Weapons Intelligence (WEAPINT): Intelligence Discipline Guide

Every weapon carries a serial number and a paper trail from a factory to a legal export licence. Trafficking investigation is the work of finding where that trail was broken.

What Weapons Intelligence is as a discipline

Weapons intelligence covers weapons systems, their capability, their lawful transfer and their diversion into illicit hands. It has two complementary halves. Capability analysis assesses what a fielded system can do, drawing on published specifications, export documentation, exercise and procurement records and technical exploitation of recovered materiel. Trafficking analysis reconstructs how weapons moved from lawful production and transfer into illicit circulation, using serial number tracing, transfer registers, end-user certification records, seizure data and the documentary trail of brokers and transport intermediaries.

Sub-methods include weapons technical intelligence on recovered materiel, serial number and lot tracing to point of legal transfer, arms transfer register analysis, end-use and end-user certificate verification, broker and shipping network mapping, and ammunition headstamp analysis. In the cycle it supports both strategic capability assessment and investigative disruption of diversion networks, and it feeds directly into sanctions and embargo monitoring.

Why it matters

Only weapons intelligence establishes where a specific recovered weapon entered illicit circulation and which lawful transfer preceded that diversion. It answers whether an arsenal is genuinely indigenous or assembled from imported components, which transfer channels recur across unrelated seizures, whether ammunition recovered in one conflict was manufactured for another, and which brokers and carriers appear repeatedly. On the capability side it answers what a system realistically achieves once logistics and training constraints are applied.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Serial numbers, factory marks and proof marks tying a recovered weapon to a producer, production lot and year
• Ammunition headstamp codes identifying manufacturer, calibre and production year, often the strongest available tracing evidence
• Arms transfer register entries recording state-to-state deliveries by system type, quantity and year
• End-user certificate irregularities such as implausible recipients, forged signatures or mismatched quantities and destinations
• Broker, freight forwarder and air cargo operator recurrence across seizure cases and embargo violation reporting
• Seizure and recovery reporting from law enforcement and monitoring panels documenting types, quantities and routes
• Procurement notices, exercise reporting and parade imagery indicating which systems have actually entered service
• Component-level provenance where subsystems, optics or electronics originate from a different state than the assembled weapon

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• SIPRI Arms Transfers Database — Free searchable record of major conventional weapons transfers by supplier, recipient, system and year since 1950
• Small Arms Survey — Free research on small arms holdings, illicit flows, marking and tracing practice and regional diversion dynamics
• Conflict Armament Research and iTrace — Field-documented weapons and ammunition with serial and lot level tracing back to point of legal transfer
• UN Register of Conventional Arms — Voluntary state reporting of imports and exports of major conventional weapons categories, useful for cross-checking
• UN Security Council panel of experts reports — Detailed embargo violation investigations naming shipments, brokers, aircraft, vessels and end-user documentation
• Arms Trade Treaty annual reports and national export reports — State-published authorised export data by destination and category, the baseline for lawful transfer analysis
• Wassenaar Arrangement munitions and dual-use lists — Agreed control lists defining which items and technologies require export authorisation
• Landmine and Cluster Munition Monitor — Documented contamination, stockpile and use reporting for mines and cluster munitions by country and year

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Fix the item precisely — Identify model, variant, producer and production period from marks and physical features before any tracing, since variant matters more than family.
2. Record every marking — Photograph and transcribe serial numbers, factory codes, proof marks and headstamps exactly, preserving chain of custody for the documentation.
3. Trace to legal transfer — Work backwards from producer and lot through transfer registers and national export reporting to the last documented lawful transaction.
4. Locate the diversion point — Compare the last lawful recipient with the recovery context to identify where custody broke: stockpile leakage, battlefield capture or fraudulent export.
5. Map the facilitation network — Extract brokers, forwarders, aircraft and vessels from panel reports and seizure documentation, then resolve them in corporate and movement data.
6. Assess capability realistically — Bound system performance by ammunition availability, maintenance, training and logistics rather than by manufacturer specification sheets.
7. Refer and publish carefully — Route findings to sanctions authorities, national investigators or monitoring panels, and publish only what does not aid replication.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Weapons Trafficking

Operates on these data points

• Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
• HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.
• Shipping Container — An ISO container identifier — trackable across ports, vessels, and customs events.
• Company / Organization — A legal entity — corporation, LLC, NGO, or business.
• Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
• Aircraft — An aircraft identified by tail number, ICAO hex, or registration.

Related disciplines

• CBRN Intelligence — Chemical, Biological, Radiological, and Nuclear Threats

Inside the platform: where Weapons Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=WEAPINT — Discipline hub
• source-catalog.php?disc=WEAPINT — Source catalogue filtered to this discipline
• search.php — Company / Organization profile
• domain.php?d=mar — Vessel / Ship profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Fix the item precisely is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Trace to legal transfer turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Refer and publish carefully feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Weapons Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Weapons intelligence supports capability assessment of adversary systems and, through weapons technical intelligence, exploitation of recovered materiel to inform force protection and counter-improvised device work. Analysts establish what a fielded system realistically achieves once ammunition availability, maintenance, training and logistics are applied, which routinely differs from manufacturer specification. Products feed threat assessments, recognition guides, protective posture decisions and counter-network targeting support. Constraints include chain of custody and explosive safety requirements on recovered items, export control on technical data, and a strict prohibition on producing design, modification or manufacture guidance in any product.

🕵 National intelligence

National intelligence uses weapons intelligence for embargo and sanctions monitoring, arms transfer assessment and support to UN and regional monitoring panels. The high-value work is diversion analysis: reconstructing the path from lawful production and transfer into illicit circulation using serial and lot tracing, transfer registers and end-user documentation. Findings support designations, demarches and panel reporting, and much of the evidence is open or obtainable through state cooperation. Handling must respect the confidentiality of tracing responses from producing states, which are given on the understanding they will not be published without agreement.

👮 Law enforcement

Law enforcement uses weapons intelligence in trafficking, straw purchasing, illegal manufacture and organised crime armament cases. Serial number tracing through the producing state and the first lawful transfer identifies the point where custody broke, which is where the offence usually sits. Evidentially, recovered firearms and ammunition require documented continuity, forensic examination for restored serial numbers and toolmarks, and ballistic comparison through national systems. Cross-border tracing runs through INTERPOL channels and producing state authorities rather than informal contacts, and international cooperation requests must be properly documented to be usable at trial.

🔍 Private investigation and corporate security

Private sector work is largely compliance and due diligence: screening counterparties in the defence supply chain, assessing brokering and transport intermediaries, and supporting litigation or insurance matters involving arms transfers. Analysts can work with public transfer registers, national export reports, panel reporting and open technical literature. What a private actor cannot do is handle recovered materiel, access national firearms registries or tracing systems, or produce technical assessments that amount to design or modification guidance. Findings suggesting embargo breach should be referred to the licensing authority or law enforcement rather than retained commercially.

📰 Journalism and OSINT media

Journalists document arms transfers, embargo violations and the use of specific munitions in incidents, often from imagery. Verification requires identifying the item by observable features to a documented variant, corroborating markings from more than one image where possible, and having a specialist confirm the identification before publication. Precision matters: naming the wrong munition family undermines an entire story. Publication ethics require withholding detail useful for replication, protecting the identity of local documenters, and giving states and manufacturers named in a transfer chain a genuine right of reply before publication.

🌍 NGO, humanitarian and human rights

Human rights and disarmament organisations document munitions use, contamination and diversion for accountability and treaty advocacy. Field documentation must be safe first: unexploded ordnance and abandoned munitions kill documenters, so work follows explosive ordnance disposal advice and never involves handling items. Documentation standards require photographing markings with scale, recording exact location and context, and preserving imagery provenance for later legal use. Do no harm applies to witnesses and local partners, who face retaliation, and to publication detail that could assist replication or reveal contaminated areas being cleared.

🎓 University and research

Researchers study arms transfer patterns, diversion mechanisms, embargo effectiveness and the humanitarian impact of specific weapon types. Public transfer registers, national export reports, panel documentation and field documentation datasets support quantitative work. Methodological care centres on the incompleteness and inconsistency of reporting: registers rely on voluntary submission, categories differ between systems, and value versus volume measures produce different pictures. Ethics review applies where field research involves affected communities. Publication should follow the field norm of describing tracing and identification methods while withholding technical detail useful only for manufacture or modification.

Playbook: working Weapons Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Fix scope on the defensive side

Establish that the question concerns capability assessment, non-proliferation, embargo monitoring, trafficking investigation or victim documentation. Any request touching design, manufacture, modification, improvised construction or acquisition is refused, and the refusal is recorded. A good output is a scope statement naming the lawful purpose and the exclusions, agreed with the customer. Stop the engagement if the requirement cannot be met defensively, and consider whether the nature of the request itself warrants a report.

Phase 2 — Identify the item precisely

Determine model, variant, producing country, factory and production period from observable features and markings, because variant matters far more than family for tracing and for capability. Use published reference material and specialist review rather than assumption. A good output is an identification with the specific features supporting it and a stated confidence. Stop and report the item as unidentified rather than guessing, since a wrong identification propagates into every downstream conclusion and is the commonest failure in published reporting.

Phase 3 — Document markings to a tracing standard

Photograph and transcribe serial numbers, factory codes, proof and inspection marks, lot numbers and ammunition headstamps exactly as they appear, with scale, lighting and multiple angles, and record the recovery context, date and location. Never handle items without explosive ordnance disposal clearance. A good output is a documentation package a national authority can act on. Stop and hand over to a qualified team if the item is energetic, damaged or of uncertain state.

Phase 4 — Preserve chain of custody

Record who recovered the item, when, where, who has held it since and under what authority, with signatures at each transfer. Tracing responses and any prosecution depend entirely on this record, and an unprovenanced item supports no attribution conclusion whatever. A good output is a continuity record accompanying the physical documentation. Stop and note the break explicitly where custody cannot be established, and downgrade the conclusions accordingly rather than proceeding as if it were sound.

Phase 5 — Trace to the last lawful transfer

Work backwards from producer and lot through national transfer records, export licensing reporting and transfer registers to the last documented lawful transaction, using the proper state-to-state or INTERPOL tracing channels. Producing states hold the definitive records and respond to formal requests. A good output is a tracing chronology naming the producer, the export and the recipient with dates. Stop when the last lawful recipient is identified or the trace fails, and record where it failed, which is itself informative.

Phase 6 — Locate the diversion point

Compare the last lawful recipient against the recovery context to identify where custody broke: national stockpile leakage, battlefield capture, fraudulent end-user certification, re-export in breach of conditions, or theft in transit. Each has different policy implications. A good output names the diversion mode with the evidence supporting it and the alternatives considered. Stop before attributing deliberate state diversion where stockpile security failure explains the evidence equally well.

Phase 7 — Verify end-user documentation

Where certificates are available, check them for the standard indicators of fraud: inconsistent formats, implausible quantities for the stated end user, officials who do not hold the stated post, unverifiable addresses and mismatches with the recipient state's own records. A good output is a document assessment with each indicator evidenced. Stop and refer to the exporting state's licensing authority, which can verify authenticity through diplomatic channels in a way no analyst can.

Phase 8 — Map the facilitation network

Extract brokers, freight forwarders, aircraft, vessels, financiers and shipping agents from panel reports, seizure documentation and transport records, then resolve them in corporate registries and movement data. Intermediaries recur across unrelated cases far more reliably than suppliers do. A good output is a facilitation network with repeat appearance counts and registry identifiers. Stop when the recurring facilitators are identified and screened across the whole case set rather than case by case.

Phase 9 — Analyse transfer register and reporting data

Use arms transfer registers and national export reports to characterise the lawful flow into a region: what was transferred, to whom, in what volume and when, and where reporting is absent. Reporting gaps are as informative as entries. A good output is a transfer picture with the reporting completeness stated per state. Stop before treating register values as physical quantities, since methodologies differ and value-based measures diverge sharply from unit counts.

Phase 10 — Assess capability realistically

Bound system performance by ammunition availability, maintenance and spares, crew training, logistics and integration rather than by manufacturer specification. A capable platform without sustainment is a static asset. A good output is a capability statement naming the limiting factor and its evidence. Stop before repeating specification sheet figures as achieved performance, and never include detail on modification, improvement or defeat of protective measures.

Phase 11 — Corroborate with independent evidence

Confirm findings with imagery, seizure reporting, customs and flight or vessel records, panel of experts documentation and, where safe, further field documentation. Serial tracing plus movement evidence is far stronger than either alone. A good output states which conclusions rest on documentary tracing and which on physical or movement evidence. Stop when the conclusions carrying policy weight are independently corroborated or explicitly flagged as single-source.

Phase 12 — Refer, and publish with redaction

Route findings to sanctions authorities, national licensing bodies, monitoring panels or law enforcement, and publish only what does not assist replication, modification or evasion. Respect the confidentiality conditions attached to tracing responses from producing states. A good output has been reviewed by a second practitioner specifically for replication risk and for risk to field documenters. Stop before publishing precise locations of unexploded ordnance or the identities of local documenters.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
SIPRI Arms Transfers Database	Open	Records of international transfers of major conventional weapons since 1950 with trend indicator values, suppliers and recipients	Establishes the lawful transfer baseline for a region and period against which recovered items are compared
SIPRI Military Expenditure and Arms Industry databases	Open	Military spending by country and revenue data for the largest arms-producing companies with consistent methodology	Context for procurement capacity and industrial base assessment behind observed transfers
Small Arms Survey	Open	Research on small arms holdings, transfers, diversion, stockpile management and armed violence with country and thematic reports	Authoritative reference for small arms diversion typologies and regional holdings estimates
Conflict Armament Research and iTrace	Open	Field-documented weapons and components recovered in conflict, traced through production and transfer with published case detail	The reference dataset and methodology for physical tracing from recovery to lawful transfer
UN Register of Conventional Arms	Open	Voluntary state reporting of imports and exports across major conventional weapon categories plus small arms background information	State-declared transfer data useful for identifying both flows and reporting gaps
UN Security Council panel of experts reports	Open	Investigative reporting on sanctions and embargo implementation with documented cases, serial tracing and named facilitators	The richest open source on diversion networks, brokers and transport intermediaries
Arms Trade Treaty documentation and annual reports	Open	Treaty text, state party reporting on authorisations and transfers, and implementation guidance	Establishes state obligations on export assessment and diversion prevention, and their reporting record
National export control annual reports	Open	State reporting of licences granted and refused by destination and category, published by many exporting states	Corroborates or contradicts claimed transfer chains at the licensing level, by destination and category
Wassenaar Arrangement munitions and dual-use lists	Open	Multilateral control lists covering conventional arms and dual-use goods and technology with best practice guidelines	Determines control status of items and technical data before any assessment is shared
Landmine and Cluster Munition Monitor	Open	Annual reporting on landmine and cluster munition use, contamination, casualties, clearance and treaty compliance	Authoritative record of use, contamination and clearance progress for treaty-prohibited weapon types worldwide
GICHD and mine action standards	Open	International mine action standards, technical notes and research on explosive ordnance risk and clearance practice	Safety framework for any field documentation near explosive remnants, and clearance capability assessment
ICRC arms and international humanitarian law resources	Open	Legal analysis of weapons under international humanitarian law, treaty commentary and weapon review guidance	Frames whether a weapon type or its use raises legal issues, which is often the point of the documentation
INTERPOL illicit arms records and iARMS	Registration	International system for recording and tracing lost, stolen, trafficked and smuggled firearms, accessible to law enforcement	The lawful cross-border tracing channel for recovered firearms, routed through national central bureaux
UNODC firearms trafficking studies	Open	Global study on firearms trafficking with seizure data, trafficking routes and national reporting analysis	Quantitative context for seizure patterns, trafficking route assessment and national firearms reporting completeness
US Directorate of Defense Trade Controls and munitions list	Open	US munitions list, licensing requirements, brokering registration and published enforcement actions	Establishes US control status and identifies previously sanctioned brokers and exporters
OSCE documents on small arms and stockpile management	Open	Regional commitments and best practice guides on stockpile security, surplus destruction and export control	The applicable standard when assessing whether stockpile security failures explain a diversion

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Weapons Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Reference identification guides and specialist review — Published recognition material for weapons and munitions variants; identification should always be confirmed by a specialist before publication.
• Photographic documentation kits with scales — Standardised imaging of markings for tracing submissions; quality of lighting and angle determines whether a code is legible enough to trace.
• Case and continuity management systems — Records custody, transfers and authorities for recovered items; unglamorous and decisive, since tracing and prosecution both depend on it.
• Corporate registry and shipping data platforms — Resolves brokers, forwarders and carriers named in panel reports; coverage varies and shell structures frequently defeat resolution.
• Aircraft and vessel movement analysis tools — Corroborates transport legs in documented transfer chains; coverage gaps must be modelled rather than read as evasion.
• Graph analysis of facilitation networks — Exposes recurring intermediaries across unrelated cases; requires disciplined entity resolution to avoid spurious links.
• Imagery analysis platforms — Identifies munitions and delivery systems in incident footage and confirms stockpile activity; resolution limits variant-level identification.
• Transfer register analysis in Python or R — Compares declared flows against seizure and recovery patterns; register methodologies differ, so cross-source comparison needs explicit normalisation.
• Pre-publication redaction review workflow — Second-practitioner check for replication risk and documenter safety before release; the most important control in the discipline.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Variant beats family. Model, factory and production period determine what can be traced and what the item can do. Reporting an item at family level loses the tracing chain entirely and is the most common error in published conflict reporting.
• The lot number often outperforms the serial number. Ammunition headstamps and packaging lot codes tie a batch to a production run and an export consignment, which frequently identifies the diversion point when individual serials cannot.
• Provenance decides everything. An item without a documented recovery context and continuity record supports no attribution conclusion, however clear its markings. Record who recovered it, when, where and under whose authority before anything else.
• Trace through the proper channel. Producing states hold the definitive transfer records and respond to formal requests through state-to-state and INTERPOL routes. Informal enquiries produce unusable answers and can compromise a future prosecution.
• Facilitators recur; suppliers rotate. The broker, forwarder, aircraft or vessel that knows how to move controlled goods is not easily replaced, which makes the facilitation network the durable analytic target across unrelated cases.
• Capability is bounded by sustainment. Ammunition supply, spares, maintenance and trained crews determine what a system achieves, and a platform without them is inventory rather than capability. Name the limiting factor rather than quoting the specification sheet.
• Publish for accountability, redact for safety. Withhold technical detail useful for manufacture or modification, precise locations of unexploded ordnance, and anything identifying local documenters, whose exposure is the most common serious harm this work causes.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Weapons Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of documented items identified to variant level with specialist confirmation rather than family level.
• Tracing success rate, measured by items traced to a last documented lawful transfer as a share of items submitted for tracing.
• Median time from field documentation to submission of a tracing request to the producing state or through INTERPOL channels.
• Share of findings corroborated by both documentary tracing and independent movement or seizure evidence.
• Number of recurring facilitators identified across multiple unrelated cases and referred to sanctions or licensing authorities.
• Compliance rate for pre-publication redaction review covering both replication risk and the safety of field documenters and local partners.
• Referrals to monitoring panels, licensing authorities or law enforcement that resulted in documented action.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Identifying a weapon from low-resolution imagery, where variants with very different capability are visually near-identical
• Assuming the last documented lawful recipient is culpable, when stockpile theft and battlefield capture are common and blameless
• Ignoring that identical models are produced under licence in multiple countries, which breaks naive producer attribution
• Reading parade or exercise appearances as operational capability without evidence of ammunition stocks, crews and sustainment
• Treating removed or obliterated serial numbers as unrecoverable when other lot marks and component codes often remain
• Publishing technical detail that assists replication rather than tracing, which converts investigation into proliferation risk

Legal and ethical considerations

This discipline covers capability assessment, non-proliferation and trafficking investigation only. It never extends to design, manufacture, modification or acquisition guidance, which must be refused. Arms and related technical data are controlled under the Arms Trade Treaty, Wassenaar Arrangement, ITAR, EU dual-use regulation and national munitions lists; even sharing detailed technical analysis with a foreign national can constitute a controlled transfer. Recovered materiel handling requires lawful authority and chain of custody. Credible diversion findings should be referred to sanctions authorities and national investigators.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Weapons Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 data points, 1 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What is in scope for weapons intelligence and what is not?

In scope: identification of fielded systems and recovered materiel, capability assessment bounded by sustainment, serial and lot tracing to lawful transfer, diversion analysis, end-user certificate verification, facilitation network mapping, embargo and sanctions monitoring, and documentation for accountability. Out of scope, without exception: design, manufacture, modification, improvised construction, defeat of protective measures, and acquisition guidance. Products should be written so they assist detection, tracing, regulation and prosecution, and should be reviewed before release specifically for detail that would assist replication rather than defence.

How does serial number tracing actually work?

Tracing runs from the recovered item back through the manufacturer to the first lawful international transfer. The requesting authority submits the markings and recovery context to the producing state, usually through a national point of contact or INTERPOL channels, and the producer identifies the production lot, the original purchaser and the export authorisation. That identifies the last documented lawful holder. Comparing that holder against the recovery context shows where custody broke. Responses are often provided in confidence, so publication requires the producing state's agreement, and informal enquiries outside these channels typically produce nothing usable.

What if the serial number has been removed?

It is often recoverable. Forensic laboratories restore obliterated serial numbers through chemical etching and magnetic particle techniques because stamping deforms the metal below the visible surface. Beyond the primary serial, most weapons carry secondary markings: factory codes, proof and inspection marks, part numbers on components and assembly marks that survive obliteration of the main number. Ammunition carries headstamps and packaging lot codes. Removal of markings is itself a finding indicating deliberate concealment, and it should be documented as carefully as the markings themselves.

How do I recognise a fraudulent end-user certificate?

Look for the standard indicators: quantities implausible for the stated end user's forces, an official whose name or post does not correspond to the ministry's actual establishment, formatting and seal inconsistencies against known genuine certificates, unverifiable addresses, and stated end users that later deny the transaction. Cross-check against the recipient state's own export and import reporting. Verification is not something an analyst completes alone: refer the certificate to the exporting state's licensing authority, which can verify authenticity through diplomatic channels and has done so in many documented cases.

How much can I conclude about capability from open sources?

Enough to be useful if you focus on sustainment rather than specification. Published figures describe optimum conditions; what determines operational capability is ammunition availability, spares and maintenance, crew training and turnover, integration with sensors and command systems, and logistics. Open sources on procurement volumes, exercise activity, maintenance contracts and observed serviceability rates support that assessment. Say what the limiting factor is and how you know. Never include modification, improvement or countermeasure-defeat detail, which falls outside the discipline regardless of who is asking.

Is it safe to document munitions in the field?

Only with explosive ordnance disposal advice and never by handling items. Unexploded and abandoned ordnance kills documenters regularly, and items can be sensitive to movement, heat or radio emissions. The standard practice is to photograph from a safe distance with a scale in frame, record location and context precisely, follow the applicable mine action standards, and report the item's location to clearance authorities. Organisations should train and equip field staff before deployment, and no story or dataset justifies handling an item that has not been cleared by a qualified team.

How should transfer register data be used and not used?

Use it to characterise lawful flows, identify recipients and, importantly, to identify reporting gaps, which are as informative as entries. Do not treat register figures as physical quantities: the UN register relies on voluntary submission with variable participation, SIPRI uses trend indicator values that express military capability rather than financial value or unit counts, and national reports use licensing categories that differ between states. Comparisons across sources need explicit normalisation, and any published figure should state which methodology produced it and what it does and does not measure.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Arms Trade Treaty, which requires export assessment against diversion, humanitarian and human rights criteria and establishes reporting obligations.
• UN Programme of Action on Small Arms and the International Tracing Instrument, which set marking, record-keeping and cooperation-in-tracing standards.
• UN Firearms Protocol supplementing the Convention against Transnational Organized Crime, which criminalises illicit manufacturing and trafficking and mandates marking.
• Wassenaar Arrangement munitions and dual-use lists with best practice guidelines, which define controlled items and expected export control practice.
• US International Traffic in Arms Regulations and the US Munitions List, which control defence articles, services and technical data including analysis shared with foreign nationals.
• EU Common Position 2008/944/CFSP on arms export control, which sets the criteria member states must apply to licensing decisions.
• International Mine Action Standards, which govern safe practice around explosive ordnance including for documentation and survey.
• UN Security Council arms embargoes and panel of experts mandates, which define prohibited transfers and the investigative framework for monitoring them.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Arms Transfers Database — Stockholm International Peace Research Institute. Records of international transfers of major conventional weapons with consistent trend indicator methodology
2. Small Arms Survey research and country profiles — Small Arms Survey, Graduate Institute Geneva. Research on small arms holdings, transfers, diversion and stockpile management
3. iTrace and field documentation reports — Conflict Armament Research. Physically documented weapons and components traced from recovery through production and lawful transfer
4. UN Register of Conventional Arms — UN Office for Disarmament Affairs. State-reported transfers of major conventional weapons and small arms background information
5. Arms Trade Treaty and state party reporting — ATT Secretariat. Treaty text, export assessment criteria and annual reporting on authorisations and transfers
6. Munitions and dual-use control lists — Wassenaar Arrangement. Multilateral control lists and best practice guidelines for conventional arms and related technology
7. Landmine and Cluster Munition Monitor reports — International Campaign to Ban Landmines and Cluster Munition Coalition. Annual documentation of use, contamination, casualties and clearance for prohibited weapon types
8. International Mine Action Standards — Geneva International Centre for Humanitarian Demining. Standards and technical notes governing safe practice around explosive ordnance
9. Global Study on Firearms Trafficking — UN Office on Drugs and Crime. Analysis of seizure data, trafficking routes and national firearms control reporting
10. Weapons and international humanitarian law resources — International Committee of the Red Cross. Legal analysis of weapons under humanitarian law and guidance on weapon reviews

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: links transfer registers, seizure reporting and broker networks to trace diversion and monitor embargo compliance. Explore the platform, or browse the rest of the library by following any tag above.