# Hordejakten 2026 – OSINT notes

Living file. Add anything that could locate the box; keep the source next to each item.

## The campaign
- Terms: box is "skjult et sted i Norge", competition starts 21.09.2026 and runs until a winner is crowned,
  hints via the Horde app and "andre kanaler" (newsletter, Horde Plus). Box "ikke i farlig terreng".
  Source: horde.no/gjeldfri/hordejakten/vilkaar
- Organiser: Horde AS, Lars Hilles gate 20A, Bergen. Source: mynewsdesk press release 2024.
- Stream: YouTube EQHgfmZicc8, channel HordeApp (UCYZHbPn2bSU3xli7-aPxZ7w), no location field, no tags,
  release timestamp 2026-09-21 06:50:40 Oslo (countdown card until ~07:00). ~640 concurrent viewers at 15:00.

## Earlier hunts (pattern)
- 2023: Tokke kommune, Telemark. Two weeks. One finder pulled the other out of a bog. A finder confirmed
  proximity by honking his car horn and hearing it on the stream. Sources: kom24, sosialnytt, ta.no.
- 2024: by the Kongsberg silver mines (Buskerud). Hints "gradually over the week", found on a Sunday morning,
  several people arrived the same morning, 5-minute code attempts. Source: ba.no.
- Both: forest, reachable by car + walk, southern inland Norway, 1–2 weeks.

## What the camera/microphone has established (2026-09-21)
- Scene: mature pine with spruce and birch, blueberry heath, flat ground, canopy shade on the box all day.
- Roof condensation 07:00–09:40, dry by 10:11 → humid clear night, dew-point reached, warming morning.
- No car/truck sounds in 8 h → no trafficked road within ~500 m. Crew access track likely within a few 100 m.
- 08:30 mechanical ticking (YAMNet "mechanisms/clock"), 20 s, loud; alarm-like tones 14:10 and 14:29
  (YAMNet "alarm/siren", not vehicle sirens) – possibly items at the box.
- Confirmed overflights (by ear): 07:03, 10:54, 11:03, 11:29, 12:03, 14:07, 14:09.
- Birds ≥0.85: Willow Tit (120), Blue Tit, Redwing, Magpie, Great Tit, Fieldfare, Bohemian Waxwing flock 07:36,
  Parrot Crossbill (7), Treecreeper, Great Spotted Woodpecker. Old pine forest; waxwings hint north/east inland.

## Timing checks
- `time_sweep.py` (shift all event times -300..+300 s): the best aircraft-match score barely changes
  (0.77–1.35, no sharp minimum; different offsets prefer different regions) → the confirmed events do not
  yet constrain the location, and no clock offset can be inferred from them. Within ±60 s Østerdalen stays best.
- Archive/backfill timestamps come from YouTube's release time and HLS PROGRAM-DATE-TIME (exact to seconds);
  live segments are stamped at reception, i.e. late by the HLS latency (measured below).

## Open data feeds in use
- MET Norway Frost API (all stations, hourly) – weather_match.py
- adsb.lol live API + same-day heatmap history – flights_log.py / adsb_heatmap.py
- Kartverket topo tiles, Natural Earth outline – web UI / norway_mask.py

## Live chat (captured continuously to horde_live/osint/, shown in the UI)
- Viewers ask the person in the box yes/no questions and read her gestures ("begge hendene opp hvis JA",
  "tommel opp", "3 fingre"). Questions seen 2026-09-21 ~15:00: Sørlandet/Agder?, Oppland?, Hønefoss?,
  bears in the area?, driven back and forth?, "skytebane?" (someone heard shooting), "hør etter fly / sjekk
  flightradar", "Kjevik leir Kristiansand 4657" (a guess), "rødvingetrost?" (Redwing – matches BirdNET).
- She apparently does not know where she is ("hun vet ikke hvor hun er").
- Pinned by @hordeapp 15:07: "Ny avstemming i Horde-appen! Stem mellom 'lesestoff' og 'tusj og tavle'".
  A whiteboard would let her answer written questions – watch for it.
- 15:07 someone asked her to check whether Wolt/Foodora could deliver ("hopp en gang for ja") – if she reacts,
  that is a strong urban-proximity test.

## Birds vs. GBIF (artsobservasjoner via GBIF)
- Bohemian Waxwing, Norway, September 2026: 33 records – Finnmark 17, Troms 11, Nordland 3, Vestland 1,
  Trøndelag 1 (Sept 2025: 32 records, 3 in Innlandet). Camera: waxwing flock 07:36–07:37, 8 detections ≥0.85
  (max 0.95). If real, a strong pointer to Nordland/Troms/Finnmark. Clip: clips/other/…waxwing_flock.mp4.
- Parrot Crossbill Sept 2026: 679 records, widespread (observer-biased to the south) – not diagnostic.

## Satellite (NASA GIBS, MODIS Terra true colour, ~11:30–12:00 local pass)
- Southern Norway inland largely cloud-free at the pass; a cloud mass over Nordland/Troms. Camera at
  11:30–12:00: no direct sun patches (sun index 118–127 vs 150 at 07–09). Check crops before drawing conclusions.

## Sigdal check (2026-09-21 15:30)
- Aircraft: only 1 of 11 confirmed hits has a plausible plane near Sigdal; six planes passed within 8 km
  (22–25 kft, 09:10, 11:10, 12:11, 14:25, 14:37, 14:57) of which the detector heard one (14:25).
  Falsification clips are in clips/expected/ – label them heard/not on the map page.
- Weather: Veggli 8.0 °C dew-point depression at dawn, Hokksund/Darbu/Kongsberg ~5 °C → dew on the roof
  not possible there; stations rank 317–386 of 400.
- Forest (NIBIO SR16): Sigdal/Eggedal is mixed spruce (dominant) and pine – compatible with the scene.
- Chat: "Sigdal? stand up" at 15:15, "Buskerud? hop 5×" at 15:18; she stood up ~15:19:36 (see sheet).
  Earlier prompts (Wolt 15:07, Kongsberg 15:08) got no reaction, so she probably does not see the chat.

## Crowd-read gestures (Discord relay 2026-09-21, unverified but consistent)
- She is Anja from Oslo, picked up in Oslo; 7+ h by car, mostly flat, winding, no ferries; departed before 21 Sept.
- Sun on HER right at 10–11 (camera not mirrored: our left = her right) → camera looks ~WSW (240°),
  she faces ~ENE. Consistent with afternoon sun patches from behind the camera (15:30+).
- Clouds drifted from our right to our left at 10–11 → from ~NNW to SSE → surface wind N/NW sector.
- Terrain was moist when she entered the box; no running water audible; construction work audible (16:04);
  walked UPHILL from the car; sees only forest.
- Codes: four digits; two padlocks on the box plus one on the big box's door.
- Encoded: fusion `--drive-hours 7` distance band (250–450 km straight line from Oslo, default on);
  weather_match wind-direction term (N/NW 09:30–11:30). Camera heading enables shadow-azimuth work.

## Sun visible in the frame (2026-09-21 16:45–17:07)
- The sun disc shone through the canopy at the top right of the 720p frame (x≈1015→1105, y≈5→40).
- Camera fit (sun_track.py): focal 1068 px (62° HFOV), heading ≈220° (SW), pitch ≈0. Residual lowest at
  59–61°N, +30 % by 66°N, +60 % at 70°N → soft evidence for southern/central latitudes, independent of
  every other line. Bias: cluster A touches the top edge (clipped), which if anything pushes the true
  latitude further south. Repeat tomorrow with a longer arc (sun enters the frame ~16:45).

## Whiteboard (from 18:30, IR on; she holds it up to the camera)
- 18:31: "INGEN FLY / INGEN SKYTING / OSLO, SØN KL 04.00 / CA 5-10 MIN Å GÅ FRA BIL".
  → She has heard no planes (rules out approach paths / busy low corridors; faint high jets may be missed),
    no shooting (no active range nearby), left Oslo Sunday 04:00 (arrived ~11:00 Sunday), 5–10 min walk
    (≈400–800 m, uphill) from a car/parking spot.
- 18:36: "INGEN FERGE / KUN BIL / VET IKKE ANG. TUNELLER" (no ferry, car only, unsure about tunnels).
- 18:38: "TROR DET VAR OPPOVER / SISTE 5-10 MIN" (thinks the last 5–10 min on foot went uphill).
- 18:44: "... / KUPERT TERRENG / MYE LYNG / HØRER IKKE MYE FRA BOKSEN" (undulating terrain, lots of heather,
  hears little from the box → quiet site).
- 18:48: "KUPERT TERRENG / LIVE 07:00 / NEI, SER KUN SKOG OG KAMERA FRA BOKS" (the 07:00 was the stream start;
  sees only forest and the camera).
- 18:57: "@PROJECT MECH / PRESENNING / MER ÅPEN SKOG TIL HØYRE FOR MEG" (a tarpaulin nearby; more open forest
  to her right, i.e. to our left = roughly south-east of the box given the camera looks SW).
- 19:00: "INGEN SKYER NÅ / SNART SOLNEDGANG" (no clouds now; sunset soon) → clear sky at 19:00 (checkable at
  stations with cloud data; expect dew/frost tonight); sunset "soon" at 19:01 fits inland east/central
  Norway (sunset ~19:15 at 61.5N 11.4E) better than the west coast (~19:40 in Ryfylke).
- Encoded: aircraft_match "loud pass" penalty (planes within 6 km / ≥30° up during recording).
- board_watch.py saves every raised-board frame to clips/board/ (shown in the UI).
- Pinned 18:02: new app vote "Lesestoff vs kompass" — a compass would give the camera heading directly.

## Ideas not yet used
- NIBIO SR16 / AR5 forest maps (tree species, site index) to filter candidate cells for pine-dominated flat forest.
- Kartverket N50 skogsbilvei (forest roads) layer for the last kilometre.
- Horde app hints (need someone with the app to paste them here), newsletter, Horde Plus "Jaktus".
- YouTube live chat (hunters' speculation; Horde staff messages).
- Car-horn test once a valley is identified (worked in 2023).

## Whiteboard 19:30-19:50 (IR, TavlAI captures)
- 19:32  "IKKE MØRKT ENDA / ... FINT VÆR" (not dark yet / ... nice weather)
- 19:35  "(I DAG) CA 12 °C / NÅ CA 8-11 °C"  -> added to weather_match (day max ~12, 19:35 in 8-11)
- 19:38  "4 STORE STEINER, KUN STEIN DER" (4 big rocks, only rock there; chat readers agree) -> terrain: boulders near the box
- 19:47  "MØRKT NÅ" (dark now)  -> observations.json: sun elevation -6 ±2.5 deg at 19:47:00 (civil dusk), stream delay ~22 s
- 19:50  "KLAR HIMMEL" (clear sky)
- Recorder switched to 1080p (format 270) at 19:51:57; 19:51:14-19:51:57 backfilled from DVR.

## Twilight from the IR frames (21 Sep evening)
- Sky patches between the trees keep the natural twilight while the IR lamp lights the foreground.
  Mask-mean of 16 sky pixels: clipped ~120 until 19:10, then falls to a floor (~68) around 19:57.
  p95 of the top rows (sky_glow.py): floor reached 19:39 (sky_glow.json event, source sky_floor).
- Sun elevation at 19:57 is only -4.8 (Sigdal) to -6.3 (Finnskogen) anywhere in S Norway: the E-W
  spread across the country is ~1.5 deg, so a single dusk event barely separates candidates.
  The robust use is the PAIR with tomorrow's dawn rise (same threshold cancels) -> solar midnight.
- Camera was re-framed (wider) at 20:07-20:08; reference6.jpg added; sky_glow splits runs at reframes.
- Norway mask upgraded to Natural Earth 10 m (border ~1 km); 60.3/12.7 (Torsby, SE) is now excluded.

## Live weather (MET nowcast/forecast, 21:27) and what to watch at dawn
- Over the 95 % region (515 points): only 3 points raining now (Trøndelag coast/Gauldal), temps -4.5..16 C.
  Top cells now: Finnskogen 8.5 C clear, Trysil 6.1 C clear, Koppang 8.2 C clear, Meråker 4.4 C half cloud.
- 06:00 forecast: Finnskogen 2 C / RH 99 % clear (dew + fog likely), Trysil 2 C / 91 %, Koppang 5 C / 89 % but
  90 % cloud, Sigdal 6 C / 66 % (no dew). -> tomorrow's roof condensation + IR-off time + sky-glow rise will
  separate these: heavy dew & clear dawn favours Finnskogen/Trysil; cloudy dawn favours Koppang.
- fusion.py now has a 'live' component (rain now, temp outside 4-11 C, cloud > 60 %) from met_live.json.
- Other-sound clips (bell/gunshot/train/siren/music) cut to clips/other/ for human verification.
- Public report: publish_report.py builds horde_live/public/index.html and mirrors it to the FTP host (.env).

## 21:29 plane sighting (night)
- 21:27:42 chat: she signalled a shooting star. 21:29:10 chat asks her to point where it was.
- 21:29:38-21:29:53 stream: she points straight up (arm within ~10-20 deg of vertical, slight lean to
  camera-left = SE). 21:30:12-21:30:30: board reads "... FLY" (enhanced frame: second line FLY).
- Interpretation: a plane passed high overhead ~21:29:16 real time (stream -22 s). Ambiguous with the
  shooting-star pointing, so sighting.py/fusion 'sighting' component is soft (max cost 2.5).
- adsb.lol at that moment: planes near the zenith only along the Trondheim airway (SAS4098 over Meråker
  cell #4 at 53-77 deg, NOZ68L near Røros 60-83 deg, SAS4124/NOZ385 Gauldal), NOZ9EG over Lillehammer
  (81 deg), THY11 over Jotunheimen, NOZ56U over Elverum-north (24k ft, 64-71 deg).
  Finnskogen best 25 deg (SAS1488), Koppang 14 deg, Trysil 9 deg -> the top-3 cells are disfavoured
  if the gesture really was the plane. Map: report_img/22_plane_sighting_2129.png

## Sun patterns through the day (clear sky) and satellite clouds
- Direct-sun patches (warm+bright pixels, sun_patches.csv): first at 07:51, strongest 08:25-09:55 (patches in the
  frame centre = sun behind the camera, ESE), sparse midday, last at 17:23; sun disc itself in frame 16:20-17:27.
- Geometry: first patch at 07:51 = sun elevation ~5.8-6.5 deg at az ~99 (open ESE canopy horizon ~6 deg);
  disc crossing the top of the frame 16:21-16:27 = elevation ~18.6 deg (fits 60-62N within ~1 deg; Meråker ~1.5 low).
- NASA GIBS MODIS/VIIRS 21 Sept: SE Norway (Oslo-Elverum-Sigdal) cloud-free on all 4 passes; Trøndelag/Meråker,
  Røros and the west coast cloudy (0.5-0.7). Camera saw sun all day -> fusion 'satellite' component (2.5 x cloud).
  Result: Meråker and Røros-side cells drop; #1 60.90/11.20 (Løten/Elverum forest), #2 61.30/11.20 (Rena-Åsta).
- Rumble detector (50-300 Hz, 1-4 min smooth hump) added: night high overflights 19:15:14 (+13 dB), 20:28:06
  (+12 dB), 21:33:12 (+8 dB, the one she saw at 21:29) -> 21:33:12 labelled plane.

## 21:29-21:34 plane: seen (board FLY 21:30) and heard (rumble peak 21:33:20 stream)
- sightings.json now uses the window 21:29:40-21:34:00 (stream) with min elevation 25 deg; fusion 'sighting'
  cost = (shortfall/10)^2 capped 3. Combined seen+heard test (>=25 deg and closest approach 21:32-21:33 real)
  keeps only ~10 % of Norway's cells: Østerdalen west side (Elverum-Rena-Koppang under NOZ56U/NOZ9EG), the
  Røros-Gauldal-Meråker airway (NOZ68L/NOZ385/SAS4098), Hallingdal (WIF149). Finnskogen, Trysil, Sigdal, Oslo,
  61.8/11.1 fail (max 6-18 deg).
- Meteosat cloud mask timeline (cloud_timeline.py) vs camera sun patches: negative correlation over all of SE
  Norway (MSG flags the 07:00-13:30 valleys cloudy while the camera had sun 08:30-10:00) -> kept as a
  diagnostic (report_img 27/28), not used in fusion: MSG pixels are 4-8 km and morning fog/low cloud in valleys
  would be flagged even if the site itself (uphill) sat in sun.

## Fusion modes (UI selector in Best guesses, /api/fusion?mode=)
- all | event2130 (only the 21:30 seen+heard plane) | event2130_forest (+satellite clouds, drive) | nolabels
  (everything except hand-labelled plane events) | noair.
- 21:30 alone: survivors are the cells under NOZ56U/NOZ9EG (Østerdalen west), NOZ385/NOZ68L/SAS4098
  (Røros-Gauldal-Meråker), WIF149 (Hallingdal) and the coastal airways; by area the west coast and inland
  Trøndelag dominate (26 % / 21 %), Østerdalen 5 %. With clouds + drive: west coast 38 %, Østerdalen 10 %.
  With everything: Østerdalen west 42 %.

## Tyttebær + furu (22 Sep, night)
- She says there are lingonberries at the box. gbif_berries.py: GBIF/Artskart observations 2005+ of tyttebær,
  røsslyng (dry heath) vs blåbær (moist spruce) -> dry-heath share per cell, weak fusion component 'berries'.
- pine_map.py: NIBIO SR16 tree species nationwide (1 km render, 5 km box means) -> forest fraction + pine share;
  fusion component 'furu' (cost up to 1.5 for pine-free forest, 1.0 for treeless). At 5 km scale the west
  side of Østerdalen (60.9-61.3N, 11.2E) is spruce-dominated (pine 7-8 %); pine belts: Glomma valley floor
  sand plains (Rena-Koppang), Trysil-west/Osen (55 %), Finnskogen (59 %), Østfold/Aust-Agder, Tynset-Tolga.

## Relief, soil and deposits (22 Sep 00:30-01:30)
- Frame 17:26:54: ground behind the box dips slightly, taller sunlit pines further back (sun az 248, el 12.5:
  crowns lit from the right-back). terrain_profile.py samples Kartverket DTM along the camera azimuth (219 deg)
  at walk-zone points: 'dip 1.5 m within 40-160 m then rise >= 4 m at 250-700 m' matches only 4-11 % of points
  in each top area (Osen 7 %, Elverum-north 4 %, Rena-Åsta 11 %, Tynset 5 %) -> a strong local filter, map 34.
- Økologisk grunnkart catalogue (kartlag.json): NIBIO markfuktighet (depth-to-water, renders only at ~5 m/px),
  NGU løsmasser, NIBIO vegetasjon, Miljødirektoratet naturtyper/landformer, NGU berggrunn, høydedata WMS.
- road_check now samples markfuktighet per candidate point: dry (>1 m) share Osen 76 %, Elverum-north 67 %,
  Rena-Åsta 80 %; Tynset/Tolga/Meråker 100 % (thin mountain soils or coverage edge).
- deposit_map.py (NGU løsmasser at 1 km): sandy glaciofluvial/fluvial plains are narrow valley terraces and get
  lost at 5 km; kept as a diagnostic map (35), not in the fusion.

## Live team map (22 Sep ~02:00)
- https://default.no/live.php : phones share GPS (watchPosition, POST every 10 s) under a name; everyone sees
  markers + trails (covered roads) + pinned reports ("hørte fly", "tyttebær", ...); model's top cells + walk
  zones drawn from data/fusion.json + roads/. Data in lookers.json / reports.json on the server; ?export=1.
- Local UI: "Search team (live)" layer + list (proxy /api/lookers, 15 s cache, 30 s refresh); publish loop
  also mirrors it to horde_live/lookers.json.

## 22 Sep morning
- Roof dry when it came back in frame at 08:06 (haze 13-15; yesterday 100 at 07:00) -> weather_match day 2
  (weather_match_day2.json, condensation_morning=False): saturated-dawn stations penalised (Rena flyplass dep 0.3,
  Evenstad 0.2, Trysil 0.1, Alvdal 0.5 all fog-prone; Hamar II 1.3 fine). Averaged into the fusion per station.
- IR switched off 08:00:19 (an hour after sunrise) and on at 18:30 with the sun 6 deg up: the IR switch is crew
  operated, not a light sensor -> IR-on/off pairing removed from the sun solver (it briefly pulled the solution
  to 8-9 E). Sky-glow floor/rise are not symmetric enough either; pairs disabled, manual board facts remain.
- TavlAI daylight blindness: the model finds 0 boards in 367 chat-cued daylight frames at conf 0.10 -> 120+34
  daylight frames queued in label.html (labels_pending.txt) for hand labelling, then retrain.

## Audio is (partly) a replay (found 2026-09-22 ~13:15, audio_loop.py)
- Fingerprinted all 30 h of stream audio (24-band spectral shape, 0.5 s frames) and searched for repeats.
  Sample-level check: 22 Sep 11:02:40 == 21 Sep 11:09:13 with waveform correlation 0.999 (identical signal).
- Replay blocks: 22 Sep 10:26-13:00 replays 21 Sep 10:33-15:00 in pieces (lags 23.89 h, 22.01 h, 24.62 h, 22.34 h);
  22 Sep 08:24-08:32 and 09:43-09:48 replay 22 Sep 06:30-07:00. Video is live (frames differ), sound is canned.
- 21 Sep 15:00-23:59 and 22 Sep 00:00-06:30 show no repeats: treated as genuine (the 21:30 plane matched ADS-B
  to the second, which a replay could not). Sound-based evidence after 22 Sep 06:30 is ignored.
- Update 13:50: waveform-verified 55 replay blocks (198 minutes). Replays started already on the evening of
  21 Sep: 23:34-23:37 copies 16:24-16:33; 22 Sep 02:22-02:54 copies 21 Sep 23:17-23:47, 11:26 and 16:24.
  Public proof page: default.no/dupedaudio.php (A/B audio, waveform overlays, timeline). Trusted ranges in
  horde_live/dupedaudio.json.

## Hint video "Trenger du et hint?" (22 Sep 13:51) - terrain reading of the exterior shots
- Shot 1 (f0000-f0079) is a lens zoom-in (scale x1.52, focus of expansion at image centre), not a dolly: no
  usable parallax, so no stereo depth. Read qualitatively: box on a ~30 cm platform on blueberry/lingonberry
  heath with moss hummocks; ground level behind the box, rising gently; birches (yellow) at mid distance left
  and right, tall straight pines (crowns above frame) behind; big pine trunk right foreground; no rocks, no
  water in view; flat overcast light (no shadows) -> not the sunny 21 Sep: filmed on the setup day.
- Shot 10 (f0257-f0304): box from the door side, low warm sun from the right rear -> morning or evening.
- Images: hints/terrain_grid.png (10 % grid), hints/terrain_depth.png (rough relative depth from the push-in).
- Fusion is audio-free by default from 22 Sep 14:40 (w_air 0, sighting without rumble timing).

## horde.no source maps (public, 22 Sep 15:50)
- The Gatsby site ships source maps. /secret/kodejakten is a 4-mini-game "Kodejakten" (Regningsinvasjonen,
  LopAlf, FlyAlf, Dartskiven); after four server-verified games the server issues a code shown behind a padlock
  (KodeVist.tsx) -> most likely one of the box's padlock codes. Code is server-side (HMAC session), not in the
  client. Playing it is legitimate; nothing locational in it.
- /secret/hohohint-a: two riddles ("three last digits of the 2024 amount", "points for referring a friend" = 500),
  from the Christmas 2025 campaign; shows the style of code riddles. Not locational.
- content/jakten.ts: campaign copy, rules, terms. "Kassen star ikke i farlig terreng", "Boksen inneholder ikke
  fysiske kontanter", codes released only in the app. No location text. Sanity CMS (k11iw1kj/blogg) public
  dataset has no hunt-hint documents.
- 22 Sep 20:08 "plane": she pointed straight up twice; board 20:09:47 reads "TROR FLY, MEN KAN HA VAERT SATELITT".
  Skyfield check: SL-14 rocket body (bright, sunlit) crossed at 55 deg from every candidate at 18:08:45-55Z; the
  only aircraft high overhead anywhere in the region was WIF1AT (Dash 8, 25,000 ft) over Brumunddal/Nes. Ambiguous
  -> sighting removed from sightings.json. Ringsaker (Stavsjo/Furnes) stays a secondary candidate only.