Logistics Intelligence (LOGINT): Intelligence Discipline Guide

Goods leave a paper trail long before they leave the warehouse. Customs declarations, manifests and trade statistics describe physical movement that no press release will ever confirm.

What Logistics Intelligence is as a discipline

Logistics intelligence is the analysis of the physical movement of goods across modes, borders and intermediaries. It works with the documentary layer of trade: bills of lading and manifests, customs declarations, harmonised system commodity codes, trade statistics, freight forwarder and consolidator records, warehousing and bonded storage, and the routing decisions that connect them. The discipline reconstructs how a specific consignment travelled from producer to end user, and what that route says about cost, urgency, concealment and the intermediaries who made it possible.

Sub-methods include manifest and bill of lading analysis, commodity code and valuation anomaly detection, trade flow and mirror statistics analysis, transshipment and route reconstruction, and freight intermediary network mapping. Within the intelligence cycle it acts as the physical corroboration layer for financial and corporate intelligence: a payment can be fictitious, but a container occupies space on a specific vessel on a specific date.

Why it matters

Only logistics intelligence establishes that goods actually moved, in what quantity, under what description and through whose hands. It answers whether a declared commodity matches the declared value and route, where a supply chain physically transits and therefore where it is vulnerable, which intermediaries repeatedly appear across suspicious consignments, and whether trade statistics reported by two partner countries agree. Mirror statistics discrepancies are frequently the first quantitative indicator of smuggling, misinvoicing or sanctions circumvention.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Bill of lading records naming shipper, consignee, notify party, commodity description, container numbers and vessel and voyage
Harmonised System code selection, including codes chosen to attract lower duty or avoid licensing scrutiny
Declared unit values that diverge sharply from market prices, indicating over or under-invoicing and value transfer
Routing through transshipment hubs that add cost and time without commercial logic, a classic origin-obscuring pattern
Mirror statistics gaps where an exporter and importer report materially different volumes for the same trade flow
Repeated freight forwarders, consolidators and customs brokers appearing across otherwise unconnected consignments
Container dwell times, bonded warehouse use and free trade zone transits that break the documentary chain of origin
Sudden route changes following sanctions designations or export control listings affecting a commodity or destination

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

UN Comtrade — Free bilateral trade statistics by commodity code and partner, the basis for mirror statistics and flow analysis
US Census USA Trade Online and Schedule B — Detailed US import and export statistics by commodity, district and partner country, free with registration
Eurostat Comext — Free detailed EU external trade data by product, member state and partner for flow and anomaly analysis
WCO Harmonised System nomenclature — Authoritative commodity classification structure needed to interpret and compare any customs declaration
BIS Consolidated Screening List and export control lists — Restricted parties and controlled commodities, essential for judging whether a shipment required a licence
Port authority statistics and terminal schedules — Publicly published throughput, vessel calls and berth schedules that time-anchor cargo movements
AIS-derived port call data — Vessel arrivals and departures giving independent physical confirmation of the maritime leg of a consignment
IATA and national air cargo statistics — Published air freight volumes and route capacity for assessing the aviation leg and its plausibility

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Define the consignment question — Establish whether you are tracing a specific shipment, a commodity flow or an intermediary network, since each needs different data granularity.
Fix the commodity codes — Identify every plausible HS code for the goods, including adjacent and deliberately misapplied codes, before pulling any statistics.
Pull both sides of the flow — Retrieve exporter-reported and importer-reported figures for the same flow and period, then quantify the discrepancy.
Reconstruct the route — Assemble the physical legs from manifests, port calls and air cargo data, identifying every transshipment and custody change.
Map the intermediaries — Extract forwarders, brokers, consignees and notify parties, then resolve them in corporate registries and screening lists.
Test the commercial logic — Assess whether route, timing, valuation and packaging make commercial sense; illogical logistics is the strongest single indicator of concealment.
Corroborate physically — Confirm the maritime and air legs with independent movement data before concluding that the documentary record reflects reality.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.
Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
Shipping Container — An ISO container identifier — trackable across ports, vessels, and customs events.
Person / Name — A named individual — the subject of identity resolution and profiling.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
Aircraft — An aircraft identified by tail number, ICAO hex, or registration.

Related disciplines

Aviation Intelligence — Aircraft, Flights, and the Aviation Domain
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Supply Chain Intelligence — Supplier Networks, Dependencies, and Integrity
Vehicle Intelligence — Vehicles, Registration, and Movement

Inside the platform: where Logistics Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=LOGINT — Discipline hub
source-catalog.php?disc=LOGINT — Source catalogue filtered to this discipline
search.php — Company / Organization profile
domain.php?d=mar — Vessel / Ship profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Score Country Risk
Sync Intel Domains
Resolve Everything
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the consignment question is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Pull both sides of the flow turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Corroborate physically feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Logistics Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Logistics intelligence supports assessment of an adversary's sustainment: what is moving, in what quantity, through which nodes, and where the flow is vulnerable. Analysts read trade statistics, manifest data and routing to identify dependency on specific ports, corridors and intermediaries, and to detect surges that precede operations. Products feed sustainment estimates, infrastructure assessments and interdiction planning in the sense of understanding chokepoints. Constraints include the coarse granularity of trade statistics, licensing limits on commercial manifest data, and the requirement to keep host nation and coalition commercial partners' confidential data properly protected.

🕵 National intelligence

For national intelligence this is a physical corroboration discipline. Financial records can be fabricated and corporate structures can be hollow, but a container occupies a specific slot on a specific vessel on a specific date. Requirements typically concern sanctions circumvention, proliferation procurement and illicit finance, where mirror statistics discrepancies and routing anomalies provide quantitative leads. Findings feed designations and demarches, and because much of the data is open or commercially licensed rather than classified, conclusions can be shared with partners, industry and multilateral bodies with far fewer handling constraints than most disciplines.

👮 Law enforcement

Law enforcement uses logistics intelligence in customs fraud, smuggling, counterfeiting, trade-based money laundering and export control cases. Bills of lading, entry summaries and manifest data identify consignors, consignees, notify parties and forwarders, which builds the network around a seizure. Evidentially, commercial manifest aggregators are leads, not proof: the authoritative record is the customs declaration and the carrier's own documents, obtained through customs cooperation, a production order or mutual legal assistance. Valuation and classification analysis needs a customs expert, since misdeclaration cases turn on tariff interpretation as much as on facts.

🔍 Private investigation and corporate security

Corporate teams use trade data for competitor supply chain mapping, counterparty verification, counterfeit source identification and sanctions compliance diligence. Manifest data reveals which suppliers a competitor actually uses and at what volume, which is legitimate competitive intelligence in most jurisdictions. Constraints are contractual and jurisdictional: many manifest datasets are licensed with redistribution limits, some countries treat customs declarations as confidential business information, and obtaining them outside published channels may be unlawful. Findings that indicate diversion or sanctions breach generally carry a reporting obligation rather than a commercial option.

📰 Journalism and OSINT media

Journalists use trade data to trace goods from a factory to a shelf, to document arms and dual-use shipments, and to expose forced labour in supply chains. Verification standards require reading manifest fields correctly, understanding that a consignee may be a freight forwarder rather than the buyer, and corroborating a documentary record with vessel movement and, where possible, imagery. Give named companies a right of reply and be precise about what a manifest proves. Protect sources inside customs and freight companies carefully, since disclosure of commercial trade data is often a criminal offence for the discloser.

🌍 NGO, humanitarian and human rights

Human rights and environmental organisations use trade data to document timber, mineral, fishing and forced labour supply chains, and to support import bans and due diligence litigation. Documentation should preserve the original records with retrieval dates, because trade datasets are revised and access is frequently withdrawn. Do no harm applies to naming small suppliers and workers, who bear the consequences of exposure while the buying brand negotiates. Duty of care extends to field researchers at ports and factories, and findings should be shared with affected workers' organisations rather than only with regulators and media.

🎓 University and research

Researchers use trade statistics for economics, development, sanctions effectiveness and illicit flows research. Methodological care centres on mirror statistics: bilateral discrepancies arise from valuation basis, transshipment attribution, timing and confidentiality suppression as well as from misinvoicing, so discrepancy alone is not evidence of fraud. Harmonised system revisions break time series and require concordance. Ethics review rarely applies to aggregate statistics but does where firm-level or personal data appears. Reproducibility requires publishing the classification version, the reporting country set, the extraction date and the treatment of missing and confidential values.

Playbook: working Logistics Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the consignment question

Establish whether you are tracing a specific shipment, quantifying a commodity flow, or mapping an intermediary network. These need different data granularity and different budgets, and starting the wrong one wastes weeks. A good output is a written question naming the commodity, the parties or corridor, the period and the decision it supports. Stop when you can state whether the answer requires shipment-level records, which are usually licensed, or aggregate statistics, which are usually free.

Phase 2 — Fix the commodity codes

Identify every plausible harmonised system code for the goods, including adjacent codes, codes used in prior misdeclaration cases, and the national extensions beyond the six-digit international level. Codes change between HS revisions, so establish which version applies to your period. A good output is a code set with the HS version and the rationale for each inclusion. Stop when a customs specialist agrees the set covers how the goods would plausibly be declared, honestly or otherwise.

Phase 3 — Pull both sides of the flow

Retrieve exporter-reported and importer-reported figures for the same flow, period and code, then quantify the discrepancy in both value and quantity. Adjust for the standard causes: free on board versus cost including insurance and freight valuation, transshipment attributed to the intermediate country, timing across year ends, and confidentiality suppression. A good output is a reconciled comparison with each adjustment stated. Stop before calling a residual discrepancy misinvoicing without excluding these mundane explanations.

Phase 4 — Establish the baseline trade pattern

Characterise the normal flow for this commodity and corridor over several years, including seasonality, typical unit values and the usual partner countries. Anomalies exist only against this. A good output is a baseline with unit value ranges and the historical partner mix. Stop when the baseline is long enough to contain at least one full seasonal cycle and any known disruption such as a sanctions action or a pandemic period, which must be handled explicitly rather than averaged away.

Phase 5 — Detect valuation and quantity anomalies

Compare declared unit values against the baseline and against world market prices, flagging both under and over invoicing, and check whether quantity units are consistent. Extreme unit values are the classic signal of trade-based value transfer. A good output is an anomaly list with the deviation and the plausible legitimate explanations tested. Stop before treating a single outlier as evidence, since data entry errors and unit mismatches produce spectacular false positives.

Phase 6 — Retrieve shipment-level records

Where the question needs it, pull bills of lading and manifest records with consignor, consignee, notify party, forwarder, commodity description, weight, container numbers and vessel details. Note which countries publish these and which do not, because coverage is highly uneven. A good output is a shipment table with every field preserved as recorded. Stop and document the limitation where the corridor of interest has no public manifest data, which is true for much of the world.

Phase 7 — Reconstruct the physical route

Assemble the legs from origin to destination: inland haulage, port of loading, transshipment hubs, port of discharge and final delivery, with dates and carriers. Transshipment points are where documentary identity is most often changed. A good output is a leg-by-leg route with the evidence for each. Stop when every custody change is either documented or explicitly identified as an assumed leg.

Phase 8 — Map the intermediary network

Extract forwarders, brokers, consolidators, consignees and notify parties, then resolve them in corporate registries and screening lists. Intermediaries recur across unrelated suspicious consignments far more reliably than shippers do, which makes them the highest-value analytic object. A good output is an intermediary network with registry identifiers and repeat appearance counts. Stop when the recurring intermediaries are identified and screened across the whole set rather than shipment by shipment.

Phase 9 — Test the commercial logic

Assess whether the route, timing, packaging, valuation and choice of intermediary make commercial sense. Illogical logistics, such as expensive routing for a cheap commodity, transshipment that adds cost for no benefit, or a forwarder with no presence in the trade lane, is the strongest single indicator of concealment. A good output states the specific illogicality and its cost. Stop before concluding concealment where an industry-specific explanation exists, and ask a practitioner if you do not know.

Phase 10 — Corroborate with physical movement data

Confirm the maritime and air legs independently: vessel port calls and AIS history, aircraft movement records, port authority statistics and terminal schedules. Documents describe intent; movement data describes what happened. A good output pairs each documented leg with independent movement evidence or flags it as uncorroborated. Stop when the legs that carry the conclusion are corroborated, since corroborating every leg is rarely affordable.

Phase 11 — Screen for controls and obligations

Check the commodity against export control lists and the parties against sanctions, denied party and entity lists in every relevant jurisdiction. Where the goods are controlled or the parties designated, identify the licensing authority and the reporting obligation that follows. A good output is a screening record with list versions, dates and the compliance conclusion. Stop and escalate to counsel and the licensing authority rather than continuing to investigate independently once a probable breach is identified.

Phase 12 — Report with data caveats and referral

Deliver findings with the data sources, coverage limits, code set, revisions applied and the distinction between statistical inference and documented shipments. Include the referral made or recommended where diversion or breach is indicated. A good output allows a regulator to act without re-doing the analysis. Stop before presenting a mirror statistics discrepancy as a quantified crime figure, which is the discipline's most persistent overreach.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
UN Comtrade	Registration	Official bilateral merchandise trade statistics by reporter, partner, commodity code, value and quantity across decades	Mirror statistics analysis and long baselines for any commodity and corridor, free at moderate volumes
US Census Bureau foreign trade data	Open	US import and export statistics by Schedule B and HTS code, district, partner and mode with monthly updates	Detailed US-side figures including port of entry, which localises a flow to a specific gateway
Eurostat Comext and EU trade statistics	Open	Detailed EU external and intra-EU trade by combined nomenclature code, partner, member state and transport mode	EU-side quantities and values with confidentiality flags shown, essential for mirror comparisons
World Customs Organization harmonised system	Open	The international commodity nomenclature with explanatory notes, classification opinions and revision concordances	Authoritative definition of what a code covers and how revisions break comparability across years
World Bank WITS	Registration	Integrated trade solution combining Comtrade, tariff and non-tariff measure data with analytical tools	Quick cross-source comparison and tariff context that explains some valuation behaviour
ITC Trade Map	Registration	Trade statistics and market analysis by product and country with mirror data and unit value indicators	Fast identification of unit value anomalies against regional and world benchmarks
Observatory of Economic Complexity	Open	Visualised bilateral trade flows built on official statistics with product and country profiles	Rapid orientation on a commodity's global flow structure before detailed work
US Bureau of Industry and Security control lists and screening	Open	Commerce Control List, entity list, denied persons and consolidated screening resources with search interface	Determines whether a commodity is controlled and whether any party is restricted before reporting
Consolidated Screening List	Open	Combined US government restricted party lists across Commerce, State and Treasury with an API	Single screening pass across US restriction regimes for every party in a consignment
EU dual-use control list and sanctions map	Open	EU controlled item annexes and consolidated restrictive measures by regime, sector and designated party	European control determination and the applicable prohibition for a given corridor
Port authority statistics and terminal schedules	Open	Throughput, vessel call schedules, berth allocation and cargo statistics published by individual port authorities	Independent confirmation that a vessel called and rough validation of volumes moving through a node
AIS-derived port call data	Licensed	Vessel arrival and departure events derived from position broadcasts with berth-level attribution	Corroborates the maritime leg of a documented route and exposes undeclared intermediate calls
IATA and national air cargo statistics	Open	Air freight volume, yield and route statistics with monthly reporting by region and trade lane	Baselines for air freight flows where sea data does not apply, particularly for high-value goods
Panjiva, ImportGenius or similar manifest aggregators	Licensed	Shipment-level bills of lading with shipper, consignee, commodity description, weight and container details	Names the actual counterparties behind a flow, subject to redistribution limits and uneven country coverage
OpenSanctions	Open	Consolidated global sanctions, restricted party and politically exposed person data with entity reconciliation	Screening consignees, forwarders and notify parties across regimes in one pass
Global Trade Alert	Open	Database of state interventions affecting trade including export restrictions, subsidies and procurement measures	Explains policy-driven flow changes that would otherwise be misread as evasion or disruption

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Logistics Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Comtrade API with Python — Automates bilateral flow retrieval and mirror comparison; rate limited, and requires explicit handling of missing and suppressed values.
pandas and Jupyter workflows — Reproducible reconciliation, unit value calculation and anomaly detection; the analyst must encode valuation basis adjustments correctly.
HS concordance tables — Map codes across harmonised system revisions to preserve time series; many-to-many mappings mean some series cannot be made continuous.
OpenRefine — Cleans and clusters consignee and forwarder names from manifest data; essential given the state of free-text fields, and needs manual adjudication.
Neo4j or Gephi — Maps intermediary networks across many shipments to expose recurring forwarders and consignees; requires disciplined entity resolution first.
Screening APIs against consolidated lists — Automates restricted party checks across a shipment set; fuzzy matching produces false positives that require human review.
AIS analysis platforms — Corroborates the maritime leg and detects undeclared port calls; commercial licensing restricts redistribution of derived products.
QGIS — Maps corridors, transshipment hubs and port catchments for route analysis; useful for briefing, limited by the granularity of the underlying data.
Document extraction tooling for scanned customs paperwork — Pulls fields from bills of lading and entry documents; OCR errors on container and code fields must be validated against check digits.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
Sync Intel Domains — Refreshes the reference and country-level intelligence datasets from their authorities.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Mirror discrepancies have many innocent causes. Valuation basis, transshipment attribution, timing across reporting periods and confidentiality suppression all create gaps. Exclude those before you speak about misinvoicing, or your headline number will not survive an economist reading it.
The consignee is often not the buyer. Freight forwarders, consolidators and customs brokers appear in that field constantly. Treating a forwarder as the purchaser is the fastest way to publish a wrong conclusion about who bought what.
Illogical logistics is the strongest concealment indicator. Routing that adds cost without benefit, transshipment through a hub with no relevant infrastructure, or a forwarder with no presence in the lane, each signal that the route serves documentary rather than physical purposes.
Unit value is the sharpest quantitative tool you have. Compare declared value per unit against the baseline and world prices in both directions, because over-invoicing moves value out just as effectively as under-invoicing moves it in.
Codes change and so do time series. Harmonised system revisions split and merge categories, so a step change in a flow may be a nomenclature artefact. Always check the revision boundary before interpreting a break in the series.
Intermediaries recur; shippers rotate. Front companies are cheap to replace, but the forwarder, broker or carrier that actually knows how to move the goods is not, which is why intermediary networks are the durable analytic object in this discipline.
Documents state intent, movement data states fact. A manifest describes what someone declared. Vessel port calls, aircraft movements and terminal records describe what physically happened, and the gap between the two is frequently the finding.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Logistics Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of flagged anomalies that survive exclusion of mundane explanations such as valuation basis, timing and code revision.
Share of documented consignment legs corroborated with independent movement data rather than accepted from documents alone.
Entity resolution rate for consignees, forwarders and notify parties matched to a registry identifier.
Time from a shipment record becoming available to detection of a screening hit against restricted parties.
Number of referrals to customs, licensing or sanctions authorities that were accepted and acted upon rather than filed without action.
Coverage transparency, measured by the share of products that state which corridors had no shipment-level data available.
Accuracy of route reconstructions checked against later seizure or enforcement findings where these become available.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Assuming manifest descriptions are accurate; commodity descriptions are frequently vague, generic or deliberately misleading
Comparing trade statistics without accounting for valuation basis, since exports are typically FOB and imports CIF
Ignoring timing offsets, where a shipment is recorded by the exporter and importer in different months or years
Treating a freight forwarder as a party to wrongdoing when forwarders legitimately handle thousands of unrelated consignments
Overlooking free trade zone and bonded transits, which legally break origin documentation and hide the true consignor
Relying on a single commercial trade data aggregator whose coverage of a given country may be partial or licensed from resellers

Legal and ethical considerations

Trade statistics and many manifest datasets are public, but detailed commercial shipment data is frequently licensed and subject to redistribution limits. Some jurisdictions treat customs declarations as confidential business information, and obtaining them outside published channels may be unlawful. Screening against export control and sanctions lists is a legal obligation for many organisations, and findings suggesting diversion should be reported to the relevant licensing authority. Personal data appearing in shipping records, such as individual consignees, remains protected under data protection law.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Logistics Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Does a mirror statistics gap prove misinvoicing?

No. Bilateral discrepancies are normal and arise from several structural causes: exports are usually reported free on board while imports are reported including insurance and freight, goods transshipped through a third country are often attributed to that country by one side and not the other, shipments crossing a reporting period boundary appear in different years, and confidentiality rules suppress some flows entirely. Re-exports and processing trade add more. Only after adjusting for these should a residual be discussed, and even then it is an indicator warranting investigation rather than a quantified crime figure.

Where can I get shipment-level manifest data?

Coverage is uneven and mostly commercial. The United States publishes vessel manifest data that aggregators resell with search and analytics, and a handful of other countries publish comparable records. Most of the world does not, and in several jurisdictions customs declarations are confidential business information whose disclosure is a criminal offence for the discloser. For unavailable corridors, work indirectly through aggregate statistics, port call data, corporate disclosures, litigation records and procurement filings, and state the data gap explicitly rather than letting silence read as absence of trade.

How do I identify the real buyer behind a shipment?

Read all the party fields, not just consignee. The notify party is frequently the actual purchaser or its agent, and the consignee may be a forwarder or a bonded warehouse. Then resolve every named entity in corporate registries, look for repeated pairings across shipments, and check whether the delivery address corresponds to a real facility. Corroborate with the buyer's own disclosures, customs entry summaries where available, and inland transport records. Where the structure defeats you, report the chain as far as it is documented rather than guessing at the end point.

What are the strongest indicators of trade-based value transfer?

Unit values far from market norms in either direction, invoices for goods whose declared quantity is physically inconsistent with the container or vessel capacity, repeated shipments between related parties at implausible prices, payment routing that does not match the goods routing, and use of intermediaries with no logistical function. Multiple weak indicators appearing together carry far more weight than any single extreme value, because data errors produce spectacular single outliers routinely. Always check the unit of quantity, which is a frequent source of apparent hundred-fold discrepancies.

How do I handle harmonised system revisions in a time series?

Identify which HS version applied in each year of your series, obtain the official concordance tables from the World Customs Organization, and map codes forward or backward consistently. Where a mapping is many-to-many, either aggregate to a level where the mapping is clean or report the series in segments with the break marked. Never silently join series across a revision boundary, because splits and merges of categories produce apparent surges and collapses that have nothing to do with actual trade and that a reviewer will spot immediately.

When does a finding trigger a reporting obligation?

Sooner than most commercial teams expect. If your analysis indicates that controlled goods may have been exported without a licence, or that a designated party is involved, most regimes impose obligations on the parties concerned and expect voluntary self-disclosure, which materially reduces penalties. If your organisation is in the transaction chain, stop the transaction and involve counsel immediately. If you are a third party analyst, the right step is a referral to the licensing authority or law enforcement with your documentation, not continued independent investigation that may alert the subject.

Can I rely on commercial manifest aggregators for evidence?

As leads, yes; as proof, no. Aggregators transcribe and normalise carrier-filed data, introducing errors, and their coverage and retention vary. For evidential purposes the authoritative records are the customs declaration, the carrier's bill of lading and the terminal records, obtained through customs cooperation channels, a production order or mutual legal assistance. Preserve the aggregator record with its retrieval date as the lead, then obtain the primary document. Also check the licence terms, since most aggregator agreements restrict redistribution of records in client deliverables.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

Harmonized Commodity Description and Coding System maintained by the World Customs Organization, which defines the international commodity nomenclature and its revisions.
WCO SAFE Framework of Standards, which sets advance cargo information, risk management and authorised economic operator expectations.
Revised Kyoto Convention on the simplification and harmonisation of customs procedures, which frames declaration, valuation and control practice.
WTO Customs Valuation Agreement, which governs how declared value is determined and therefore what constitutes misdeclaration.
UN Comtrade and IMTS 2010 international merchandise trade statistics concepts and definitions, which explain valuation basis and partner attribution rules.
Export control regimes including the EU dual-use regulation, US Export Administration Regulations and Wassenaar lists, which determine controlled commodity status.
FATF guidance on trade-based money laundering, which sets the recognised typologies and red flag indicators used by regulated institutions.
UN Security Council sanctions resolutions and national implementing measures, which impose prohibitions and reporting duties on specific commodities and corridors.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

UN Comtrade database — United Nations Statistics Division. Official bilateral merchandise trade statistics used for mirror analysis and long baselines
Harmonized System nomenclature and explanatory notes — World Customs Organization. The international commodity classification with revision concordances and classification opinions
Foreign trade statistics and Schedule B — US Census Bureau. Detailed US import and export data by commodity code, partner and port
Comext detailed trade statistics — Eurostat. EU external and intra-EU trade data by combined nomenclature code and member state
World Integrated Trade Solution — World Bank. Integrated access to trade, tariff and non-tariff data with analytical tooling
Commerce Control List and entity list resources — US Bureau of Industry and Security. US export control classifications and restricted party listings
Consolidated Screening List — US International Trade Administration. Combined US restricted party lists with search and API access
Trade-based money laundering typologies — Financial Action Task Force. Recognised typologies and red flags for value transfer through trade transactions
Trade Map market analysis tools — International Trade Centre. Trade statistics with mirror data and unit value benchmarking by product and market
Global Trade Alert database — Global Trade Alert. Record of state interventions affecting trade flows, used to explain policy-driven changes

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: links manifests, trade statistics and port calls into a single traceable route per consignment or commodity flow. Explore the platform, or browse the rest of the library by following any tag above.