Reference Intelligence (REFINT): Intelligence Discipline Guide

Most wrong conclusions can be traced back to two records an analyst believed were about the same thing. Reference intelligence is the discipline that decides when they are, and proves it.

What Reference Intelligence is as a discipline

Reference intelligence is the disciplined use of authoritative identifiers, code lists, registers and standards as the backbone of analysis: country and subdivision codes, legal entity identifiers, port, airport and vessel codes, numbering plans, currency codes, industry classifications, geographic gazetteers, and the crosswalks between them. It underpins entity resolution, deduplication and cross-discipline fusion. Practitioners maintain a curated, versioned reference layer, because codes get reassigned, jurisdictions change names and boundaries, and classification vocabularies drift with every revision.

Sub-methods include identifier validation through format rules and check digits, authority selection deciding which register is the source of truth for a given fact, crosswalk maintenance between classification systems, versioned snapshots so historic records are read against the code list in force at the time, and provenance labelling of derived fields. In the cycle it sits squarely in processing: it is what makes fusion possible without silently merging distinct entities.

Why it matters

Reference intelligence answers whether two records describe the same entity, place or asset, and which authority is entitled to say so. It also answers what a code meant on the date a record was created, which matters whenever you compare across years. Without it every downstream discipline inherits invisible errors: duplicated counterparties, mismatched jurisdictions, incomparable statistics, and merged identities that no later analysis will detect.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Legal entity identifiers and registration numbers that tie a trading name to a jurisdiction and a filing authority.
Check-digit failures in identifiers such as IBAN, LEI, IMO, VIN or machine-readable zones, exposing transcription errors or fabricated documents.
Code reassignments and retirements, where a country, airport or currency code now denotes something different from the archived record.
Gazetteer name variants, exonyms and spelling conventions that make one settlement appear as several distinct places.
Classification mappings between systems such as NACE and ISIC, which decide whether two datasets are comparable at all.
Administrative boundary changes and subdivision renaming that silently invalidate year-on-year comparison of regional statistics and case counts.
Hierarchy conflicts where one authority nests a subdivision or a subsidiary differently from another.
Identifier reuse, where a retired registration number is later issued to an entirely unrelated entity.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

ISO 3166 country and subdivision codes — Canonical country, territory and subdivision identifiers with newsletters recording changes over time
GLEIF LEI reference data — Open legal entity identifiers with registration authority, legal address and parent relationship records
UN/LOCODE — UN-maintained codes for ports, airports and inland locations used across trade and logistics data
IANA registries — Authoritative internet number, protocol and top-level domain registries with allocation records
GeoNames and NGA GNS — Open gazetteers with name variants, coordinates, feature classes and administrative hierarchy
Eurostat NUTS classification — Versioned European statistical regions, essential for correct comparison across revisions
ITU-T Operational Bulletin — Official numbering plan, country code and network code assignments and their amendments
Wikidata — Practical crosswalk between identifier systems, treated as a pointer to authorities rather than an authority

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Define entity types — List the things you must identify uniquely, such as companies, people, places, vessels or products, and the attributes that distinguish each.
Choose the authority — Name the single source of truth for each identifier type and record why, so later analysts do not silently substitute a convenient alternative.
Ingest with versions — Load reference sets with publication date and version, keeping prior versions so historic records can still be read correctly.
Validate identifiers — Apply format rules and check digits at ingest, quarantining failures instead of coercing them into the nearest valid value.
Build crosswalks — Map between classification systems explicitly, recording where the mapping is exact, approximate or genuinely impossible.
Resolve entities — Match deterministically on strong identifiers first, then apply scored probabilistic matching, holding merges to a higher bar than links.
Review on a cadence — Track reassignments, retirements and boundary changes on a schedule, and re-run affected analyses when an authority publishes a revision.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Risk Analysis

Operates on these data points

Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.
Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.

Related disciplines

Open Source Intelligence — Publicly Available Information, Systematically Collected
Risk Intelligence — Structured Assessment of Threat and Consequence

Inside the platform: where Reference Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=REFINT — Discipline hub
source-catalog.php?disc=REFINT — Source catalogue filtered to this discipline
search.php — Company / Organization profile
sanctions.php — Sanction / Watchlist Entry profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define entity types is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Ingest with versions turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Review on a cadence feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Reference Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence systems depend on shared reference data to interoperate at all. Analysts maintain authoritative code lists for countries, places, units of measure, coordinate reference systems, ports, airfields and equipment so that reporting from different formations and partner nations can be fused rather than silently duplicated. It underpins common operating picture accuracy, logistics and movement planning, and target folder integrity, and it feeds every geospatial product through consistent datum and gazetteer handling. Constraints include national variation in place-name authority, the political sensitivity of boundary and name choices in disputed areas, and the requirement to record which code list version a historic report was written against so archived reporting remains readable.

🕵 National intelligence

Reference intelligence is the quiet infrastructure of all-source fusion. Agencies maintain curated registers of countries, entities, identifiers and classification vocabularies so that reporting from separate collection streams resolves onto the same object. It matters most at the join: a company identified by registration number in one report and by transliterated name in another is either the same entity or two, and only the reference layer decides. Handling considerations include the classification of internally derived crosswalks, the need to record authority and version for every reference fact, and the discipline of never letting an analytic assumption become a reference value without a documented source.

👮 Law enforcement

Investigators rely on reference data to make records from different systems comparable and to avoid charging the wrong person because two records were merged on a name. It supports evidential accuracy in exhibits: correct jurisdiction codes, correct registration identifiers, correct place names as they stood on the date in question. Where identifiers relate to individuals, such as national identity or driver numbers, access is governed by the domestic regime and often requires specific authority. Chain of custody applies to reference snapshots too, because an exhibit stating a company's registered address must be readable against the register as it stood, not as it stands today.

🔍 Private investigation and corporate security

Corporate investigators and compliance teams use reference data to make screening and due diligence deterministic rather than approximate. Correct jurisdiction codes, entity identifiers, industry classifications and address standards decide whether a match is real. The private-sector constraint is licensing rather than legality: many code lists and gazetteers are free to consult but restricted for redistribution, and building a client-facing product on a restricted list is a contractual breach even though the data is visible. Private actors must also avoid assembling reference registers of private individuals' identifiers, which converts a benign infrastructure task into high-risk personal data processing.

📰 Journalism and OSINT media

Newsrooms use reference data to get names, places, jurisdictions and figures right, and to make datasets from different sources comparable before drawing a conclusion. The verification value is concrete: a company registration number cited in a filing settles an identity that a name never will, and an official gazetteer settles a place name that a map application may render differently. Publication ethics include naming places in a way that is accurate without adopting a contested political position without saying so, and disclosing when figures have been converted between classification systems, since crosswalks introduce error that readers should be able to see.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights organisations depend on common reference layers to coordinate: administrative boundary codes, place gazetteers, sector classifications and organisation identifiers make needs assessments, funding data and incident records comparable across agencies. Do-no-harm considerations arise where boundary or place-name choices carry political weight in a conflict, and where administrative codes reveal the location of small displaced populations. Documentation for accountability requires stable identifiers so incidents recorded years apart can be linked. Duty of care applies to partner data: reference registers should not become a covert list of local staff or community members by accumulation.

🎓 University and research

Researchers need reference data for reproducibility above all. A dataset merged on country name rather than ISO code, or on an industry label rather than a classification code, cannot be reliably reproduced, and historic analysis is wrong if current codes are applied to past periods. Good practice publishes the exact version of each code list used, the crosswalk applied, and the unmatched residual. Ethics review is rarely engaged by reference work itself unless personal identifiers are involved. Citation obligations are real: open registers such as GLEIF, GeoNames and OpenStreetMap carry attribution or share-alike conditions that follow into published derivatives.

Playbook: working Reference Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the reference domains

List the classes of fact your analysis depends on: geography, legal entities, transport nodes, currencies, commodities, industries, languages, time. For each, state what question the reference layer must answer and at what granularity. Do not build what you will not use. A good output is a short register naming each domain, the decision it supports and the required granularity, agreed with the analysts who will consume it. Stop when the register is complete enough that authority selection can begin, not when it is exhaustive.

Phase 2 — Select the authority

For each domain choose the source of truth and write down why. Prefer the body that issues the identifier over anyone who republishes it: ISO for country and currency codes, UN/LOCODE for locations in trade, IANA for internet number and protocol registries, GLEIF for legal entity identifiers, the national company registry for company facts. Record the fallback where the authority does not cover a case. A good output is an authority matrix with named owners. Stop when every domain has a primary authority and a documented exception rule.

Phase 3 — Ingest with versioning

Pull each list directly from its authority, record the publication date, the version identifier and a hash of the file, and keep every prior version. Do not overwrite. Reference data changes more than people expect: countries change names, subdivisions are created and merged, ports are recoded, classifications are revised. A good output is a store where any historic record can be interpreted against the list in force at the time it was created. Stop when point-in-time lookup works for every domain you ingested.

Phase 4 — Validate formats and check digits

Implement structural validation before anything reaches analysis. Verify check digits and format rules where they exist: LEI and IBAN checksums, VAT number formats per member state, machine-readable travel document check digits, IMO number checksum, coordinate ranges and datum. Reject or quarantine values that fail rather than storing them silently. A good output is a validation layer with an explicit quarantine queue and a rate of failures by source system. Stop when the failure rate is low enough that quarantine review is feasible daily.

Phase 5 — Normalise and canonicalise

Define one canonical representation per domain and convert on entry: uppercase alpha-2 or alpha-3 country codes, E.164 for telephone numbers, ISO 8601 with explicit timezone for dates and times, a defined address standard, a defined transliteration scheme per script. Keep the original raw value alongside the canonical form, always. A good output is a store where joins can be made on canonical fields with confidence and the source string is still recoverable. Stop when the canonical rules are documented well enough for a new engineer to apply them without asking.

Phase 6 — Build and test crosswalks

Where two classification systems must be compared, build an explicit mapping and characterise its quality: one-to-one, one-to-many, many-to-many or unmatched. Record the direction of the mapping and the loss it introduces, because industry and commodity crosswalks are rarely symmetrical. Publish the unmatched residual rather than hiding it. A good output is a documented crosswalk with coverage statistics and worked examples of the lossy cases. Stop when the residual is small enough, or well enough understood, that downstream analysis can state its effect.

Phase 7 — Handle disputed and changing geography

Establish a policy for disputed territories, contested names and boundary changes before the first product uses them. Decide which gazetteer and boundary set you use, how you present alternative names, and how you record the political sensitivity so it can be varied by audience. Keep historical boundaries available for historic analysis. A good output is a written naming and boundary policy approved by editorial or legal leadership. Stop when the policy covers the areas you actually work in and names its decision maker for exceptions.

Phase 8 — Attach provenance to every field

Every reference-derived value in an analytic record should carry its authority, version and the date it was applied. Derived fields such as region groupings or risk tiers should be labelled as derived, with the rule that produced them. Without this, a later reader cannot tell an asserted fact from an inferred one. A good output is a schema where provenance is a first-class column, not a comment. Stop when a random record can be traced to its authority without asking the person who built it.

Phase 9 — Manage licences

Record the licence for every dataset at ingestion and store it with the data: attribution requirements, share-alike obligations, redistribution limits and any prohibition on commercial use. Check whether obligations follow into derived products, which is the usual trap with share-alike geodata. Where a licence prohibits what your product needs, find an alternative source before the dependency is embedded. A good output is a licence register mapped to products. Stop when every downstream product can state, on demand, what it may lawfully redistribute.

Phase 10 — Keep personal data out

Reference layers should contain identifiers of things, places and organisations rather than people. Where an identifier necessarily relates to an individual, such as a national identity number or a director identifier, treat it as personal data with a lawful basis, minimisation and retention limits, and separate it from the general reference store. Do not build a convenience register of people because it is useful. A good output is a documented separation with access controls. Stop when the personal identifiers in scope are inventoried and controlled.

Phase 11 — Monitor for change

Subscribe to the change feeds of your authorities and review amendments on a defined cadence. Watch specifically for reassigned codes, which are the most dangerous class of change because old data becomes silently wrong rather than obviously broken. Test the effect of each change on existing joins before adopting it. A good output is a change log with an impact assessment per change. Stop when the change process is routine enough that adoption is a decision rather than a scramble.

Phase 12 — Audit the joins

Periodically sample the entity resolutions your reference layer enabled and check them by hand. Look for merges made on weak attributes, records that failed to join and were dropped, and duplicates that survived because of transliteration variants. Report match and unmatch rates by domain rather than in aggregate. A good output is an audit note with named defects and owners. Stop when the defect list is being worked down rather than growing, and re-run on the agreed cycle.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ISO 3166 country and subdivision codes	Open	Standard codes for countries, dependent territories and their principal subdivisions, with a documented change history.	Canonical country and subdivision keys for every join; the change history is what makes historic records interpretable.
UN M49 standard country and area codes	Open	United Nations Statistics Division numeric codes and standard regional and sub-regional groupings for statistical use.	Provides neutral regional aggregations for statistics and avoids inventing ad hoc groupings that cannot be compared.
UN/LOCODE	Open	United Nations code list for trade and transport locations covering ports, airports, rail terminals and inland points.	Standard location keys for logistics, shipping and trade analysis where port names alone are ambiguous or duplicated.
GLEIF Legal Entity Identifier data	Open	Global register of legal entity identifiers with legal name, address, registration authority and parent relationships.	Primary authority for cross-border legal entity identity and the anchor for corporate entity resolution.
GeoNames	Open	Open gazetteer of place names, alternate and historic names, feature classes, population and coordinates.	Resolves place-name variants across languages and scripts so textual location references can be matched consistently.
NGA GEOnet Names Server	Open	Official US gazetteer of foreign geographic feature names including approved and variant names and feature designations.	Authoritative reference for foreign place names, including transliteration variants used in official reporting.
OpenStreetMap	Open	Community-maintained global map data with detailed feature tagging, administrative relations and full edit history.	Fills gazetteer and infrastructure gaps at high detail; share-alike licence terms follow into derived products.
IANA protocol and number registries	Open	Authoritative registries for top-level domains, IP address allocations, autonomous system numbers, ports and media types.	Source of truth for internet identifier facts used in infrastructure attribution and technical entity resolution.
EPSG Geodetic Parameter Dataset	Open	Registry of coordinate reference systems, datums, projections and transformations with stable numeric identifiers.	Ensures coordinates are interpreted against the correct datum and projection rather than assumed to be WGS 84.
World Customs Organization Harmonized System	Licensed	International commodity classification nomenclature used for customs tariffs and trade statistics, revised periodically.	Standard commodity keys for trade analysis, with revision history needed to compare periods across HS versions.
ISIC and NACE industry classifications	Open	United Nations and European standard classifications of economic activities with published correspondence tables.	Comparable industry coding across jurisdictions and the crosswalks needed to reconcile national classification schemes.
ITU-T E.164 numbering plan resources	Open	International standard for public telephone numbering including country codes and national numbering plan notifications.	Validates and canonicalises telephone identifiers and identifies the country and range holder behind a number.
IMO ship identification number scheme via GISIS	Registration	Permanent seven-digit identifiers for ships and shipping companies, with official particulars and change history.	Stable vessel identity that survives changes of name, flag and owner, which names and call signs do not.
ICAO location and aircraft registries	Open	International standards and reference material for aerodrome location indicators, aircraft registration marks and operator codes.	Canonical aviation identifiers for airfields, operators and aircraft used in movement and logistics analysis.
Research Organization Registry and ORCID	Open	Persistent identifiers for research organisations and for individual researchers, with structured metadata and relationships.	Disambiguates institutions and authors in technical and academic literature analysis where names are highly ambiguous.
Humanitarian Data Exchange common operational datasets	Open	Standardised administrative boundaries and place codes for humanitarian response, maintained per country with version history.	Shared administrative coding so needs, incident and funding data from different agencies can be joined reliably.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Reference Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

OpenRefine — Interactive tool for clustering, standardising and reconciling messy values against external identifier services. Limitation: clustering algorithms merge on similarity, so every cluster needs human confirmation before it is accepted.
libpostal — Statistical address parser and normaliser handling many international address formats. Limitation: accuracy degrades sharply in countries with informal or non-standard addressing and for addresses containing building-level detail.
PROJ and GDAL — Libraries for coordinate transformation and geospatial format conversion between reference systems. Limitation: a correct transformation still produces wrong results if the source datum was recorded incorrectly upstream.
Checksum validators for structured identifiers — Validate LEI, IBAN, IMO, VAT and travel document check digits at ingestion. Limitation: a valid checksum proves the value is well formed, not that the entity or document exists.
Wikidata and its query service — Cross-references identifiers across hundreds of external authorities for places, organisations and people. Limitation: community maintained and unevenly sourced, so it is a crosswalk aid rather than an authority.
Data versioning and snapshot storage — Retains every ingested version of a code list so point-in-time lookup is possible. Limitation: storage discipline must be established before the first ingest, since history cannot be reconstructed later.
Record linkage libraries — Provide deterministic and probabilistic matching with configurable comparison functions and blocking. Limitation: threshold choice silently trades false merges against missed links and must be evaluated on labelled data.
Schema and constraint validation frameworks — Enforce field formats, controlled vocabularies and referential integrity at load time. Limitation: they catch structural error only, and will happily accept a well-formed but wrong authority value.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Reassignment is the dangerous change, not deletion. When a code is retired and later reused for a different thing, historic records become quietly wrong rather than visibly broken, which is why point-in-time lookup matters more than currency.
Choose the authority that issues the identifier, not the aggregator that is easiest to query. Aggregators lag, transcribe imperfectly and occasionally invent reconciliations; the issuing register is the only thing you can defend in a dispute.
Always keep the raw value beside the canonical one. Canonicalisation is a lossy transformation, and the day you need to explain why two records were joined, the original string is the evidence.
Crosswalks are directional and lossy. A mapping from a detailed classification to a coarse one is not reversible, and reporting a figure converted in the wrong direction produces a number nobody can reproduce.
Place naming is a political act in contested areas. Decide the policy centrally, record it, and present alternative names deliberately rather than inheriting whatever your basemap provider chose.
Treat licence terms as part of the data. Share-alike obligations on geodata follow into derived products, and the point at which you discover this should not be the point at which a client asks to redistribute.
Resist the convenience register of people. Reference infrastructure that starts holding national identity numbers or director identifiers stops being low-risk plumbing and becomes high-risk personal data processing overnight.
Unmatched residuals carry information. The records that fail to join are usually the interesting ones, so publish the unmatch rate and inspect a sample rather than dropping them from the denominator.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Reference Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of analytic records whose reference-derived fields carry authority, version and application date, rather than a bare value with no provenance.
Point-in-time lookup coverage: share of ingested domains for which any historic date can be resolved to the code list version then in force.
Identifier validation failure rate by upstream source system, trended over time, used to target data quality work at the systems actually causing error.
Match and unmatch rates per domain on periodic join audits, with a sampled manual review confirming that merges were correct rather than merely numerous.
Number of downstream products able to state their redistribution rights on demand from the licence register, as a share of products in service.
Time from publication of a change by an authority to assessed adoption or documented rejection, measured per domain.
Count of duplicate entities detected and resolved per audit cycle, trending downward, as evidence that canonicalisation rules are working rather than merely applied.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Using a community-edited encyclopedia as an authority rather than as a pointer to the authoritative register.
Matching entities on names alone, which fails hardest exactly where record volumes are highest.
Ignoring temporal validity and applying today's code list to a record created under a previous revision.
Assuming standard codes are permanent. Reassignment silently corrupts historic joins without raising any error.
Coercing mismatched classification systems into one another, producing comparisons the underlying definitions do not support.
Over-merging entities. A false merge is far harder to detect and unwind than a missed link.

Legal and ethical considerations

Reference work is mostly a licensing discipline. Many code lists are free to consult but restricted for redistribution, and open datasets such as OpenStreetMap, GeoNames and GLEIF carry attribution or share-alike conditions that follow into your derived products. Track the licence for every dataset you ingest and store it alongside the data. Keep personal data out of the reference layer where possible, and where identifiers relate to individuals, such as national identity numbers, treat them as personal data with lawful basis, minimisation and retention limits.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Reference Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 data points, 1 mission domains, 2 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Why not just join on country name?

Because names are unstable and non-unique. Countries change names, are rendered differently across languages and datasets, and carry variants with and without articles, abbreviations and political qualifiers. A join on name silently drops records that should match and merges some that should not, and the loss is invisible unless you count the residual. ISO 3166 alpha-2 or alpha-3 codes with a recorded version give a stable key and a documented change history, so a record from ten years ago can be interpreted correctly. Keep the original name string alongside the code so you can still show what the source actually said.

Which gazetteer should be authoritative for place names?

It depends on purpose. For official reporting where consistency with government usage matters, the national gazetteer of the country concerned, or the NGA GEOnet Names Server for foreign names in a US or NATO context. For multilingual matching of text references, GeoNames gives the widest alternate-name coverage. For feature-level detail such as buildings and minor roads, OpenStreetMap is usually the only source with the density needed, subject to its share-alike terms. The important part is choosing one as primary, recording the choice, and handling disputed names under a written policy rather than case by case.

How should historic data be handled when classifications are revised?

Analyse each period against the classification in force at the time, then convert deliberately using a published correspondence table, and report the conversion. Applying today's codes to old data produces figures that cannot be reproduced from the source and that quietly disagree with official statistics. Where a correspondence is many-to-many, state the allocation rule you used and show the sensitivity of the result to it. Retain both the original and the converted values. If the conversion materially affects the conclusion, present both series rather than choosing one and hoping the reader does not check.

Is a valid check digit enough to accept an identifier?

No. A checksum confirms the value is structurally well formed and has probably not been mistyped. It says nothing about whether the entity exists, whether the identifier is currently active, or whether it belongs to the party claiming it. Validation should be a gate before lookup, not a substitute for it. For company identifiers, confirm against the issuing register and capture the registration status and date. For document numbers, structural validity is a weak signal that is trivially satisfied by a fabricated but well-constructed value, which is exactly what a competent forger produces.

What licensing traps catch reference layers most often?

Share-alike geodata is the classic one. Building a client deliverable on OpenStreetMap derivatives can bring attribution and licensing obligations into a product that was assumed to be proprietary. Beyond that: commodity and industry nomenclatures that are free to consult but licensed for redistribution; commercial gazetteers embedded in a mapping product whose terms prohibit extraction; and national register data that permits individual searches but forbids bulk retention. Record the licence at ingestion, map datasets to the products that depend on them, and check obligations before a dependency is designed in rather than after a client asks.

How do you keep a reference layer from becoming a personal data store?

By deciding at the outset that it holds facts about places, organisations and things, and enforcing that with schema controls and review. Where an identifier necessarily concerns an individual, hold it in a separate, access-controlled store with a documented lawful basis, purpose limitation and retention period, and link to it rather than merging it in. The pressure to add convenience fields is constant because they make joins easier. Resist it, or the low-risk infrastructure becomes a high-risk processing operation with subject access, accuracy and deletion obligations attached to every downstream copy.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 3166, defining codes for the representation of names of countries, territories and their subdivisions, including a published change and reassignment history.
ISO 8601, governing date and time representation and the explicit expression of timezone offsets, which is the precondition for correlating events across sources.
ISO 4217 currency codes and ISO 17442 legal entity identifiers, providing stable keys for monetary and corporate identity respectively.
UN/LOCODE, the United Nations code for trade and transport locations, governing standard identifiers for ports, airports and inland transport nodes.
ITU-T Recommendation E.164, defining the international public telecommunication numbering plan and the structure that makes telephone identifiers parseable.
OGC and EPSG geodetic standards, governing coordinate reference systems, datums and transformations so spatial data from different sources aligns correctly.
GDPR principles of purpose limitation and data minimisation, which determine whether an identifier relating to an individual may be held in a shared reference layer at all.
FAIR data principles, governing findability, accessibility, interoperability and reuse, including the requirement for persistent identifiers and machine-readable provenance.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

ISO standards catalogue including ISO 3166 and ISO 4217 — International Organization for Standardization. Authoritative catalogue of international standards for codes and identifiers
UN/LOCODE code list for trade and transport locations — UN Economic Commission for Europe. Standard location codes for ports, airports and inland transport nodes
Global LEI Index — Global Legal Entity Identifier Foundation. Open register of legal entity identifiers and parent relationships
IANA protocol and number registries — Internet Assigned Numbers Authority. Authoritative registries for internet identifiers and protocol parameters
GeoNames geographical database — GeoNames. Open gazetteer with alternate and historic place names worldwide
GEOnet Names Server — US National Geospatial-Intelligence Agency. Official gazetteer of foreign geographic names and variants
EPSG Geodetic Parameter Dataset — International Association of Oil and Gas Producers. Registry of coordinate reference systems and transformations
Standard country or area codes for statistical use (M49) — United Nations Statistics Division. Numeric country codes and standard regional groupings for statistics
Harmonized System nomenclature — World Customs Organization. International commodity classification underpinning customs and trade statistics
Research Organization Registry — ROR Community. Persistent open identifiers for research organisations

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: versioned reference data, identifier validation and maintained crosswalks underpinning every entity you resolve. Explore the platform, or browse the rest of the library by following any tag above.