Convoy — Athena Trace 2026 Writeup

Content note

This challenge concerns the Pulwama attack of 14 February 2019, in which 40 Indian CRPF personnel were killed. The writeup deals only with the geolocation and provenance methodology and takes no position on the surrounding political dispute.

The challenge

A wire photographer reached the roadside within the hour and filed this frame. The agency caption travelled with the file; the copy we have has lost it. Give us the village, the district, and the date.

Flag format: trace{Village_District_YYYY-MM-DD} — underscores for spaces. The first field is the village at the site itself, not the district headquarters and not the nearest city; the second is the district that village sits in. The date is the day the attack happened, not the day an outlet published its story about it.

Read the prompt carefully and it tells you the whole method. “The agency caption travelled with the file; the copy we have has lost it.” The challenge is not “what is this photo” — it is caption recovery. The answer existed as a formatted string attached to this exact frame, and the task is to get it back.

Stage 1 — Prove the metadata is actually gone

The artifact arrives as attack.avif, which a lot of viewers still can’t decode. That’s mildly annoying, but it also creates the right instinct: before converting anything, inspect the container.

This matters because the prompt’s claim is a claim, not a fact. If IPTC or XMP caption fields had survived the re-encode, the entire challenge would collapse into one command. Wire photos carry their captions in metadata as standard, and “lost the caption” often means “lost the visible caption” while the embedded fields ride along untouched.

ffprobe attack.avif

The result: a single 720×540 AVIF frame, no embedded caption metadata. The claim holds — the caption really is gone, and the recovery has to happen externally.

Only then convert for downstream tooling:

ffmpeg -i attack.avif attack.png

Habit worth keeping: check metadata before format conversion, not after. Re-encoding is exactly the operation that strips IPTC/XMP fields. If you convert first and inspect second, you can destroy the answer and then conclude it was never there.

Stage 2 — Recognise the scene

The converted frame shows the aftermath of a roadside explosion: a heavily damaged bus, debris strewn across the carriageway, Indian security personnel examining the site.

Reverse image search identifies it immediately as the 2019 Pulwama attack — the suicide bombing of a CRPF convoy in Jammu and Kashmir.

And here the challenge’s real difficulty appears. Reverse image search returns hundreds of hits: Reuters, Al Jazeera, The New York Times, Hindustan Times, Dawn, WION, RFI, The Diplomat, plus aggregators, YouTube stills, and social reposts. The photograph is one of the most syndicated images of the event.

Volume is not the same as information. Most of those pages carry the image with their own headline and no wire caption at all, or with a paraphrase. Recognising the event took one search; recovering the caption took targeted ones.

Stage 3 — Recover the caption

The move is to search for caption fragments rather than the event. Wire captions have a rigid house style — [subject] [verb] [location] [date] — so you search the shape, not the topic.

Outlets that republish agency photos wholesale preserve the string verbatim. That turns up the original:

Indian soldiers examine the debris after an explosion in Lethpora in south Kashmir’s Pulwama district February 14, 2019.

Confirmed across multiple independent republishers, including The Business Standard, The Peninsula and Al Jazeera. The caption matching this scene is credited to Reuters / Younis Khaliq.

One sentence, all three fields.

Stage 4 — Read the fields off the caption, not off memory

The flag spec spends three clauses ruling out the answers you’d give from general knowledge, and each one maps to a real error:

The caption resolves all three without inference:

• Village at the site: Lethpora — the caption names the site itself, not the administrative centre.
• District: Pulwama — stated explicitly.
• Date of the attack: 2019-02-14 — the caption date is the exposure date, which for a photographer who reached the scene within the hour is the day of the attack.

That last one is worth noting: the prompt’s detail about the photographer arriving “within the hour” isn’t colour. It’s telling you that the caption date and the event date are the same, so the caption is a valid source for the date field.

Flag

trace{Lethpora_Pulwama_2019-02-14}

Takeaways

1. Verify the premise before accepting it. “The caption is lost” is testable in one command. Sometimes it’s wrong, and the whole challenge is a metadata read.
2. Inspect before converting. Format conversion strips the exact fields you want. Order of operations decides whether the evidence survives.
3. Search the caption’s grammar, not the event. Wire captions have a fixed structure. Searching a distinctive fragment finds republishers who preserved the string; searching the event name finds a thousand editorial rewrites.
4. Syndication volume ≠ provenance. Hundreds of hits made the event trivially identifiable and the caption no easier. Distinguish “who has this image” from “who has the original metadata”.
5. The exclusions in a flag spec are a map of the traps. Three clauses ruled out three specific wrong answers. On a well-written card, negative constraints tell you exactly where solvers go wrong.

Sources and credits

Challenge artifact: wire photograph of the Pulwama attack site, 14 February 2019, widely syndicated across news outlets. The caption matching this scene is credited to Reuters / Younis Khaliq; the copy distributed with the challenge carried no embedded metadata, so the provenance of this specific file could not be independently confirmed. Reproduced here for the purpose of analysis and commentary; all rights remain with the rights holder.