Facility / Site: Data Point Intelligence Guide

A facility is where corporate paper meets physical reality. Registries tell you who claims the site; the ground truth tells you what it actually does.

Understanding the Facility / Site as an intelligence artifact

A facility is a fixed site with a function and a footprint: a manufacturing plant, refinery, port terminal, warehouse, military installation, mine or data centre. Analytically it is the junction of a location, an operating entity, a physical layout and a set of permissions. It has boundaries you can draw, buildings you can count, transport and utility connections you can trace, and paperwork attached to it: environmental permits, planning consents, land title, utility contracts, customs approvals and operating licences.

Facilities differ from locations in that they persist, have owners distinct from occupiers, and change function over time. Layout encodes purpose: tank farms and berths for liquid bulk, conveyors and stockpiles for dry bulk, substation capacity and cooling plant for data centres, revetments and hardstand for airfields. Sub-tenancy is common in industrial parks, so the registered occupier and the actual operating entity frequently differ.

Why it matters

Facilities are the physical bottleneck in almost every illicit supply chain. Goods must be produced, stored, transshipped or processed somewhere with capacity, power and access. Identifying the site converts an abstract network into an observable object you can image repeatedly, tie to permits and corporate filings, and correlate with shipping and trade records. Facility-level analysis also supports capacity estimation, which constrains claims about output, throughput and storage volume.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Footprint area and building count give a capacity envelope that constrains claimed production or storage volumes.
Rail spurs, berths, pipelines and road access reveal which transport modes and volumes the site was built for.
Substation size, transformer count and cooling plant indicate power draw and therefore process type at industrial sites.
Double fencing, berms, guard posts and controlled access indicate sensitivity well beyond ordinary commercial norms.
Permit and inspection records name the operating entity, the substances handled and the authorised throughput.
Vehicle and container counts observed over time proxy activity levels, shift patterns and seasonal cycles.
Adjacent land ownership and new construction reveal expansion plans before they are publicly announced.
Utility, water and effluent connections corroborate or contradict the industrial process the operator declares.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

OpenStreetMap and Overpass — Mapped buildings, land use, industrial tags and infrastructure connections around the site.
EPA ECHO and Facility Registry Service — US permits, inspections, enforcement history and operator identity by individual facility.
EU Industrial Emissions Portal (E-PRTR) — European industrial sites with operator name, activity type and reported releases.
Global Energy Monitor trackers — Coal, gas, LNG, steel and pipeline facilities with status, capacity and ownership detail.
WRI Global Power Plant Database — Plant location, capacity, fuel type and operator for power generation sites worldwide.
OpenInfraMap and PeeringDB — Grid infrastructure and data centre facility records including tenants and interconnection points.
UN/LOCODE and port authority listings — Terminal identification, operator details and berth information for maritime facilities.
Sentinel Hub and Copernicus Browser — Repeat imagery for observing layout, construction and activity change over time.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Fix the footprint — Draw the site boundary from imagery and mapping, recording an explicit polygon rather than a single centroid point.
Identify the occupier — Match address and parcel to company registry, permit and land records, separating owner, lessee and actual operator.
Read the layout — Classify structures and infrastructure to infer function, then test that inference against the declared business activity.
Pull the paperwork — Retrieve environmental, planning and customs permissions naming throughput, substances handled and responsible persons.
Establish a baseline — Assemble a time series of imagery defining normal activity before assessing whether any observed change is significant.
Link to flows — Connect the site to shipping, trade and transport records referencing its port, address or bonded warehouse code.
Screen the operators — Run owning and operating entities and their officers against sanctions, debarment and enforcement records.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Geospatial Intelligence — Intelligence Derived from Place
Imagery Intelligence — Interpretation of Visual Imagery
Technical Intelligence — Technology Capability, Design, and Exploitation
Measurement & Signature Intel — Signatures, Measurements, and Physical Phenomena
Environmental Intelligence — Environmental Conditions, Damage, and Crime
Economic Intelligence — Economic Conditions, Trade, and Market Signals
Legal Intelligence — Law, Litigation, and Regulatory Intelligence
Risk Intelligence — Structured Assessment of Threat and Consequence
Corporate Intelligence — Understanding Companies, Structure, and Control
Sanctions Intelligence — Screening, Designations, and Evasion Detection

Investigated in these domains

Pivots to these data points

Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
Satellite Imagery — Overhead imagery of an area of interest, used for change detection and site analysis.

Inside the platform: where Facility / Site lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

datapoint.php?dp=dp_facility — Data point hub
domain.php?d=critinfra — Critical Infrastructure dashboard
domain.php?d=mining — Mining & Resource Crime dashboard
domain.php?d=labor — Forced Labour & Modern Slavery dashboard
domain.php?d=wmd — WMD / Proliferation dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Fix the footprint is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Read the layout turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Screen the operators feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Facility / Site

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Facilities are the fixed objects around which most military intelligence problems resolve: ports, airfields, depots, plants and power infrastructure. Analysts build facility profiles for intelligence preparation of the battlespace, force protection, logistics planning and infrastructure assessment, combining footprint, layout, capacity estimates and access routes. Where a site could become an objective, the legal test is whether it makes an effective contribution to military action and whether its destruction offers a definite military advantage, which requires positive identification well beyond a layout inference. Dual-use infrastructure such as power and water carries heightened proportionality obligations. Protected objects, including medical facilities and cultural property, should be mapped explicitly so they are not misread as unidentified industrial sites.

🕵 National intelligence

For national intelligence a facility is a durable collection target: it persists, it can be revisited, and change over time is measurable. Facility analysis supports proliferation monitoring, sanctions enforcement, supply-chain assessment and infrastructure resilience judgements, fusing imagery with permits, corporate filings, trade records and reporting. Classification is usually driven by the collection rather than the conclusion, so an open-source facility profile built from commercial imagery and public permits often disseminates far more widely than the classified assessment it supports. Maintain the profile as a living object with a baseline, a change log and named sources, because the value is in the time series rather than in any single observation.

👮 Law enforcement

Investigators use facility analysis to establish where an offence occurred, who controlled the site and what capability existed there. Permits, land registry records, utility connections, planning consents and inspection reports are documentary evidence obtainable openly or by production order, and they name responsible persons. For search planning, the facility profile drives warrant scope, officer safety and evidence recovery: knowing tank farms, chemical stores or server rooms exist changes the specialist resources required. Aerial and satellite imagery is generally admissible with provenance, but flying a drone over private property or entering the perimeter without authority contaminates the evidence and creates criminal exposure for the investigator.

🔍 Private investigation and corporate security

Corporate security uses facility analysis for supplier audits, site due diligence, counterfeit investigation, insurance claims and pre-acquisition verification. The lawful toolkit is public mapping, licensed imagery, registry and permit records, and observation from public land or with the occupier's consent. What a private actor may not do is trespass, fly a drone over private or restricted airspace without permission, place cameras overlooking a site, or induce an employee to breach duties of confidence. Where the site is small enough that observation captures a home or identifiable workers, data-protection obligations attach. Document the observation position and method so the report survives challenge.

📰 Journalism and OSINT media

Facility reporting has produced some of the strongest investigative journalism of the last decade, from detention sites to industrial pollution. The verification standard is layered: imagery showing the structure, documents naming the operator, and where possible a human source or ground photograph. Do not over-read layout, since dual-use plant looks similar across legitimate and illicit processes, and confident misidentification of a facility is a serious and public failure mode. Seek comment from the named operator with specifics before publication. Weigh whether publishing security arrangements or precise layout of a sensitive site creates risk that the story does not justify.

🌍 NGO, humanitarian and human rights

Human-rights and environmental organisations use facility analysis to document detention sites, forced-labour workplaces, illegal extraction and pollution, and to attribute them to corporate and state actors. Imagery and permits allow documentation without putting local monitors at risk, which is the central do-no-harm argument for the method. Where testimony from workers or detainees is combined with imagery, protect the witnesses absolutely: naming a specific workplace can identify who spoke. Preserve material to an accountability standard with hashes and chain of custody, since it may support future proceedings, and provide staff analysing distressing imagery with proper psychosocial support.

🎓 University and research

Researchers use facility datasets for energy transition studies, supply-chain mapping, industrial emissions research and conflict infrastructure analysis. Methodological rigour means defining the facility boundary explicitly, documenting the imagery and interpretation keys used, and reporting inter-rater agreement where classification is manual. Ethics review is usually required where the analysis touches identifiable individuals or vulnerable workers, and imagery licences frequently restrict redistribution of derived products, so plan data sharing before collection. Publish the polygon set, the coding protocol and the uncertainty, and cite imagery by scene identifier and acquisition date so another team can rerun the observation.

Playbook: working Facility / Site end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the site and the question

State what facility you are examining and what decision the profile supports: capacity, ownership, activity level, compliance or change. Different questions require different evidence and different stopping points. Fix the geographic extent under examination, including whether adjacent parcels are in scope. A good output is a short scoping note with the question, the extent and the consumer. Stop when the boundary of the enquiry is as clear as the boundary of the site.

Phase 2 — Fix the footprint as a polygon

Draw the site boundary from imagery and mapping rather than recording a centroid, and note the fence line, gates, and any sub-parcels under different control. Record the imagery date used to draw it, because boundaries change. A good output is a stored polygon with a source and date attribute. Stop when the polygon matches what a person standing at the gate would call the site.

Phase 3 — Establish the property chain

Match the parcel to land registry, cadastral and planning records to identify the owner, and separately identify the lessee and the actual operator, which are frequently three different entities. Industrial parks and sub-tenancy make this the step most often skipped and most often wrong. A good output distinguishes owner, occupier and operator with a source each. Stop when you can name who controls the site rather than who owns the ground.

Phase 4 — Read the layout systematically

Classify structures and infrastructure: buildings by type, tanks, silos, stockpiles, conveyors, berths, rail spurs, substations, cooling plant, flare stacks, effluent outfalls, hardstand and security features. Record what you observe separately from what you infer it means. A good output is an annotated layout with an observation column and an inference column. Stop when every significant structure has been described, including the ones you cannot identify.

Phase 5 — Estimate capacity

Derive a capacity envelope from measurable quantities: footprint area, tank dimensions, stockpile volume, berth length and draught, substation rating, cooling capacity. Express results as ranges with the assumptions stated. Capacity estimates are powerful because they constrain claims about output that no document can. A good output is a range with a method note. Stop when the estimate is defensible to someone who knows the industry better than you do.

Phase 6 — Pull the regulatory paperwork

Retrieve environmental permits, planning consents, emissions reporting, inspection and enforcement records, customs approvals and bonded warehouse registrations. These name the operator, the substances handled, authorised throughput and responsible persons, and they are dated. A good output is a document set with entity names extracted. Stop when the declared activity is documented well enough to compare against the observed layout. Note the date of each permit, because a document can describe a business that left the site years ago.

Phase 7 — Establish an imagery baseline

Assemble a time series over a period long enough to characterise normal variation, matching season, sun angle and processing level where possible. Without a baseline, ordinary industrial fluctuation reads as significant change, which is the most common error in this discipline. A good output is a dated scene list with a description of normal. Stop when you can say what a typical week at this site looks like.

Phase 8 — Assess change against the baseline

Compare current observations against normal and characterise what changed, when, and within what bracket the change occurred. Use radar coherence or thermal layers where optical imagery cannot show the change of interest. A good output is a change log with dated brackets and confidence. Stop when the change is either dated to the sensor revisit interval or shown to be undatable from available coverage.

Phase 9 — Link the site to flows

Connect the facility to shipping, trade, transport and utility records referencing its port, address, bonded warehouse code or grid connection. This is what converts a site into a node in a network rather than an isolated observation. A good output is a list of flows with document references and dates. Stop when the linkage is either established with documents or explicitly recorded as unevidenced.

Phase 10 — Screen the entities

Run owner, occupier, operator, parent companies and named responsible persons against sanctions, export-control, debarment and enforcement records, with dated list versions. A facility profile without entity screening is incomplete for almost every consumer. A good output is a screening log tied to the entity table. Stop when every named legal and natural person has been screened once. Repeat the screen when the profile is reissued, because designations and debarments change between publications.

Phase 11 — Corroborate from the ground

Seek independent ground-level evidence: street-level imagery, photographs, job advertisements naming the site, local reporting, corporate marketing material, worker accounts obtained ethically. Overhead interpretation without ground reference is where high-profile errors happen. A good output pairs at least one overhead inference with independent confirmation. Stop when the core inference has a second, independent line of evidence or is clearly flagged as unconfirmed.

Phase 12 — Assess harm and publish carefully

Before release, consider whether publishing layout, security arrangements or worker-identifying detail creates risk, and check jurisdictional restrictions on imagery of defence and critical infrastructure. Give the named operator an opportunity to respond where the product is public. A good output is a release decision recorded with its reasoning and the imagery licence checked. Stop when the archive retains the full profile and the published version reflects a deliberate choice.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
OpenStreetMap and Overpass	Open	Mapped buildings, land use, industrial tagging, rail spurs, pipelines and access roads contributed and maintained collaboratively.	First pass on site extent, infrastructure connections and what the mapping community already knows about the facility.
EPA ECHO and Facility Registry Service	Open	United States permits, inspections, violations, enforcement actions and operator identity for regulated facilities, keyed to a facility identifier.	Names the operating entity, the substances handled and the authorised throughput, with a dated compliance history.
European Industrial Emissions Portal	Open	European industrial installations with operator names, activity classifications, permitted capacity and reported pollutant releases.	Establishes the declared activity and scale of a European site against which observed layout can be tested.
Global Energy Monitor trackers	Open	Openly licensed datasets of coal, gas, LNG, steel, pipeline and other energy facilities with status, capacity, ownership and coordinates.	Provides an existing curated record for energy and heavy industry sites, including planned and cancelled projects.
Global Power Plant Database	Open	Worldwide inventory of power generation facilities with capacity, fuel type, owner and estimated generation.	Benchmarks a site against known plants of the same type and supplies capacity figures for cross-checking imagery estimates.
OpenInfraMap	Open	Visualisation of power grid, telecommunications and pipeline infrastructure derived from OpenStreetMap tagging.	Traces the transmission lines, substations and pipelines connecting a facility, which constrain its plausible power draw and process.
PeeringDB	Open	Open database of network facilities, interconnection points, and the organisations present at each data centre.	Identifies tenants and interconnection at data centre facilities, which registry records rarely disclose.
Copernicus Data Space Ecosystem	Registration	Free Sentinel-1 radar and Sentinel-2 optical archives with browser, API and processing services.	Builds the dated imagery baseline and detects construction, demolition and activity change at moderate resolution.
USGS EarthExplorer	Registration	Landsat archive extending back decades plus declassified historical reconnaissance imagery of much of the world.	Establishes long-run site history, including what existed before current construction and when the site first appeared.
UN/LOCODE and port authority publications	Open	Standard location codes for ports and terminals, alongside authority-published berth, terminal operator and capacity information.	Identifies terminal operators and berth characteristics for maritime facilities and links them to shipping records.
National land registry and cadastral services	Registration	Official parcel boundaries, title, ownership and charges over land, published or available for a fee in most jurisdictions.	Establishes legal ownership of the ground, which is frequently distinct from the operating entity on site.
Maxar Open Data Program	Open	High resolution optical imagery released publicly for major disasters and selected crisis events.	Provides sub-metre imagery of affected facilities where free moderate-resolution archives cannot resolve the detail required.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Facility / Site. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

QGIS with imagery plugins — Digitises footprints, measures structures and overlays permits and boundaries; measurement accuracy depends on correct projection and on imagery orthorectification.
Copernicus Browser — Rapid search and visual comparison across Sentinel archives with band combinations and indices; moderate resolution cannot resolve vehicles or small structures.
Google Earth Pro — Historical high-resolution mosaics with a date slider and measurement tools; acquisition dates are approximate and imagery provenance is not always clear.
SNAP or ASF processing tools — Generates radar coherence and change products that reveal disturbance under cloud; requires understanding of interferometric limits or artefacts read as activity.
Overpass Turbo — Queries mapped infrastructure within the site polygon and its surroundings; completeness depends entirely on local mapping effort, which varies enormously.
Shadow and height measurement utilities — Derives structure height from shadow length and known sun geometry; sensitive to terrain slope and to off-nadir viewing angle in the source scene.
Document and entity extraction tooling — Pulls operator names and responsible persons from permits and inspection reports at scale; extraction errors on scanned documents require sampling and manual review.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Owner, occupier and operator are three different questions. Registry records answer the first, leases and permits the second, and only observation or utility and customs records reliably answer the third. Conflating them produces confident attribution to a landlord.
Layout constrains function but does not determine it. Tank farms, conveyors and cooling plant narrow the process family; they do not distinguish legitimate from illicit production. State the constraint, not the conclusion.
Build the baseline before you look for change. Without a season-matched, sun-angle-matched series of normal activity, ordinary industrial variation reads as a significant event, and this is the single most common failure in imagery-based facility work.
Capacity estimates are more defensible than activity claims. Measured footprint, tank dimensions and berth length yield a physical envelope that constrains what any actor could possibly be doing, and it survives challenge better than an interpretation of what they were doing on one date.
Permits are dated evidence of intent and identity, not of current activity. A site may have changed hands and function twice since the last permit, so always compare document date against imagery date before relying on the operator name.
In shared industrial parks, the activity you observe may belong to a neighbour. Establish the internal boundaries and separate access routes before attributing any movement, stockpile or vehicle to your target entity.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Facility / Site is producing anything, and they are worth baselining before you change process or tooling.

Proportion of facility profiles where owner, occupier and operator are separately evidenced rather than assumed identical.
Share of change assessments supported by a documented seasonal baseline rather than a two-image comparison.
Rate at which imagery-derived inferences are later confirmed or contradicted by ground truth, tracked to calibrate interpretation confidence.
Median bracket width, in days, achieved when dating a construction or demolition event from available imagery.
Proportion of facility profiles in which every named entity has been screened against dated sanctions, debarment and enforcement sources.
Number of publications where layout or security detail was withheld following a recorded harm assessment.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Registered address and operating site are often different, and corporate service addresses map to nothing physical at all.
Function inferred from layout is a hypothesis, and dual-use plant looks similar across legitimate and illicit processes.
Sites change hands and purpose without public record, so an old permit may describe a business that left years ago.
Imagery interpretation without ground reference regularly over-reads normal industrial variation as significant change.
Shared industrial parks and sub-tenancy mean observed activity may belong to a neighbour rather than your target.
Publishing precise details of sensitive sites can create security risk and, in some jurisdictions, direct legal exposure.

Legal and ethical considerations

Facility analysis touches security-sensitive sites, private property and, at small sites, individual homes and workplaces. Use lawfully obtained imagery and public records; never trespass, fly restricted airspace or induce insiders to breach duties. Some jurisdictions restrict publication of imagery or details concerning defence and critical infrastructure. Assess harm before publishing layouts or security arrangements, retain source imagery with acquisition metadata for evidential integrity, and keep observation and inference explicitly separated.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Facility / Site, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 10 mission domains, 3 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How confidently can I identify what a facility produces from imagery?

You can usually narrow it to a process family and rarely to a product. Tank farms with vapour recovery, flare stacks and marine loading arms indicate hydrocarbon handling. Conveyors, stockpiles and rail loops indicate dry bulk. Large substations and extensive cooling indicate high electrical load. What imagery cannot tell you is which specific chemical, whether the line is running legitimate or diverted product, or what the batch contains. Say what the layout constrains, list the process families consistent with it, and seek documents or ground truth to discriminate. Confident product identification from overhead alone is where reputations are lost.

The registry says the site belongs to a holding company with no other trace. What next?

Move to the documents that name operators rather than owners. Environmental and planning permits, emissions returns, health and safety notices, customs and bonded warehouse registrations, utility connection records and fire authority filings all name the entity actually running the site and often an individual responsible person. Job advertisements, procurement notices and corporate marketing frequently name the site directly. Trade records referencing the address or the nearest port complete the picture. The holding company is a title-holding shell; the operational paper trail sits with regulators, and it is usually public.

Is drone imagery an option for facility work?

Only within aviation law and property law, which are more restrictive than most analysts assume. Many jurisdictions prohibit overflight of defence, nuclear, port and critical infrastructure sites entirely, require licences for commercial operation, and impose distance limits from people and structures. Flying over private property may constitute trespass or a privacy breach even where the flight itself is lawful. For law enforcement, an unauthorised flight can taint the resulting evidence. Where lawful, drone imagery is excellent and its metadata is far richer than satellite; where not, licensed satellite tasking is the compliant alternative and usually the faster one.

How do I date a change I can see but not bracket?

Use every archive rather than one. Combine Sentinel-2 optical, Sentinel-1 radar which sees through cloud, Landsat for longer history, Planet basemaps where available, and commercial archive searches. Radar coherence loss between passes flags ground disturbance even when optical coverage is clouded out. Then state the bracket honestly: change occurred between the last clean scene showing the old state and the first showing the new. If that bracket is three months because of cloud, say three months. An unjustified narrower claim will be the thing that is attacked.

What can facility analysis contribute to a forced labour or detention investigation?

A great deal, carefully. Imagery can document the construction of walled compounds, watchtowers, internal fencing, dormitory blocks and factory adjacency, with dates, and permits and corporate filings can attribute the site to named operators and their customers. This can be done without putting anyone on the ground at risk, which is its main ethical advantage. What it cannot do is establish what happens inside, which requires testimony. When testimony and imagery are combined, protect the witnesses first: identifying a specific workplace can identify who spoke, so agree publication detail with them and consider whether the site can be described at a coarser level.

Can I publish the security layout of a site I have analysed?

Rarely, and never without weighing it. Fence lines, camera positions, guard posts and access control are exactly the details that help someone attack a site or harm people inside it, and some jurisdictions criminalise publishing such information about defence and critical infrastructure regardless of how it was obtained. The reportable finding is usually that the site is unusually secured, which supports the story without the schematic. Keep the detailed annotation in your archive, publish the conclusion, and record the decision. If a public interest genuinely requires the detail, take legal advice before publication rather than after.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 14001 environmental management and the associated permitting regimes generate the documentary record naming operators and authorised processes.
The EU Industrial Emissions Directive requires permits, reporting and inspection for large installations, producing the European facility record.
The Aarhus Convention establishes public access to environmental information, which is the legal basis for obtaining much facility documentation.
The International Ship and Port Facility Security Code governs port facility security arrangements and identifies designated port facilities.
ISO 19115 geographic metadata standards apply to the polygons, imagery and derived products produced during facility analysis.
The Berkeley Protocol on Digital Open Source Investigations sets the documentation and preservation standard for imagery-based facility findings used in accountability.
The UN Guiding Principles on Business and Human Rights frame corporate responsibility findings that facility-level evidence commonly supports.
The 1954 Hague Convention protects cultural property, which should be identified explicitly in any facility layer used for operational planning.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

ECHO enforcement and compliance history — United States Environmental Protection Agency. Permits, inspections and enforcement records for regulated facilities.
European Industrial Emissions Portal — European Environment Agency. Operator, activity and emissions data for European industrial installations.
Global Energy Monitor trackers — Global Energy Monitor. Openly licensed inventories of energy and heavy industry facilities worldwide.
Global Power Plant Database — World Resources Institute. Global inventory of power generation facilities with capacity and ownership.
Copernicus Data Space Ecosystem — European Space Agency and European Commission. Sentinel optical and radar archives used to build facility imagery baselines.
EarthExplorer archive — United States Geological Survey. Landsat and declassified historical imagery for long-run site history.
Guiding Principles on Business and Human Rights — United Nations. Framework for corporate responsibility findings arising from site-level evidence.
PeeringDB interconnection database — PeeringDB. Open record of data centre facilities and the networks present at each.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: ties site footprints to operators, permits, imagery baselines and trade flows in one profile. Explore the platform, or browse the rest of the library by following any tag above.