Conflict & Humanitarian: Mission Domain Intelligence Guide

The first measurable sign of a coming famine is usually not hunger. It is a market price series breaking from its seasonal pattern in three districts at once.

What Conflict & Humanitarian covers as a mission domain

Conflict and humanitarian intelligence covers the analysis of armed conflict dynamics and their human consequences: displacement, food insecurity, protection risks, attacks on civilians and civilian infrastructure, and constraints on humanitarian access. Practitioners produce early warning of escalation, actor and frontline mapping, needs and severity analysis, access and security assessment for aid operations, and documentation of violations for accountability. The work sits between political analysis, security risk management and humanitarian programming, and its output is normally a decision about where to deploy, how to negotiate access, or when to withdraw.

Analysts separate the conflict system, meaning belligerents, alliances, resource flows, external sponsors and negotiation tracks, from the humanitarian system with its clusters, funding cycles and access negotiations. Key sub-areas include protection of civilians, conflict-related sexual violence, recruitment of children, siege and starvation dynamics, attacks on healthcare and education, and forced displacement both internally and across borders.

Why it matters

Conflict now drives the overwhelming majority of acute humanitarian need, and famine in the modern era is almost always a product of conflict and access denial rather than absolute scarcity. Early and accurate analysis moves resources before mortality rises and shapes the negotiations that open access corridors. Documentation also determines whether violations are ever prosecuted and whether displaced populations can later reclaim property, status and compensation.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Staple food and fuel prices in local markets diverging from seasonal norms across several districts simultaneously.
• Armed group behaviour shifting from checkpoints and taxation to the targeting of civilian settlements, indicating a change in objective.
• Sharp rise in denied or delayed humanitarian access approvals, or new escort and clearance requirements on a specific corridor.
• Population movement beginning before any fighting, which often reflects local knowledge of imminent operations.
• Attacks on health facilities, water infrastructure and markets, which distinguish deliberate deprivation from incidental damage.
• Recruitment activity in displacement sites, particularly of adolescents, alongside collapsing school attendance in the same locality.
• Communications blackouts or internet shutdowns in a defined area immediately preceding or accompanying military operations.
• Currency collapse, remittance corridor closure or telecoms disruption that removes a population's ability to buy food it can physically reach.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• ACLED — Georeferenced political violence and protest events with actor, date, location and fatality coding.
• UN OCHA and ReliefWeb — Situation reports, access snapshots, funding data and humanitarian needs overviews by country.
• IPC and Cadre Harmonise — Standardised food insecurity phase classification underpinning famine declaration and response planning.
• UNHCR and IOM Displacement Tracking Matrix — Refugee and internal displacement figures, flow monitoring and site-level assessment data.
• FEWS NET — Food security early warning analysis integrating price, climate, production and conflict data.
• UNOSAT and Copernicus Emergency Management Service — Satellite-derived damage, flooding and settlement destruction assessments for affected areas.
• Human Rights Watch, Amnesty International and UN commissions of inquiry — Verified violation documentation with published methodology and witness protection standards.
• WHO Surveillance System for Attacks on Health Care — Reported attacks on health facilities, personnel and transport, recorded by country and date.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Frame the analytical question — Decide whether the product is early warning, access analysis, needs assessment or violation documentation, since the methods differ materially.
2. Establish the conflict baseline — Map actors, alliances, territorial control, resource flows and external backers, stating explicitly what is contested versus established.
3. Build a monitoring set — Select leading indicators such as prices, displacement, access denials and incident tempo, and track them against seasonal and historical norms.
4. Triangulate reporting — Cross-check local reporting, satellite imagery, agency data and community sources, weighting for access bias and reporting incentive.
5. Assess severity and access separately — Distinguish how bad conditions are from whether people can be reached, because the two drive different operational decisions.
6. Document violations to standard — Where accountability is in scope, apply consistent evidentiary criteria, secure informed consent and preserve provenance throughout.
7. Deliver decision-ready product — Give the operational recommendation and an explicit confidence level, not merely a description of the situation.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Geospatial Intelligence — Intelligence Derived from Place
• Imagery Intelligence — Interpretation of Visual Imagery
• News Intelligence — Media Reporting as an Intelligence Source
• Human Intelligence — Information from People, Ethically Obtained
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Risk Intelligence — Structured Assessment of Threat and Consequence
• Medical Intelligence — Health Systems, Capability, and Medical Threats

Worked in these data points

• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.
• Video — A video file or stream — the core artifact for incident verification and chronolocation.
• Satellite Imagery — Overhead imagery of an area of interest, used for change detection and site analysis.
• GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
• Person / Name — A named individual — the subject of identity resolution and profiling.

Adjacent mission domains

• Military & Defense
• Counter-Terrorism
• Border Security & Migration
• Transnational Repression
• Food & Agricultural Security
• Climate Security
• Disinformation / IO

Inside the platform: where Conflict & Humanitarian lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• domain.php?d=conflict — Conflict & Humanitarian dashboard
• theater.php?d=conflict — Threat theater view
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Conflict & Humanitarian:

• Disinformation / Influence Op Response — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Score Country Risk
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Frame the analytical question is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Build a monitoring set turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Deliver decision-ready product feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Conflict & Humanitarian

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence analysts use conflict and humanitarian analysis for civil-military coordination, protection of civilians tasks, and understanding the human terrain that shapes operations. Displacement patterns, market functioning, access constraints and civilian harm data inform planning where a mission includes protection or stabilisation responsibilities, and they support assessment of how operations affect the civilian environment. Constraints are significant and often misunderstood: humanitarian actors maintain independence and neutrality for access reasons, so information sharing is limited by design, and treating humanitarian organisations as collection assets endangers their staff and their access. Coordination runs through established civil-military mechanisms rather than direct approaches.

🕵 National intelligence

National services assess conflict trajectory, escalation risk, external sponsorship and state fragility, feeding policy on intervention, sanctions, aid allocation and evacuation planning. Requirements typically concern who is fighting whom with what support, and what would change the trajectory. Fusion combines event data, imagery, economic indicators, humanitarian reporting and diplomatic sources. Handling should recognise that humanitarian data is produced for operational purposes by organisations that do not wish to be intelligence sources, and that treating it as such compromises them. Dissemination priorities include policy customers, embassy planning and early warning mechanisms.

👮 Law enforcement

Law enforcement engagement is mainly in atrocity accountability: documenting violations for national universal jurisdiction cases or international mechanisms. Evidence standards are exacting: witness accounts taken to interview standards, digital material with preserved provenance, imagery with verified geolocation and dating, and forensic evidence handled with proper continuity. Re-interviewing traumatised witnesses repeatedly across multiple bodies is a recognised and serious harm, so coordination between documentation actors matters. Command responsibility questions require order of battle and communications evidence in addition to incident documentation, which is where most cases are weakest.

🔍 Private investigation and corporate security

Corporate security uses this for operational risk assessment, evacuation planning, business continuity and duty of care in fragile environments. The deliverable translates conflict indicators into decisions about staffing, movement, asset protection and withdrawal thresholds. A private actor may not gather intelligence in ways that endanger local staff or breach local law, should not deploy security arrangements that make staff appear to be a party to conflict, and must be careful that payments to armed actors for access constitute financing offences. Duty of care for local employees, who cannot leave, is the ethical and legal core of the work.

📰 Journalism and OSINT media

Conflict reporting standards are well established but under constant pressure from speed. Verify imagery through geolocation and chronolocation, corroborate casualty claims across independent sources, and treat all belligerent statements as claims requiring testing. Protect sources and local fixers, whose exposure is severe and continues after the story ends. Avoid publishing detail identifying witnesses, displaced people's locations or hospital positions. Report humanitarian conditions with attention to the difference between assessed need and confirmed measurement, since food security and casualty figures are frequently reported with false precision.

🌍 NGO, humanitarian and human rights

This is the primary practitioner community. Analysis supports access negotiation, security risk management, needs assessment, programme design and advocacy. Practice must be do-no-harm at every stage: data collection in conflict can identify people to armed actors, and assessment activity itself creates expectations and risks. Documentation for accountability must be victim-centred, with consent handled as ongoing, minimal re-interviewing, and protection of identity built into the data architecture rather than added afterwards. Duty of care extends to national staff and community focal points who carry most of the risk and rarely feature in organisational risk registers.

🎓 University and research

Research covers conflict dynamics, civilian victimisation, displacement, food security and humanitarian effectiveness. Methodology must handle severe data problems: event data reflects media coverage density, mortality estimates require survey methods with wide confidence intervals, and access constraints bias everything toward reachable areas. Ethics approval is essential for any fieldwork, with protocols for consent, distress, data security and researcher extraction. Reproducibility is served by publishing coding rules and analysis code while withholding location-level data that could endanger respondents. Collaboration with operational agencies raises independence questions that should be declared.

Playbook: working Conflict & Humanitarian end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Frame the decision the analysis serves

Establish precisely what will be decided: whether to open a programme, where to preposition supplies, whether to evacuate, how to negotiate access, or what to advocate for. Conflict analysis without a decision attached expands indefinitely and delivers nothing usable. Output is a decision statement with the owner and the timing. Stop when you can name what changes as a result of the answer.

Phase 2 — Map the conflict system

Identify belligerents, their command structures, alliances, resource flows, external sponsors, internal factions and negotiation tracks. Include the actors who are not fighting but shape outcomes: traders, diaspora financiers, religious authorities and neighbouring states. Output is an actor map with relationships and interests. Stop when you can explain why each actor is fighting and what would change their calculus.

Phase 3 — Establish territorial control and access geography

Determine who controls which areas, where the frontlines are, which routes are usable, where checkpoints sit and who authorises movement. Access is the binding constraint on humanitarian action and the key variable in most operational decisions. Update continuously, since control changes faster than any published map. Output is an access picture with dates and confidence.

Phase 4 — Build the early warning indicator set

Select indicators that lead rather than lag: market price series breaking from seasonal patterns, displacement of small numbers before large movements, withdrawal of local officials, closure of schools and clinics, changes in checkpoint behaviour, and shifts in rhetoric by specific actors. Output is a monitored indicator set with thresholds and named owners for each. Stop when each indicator has a defined trigger and a defined response.

Phase 5 — Assess severity and needs with method

Combine food security classification, nutrition surveys, displacement figures, health data and protection reporting into a severity picture, being explicit about which figures are measured, which are estimated and which are extrapolated from unreachable areas. The credibility of humanitarian advocacy depends on this distinction being visible. Output is a severity assessment with the method and its limits stated.

Phase 6 — Analyse protection risks specifically

Assess risks to civilians by group and by location: attacks on civilians, conflict-related sexual violence, recruitment of children, arbitrary detention, denial of movement and attacks on healthcare and education. These require different data and different sources from general conflict analysis, and they are frequently omitted. Stop when protection risks are disaggregated rather than treated as a single category.

Phase 7 — Design safe information collection

Before collecting anything, assess what harm the collection itself could cause: identifying people to armed actors, creating expectations, exposing enumerators, or generating data that could be seized. Build minimisation, pseudonymisation, separate identifier storage and secure transport into the design. Stop when you can state what happens to the data if a device is confiscated at a checkpoint.

Phase 8 — Document violations for accountability

Where documentation is a purpose, apply the recognised standards: informed and ongoing consent, trauma-informed interviewing, minimal re-interviewing through coordination with other documenters, preserved provenance for digital material, and analysis kept separate from identifying data. Output is a documentation set usable by an accountability mechanism without further contact with witnesses.

Phase 9 — Support access negotiation with evidence

Provide negotiators with the specific facts they need: who controls the route, who has authority, what precedent exists, what the counterpart has permitted elsewhere, and what the population's actual needs are. Access negotiation succeeds on specificity and relationships, and analysis contributes the former. Stop when the negotiator has what they need for the specific counterpart, not a general context report.

Phase 10 — Feed security risk management

Translate the picture into operational security decisions: movement rules, acceptance strategy, communications discipline, contingency and relocation triggers. Ensure national staff risk is assessed explicitly and not assumed to be lower because they are local, which is the single most common failure in humanitarian security management.

Phase 11 — Advocate with defensible figures

Where the output is public advocacy, ensure every figure is sourced and its uncertainty stated, since contested numbers become the story and discredit the underlying case. Distinguish what is verified from what is credible reporting. Provide the specific ask rather than a general call for concern.

Phase 12 — Review and recalibrate

After any major development, test whether the indicator set actually gave warning, whether severity assessments matched what was found when access opened, and whether protection risks were correctly anticipated. Update methods on evidence. Stop when the review produces changes to the indicator set rather than a narrative of what happened.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ACLED	Registration	Georeferenced political violence, protest and strategic development event data with actor coding and daily updates.	Primary near-current source for violence patterns, actor activity and geographic escalation analysis.
UCDP	Open	Uppsala Conflict Data Program organised violence datasets with long time series and conservative coding rules.	Provides the long-run comparative baseline and rigorous conflict classification for trend analysis.
ReliefWeb	Open	Humanitarian information service aggregating situation reports, assessments, appeals and maps by emergency.	Central access point for operational humanitarian reporting from all agencies working in a crisis.
Humanitarian Data Exchange	Open	Open platform hosting operational datasets including displacement, administrative boundaries, access and needs data.	Supplies the structured datasets underpinning severity mapping and needs analysis for a response.
UN OCHA	Open	Coordination body publishing humanitarian needs overviews, response plans, access snapshots and funding data.	Provides the authoritative coordinated picture of needs, access constraints and response coverage.
IPC food security classification	Open	Standardised classification of acute food insecurity and malnutrition with technical analysis by area and period.	Supplies the recognised severity classification for food security advocacy and programme prioritisation.
FEWS NET	Open	Famine early warning analysis combining agroclimatology, market prices, trade and conflict for projected outcomes.	Provides forward-looking food security projections and market price series used as early warning indicators.
IOM Displacement Tracking Matrix	Open	Systematic tracking of displaced populations with location, numbers, needs and movement intentions data.	Establishes displacement figures and movement patterns at operational granularity for response planning.
UNHCR data portal	Open	Refugee, asylum seeker and internally displaced population statistics with situation-specific operational portals.	Supplies authoritative cross-border displacement figures and protection context by situation.
Internal Displacement Monitoring Centre	Open	Global estimates and analysis of internal displacement by conflict and disaster with methodology documentation.	Provides comparable internal displacement figures and trend analysis independent of operational agencies.
Insecurity Insight	Open	Monitoring of violence against aid, health and education, including attacks on facilities and personnel.	Supports security risk management and documentation of attacks on protected services and staff.
WHO Surveillance System for Attacks on Health Care	Open	Reporting of attacks on healthcare facilities, transport, personnel and patients by country and period.	Provides the authoritative record of attacks on health care for protection analysis and accountability.
OHCHR reporting and commissions of inquiry	Open	Human rights monitoring reports, investigative mechanism outputs and treaty body findings on conflict situations.	Establishes documented violations and the legal characterisation applied by UN mechanisms.
ICRC resources on international humanitarian law	Open	Treaty database, customary IHL study and commentary on obligations of parties to conflict.	Supplies the authoritative legal framework for characterising conduct and framing protection advocacy.
WFP market and food security monitoring	Open	Market price monitoring, food security assessments and logistics capacity information across operations.	Provides the market price series whose deviation from seasonal patterns is a leading crisis indicator.
Copernicus and satellite imagery services	Registration	Free and commercial imagery supporting damage assessment, displacement site mapping and agricultural monitoring.	Independently verifies destruction, camp growth and cultivation change where access is denied.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Conflict & Humanitarian. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• KoBoToolbox and mobile data collection platforms — Structured field data collection with offline capability and encryption. Limitation: device seizure at checkpoints exposes data unless local storage is properly managed.
• QGIS and humanitarian mapping tools — Map access constraints, displacement sites, control areas and service coverage. Limitation: administrative boundary data is frequently contested and outdated in conflict.
• HDX and open humanitarian datasets — Provide shared operational data across agencies in standard formats. Limitation: update frequency varies enormously and metadata quality is inconsistent.
• Satellite imagery analysis platforms — Assess damage, camp growth and agricultural change where access is denied. Limitation: revisit and cloud cover, and damage assessment requires validation.
• Event data platforms — Provide near-current violence data for trend and escalation analysis. Limitation: coding depends on media reporting, which is thinnest exactly where access is worst.
• Secure communications and case management — Protect witness data and staff communications in hostile environments. Limitation: only as strong as the discipline of the least careful team member.
• Market price monitoring systems — Track commodity prices as a leading indicator of food security deterioration. Limitation: data collection stops precisely when markets collapse and information is most needed.
• Anonymisation and disclosure control tooling — Reduce re-identification risk before data sharing or publication. Limitation: small populations and unique combinations defeat standard techniques.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Market price series are the most underused early warning instrument available. A staple price breaking from its seasonal pattern in several districts simultaneously precedes displacement and mortality by weeks and is measurable, cheap and hard for any party to manipulate.
• Assessment activity itself creates risk. Enumerators asking questions in a controlled area mark themselves and their respondents, so collection design must start from what happens if the device is seized and who becomes visible by participating.
• Distinguish measured, estimated and extrapolated figures visibly in every product. Humanitarian advocacy is repeatedly discredited by contested numbers, and the numbers are contested precisely because the method is invisible in how they were presented.
• National staff carry most of the risk and appear in the fewest risk assessments. They cannot leave, their families are locally exposed, and their association with an international organisation persists after any evacuation, which should shape security policy rather than being noted afterwards.
• Coordinate documentation to avoid re-interviewing. Survivors in high-profile situations are interviewed repeatedly by different bodies, which is a recognised harm and degrades evidence quality, so joint documentation protocols matter more than any single organisation's completeness.
• Small displacements precede large ones. Households with means and information move first, in numbers too small to appear in displacement figures, so monitoring early low-volume movement in specific villages gives warning that aggregate statistics will not.
• Access is negotiated with specificity, not with principle. Negotiators need to know precisely who controls which checkpoint, what has been permitted elsewhere by the same counterpart and what the population needs, which is the concrete contribution analysis makes to access.
• Protection risks must be disaggregated or they disappear. Conflict-related sexual violence, child recruitment, arbitrary detention and denial of movement each require different sources and different indicators, and folding them into a single protection category reliably means none of them is analysed.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Conflict & Humanitarian is producing anything, and they are worth baselining before you change process or tooling.

• Warning lead time achieved, measured as the interval between indicator trigger and the event it anticipated, tracked across multiple episodes.
• Proportion of severity assessments validated when access opened, as a calibration measure for estimates made from unreachable areas.
• Access outcomes achieved following analytical support to negotiation, measured as routes opened or authorisations obtained.
• Proportion of data collection exercises completed with a documented do-no-harm assessment and no reported harm to respondents or enumerators.
• Re-interview rate for documented survivors, tracked downward as an explicit protection measure.
• National staff security incident rate compared to international staff, monitored as an equity measure in duty of care.
• Proportion of published figures with stated method and uncertainty, audited as a credibility control.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Reporting bias toward accessible areas, which systematically understates conditions precisely where access is worst and need is greatest.
• Treating casualty counts as a severity measure, when displacement, disease and hunger cause most conflict-related mortality.
• Accepting belligerent claims about territorial control and open corridors without independent verification.
• Assuming a ceasefire announcement reflects conditions on the ground, when local commanders and proxy forces are often not bound by it.
• Publishing detail that identifies witnesses, national staff or specific communities, which invites reprisal against them.
• Confusing funding-driven reporting cycles with genuine changes in the level of need.

Legal and ethical considerations

Humanitarian analysis engages international humanitarian law, refugee law and the principles of humanity, neutrality, impartiality and independence, which constrain both what is collected and who it may be shared with. Passing humanitarian information to military or intelligence consumers can endanger staff and destroy negotiated access. Witness testimony requires informed consent, secure storage and recognition that participation may expose people to reprisal. Where documentation may support prosecution, follow recognised evidence protocols and avoid re-traumatising survivors through repeated interviewing.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Conflict & Humanitarian, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 7 data points, 7 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What gives the earliest reliable warning of a food crisis?

Market behaviour, ahead of nutrition data. Staple prices breaking from their seasonal pattern, unusual terms of trade between livestock and grain, traders withdrawing from routes, and distress sales of productive assets all precede measurable malnutrition by weeks or months. Nutrition surveys confirm a crisis that has already arrived. The practical implication is that market monitoring systems, which are relatively cheap and can operate where surveys cannot, should be treated as core early warning infrastructure rather than as supporting economic context, and that a price series breaking in several districts at once is a stronger signal than any single dramatic report.

How should casualty and mortality figures be handled?

With visible method and honest uncertainty. Direct incident counts are minimums constrained by access and reporting. Excess mortality estimates from surveys carry wide confidence intervals and depend heavily on baseline assumptions. Ministry and belligerent figures serve political purposes in both directions. The correct practice is to state what each figure measures, how it was derived and what it excludes, and to resist the pressure to produce a single authoritative number. Products that present a precise figure without method are the ones that get attacked, and the attack then discredits the underlying humanitarian case.

Why is data collection itself a protection risk?

Because in a controlled area, participation is visible. Enumerators moving through communities, questions about armed actors, and lists of beneficiaries all create exposure for respondents and staff, and datasets have been seized at checkpoints and used to identify people. Mitigation is architectural rather than procedural: collect the minimum, separate identifiers from responses, do not store identifying data on field devices, plan for confiscation, and think carefully about whether a question needs asking at all. The default assumption should be that any data collected may end up in the hands of a party to the conflict.

How do humanitarian and intelligence work coexist?

By staying separate, deliberately. Humanitarian access depends on parties believing an organisation is neutral and is not gathering information for military or political purposes, and that belief is fragile and easily destroyed. Aid workers have been killed on the basis of such suspicions. This means humanitarian analysts should not accept intelligence taskings, should be cautious about information sharing arrangements that could be perceived as collection, and should route civil-military coordination through the established mechanisms. Analysts moving between sectors need to internalise that this is an operational safety constraint, not institutional squeamishness.

What makes access negotiation succeed?

Relationships, precedent and specificity. Counterparts respond to a concrete request about a particular route, a particular cargo and a particular population, supported by the fact that they or a comparable actor permitted something similar previously. General appeals to humanitarian principle rarely move anyone. The analytical contribution is knowing exactly who has authority over which stretch of ground, what has been agreed before and by whom, and what the affected population actually needs, so the negotiator can make a specific ask rather than a moral case. Access work is unglamorous, incremental and the single highest-value activity in most responses.

How should conflict-related sexual violence be documented?

Only by trained documenters, following the Murad Code and the survivor-centred standards built around it, or not at all. The risks of poorly conducted documentation are severe: re-traumatisation, exposure to reprisal, stigma, and evidence too compromised to be usable by any accountability mechanism. Coordination between documenting organisations is essential to prevent repeated interviewing of the same survivors. Analysts without specific training should support the work through pattern analysis of existing documented cases rather than through direct contact, and should design products so that no individual can be identified from the aggregate.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Geneva Conventions and Additional Protocols, together with customary international humanitarian law as documented by the ICRC.
• Humanitarian Principles of humanity, neutrality, impartiality and independence, which govern access and operational conduct.
• Sphere Handbook minimum standards in humanitarian response, defining technical and quality benchmarks for assistance.
• Core Humanitarian Standard on Quality and Accountability, setting commitments on accountability to affected populations.
• IPC Integrated Food Security Phase Classification technical manual, defining the severity classification methodology.
• Murad Code, governing safe, ethical and effective documentation of conflict-related sexual violence.
• Berkeley Protocol on Digital Open Source Investigations, standardising open-source evidence collection for accountability mechanisms.
• Guiding Principles on Internal Displacement, framing the rights of internally displaced people and the responsibilities of authorities.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Armed Conflict Location and Event Data — ACLED. Georeferenced political violence event dataset with actor coding.
2. UCDP organised violence datasets — Uppsala University. Long-run conflict data with conservative coding and documented methodology.
3. Global Humanitarian Overview and needs assessments — UN OCHA. Coordinated analysis of humanitarian needs, access and response funding.
4. IPC acute food insecurity analyses — IPC Global Partners. Standardised severity classification for food insecurity and malnutrition.
5. Famine early warning analysis — FEWS NET. Forward-looking food security projections built on market and climate data.
6. Displacement Tracking Matrix — International Organization for Migration. Operational displacement figures, locations and movement intentions.
7. Customary international humanitarian law study — International Committee of the Red Cross. Authoritative statement of customary rules binding parties to conflict.
8. Surveillance System for Attacks on Health Care — World Health Organization. Global record of attacks on health facilities, personnel and transport.
9. Commission of inquiry and monitoring reports — UN Human Rights Office. Documented violations and their legal characterisation in conflict settings.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: tracks escalation, access and severity indicators to move decisions ahead of the crisis curve. Explore the platform, or browse the rest of the library by following any tag above.