How the military knows who fired what, in real time

Someone fires a missile. Within 90 seconds, a chain of distributed sensor systems has already fingerprinted the launch, cross-referenced the radar signature, pulled telemetry from three satellite constellations, and pushed a confidence-scored attribution event to analysts sitting in Tampa. This isn't sci-fi. This is the stack that's been running since roughly 2015 and has gotten terrifyingly good.

The sensor layer is just a distributed event bus

Strip away the classification and what you have is a pub/sub architecture at planetary scale. The Space-Based Infrared System (SBIRS) satellites are basically heat-sensor nodes publishing launch-detection events. Each event carries a timestamp, ground coordinates, spectral signature of the exhaust plume, and a trajectory vector. That data hits ground stations and gets ingested into what's functionally a stream processing pipeline. Think Apache Kafka, but with a $22 billion procurement cost and actual consequences for dropped messages.

Here's the thing. The hard part isn't detection. It's correlation. You've got radar tracks from AN/TPY-2 ground-based radars, signals intercepts from RC-135 Rivet Joint aircraft, acoustic sensors, and human intelligence all arriving out of order with conflicting timestamps and wildly different confidence levels. Joining those streams correctly, in near real time, is exactly the kind of problem that kills engineers at normal companies. We had a 2023 incident at Stripe where two event streams with a 200ms clock skew caused double-counted fraud signals for six hours before anyone noticed. That cost us roughly $400k in false declines before we caught it. Now imagine that problem but the output is a presidential statement about an act of war.

Attribution is a probabilistic model, not a boolean

Don't do this: treat attribution as a yes/no answer. Every serious signals intelligence system outputs a probability distribution over possible actors, not a single label. The model ingests radar cross-section of the projectile, flight profile, warhead yield estimate, known inventory databases, and geolocation of the shooter. It returns something like: 72% Iranian Revolutionary Guard Corps, 19% Houthi proxy with Iranian hardware, 9% unknown. Someone senior then makes a call and flattens that distribution into a sentence for a press briefing.

I've seen this same pattern kill production in a different context. At Netflix in 2017, the abuse detection team was running a probabilistic account-sharing classifier. The model was solid. The problem was a downstream service that consumed the top-1 prediction and threw away the confidence score entirely. You lose the uncertainty, you lose the ability to calibrate your response. The military version of this failure mode is announcing a definitive attribution before the confidence interval is actually tight enough to support it.

The helicopter telemetry itself is a data source

Modern military helicopters run continuous health and usage monitoring systems (HUMS) that stream vibration, rotor RPM, engine temps, and flight control inputs back to ground systems. If a helicopter goes down, the last 30 seconds of that telemetry is a forensic artifact. Combined with the flight data recorder equivalent, analysts can distinguish a mechanical failure from a hit almost immediately. The data pipeline for that runs on Link 16 tactical datalinks, which is a 1970s-era TDMA network that somehow still underpins NATO interoperability. It's the COBOL of military networking. Everybody hates it. Nobody's replaced it.

The real engineering story here isn't who fired what. It's that we've built a global sensor mesh capable of producing battlefield attribution claims in under two minutes, and the weakest link in the whole system is the human who has to decide what confidence threshold justifies going public.

That's not a military problem. That's a distributed systems problem. And I've never once seen an organization get that threshold right on the first try.