# Kinematic Threat Brief **LRRK Watch / Open-Source Intelligence** — Five current signals across systems that sense, move, and act. | Field | Value | | --- | --- | | Collection cutoff | 31 December 2011 | | Platform | Quiet Systems | | Data label | Open-source intelligence // LRRK analytic product | | Handling | Public-source material. Image rights require separate verification before publication. | ## Executive read ### BLUF An RQ-170 Sentinel on a CIA reconnaissance mission fell into Iranian hands after operators lost control — the first time this archive can put the Lockheed stealth UAV on a dated public ledger — and the U.S. story (guidance failure over western Afghanistan) and the Iranian story (dominant-border shoot-down) cannot both be true. ### Key judgments 1. **[Assessment — high confidence]** Two U.S. officials told CNN the lost aircraft was an RQ-170 on a CIA reconnaissance mission involving intelligence community and military personnel stationed in Afghanistan. 2. **[Assessment — high confidence]** ISAF said operators of a U.S. unarmed reconnaissance UAV flying over western Afghanistan “lost control of the aircraft”; a senior U.S. official said the guidance system failed, a satellite pinpointed damaged wreckage, and retrieve-or-bomb options were discarded as impractical. 3. **[Inference — moderate confidence]** Whether the loss was a navigation/C2 failure or an Iranian counter-UAS Act is the December trust question; Iranian GPS-spoof claims beyond “shot down / identified and downed” are not in the fetched CNN piece and are not added here. ### Analytic labels - **Fact** — verified reporting or primary record - **Assessment** — analytic judgment - **Inference** — reasoned but not directly observed - **Uncertainty** — unresolved information gap ### Source grades - **A1** — authoritative primary record / directly confirmed - **B1–B2** — generally reliable and corroborated - **C3** — useful but requires caution ## 01. RQ-170 lost — CIA recon, Lockheed Sentinel named *Event / publication dates: crash “last week” relative to CNN 6 December 2011; CNN updated 7 December* **Verified record — [Fact — B1]** CNN (Barbara Starr, published 6 December, updated 7 December) reported two U.S. officials confirmed a U.S. stealth drone that crashed in Iran was part of a CIA reconnaissance mission involving the intelligence community and military personnel in Afghanistan. Officials confirmed to CNN it was an RQ-170. The RQ-170 Sentinel is a stealth drone developed by Lockheed Martin for the Air Force to provide ISR. CIA officials declined to comment. Fetched: https://www.cnn.com/2011/12/06/world/meast/us-iran-drone **Threat landscape.** A low-observable unmanned Sense asset is now wreckage in an adversary’s possession. Reverse-engineering and signature compromise are the strategic costs. **Intelligence assessment.** [Assessment — high confidence] An RQ-170 was lost and named in the first week of December. [Inference — moderate confidence] CIA tasking plus military operators is a joint Control Fabric. [Uncertainty] Exact crash date inside “last week” is not pinned in the CNN piece. **Opportunity.** A NAVAIR/Air Force mishap date-time and last known coordinate. **LRRK relevance.** Passport / Control Fabric / Sense-Move-Act / Watch. First dated public RQ-170 employment-and-loss in this archive. **Confidence.** High on type and CIA-mission confirmation to CNN; moderate on the exact day. ## 02. U.S. account: guidance failed, tasked over western Afghanistan, not Iran *Event / publication dates: CNN 6–7 December 2011* **Verified record — [Fact — B1]** A senior U.S. official with direct access to the assessment said the drone was tasked to fly over western Afghanistan and look for insurgent activity, with “no directive to either fly into Iran or spy on Iran from Afghan airspace.” The drone “crashed solely because its guidance system failed.” A U.S. satellite “quickly pinpointed the downed drone, which apparently sustained significant damage.” Official: “The Iranians have a pile of rubble and are trying to figure what they have and what to do with it.” Another official: the United States briefly considered retrieving the aircraft or bombing the wreckage; those ideas were “quickly discarded as impractical.” ISAF: “The UAV to which the Iranians are referring may be a U.S. unarmed reconnaissance aircraft that had been flying a mission over western Afghanistan late last week. The operators of the UAV lost control of the aircraft and had been working to determine its status.” Coalition officials said they were ordered to put out that statement; it says “operators,” not which agency. U.S. officials discounted the Iranian shoot-down claim and continued to say the crew lost flight control and the drone then entered Iranian airspace. American officials “have been adamant that U.S. assets do not fly over Iranian air space.” Fetched: https://www.cnn.com/2011/12/06/world/meast/us-iran-drone **Threat landscape.** Lost-link / guidance failure over a border is a C2 integrity problem. If the U.S. account is true, Iran inherited a navigation accident. If it is false, the tasking sentence is a cover story. **Intelligence assessment.** [Assessment — high confidence] This is the official-anonymous U.S. line as of 6–7 December. [Inference — moderate confidence] The ISAF wording was a directed, agency-opaque statement. [Uncertainty] Whether the aircraft was ever tasked toward Iranian territory is not independently verifiable from this piece. **Opportunity.** A flight-path reconstruction from radar or the satellite image. **LRRK relevance.** Control Fabric / Kestrel. Record guidance-failure versus lost-control language. **Confidence.** High that this was the U.S. story; low that the tasking sentence is complete. ## 03. Iranian account: identified and downed; media say slightly damaged *Event / publication dates: CNN 6–7 December 2011 citing IRNA* **Verified record — [Fact — B2]** CNN: Iranian media reported the RQ-170 was slightly damaged and in the hands of Iranian forces. IRNA: “Armed forces with a dominant control over the country’s borders managed to identify and down the invading plane.” An unnamed Iranian military official called it a “clear example of aggression.” CNN notes that in July, Iran’s military claimed it downed a U.S. “spy drone” near the Fordo plant in Qom, then backtracked, saying the incident was a training exercise. Fetched: https://www.cnn.com/2011/12/06/world/meast/us-iran-drone **Threat landscape.** Two physical pictures: U.S. “pile of rubble” versus Iranian “slightly damaged.” One of those is a narrative weapon. **Intelligence assessment.** [Assessment — high confidence] Iran claimed a successful counter-UAS event. [Inference — low confidence] Intact capture versus rubble cannot be resolved from CNN text. [Uncertainty] Electronic-warfare / GPS-spoof mechanisms are not specified in this fetched article and are not reconstructed here. **Opportunity.** Independent imagery of the displayed airframe. **LRRK relevance.** Watch / Kestrel. Grade Iranian EW claims only when a December primary states them — this one does not. **Confidence.** High on the claim; low on airframe condition. ## 04. U.S.-person legal file still unpublished at year-end *Event / publication dates: 30 September and 14 October deaths; no December memo fetched* **Verified record — [Fact — B1]** No December DoJ/OLC public theory fetched. Carry-forward: https://www.bbc.com/news/world-middle-east-15132308 ; https://www.independent.co.uk/news/world/middle-east/family-hits-out-at-us-in-fury-at-fate-of-anwar-alawlaki-s-slain-son-2372514.html **Threat landscape.** Year-end Control Fabric: acknowledged Libya Predators, leaked extra-theater map, citizen deaths, and now a named stealth UAV — still no legal white paper. **Intelligence assessment.** [Assessment — high confidence] Gap persists through 31 December. [Uncertainty] Classified OLC exists or does not — not a public Fact. **Opportunity.** Any year-end official legal comment. **LRRK relevance.** Control Fabric. **Confidence.** High. ## 05. Stuxnet still not an official U.S.–Natanz join in this archive *Event / publication dates: Symantec dossier 1.3 (November 2010) still the fetched technical baseline* **Verified record — [Fact — A1]** PLC reprogramming, Iran-concentrated infections, no fetched official 2011 U.S. attribution or IAEA Stuxnet sentence in this collection. Fetched: https://www.cs.unh.edu/~it666/reading_list/ZeroDay/w32_stuxnet_dossier.pdf **Threat landscape.** Cyber-to-physical Act on industrial controllers remains last year’s public discovery, this year’s unfinished official join. **Intelligence assessment.** [Assessment — high confidence] December 2011 adds no fetched official join. [Uncertainty] Later 2012 leaks are outside this cutoff. **Opportunity.** An IAEA or U.S. official sentence. **LRRK relevance.** Lab / Sense-Move-Act. Year-end carry-forward. **Confidence.** High. ## Forward indicators Ranked watchlist as of the collection cutoff (what a 2001–2011 Watch desk would have monitored next). 1. Independent imagery of the RQ-170 in Iranian custody and any reverse-engineering claims. 2. Official U.S. legal theory for U.S.-person targeting. 3. Iranian counter-UAS technique claims that can be sourced (not reconstructed). 4. LDUUV awards and next UUV at-sea tests. 5. 2012 civil sUAS NPRM movement — still not a consumer quadcopter market. > **Collection integrity.** RQ-170 from the 6–7 December CNN piece actually fetched. Iranian GPS-spoof how-tos appearing in later press are not in that article and are not added. December 2011 undersea-cable / SMW3 items were not fetched. DoJ white paper is a later leak. No Stuxnet exploit recipe. No DJI Phantom. No Abbottabad-as-drone. *LRRK — security assurance for systems that sense, move, and act.*

L-C1