Led primarily by “Generation Z,” the revolution that has been shaking the island nation since September 25, 2025, has demonstrated the power of online activism and the use of Open Source Intelligence (OSINT) tools in the context of a large-scale movement. The speed and precision of these citizen investigations have played a crucial role in the rapid shift of events.
From the movement’s earliest days, protesters turned to Discord to organize themselves—following in the footsteps of their predecessors in Nepal. Quickly, facing rumors of an attempted internet shutdown, the offline messaging application Bitchat, launched by Jack Dorsey, was rapidly considered.
To make their voices heard, there were even protests on the online gaming platform Roblox.
However, beyond communication tools, the cyberspace has become a battlefield in its own right where Gen Z protesters have been able to impose their strength. Unlike the streets where they endure gunfire and tear gas, here they master the weapons. Three cases among many perfectly illustrate how this use of technology has helped rapidly shift the outcome of this ongoing crisis.
Case 1: FlightRadar24 is Helping Track Escapes and Exfiltrations
It’s Saturday evening, October 11, 2025. Madagascar Aviation, a page run by aviation enthusiasts, suddenly resumes activity after two years of silence. Scoop: a private jet belonging to the country’s most wanted businessman has allegedly left Ivato International Airport in a rush, circles for nearly an hour off the coast of Reunion Island, then lands in Mauritius.
Even before traditional media or official sources, it was the Madagascar Aviation Facebook page of enthusiasts that revealed the escape live, using air traffic tracking tools like FlightRadar and open-source air traffic control listening tools. The information went viral, and the flight momentarily became the most tracked on the FlightRadar24 site. It wasn’t until the next day in late morning that an official statement from the Mauritian government confirmed the information.
Flightradar24 is a flight tracking website for air traffic. It broadcasts real-time information on commercial or private aircraft flights through data transmitted by the ADS-B transponder equipping the aircraft.Wikipedia
Barely 12 hours later, it was again this page that first published the movement of a helicopter from the Iavoloha State Palace to Sainte Marie, where a French military aircraft allegedly took over to transport “a very high-ranking political figure” to Reunion Island. The information was picked up several hours later by several professional media outlets, pending more official information (as of this article’s writing).
Case 2: Documentation and identification of perpetrators of police brutality
The use of Facebook live broadcasts became widespread during these protests. First by the media, competing in a form of “coopetition” for their audiences. Then later, by the protesters themselves, facing violent repression and a frightening number of police brutality.
This was the case on Friday, September 29, 2025: protests were taking place on the university road, a special intervention unit of the gendarmerie was dispatched to the scene to disperse protesters. A live video then captured the scene where a masked gendarme fired at protesters. A sequence showing the shell casings used led many internet users to conclude that live ammunition was being used. Anger mounted. Quickly, many internet users attempted to reconstruct the face of the gendarme, masked under his balaclava, using generative AI. But this approach didn’t work (American internet users had already tried the experiment two weeks earlier in the Charlie Kirk case, without success).
Regardless, some Facebook users quickly managed to circumvent this barrier by using more traditional and collaborative methods—they quickly succeeded in tracking down the identity of the gendarme in question on Facebook. Later, throughout the protests, smartphones broadcasting live streams became omnipresent on the front lines, between the rifles and the stones.
Case 3: Evidence of Links to Cyberbullying Operations
One of the most controversial figures at the heart of the ongoing revolution is a retired gendarmerie general who also sits at the head of the Senate (editor’s note: until his removal by the Senate’s Permanent Bureau on Sunday, October 12). Investigations conducted from publicly available internet data made it possible to find personal contact information he uses to manage not only his accounts but also several fake Facebook accounts active in denigrating and harassing critical figures of the regime.
Editor’s note: Although all the information stated below is public, some information will be deliberately concealed in this article as it is linked to innocent persons.
It all begins with an internet search like any internet user would do. Indeed, with enough searching, one can find this public figure’s CV publicly on the internet, including his phone numbers and email address.
By chance, these contact details are still fully functional, as proven by the WhatsApp status of one of the phone numbers in question, which was updated very recently (October 8).
From there, each of these contact details was tested with Facebook’s password recovery tool (editor’s note: or using Holehe, developed by Palenath). Indeed, these contact details serve the General, but not only. Other accounts are also linked to these different addresses: those of other members of his family, and most interestingly: several accounts very active in denigration and cyberbullying campaigns targeting regime detractors.
These accounts have several things in common: they have very few “friends,” their content is focused on attacks against personalities critical of the government, and they almost all have a mention of “Ambatolampy” on their profiles. We don’t know if other accounts personally managed by him exist, nor do we know if other more compromising information is hidden in the private exchanges of these accounts, as that would already go far beyond the boundaries of open-source investigation.
And This Is Surely Not the End
Just between the beginning and end of writing this article, developments have already occurred with, once again, OSINT tools at the center of the plot.
This revolution aims to structurally reshape the country. In the meantime, it has already reshaped the way ordinary citizens can show their strength in a different way than facing rifles. Transparency is no longer begged for; it is seized from the table.
The preparation of this article was assisted by AI:NotebookLM (synthesis, rephrasing, questioning) and Claude (translation).