTE. Content cannot be decrypted but metadata shows 45-second call to a number flagged in terrorism watchlist database, followed immediately by 3km movement toward critical infrastructure.", "context": "Prior intelligence: watchlist number active in region | Asset proximity: infrastructure 3km | Time sensitivity: critical", "signal_metadata": {"frequency_mhz": 850.0, "power_dbm": -30, "modulation": "QAM", "duration_ms": 45000, "region": "sector_33", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": null}, "signal_history": ["watchlist contact confirmed", "movement toward infrastructure post-call"], "threat_indicators": ["terrorism watchlist contact", "post-call movement toward infrastructure", "time-critical"], "gold_action": "critical", "gold_reason": "imminent_attack", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_025", "task": 2, "observation": "Anomaly Report — Transit Hub: Taxi company radio at 460.5 MHz, FM modulation. Standard dispatching. However, one driver repeatedly uses the phrase 'green package confirmed' when acknowledging pickups — phrase not in standard taxi protocol and matches known drug courier code from prior intelligence.", "context": "Prior intelligence: drug trafficking operation suspected | Asset proximity: transit hub | Time sensitivity: 24h window", "signal_metadata": {"frequency_mhz": 460.5, "power_dbm": -48, "modulation": "FM", "duration_ms": 3000, "region": "transit_hub", "time_of_day": "afternoon", "repeat_count": 8, "known_pattern": "taxi_dispatch"}, "signal_history": ["phrase used 8 times in 2 hours", "matches known courier code"], "threat_indicators": ["known drug code phrase", "abnormal protocol", "trafficking intelligence"], "gold_action": "suspicious", "gold_reason": "unusual_protocol", "difficulty": "medium", "category": "ambiguous"}
{"id": "t2_026", "task": 2, "observation": "Signal Assessment — Sector 5: Encrypted VHF at 163.0 MHz, PSK modulation. Signal is transmitting target coordinate data in military grid format (MGRS). Coordinates resolve to friendly force assembly area scheduled for tomorrow. Source is unregistered transmitter in civilian vehicle.", "context": "Prior intelligence: insider threat suspected | Asset proximity: assembly area 8km | Time sensitivity: 12h window", "signal_metadata": {"frequency_mhz": 163.0, "power_dbm": -28, "modulation": "PSK", "duration_ms": 6000, "region": "sector_5", "time_of_day": "evening", "repeat_count": 2, "known_pattern": null}, "signal_history": ["MGRS coordinates decoded", "friendly assembly area targeted", "unregistered civilian transmitter"], "threat_indicators": ["friendly force coordinates transmitted", "insider threat context", "civilian vehicle", "pre-operation timing"], "gold_action": "critical", "gold_reason": "active_targeting", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_027", "task": 2, "observation": "Flagged Signal — Mountain Village: Shortwave radio at 7.200 MHz, USB modulation. Local villager communicating with relative overseas. Content is family news and greetings. ISP confirms the caller's identity. No encryption. No anomalous patterns.", "context": "Prior intelligence: none | Asset proximity: 15km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 7.2, "power_dbm": -55, "modulation": "AM", "duration_ms": 25000, "region": "mountain_village", "time_of_day": "evening", "repeat_count": 1, "known_pattern": "amateur_ssb"}, "signal_history": ["weekly family call for 5 years"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "civilian_error", "difficulty": "easy", "category": "clear"}
{"id": "t2_028", "task": 2, "observation": "Signal Assessment — Harbor Zone: Submarine communication buoy detected at 76 Hz (ELF band), consistent with submarine communication relay. No allied submarines scheduled in this maritime zone. ELF transmitters require massive infrastructure — indicates state-level naval asset.", "context": "Prior intelligence: submarine activity detected by sonar last week | Asset proximity: harbor 30km | Time sensitivity: 6h window", "signal_metadata": {"frequency_mhz": 0.000076, "power_dbm": 10, "modulation": "AM", "duration_ms": 30000, "region": "harbor_zone", "time_of_day": "night", "repeat_count": 1, "known_pattern": "elf_submarine"}, "signal_history": ["sonar contact last week", "ELF buoy confirms submarine presence"], "threat_indicators": ["unscheduled submarine", "state-level naval asset", "harbor proximity", "sonar corroboration"], "gold_action": "hostile", "gold_reason": "reconnaissance_signature", "difficulty": "hard", "category": "adversarial"}
{"id": "t2_029", "task": 2, "observation": "Signal Assessment — Sector 18: Encrypted burst at 433.92 MHz (ISM band), OOK modulation, 50ms duration. Pattern matches standard wireless temperature sensor. Manufacturer database confirms device model. Registered to industrial refrigeration company at nearby warehouse.", "context": "Prior intelligence: none | Asset proximity: 2km | Time sensitivity: routine", "signal_metadata": {"frequency_mhz": 433.92, "power_dbm": -68, "modulation": "AM", "duration_ms": 50, "region": "sector_18", "time_of_day": "afternoon", "repeat_count": 6, "known_pattern": "iot_temperature"}, "signal_history": ["device registered 1 year ago"], "threat_indicators": [], "gold_action": "benign", "gold_reason": "authorized_operation", "difficulty": "easy", "category": "clear"}
{"id": "t2_030", "task": 2, "observation": "Anomaly Report — Sector 29: Cell phone at 1900 MHz transmitting IMSI catcher probe signals — attempting to identify nearby mobile device identities. IMSI catchers are law enforcement/intelligence tools. This device is not on authorized law enforcement register. Possible unauthorized surveillance operation.", "context": "Prior intelligence: foreign intelligence service active in city | Asset proximity: 500m from safe house | Time sensitivity: immediate", "signal_metadata": {"frequency_mhz": 1900.0, "power_dbm": -20, "modulation": "QAM", "duration_ms": 300000, "region": "sector_29", "time_of_day": "afternoon", "repeat_count": 1, "known_pattern": "imsi_catcher"}, "signal_history": ["IMSI catcher active 5 hours", "safe house proximity confirmed", "not on law enforcement register"], "threat_indicators": ["unauthorized IMSI catcher", "safe house proximity", "foreign intelligence context", "surveillance operation"], "gold_action": "critical", "gold_reason": "active_targeting", "difficulty": "hard", "category": "adversarial"}