Weapons Trafficking: Mission Domain Intelligence Guide

Most weapons in an illicit market were legal once. The investigative question is not where the gun came from but at which documented transfer it stopped being accounted for.

What Weapons Trafficking covers as a mission domain

Weapons trafficking intelligence tracks the diversion of firearms, ammunition, explosives and their components from lawful supply into illicit possession. That includes theft from military and police stockpiles, corrupt or fraudulent export licensing, brokered shipments routed through permissive jurisdictions, conversion of blank-firing and deactivated weapons, privately manufactured and additively manufactured firearms, and small-volume trafficking of components by post. The core analytic technique is tracing: recovering marking and documentation data from a seized item and following it back through recorded transfers to the point at which the chain of accountability failed.

The domain spans state-to-state transfers and their end-use monitoring, brokered and grey market shipments, battlefield capture and recirculation from conflict zones, domestic theft and straw purchasing, component and unfinished frame supply, and increasingly drone and improvised system parts. Actors include licensed dealers and brokers acting fraudulently, freight and logistics firms, corrupt officials in licensing and custody roles, organised networks and individual profiteers.

Why it matters

Diverted weapons outlive the conflict or crime that first moved them, recirculating for decades and appearing in new conflicts, organised crime and terrorism. Ammunition supply in particular determines whether an armed group can sustain operations. Component-level trafficking and self-manufacture erode the control effect of national firearms licensing, and drone components have shifted the capability available to non-state groups faster than export controls have adapted.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• End-user certificates with inconsistent signatures, implausible quantities for the stated force size, or issuing authorities that do not exist
• Shipments routed through transhipment hubs with no commercial logic, changing freight forwarder or documentation at each leg
• Recovered weapons whose serial numbers trace to a lawful export made years earlier to a recipient in a different region
• Ammunition headstamps and lot markings inconsistent with the claimed origin or manufacturing date of the consignment
• Postal and parcel interdictions of receivers, trigger assemblies, barrels or magazines declared as unrelated machined parts
• Online marketplace and forum listings for unfinished frames, conversion parts or deactivated weapons marketed by reactivation potential
• Aircraft and vessel movement patterns of cargo operators previously associated with arms shipments, including repeated unusual routings
• Clusters of recovered firearms sharing an obliterated marking pattern or an identical aftermarket modification, indicating a common source

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Conflict Armament Research iTrace — Field-documented weapon and ammunition records from conflict zones, traced back to manufacture and transfer
• Small Arms Survey — Independent research on stockpiles, diversion pathways, craft production and regional trafficking dynamics
• INTERPOL iARMS and Firearms Reference Table — International records of lost, stolen and trafficked firearms plus standardised identification data
• ATF National Tracing Center trace data — Time-to-crime and source-state analysis for firearms recovered in the United States
• UNODC Global Study on Firearms Trafficking — Comparative seizure and trafficking data with methodological guidance on national reporting
• SIPRI Arms Transfers Database — Documented major conventional weapons transfers by supplier, recipient and year for baseline legitimacy checks
• UN Register of Conventional Arms and Comtrade — State-declared transfers and trade statistics, useful for identifying mirror-statistic discrepancies
• National export licensing authorities and UN panel of experts reports — Licensing decisions, denials and documented sanctions-busting case studies with evidential detail

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Capture the physical record — Document markings, serial numbers, headstamps, proof marks and modifications precisely at recovery, with photography and standardised identification references.
2. Trace to the last lawful transfer — Work through manufacturer, export licence, importer and dealer records via the appropriate national tracing authority to find the last accountable holder.
3. Reconstruct the paper chain — Examine end-user certificates, bills of lading, freight forwarding and insurance documents for forgery, inconsistency and undeclared intermediaries.
4. Map brokers and logistics — Identify the brokering entity, transport operators and financing route, checking each against licensing records and sanctions designations.
5. Locate the diversion point — Determine where accountability failed: stockpile theft, licence fraud, corrupt custody transfer or onward resale in breach of end-use conditions.
6. Refer for regulatory and criminal action — Package findings for the licensing regulator, customs and law enforcement, distinguishing regulatory breach from criminal trafficking evidence.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Weapons Intelligence — Weapons Systems, Capability, and Trafficking
• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Logistics Intelligence — Cargo, Freight, and Physical Movement
• Sanctions Intelligence — Screening, Designations, and Evasion Detection
• Geospatial Intelligence — Intelligence Derived from Place
• Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
• Technical Intelligence — Technology Capability, Design, and Exploitation

Worked in these data points

• Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
• HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.
• Shipping Container — An ISO container identifier — trackable across ports, vessels, and customs events.
• Company / Organization — A legal entity — corporation, LLC, NGO, or business.
• Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
• Aircraft — An aircraft identified by tail number, ICAO hex, or registration.
• Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.

Adjacent mission domains

• Organized Crime
• Counter-Terrorism
• Conflict & Humanitarian
• WMD / Proliferation
• Maritime Security
• Sanctions Evasion
• Border Security & Migration

Inside the platform: where Weapons Trafficking lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• domain.php?d=weapons — Weapons Trafficking dashboard
• theater.php?d=weapons — Threat theater view
• search.php — Company / Organization profile
• domain.php?d=mar — Vessel / Ship profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Weapons Trafficking:

• Sanctions Screening & Escalation — a step-checked workflow with the pivots, sources and handling rules already wired in.
• Human Trafficking Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Capture the physical record is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Reconstruct the paper chain turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Refer for regulatory and criminal action feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Weapons Trafficking

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence organisations are both custodians and stakeholders. The custodial duty is stockpile security and accounting, since theft and leakage from military and police holdings is a documented source of illicit weapons. The stakeholder interest is understanding what armed groups in an operating area possess, how they obtained it and what that implies for force protection and for partner nation assistance. Analysts support physical security and stockpile management assessments, weapons documentation after recovery, and end use monitoring of transferred equipment. Constraints include classification of holdings data, arms transfer authorisation processes, and human rights vetting requirements before assistance is provided to any partner force.

🕵 National intelligence

National services track proliferation and diversion: brokered transfers through intermediary jurisdictions, falsified end user certificates, state supply to proxies and the movement of components subject to export control. Requirements focus on the brokers, freight agents, financiers and corrupt officials who enable diversion, since these are durable and few. Fusion of trade data, corporate records, flight and vessel movement, financial intelligence and recovered weapons documentation is the method. Handling is sensitive because assessments may support sanctions designation or diplomatic action, and because evidence of state supply to a proxy carries significant political consequence.

👮 Law enforcement

Police investigate possession, supply, conversion and trafficking, and recovered firearms are the single most productive evidential starting point. Tracing recovered weapons through manufacturer and distribution records identifies the last lawful owner and therefore the point of diversion. Evidence handling matters: continuity of the exhibit, forensic examination for marks and DNA, and ballistic comparison to link a weapon to multiple incidents. Legal process is needed for manufacturer and dealer records, and cross border tracing requires established cooperation channels. Charging strategies should distinguish organised supply from individual possession, and screen young or coerced possessors for exploitation.

🔍 Private investigation and corporate security

Private sector involvement is compliance: defence exporters, freight forwarders, financial institutions and marketplaces managing export control and brokering obligations. Diligence covers end user certificate authenticity, consistency between stated end use and the goods, routing through known transhipment jurisdictions, and screening of counterparties against designations. A private actor may not investigate trafficking, acquire controlled items to test controls, or conduct surveillance of suspected traffickers. Suspicion is reported to the export control authority or police. Documentation should be built to withstand regulatory audit, since penalties for control breaches are severe and strict in many regimes.

📰 Journalism and OSINT media

Reporting must avoid providing practical uplift: no detail on conversion, deactivation reversal, manufacture or acquisition routes, however much appears elsewhere. Verification of weapons in imagery requires specialist identification, because misidentification is common and consequential when a report alleges a state supplied a particular system. Provenance analysis of images and video should follow open source investigation standards. Source protection matters where insiders in industry or government are involved, and right of reply should go to named companies and governments with adequate time, since these allegations carry legal risk and reputational weight.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights organisations document the effects of arms availability on civilians, monitor compliance with arms transfer obligations and support survivors. Field documentation of recovered weapons and munitions, done to a recognised standard, has repeatedly established supply chains and supported accountability. Practice is protective: field teams must never handle unexploded ordnance, and documentation should be planned with explosive ordnance disposal specialists. Do no harm applies to publication, since identifying witnesses in areas controlled by armed actors is dangerous. Duty of care includes trauma support and clear rules that documentation never outranks staff and community safety.

🎓 University and research

Research covers diversion pathways, the effect of controls, small arms proliferation and the relationship between availability and violence. Methodology must contend with the fact that recovered weapons data reflects policing, so conclusions about circulation drawn from seizures are biased. Field research on arms carries genuine risk and requires ethics approval covering researcher and participant safety. Never publish technical information that would assist manufacture or conversion, which is a recognised constraint in this field. Publish coding frames for weapons identification, archive imagery with provenance, and share data through controlled access where it identifies locations or individuals.

Playbook: working Weapons Trafficking end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Frame the question around diversion

Almost every illicit weapon began somewhere lawful. The analytical question is therefore where it left legal control: theft from a stockpile, corrupt or fraudulent export licensing, brokered transfer to a false end user, loss during conflict, or diversion at retail. Framing the work this way directs collection toward records rather than toward the street. A good output states which diversion pathway is being tested and what evidence would confirm or exclude it.

Phase 2 — Document recovered weapons to standard

Record manufacturer, model, serial number, all markings including import and proof marks, condition and any signs of alteration, with photographs to a documented method. Handle only through authorised personnel and never touch munitions or suspected explosive items. Consistent documentation is what makes tracing possible months later and across borders. The output is a record another organisation can act on without re-examining the item.

Phase 3 — Trace through the lawful chain

Submit tracing requests through the proper channel to identify manufacture, export, import and the last documented lawful transfer. National points of contact and international tracing arrangements exist for this purpose. Record every response, including negative ones, because a manufacturer's inability to trace is itself a finding about record keeping. A good output identifies the point at which documentation stops, which is where diversion occurred.

Phase 4 — Examine the paperwork for fraud

Where a transfer is documented, scrutinise the end user certificate and supporting documents: issuing authority, signature and stamp consistency, plausibility of the stated end use for the quantity and type, and whether the named entity exists and has the capacity claimed. Fraudulent certificates are a recurring diversion mechanism. The output is a documented assessment of authenticity with the specific anomalies identified, suitable for a regulator or prosecutor.

Phase 5 — Map the brokers and logistics

Identify the brokers, freight forwarders, charter operators and financiers involved. These actors recur across unrelated cases and are more durable than the consignments. Use corporate registries, aircraft and vessel records, court filings and sanctions data. A good output is a facilitator picture showing which intermediaries appear in multiple transfers, since that is where regulatory and criminal action has the most leverage.

Phase 6 — Analyse the route

Reconstruct the physical movement: transhipment points, flight or voyage records, customs declarations and any deviation from the declared route. Look for the jurisdictions that appear repeatedly as pass through points because of weak controls. Note where cargo was reconsolidated or documentation changed. The output is a route reconstruction with the specific handoffs identified, which supports both prosecution and policy engagement with the transit state.

Phase 7 — Assess stockpile security where relevant

Where diversion is from state holdings, examine physical security and stockpile management: accounting practice, storage conditions, inventory reconciliation and personnel controls. This is usually a cooperative assistance exercise rather than an investigative one. A good output is a set of practical recommendations with priorities, since the alternative to secure stockpiles is a steady supply into illicit markets that no amount of downstream enforcement will offset.

Phase 8 — Link incidents forensically

Use ballistic comparison and recovered casing analysis to link a weapon to multiple incidents, and to link seizures to each other. Ensure exhibits are handled with continuity and examined in accredited laboratories. Enter results into the national and international comparison systems available. The output is a documented linkage with stated confidence that can support conspiracy charges and reveal weapon circulation between groups.

Phase 9 — Screen possessors for exploitation

Young people and vulnerable adults are frequently used to store, carry and transport weapons under coercion or exploitation. Screen for those indicators before treating possession as straightforward offending, and refer through the appropriate safeguarding or trafficking mechanism where they are present. This protects a person who is being used and is generally more productive for the investigation than prosecuting a replaceable custodian.

Phase 10 — Feed prevention and control

Convert findings into control improvements: marking and record keeping requirements, deactivation standards where conversion is a route, dealer and broker licensing conditions, and reporting obligations for suspicious orders. Engage industry with specific indicators rather than general awareness. A good output is a concrete regulatory or industry change traceable to the evidence you produced. Give industry specific indicators rather than general awareness material.

Phase 11 — Coordinate internationally

Use established channels for tracing, mutual legal assistance and joint operations, and understand that evidential rules differ between jurisdictions. Engage arms control bodies and expert panels where a transfer may breach an embargo. Agree attribution and publication sequencing with partners. The output is a coordinated approach rather than parallel investigations that surface late and compromise each other. Agree publication sequencing with partners before any findings are released.

Phase 12 — Report without providing uplift

Write findings so that they inform control and enforcement without functioning as instruction. Describe that a conversion method exists and how prevalence is detected, not how it is performed. Withhold detail on acquisition routes that remain open. A good output is a report a regulator can act on and a trafficker learns nothing from, and this constraint should be applied to internal products as well as published ones.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Small Arms Survey	Open	Independent research on small arms holdings, transfers, diversion pathways and armed violence worldwide.	Authoritative baseline data and diversion typologies for analysis and briefing. Also documents national holdings estimates and civilian ownership.
Conflict Armament Research	Open	Field documentation of weapons and ammunition recovered in conflict, traced through manufacture and transfer records.	Documented supply chain evidence and a methodological model for field documentation. Reports show the tracing method as well as the conclusion.
UN Register of Conventional Arms and UNODA	Open	State reported transfers of major conventional arms plus disarmament and arms control documentation.	Official transfer reporting baseline and treaty implementation context. Reporting is voluntary and incomplete, so gaps are informative.
SIPRI Arms Transfers Database	Open	Records of international transfers of major conventional weapons with volume estimates from 1950 onward.	Long run transfer patterns and supplier relationships for strategic assessment. Volume figures are indicators rather than financial values.
Arms Trade Treaty documentation	Open	Treaty text, national reports and implementation guidance on export assessment and diversion prevention.	The legal framework governing export licensing decisions and diversion risk assessment. Also sets the diversion risk assessment obligation on exporting states.
UN sanctions committee panel of experts reports	Open	Investigative reporting on embargo violations, named intermediaries and documented diversion cases. Panels have investigative mandates and publish supporting documentation.	Primary evidence on specific diversion networks and methods already established by UN experts.
INTERPOL iARMS and firearms tracing channels	Licensed	International system for recording and tracing lost, stolen and trafficked firearms between member countries.	The authorised law enforcement route for international tracing of recovered weapons. Access is restricted to authorised law enforcement in member countries.
ATF National Tracing Center	Licensed	United States firearms tracing service linking recovered weapons to manufacture, import and first retail sale.	Identifying the last lawful transfer for weapons of United States origin. Requests must come through authorised law enforcement channels.
Wassenaar Arrangement control lists	Open	Multilateral control lists for conventional arms and dual use goods and technologies.	Determining whether an item or component is controlled and what licensing applies.
National export control authorities	Open	Licensing guidance, control lists, enforcement notices and end user certificate requirements. Also publish enforcement actions and denied licence statistics.	Establishing licensing obligations and the specific documentation a lawful transfer requires. Also identifies which components are controlled in their own right.
Corporate registries and aircraft registers	Registration	Company records plus civil aircraft and vessel registration data used to identify brokers and transport operators.	Resolving the intermediaries and charter operators behind a suspect transfer. Registration data frequently exposes charter operators behind a broker.
Flight and vessel tracking data	Registration	Historical aircraft and ship movement records including routing, stops and transponder gaps.	Reconstructing physical movement and identifying undeclared transhipment stops. Transponder gaps are often the most informative element.
GICHD and mine action documentation standards	Open	Technical standards and guidance on explosive ordnance, survey and safe field documentation practice.	Safety and method standards for anyone documenting munitions in the field. These standards apply to any organisation documenting in the field.
Europol and national firearms threat assessments	Open	Assessments of illicit firearms markets, conversion trends and trafficking routes in Europe.	Regional market context and current diversion methods relevant to European jurisdictions. Includes current conversion and reactivation trends observed in seizures.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Weapons Trafficking. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Weapons documentation protocols and photography standards — Structured recording of markings and serials for later tracing. Limitation: requires trained personnel and safe access, which is rarely available in active conflict.
• International tracing request systems — Formal channels for tracing recovered firearms through manufacture and transfer. Limitation: depends on the quality of manufacturer and dealer record keeping, which varies enormously.
• Ballistic comparison systems — Link cartridge cases and projectiles across incidents and to recovered weapons. Limitation: comparison quality depends on database coverage and on consistent evidence submission.
• Trade and customs data analysis — Identifies anomalous flows of controlled goods and components. Limitation: coverage and commodity coding are inconsistent, and many transfers never appear at all.
• Corporate and beneficial ownership research — Resolves brokers and shell companies behind transfers. Limitation: nominee arrangements and weak registers obscure ultimate control in the relevant jurisdictions.
• Flight and vessel movement analysis — Reconstructs routing and identifies undeclared stops. Limitation: transponders can be switched off, and the gap is often the only signal available.
• Document examination for end user certificates — Assesses authenticity of licensing paperwork against known issuing practice. Limitation: requires reference exemplars that are frequently unavailable.
• Open source imagery verification — Identifies weapon systems in circulating photographs and video with geolocation and chronolocation. Limitation: misidentification is common and consequential, so specialist review is essential.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Every illicit weapon has a lawful origin. The analytical objective is the point where documentation stops, and that point is almost always a record keeping failure, a fraudulent certificate or a stockpile with no reconciliation.
• Serial numbers and markings are the whole game. Documentation that omits import marks, proof marks or the full serial makes tracing impossible later, and field teams often get one opportunity to record them.
• Brokers and freight agents recur; consignments do not. Building a facilitator picture across cases produces far more leverage than treating each transfer as an isolated investigation.
• Transponder gaps and routing anomalies carry more information than manifests. A declared route that includes an unexplained stop in a weak control jurisdiction is a stronger indicator than any paperwork discrepancy.
• Never handle munitions. Documentation of explosive ordnance is a specialist task with a safety protocol, and organisational rules should make this an absolute prohibition for non specialist staff.
• Screen young possessors for exploitation before charging. Storage and carriage roles are routinely imposed on children and vulnerable adults under threat, and prosecuting the custodian leaves the supply untouched.
• Withhold technical uplift in every product. Conversion methods, deactivation reversal and manufacture detail must not appear in reports, briefings or media engagement regardless of what is claimed to be already public.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Weapons Trafficking is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of recovered weapons successfully traced to a last documented lawful transfer, and the median time to trace result.
• Number of diversion points identified and remediated, such as stockpiles brought under reconciliation or dealers subject to enforcement.
• Share of recovered weapons documented to a standard sufficient for international tracing on first examination.
• Ballistic linkage rate between recovered weapons and unsolved incidents, indicating whether submission practice is complete.
• Number of brokers or freight operators subject to licensing, sanctions or criminal action arising from network analysis.
• Proportion of young or vulnerable possessors screened for exploitation and referred to a safeguarding pathway where indicated.
• Reduction in weapons recovered from a specific diversion pathway following intervention, measured against a pre-intervention baseline.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Assuming country of manufacture equals country of supply, when most diverted weapons change hands lawfully several times first
• Relying on obliterated or absent markings, since marking standards vary widely and some producers never applied unique identifiers
• Misidentifying weapon models from low-quality open-source imagery, a recurring error in conflict reporting
• Reading trade statistics discrepancies as evidence of trafficking when they often reflect classification and reporting differences
• Conflating civilian, law enforcement and military categories, which have entirely different legal control regimes
• Publishing technical detail on conversion, reactivation or manufacture, which directly enables the harm being investigated

Legal and ethical considerations

Export control, brokering and sanctions regimes differ substantially between jurisdictions, and an act lawful in one may be a serious offence in another. Ballistic and physical evidence demands strict chain of custody and specialist handling; analysts should work from documentation rather than items. Tracing requests generally run through designated national authorities and INTERPOL channels rather than direct contact with manufacturers. Products must exclude any technical instruction relating to manufacture, conversion or reactivation, and findings implicating licensed entities should go to the regulator before publication.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Weapons Trafficking, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 7 data points, 7 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Where do illicit firearms mostly come from?

Overwhelmingly from lawful sources that failed. Documented pathways include theft and leakage from state military and police stockpiles, particularly where accounting is poor; diversion during or after conflict; fraudulent or corrupt export licensing and false end user certificates; theft from dealers and private owners; and in some regions conversion of blank firing, deactivated or antique weapons. Craft production is significant in some markets and growing where digital manufacturing lowers barriers. The proportions vary sharply by region, so analysis should establish the local pathway from recovered weapons data rather than importing assumptions from another jurisdiction.

What makes a recovered weapon traceable?

Complete and accurate documentation at recovery, and record keeping upstream. The essentials are manufacturer, model, calibre, full serial number and every marking present including import and proof marks, recorded with photographs. Missing or obliterated serials can sometimes be restored forensically. Upstream, tracing depends on manufacturers, importers and dealers having retained transfer records, which varies by jurisdiction and by how long ago the transfer occurred. A trace that stops is still informative, because it identifies exactly where record keeping failed, which is a policy finding as well as an investigative one.

How do fraudulent end user certificates work as a diversion mechanism?

At a general level, a transfer is authorised on the basis of documentation stating a legitimate recipient and end use that is not the real one, allowing goods to move lawfully at the point of export and be diverted afterwards. Investigators test authenticity by checking whether the issuing authority and signatory exist and had authority, whether the named recipient has capacity for the quantity and type, and whether the stated end use is plausible. Post shipment verification and end use monitoring are the controls that address this, and their absence is a recurring finding in expert panel reporting.

What should a field documentation team never do?

Never handle, move or attempt to render safe munitions, unexploded ordnance or improvised devices; that is exclusively for qualified explosive ordnance disposal personnel. Never enter an area without security clearance from the responsible authority and a risk assessment. Never document in a way that identifies local witnesses or the community that reported the find where armed actors remain present. Never take custody of a weapon without the legal authority to do so. Documentation is a photographic and record keeping task carried out around these constraints, not a collection exercise.

Can open source imagery reliably identify weapon systems?

With specialist review, often yes for major systems, and much less reliably for small arms where variants look similar and image quality is poor. Misidentification carries real consequences when a report alleges that a particular state supplied a particular weapon. Good practice is independent identification by more than one specialist, explicit statement of the features relied upon, geolocation and chronolocation of the imagery to established open source investigation standards, and honest reporting of uncertainty. Where identification cannot be made confidently, describe the class rather than asserting a specific model.

What is the role of stockpile management in reducing illicit supply?

It is the most cost effective intervention available in many contexts, because a single poorly secured depot can supply an illicit market for years and no amount of downstream policing offsets it. Practical measures are physical security, accurate inventory with periodic reconciliation, marking and record keeping, personnel vetting, and surplus destruction rather than indefinite storage of obsolete holdings. Assistance programmes are usually cooperative and technical rather than investigative. The measurable outcome is fewer weapons of that origin appearing in recoveries, which requires baseline data collected before the intervention.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Arms Trade Treaty, governing export assessment obligations including diversion risk and human rights criteria.
• UN Programme of Action on Small Arms and Light Weapons, framing marking, record keeping and cooperation commitments.
• International Tracing Instrument, setting standards for marking and for cooperation in tracing illicit weapons.
• UN Firearms Protocol to the Convention against Transnational Organized Crime, criminalising illicit manufacture and trafficking.
• Wassenaar Arrangement control lists, defining controlled conventional arms and dual use items.
• International Small Arms Control Standards, providing technical guidance on stockpile management, marking and destruction.
• International Ammunition Technical Guidelines, governing safe storage and management of conventional ammunition.
• ISO/IEC 17025 accreditation for forensic ballistic and firearms examination laboratories.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Small Arms Survey research — Small Arms Survey, Graduate Institute Geneva. Independent research on holdings, transfers and diversion of small arms.
2. Field documentation and tracing reports — Conflict Armament Research. Documented weapons tracing evidence from conflict zones.
3. Arms Transfers Database — Stockholm International Peace Research Institute. Long run dataset of international transfers of major conventional weapons.
4. Arms Trade Treaty — ATT Secretariat. Treaty framework governing export assessment and diversion prevention.
5. Firearms tracing services — INTERPOL. International system for tracing recovered and trafficked firearms.
6. National Tracing Center — Bureau of Alcohol, Tobacco, Firearms and Explosives. United States firearms tracing capability linking recoveries to lawful transfers.
7. International Small Arms Control Standards — United Nations. Technical standards for stockpile management, marking and destruction.
8. Firearms trafficking threat assessment — Europol. Assessment of illicit firearms markets and diversion methods in Europe.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: traces recovered weapons through licensing, brokering and shipping records to locate the point of diversion. Explore the platform, or browse the rest of the library by following any tag above.