Image / Photograph: Data Point Intelligence Guide

Every photograph makes two claims: this is what it shows, and this is where and when it was taken. Both are testable, and both are routinely false.

Understanding the Image / Photograph as an intelligence artifact

An image is a container of pixels plus metadata. EXIF records camera make and model, lens, exposure settings, orientation, timestamps in camera local time, and frequently satellite coordinates with altitude and heading. XMP and IPTC carry editing history, captions, credit and rights information. The file structure itself is evidence: quantisation tables and encoder markers indicate which software last wrote the file, and embedded thumbnails sometimes preserve an earlier, unedited version of the image.

Metadata survival depends entirely on the pipeline. Most social platforms strip metadata and re-encode on upload, so a downloaded image usually carries platform artefacts rather than camera data. Content Credentials under the C2PA standard add a cryptographically signed provenance manifest that can survive editing where tools support it. Screenshots, forwarded messages and repeated re-encoding destroy the original chain, leaving pixel content as the only remaining evidence.

Why it matters

Images are the primary artifact for visual verification and often the only direct evidence of an event. Even stripped of metadata, the pixels contain geographic and temporal information: terrain, architecture, signage, language, vegetation, vehicle types, shadows and weather. Reverse image search establishes prior publication, which is the single most common way recycled and miscaptioned imagery is exposed. Provenance analysis distinguishes an original capture from a copy of a copy.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Camera make, model and body serial number in metadata cluster images taken by the same device across separate cases.
• Coordinate tags with altitude and compass direction give capture position and where the camera was pointed.
• Timestamps in camera local time, compared against sun position and shadows, verify or refute the claimed capture time.
• Encoder markers and quantisation tables reveal the last software used, distinguishing camera originals from re-saves.
• Reverse image search establishes earliest known publication, exposing recycled or deliberately miscaptioned material.
• Background detail such as signage, plate formats, power line design and vegetation constrains country and region.
• Shadow direction and length, combined with a candidate location and date, narrow the possible capture time window.
• Content Credentials manifests, where present, record the capture device and the chain of edits subsequently applied.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• ExifTool — Reads and reports all embedded metadata including EXIF, XMP, IPTC, maker notes and thumbnails.
• Google, Yandex and Bing reverse image search — Prior publication, near-duplicates and visually similar imagery, with differing regional strengths.
• TinEye — Reverse search focused on exact and modified copies, with first-seen dates for each match.
• InVID and WeVerify plugin — Keyframe extraction, magnification, metadata reading and multi-engine reverse search in one toolkit.
• FotoForensics — Error level analysis and metadata inspection for manipulation triage rather than proof.
• C2PA Content Credentials verification — Validates signed provenance manifests where the capture and editing chain supports them.
• SunCalc — Sun azimuth and elevation for a candidate location and time, supporting shadow verification.
• Mapillary and street-level imagery — Ground-level reference imagery for matching buildings, signage and street furniture.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Preserve the original — Hash the file on receipt and work only on copies, recording exactly where and when it was obtained.
2. Extract all metadata — Run a full metadata read including maker notes and embedded thumbnails before any conversion or resizing.
3. Establish prior publication — Run reverse image search across multiple engines to find earlier appearances and their original captions.
4. Geolocate from content — Identify terrain, architecture, signage, language and infrastructure, then match against mapping and street-level imagery.
5. Chronolocate independently — Use shadows, sun position, weather records, vegetation state and visible construction to test the claimed date.
6. Assess manipulation — Check compression artefacts, edge inconsistencies and provenance manifests, treating the result as triage not proof.
7. State confidence explicitly — Report location and time conclusions with the evidence supporting each and the residual uncertainty remaining.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Geospatial Intelligence — Intelligence Derived from Place
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Human Intelligence — Information from People, Ethically Obtained
• Environmental Intelligence — Environmental Conditions, Damage, and Crime
• News Intelligence — Media Reporting as an Intelligence Source
• Dark Web Intelligence — Hidden Services and Closed Criminal Venues
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation
• Threat Actor Intelligence — Tracking Adversary Groups Over Time

Investigated in these domains

• Wildlife Trafficking
• Child Protection
• Art & Antiquities Trafficking
• Extremism & Radicalization
• Conflict & Humanitarian
• Environmental Crime
• Disinformation / IO

Pivots to these data points

• Video — A video file or stream — the core artifact for incident verification and chronolocation.

Inside the platform: where Image / Photograph lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_image — Data point hub
• domain.php?d=wildlife — Wildlife Trafficking dashboard
• domain.php?d=cp — Child Protection dashboard
• domain.php?d=art — Art & Antiquities Trafficking dashboard
• domain.php?d=extremism — Extremism & Radicalization dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Preserve the original is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Establish prior publication turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. State confidence explicitly feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Image / Photograph

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Imagery from the ground, from unmanned systems and from open sources feeds situational awareness, battle damage assessment and pattern of life understanding of an area. Analysts geolocate and chronolocate imagery to place events in space and time, and verify provenance before anything is passed into reporting, because adversary information operations recycle and miscaption imagery deliberately. Constraints are important: an image supports understanding and verification, not positive identification for engagement, which requires corroboration by other means. Imagery of civilians and of protected sites must be handled with the same care as any other sensitive material, and captured personal media raises separate legal questions.

🕵 National intelligence

Images are among the richest single artifacts in open collection, carrying location, time, equipment, personnel and capability information in the pixels regardless of metadata. Requirements-driven work uses them to corroborate or refute reporting from other disciplines and to date events precisely. Verification is the whole discipline: establishing earliest publication, provenance and internal consistency before the content is believed. Handling should reflect that images frequently contain identifiable people, and that the fact of collection may be more sensitive than the image. Preserve originals with hashes, because a re-encoded copy loses exactly the artefacts that would settle a later authenticity dispute.

👮 Law enforcement

Images are exhibits, and the standards are correspondingly strict. Hash on receipt, work on copies, document every transformation, and preserve original metadata untouched, because the defence will examine the chain. Metadata is trivially editable, so an image is authenticated by provenance and by internal consistency rather than by its own EXIF fields. Geolocation and chronolocation performed by an analyst is expert analysis that may need to be explained in evidence. Illegal content must never be retained or circulated and must be routed through the established reporting channel, and imagery of victims requires particular care in disclosure and in court presentation.

🔍 Private investigation and corporate security

Corporate investigators use images for insurance and claims verification, counterfeit documentation, site confirmation, and open source verification in due diligence. Lawful sources are publicly posted content, client-owned material and material provided with consent. What a private actor may not do is obtain images through pretexting, deploy covert cameras in private spaces, harvest and process biometric facial data without a lawful basis, which is expressly regulated in several jurisdictions, or publish images of uninvolved individuals. Preserve originals and document the collection method, since a client's counsel will need to establish where the material came from.

📰 Journalism and OSINT media

Image verification is core journalistic craft: establish earliest publication through reverse search, geolocate from content rather than metadata, chronolocate against sun position and weather, and identify the original uploader where possible. Absent metadata is normal for platform-sourced imagery and is not evidence of manipulation. Publication ethics matter as much as verification: blur bystanders and children, consider whether identifying a location endangers people in it, obtain consent where practical, and be transparent about what has been established and what has not. Generated imagery makes provenance more important than visual plausibility, so document the verification chain in the piece.

🌍 NGO, humanitarian and human rights

For human-rights documentation images are frequently the primary evidence of an incident, supplied by witnesses at personal risk. Victim-centred practice means informed consent about how images will be used, understanding that publication can expose the photographer through metadata, background detail or the mere fact of the angle. Strip metadata before sharing externally but preserve the original securely, since accountability bodies require it. Blur faces of victims, bystanders and anyone who did not consent. Analysts reviewing graphic material need structured psychosocial support and rotation, which should be planned into the workflow rather than added after harm occurs.

🎓 University and research

Researchers use images in conflict documentation, remote sensing validation, social science and computer vision work. Ethics approval is required whenever images depict identifiable people, and boards will normally require consent, blurring or restricted access. Reproducibility means documenting the collection date, the platform, the query and the processing applied, since platforms re-encode and delete content and a dataset is rarely re-collectable. Copyright generally rests with the photographer, so redistribution of scraped image datasets is usually unlawful, and derived features or hashes are the practical sharing route. Report verification methods and their error rates rather than presenting geolocation as certain.

Playbook: working Image / Photograph end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Preserve the original immediately

Hash the file on receipt, record where and when it was obtained and from whom, and work only on copies. Any conversion, resizing or platform re-upload destroys the artefacts that would later settle an authenticity question. A good output is an original file with a checksum and a provenance note. Stop when the pristine copy is stored somewhere your working process cannot touch it.

Phase 2 — Extract all metadata

Run a complete metadata read including EXIF, XMP, IPTC, maker notes, embedded thumbnails and any content credentials manifest, before any processing. Embedded thumbnails sometimes preserve an earlier unedited version of the image. A good output is a full metadata dump stored alongside the file. Stop when everything the container holds has been extracted, including fields you do not yet understand.

Phase 3 — Assess the file structure

Examine quantisation tables, encoder markers, container structure and compression characteristics to establish what software last wrote the file and whether it is plausibly a camera original or a re-save. This is provenance evidence independent of the editable metadata fields. A good output states the likely processing history of the file. Stop when you know whether you hold an original, a platform copy or an edited derivative.

Phase 4 — Establish prior publication

Run reverse image search across several engines with different regional strengths, and search cropped and rotated variants, since exact-match search fails on modified copies. Earliest known publication is the single most effective way to expose recycled and miscaptioned imagery. A good output is a list of earlier appearances with dates and original captions. Stop when the earliest traceable appearance is found or the search space is genuinely exhausted.

Phase 5 — Identify the original source

Trace back through reposts to the account or outlet that first published it, and assess that source: history, location, prior reliability, and whether they claim authorship. Many verification failures are failures to look past the second repost. A good output names the earliest identifiable publisher and characterises their reliability. Stop when you either reach an original poster or document that the chain is broken.

Phase 6 — Geolocate from content

Work from the pixels rather than the metadata: terrain profile, architecture, signage, language and script, road markings, power line and pole design, vegetation, vehicle types and plate formats. Match candidate features against mapping, satellite and street-level imagery. A good output is a location with the specific matched features listed. Stop when at least three independent features corroborate the same place.

Phase 7 — Chronolocate independently

Use shadow direction and length against computed sun position, weather records, vegetation state, snow cover, visible construction progress and any dated objects in frame to bracket when the image was taken. A good output is a time window with the evidence supporting each bound. Stop when the bracket is as tight as the evidence allows rather than as tight as the claim requires.

Phase 8 — Test metadata against content

Compare embedded coordinates and timestamps against your independent geolocation and chronolocation. Agreement strengthens both; disagreement means the metadata is wrong, edited or the content is misattributed, and the pixels usually win. A good output explicitly reconciles or contradicts the metadata. Stop when the two lines of evidence have been compared rather than one being assumed. Where they disagree, state which you relied on and why, since that judgement is the analysis a reviewer will examine.

Phase 9 — Assess manipulation as triage

Examine compression artefacts, edge inconsistencies, lighting and shadow coherence, perspective and any content credentials manifest, treating the results as triage rather than proof. Error level analysis in particular is widely misread and does not demonstrate manipulation on its own. A good output states what was checked and what it does and does not support. Stop before a triage indicator is described as evidence of fabrication.

Phase 10 — Consider synthetic generation

Where the image could plausibly be generated, weigh provenance far above appearance: is there a signed capture manifest, an identifiable photographer, a corroborating second image from a different angle, or physical evidence in the scene that matches known reality. Detection tools are unreliable and improving generators outpace them. A good output rests on provenance rather than on a detector score. Stop when the chain to a real camera is established or is documented as absent.

Phase 11 — Corroborate with independent evidence

Seek a second image or video of the same event from a different angle, a witness account, an official record or overhead imagery for the date. A single image verified in isolation is far weaker than two independent captures that agree. A good output pairs the image with at least one independent corroboration. Stop when the event, not just the image, is supported.

Phase 12 — Publish with care and confidence

State location and time conclusions with the evidence for each and the residual uncertainty, blur bystanders and children, consider whether the location endangers anyone, strip metadata from published copies while preserving originals, and route any illegal content to the proper authority. A good output shows the working and protects the people in frame. Stop when the published version reflects a recorded decision about both accuracy and harm.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ExifTool	Open	Comprehensive metadata reader and writer supporting EXIF, XMP, IPTC, maker notes, embedded thumbnails and hundreds of file formats.	The standard first step on any image: full metadata extraction including fields most viewers never display.
Google reverse image search and Lens	Open	Large-scale visual similarity and near-duplicate search across indexed web imagery with object and text recognition.	Establishes prior publication and identifies objects, signage and landmarks that support geolocation.
Yandex image search	Open	Visual search engine with notably strong performance on faces, buildings and imagery from eastern Europe and central Asia.	Frequently returns matches that other engines miss, particularly for imagery from Russian and central Asian sources.
TinEye	Open	Reverse image search focused on exact and modified copies, returning first-seen dates and the full set of known appearances.	Best tool for establishing earliest known appearance, which is the core recycled-imagery check.
InVID and WeVerify verification plugin	Open	Browser toolkit combining keyframe extraction from video, magnification, metadata reading and multi-engine reverse search.	One-stop verification workflow, especially for extracting searchable keyframes from video before reverse search.
FotoForensics	Open	Online analysis offering error level analysis, metadata inspection, quantisation table review and file structure examination.	Triage of file processing history, with the essential caveat that error level analysis does not prove manipulation.
C2PA Content Credentials	Open	Open standard for cryptographically signed provenance manifests recording capture device and subsequent editing operations.	Where present, provides verifiable provenance that survives editing, which is increasingly the answer to synthetic imagery.
SunCalc	Open	Computes sun azimuth, elevation, sunrise, sunset and shadow direction for any location and time.	Core chronolocation tool: compares computed sun geometry against shadows visible in the image.
Mapillary	Open	Crowd-sourced street-level imagery covering many countries, searchable by location and date with sequence playback.	Ground-level reference for matching buildings, signage, street furniture and road markings during geolocation.
OpenStreetMap and Overpass	Open	Mapped features searchable by type and geometry, including buildings, roads, power lines and points of interest.	Narrows candidate locations by querying for distinctive feature combinations visible in the image.
Historical weather archives	Open	Surface observations of cloud, precipitation, temperature and visibility by station and date going back decades.	Tests whether the weather visible in the image is consistent with the claimed date and location.
Bellingcat online investigation toolkit	Open	Curated and maintained collection of verification, geolocation and archiving tools with practical methodology guides.	Reference for current working tools, which change frequently as services close or restrict access.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Image / Photograph. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• ExifTool — Extracts and can write all embedded metadata; because it writes as well as reads, metadata is proof of nothing on its own and must be corroborated.
• InVID and WeVerify plugin — Extracts video keyframes and runs multi-engine reverse search from the browser; keyframe selection can miss the frame that would have matched.
• Hashing utilities and perceptual hashing — Cryptographic hashes preserve integrity while perceptual hashes find near-duplicates after re-encoding; perceptual hashes also collide on visually similar unrelated images.
• SunCalc and shadow analysis tools — Compute expected sun geometry for chronolocation; conclusions are highly sensitive to correct time zone and to accurate estimation of shadow angles.
• QGIS with imagery layers — Matches terrain profiles and building footprints against candidate locations; requires care with projection and with imagery vintage relative to the photograph.
• C2PA verification tools — Validate signed provenance manifests where present; absence of a manifest is entirely normal and says nothing about authenticity.
• Archiving services and local capture — Preserve source pages and images with timestamps before deletion; archives can themselves be manipulated or fail to capture dynamic content, so local copies matter.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The pixels outrank the metadata. Metadata is editable in seconds and is wrong routinely even without tampering, so an image is verified by content geolocation, chronolocation and provenance, and metadata that agrees is corroboration rather than proof.
• Absent metadata is the normal case, not a red flag. Every major platform strips EXIF and re-encodes on upload, so a downloaded image carrying no camera data tells you it came from a platform, not that someone concealed something.
• Search the crop, not just the image. Exact-match reverse search fails on re-cropped, rotated, watermarked and re-encoded copies, which is exactly how recycled imagery propagates, so search regions of the image separately.
• Three independent features beat one distinctive one. A single matching building can be coincidence or a similar design; terrain profile plus a road junction plus a power line configuration in correct relative geometry is a geolocation.
• Camera clocks lie constantly. Time zones are set wrong, clocks reset to epoch after battery removal, and users never correct them, so a timestamp is a hypothesis to be tested against sun position and weather rather than a fact.
• Error level analysis is the most misused tool in the field. It shows compression discontinuity, which occurs for many innocent reasons, and it has been used to allege manipulation in images that were entirely genuine.
• Against synthetic imagery, provenance beats appearance. Detectors degrade as generators improve, so the durable questions are whether the file traces back to a real camera and a real person, and whether a second independent capture of the same scene exists.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Image / Photograph is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of images hashed and preserved in original form before any processing, conversion or resizing was applied to a working copy.
• Rate at which geolocation conclusions are supported by three or more independently matched features rather than a single distinctive landmark.
• Share of verification failures caught before publication through prior-publication search rather than after a correction.
• Median number of independent engines and search variants used per reverse image search, as a proxy for search thoroughness.
• Proportion of published imagery with bystanders and children redacted and metadata stripped, audited by sample.
• Rate at which chronolocation claims are supported by a computed solar or weather check rather than by metadata timestamps.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Absent metadata is normal for platform-sourced images and is not evidence of deliberate stripping or concealment.
• Metadata is trivially editable, so fields supporting a convenient conclusion deserve more scrutiny rather than less.
• Camera clocks are frequently wrong or set to the wrong time zone, shifting timestamps by hours or even years.
• Error level analysis is widely misread and does not reliably demonstrate manipulation on its own.
• Reverse image search coverage is uneven by region and language, so no results does not establish first publication.
• Generated and synthetic imagery increasingly defeats visual plausibility checks, making provenance more important than appearance.

Legal and ethical considerations

Images frequently contain identifiable people, children, homes and embedded location data, so handle them as personal and potentially special-category data. Establish a lawful basis before collecting or retaining, minimise what you keep, and blur or crop bystanders in any published product. Never retain or circulate illegal content; route it to the appropriate authority through the established reporting channel. Preserve originals with hashes, keep annotations in separate files, and document every transformation to maintain evidential integrity.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Image / Photograph, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 7 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

There is no metadata at all. Has it been scrubbed?

Almost certainly it was just uploaded somewhere. Every major social platform and messaging service strips EXIF and re-encodes images on upload, so the overwhelming majority of imagery circulating online carries no camera data at all. That is a statement about the distribution pipeline, not about intent. What the file will carry instead is platform artefacts: characteristic quantisation tables, dimensions and encoder markers that identify where it passed through. Use those to understand the chain, then verify the image by content geolocation, chronolocation and prior publication, which is what you would need to do regardless.

The EXIF coordinates match the claimed location. Is that enough?

No. Metadata is editable with free tools in seconds, and it is frequently wrong even when nobody has tampered with it, because devices record last known positions, network-derived fixes and stale cached locations. Treat embedded coordinates as a hypothesis, then test it against the pixels: does the terrain profile match, do the buildings and their relative geometry match street-level and satellite imagery, do the signage and language fit. If the content confirms the metadata, you have a strong result. If they disagree, the content is usually right and the metadata needs explaining.

How do I know an image is not AI generated?

You establish provenance rather than judging appearance, because detectors are unreliable and degrade as generators improve. The strong evidence is a chain back to a real camera and a real person: an identifiable original poster with a history, a signed content credentials manifest, a camera original file with coherent metadata and compression characteristics, or a second independent capture of the same scene from a different angle. Physical corroboration helps: does the scene match satellite imagery from that date, do the shadows compute correctly, do details match known reality. Absence of provenance is a reason for caution, not proof either way.

What is the correct way to handle an image containing illegal content?

Stop, do not copy or circulate it, and route it immediately through your organisation's established reporting channel to the appropriate authority or hotline. Do not retain it for analysis, do not share it with colleagues to confirm, and do not attempt your own investigation. Every jurisdiction criminalises possession and distribution of certain content, and good intentions are not a defence in most of them. Organisations working in areas where this arises should have a written protocol, a named responsible person, and support for staff who encounter it, established before it happens rather than improvised.

How much of an image should be redacted before publication?

Enough that no one is endangered who did not choose to be. Blur faces of bystanders and children as a default, and of anyone who did not consent to appear. Consider whether identifiable background detail, such as a house, a street sign or a vehicle plate, exposes the photographer or the people in the scene, particularly in repressive environments. Strip metadata from the published copy while preserving the original securely. Where the subject took a risk to supply the image, they should have a say in what is published, and their assessment of their own exposure should generally prevail.

How should images be preserved for accountability proceedings?

Hash on receipt with a documented algorithm, store the original unmodified, and record where it came from, from whom, and when, including the platform and the collection method. Keep every derived file, crop, enhancement and annotation separately with its own note describing what was done and by whom, so the chain from original to exhibit is explicit. Preserve the full metadata extract alongside. Store securely with access logging, since the material is frequently sensitive and identifiable. The Berkeley Protocol sets this out in detail and is the standard that international accountability bodies increasingly expect.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• The Berkeley Protocol on Digital Open Source Investigations sets collection, preservation, verification and analysis standards for open source imagery used in accountability.
• The C2PA specification defines cryptographically signed content provenance manifests recording capture and editing history.
• The EXIF specification and the IPTC and XMP metadata standards define the fields embedded in image files and their meaning.
• ISO 17025 accreditation applies to forensic laboratories producing image authentication evidence in several jurisdictions.
• SWGDE best practices for digital and multimedia evidence define handling, continuity and examination expectations.
• The EU General Data Protection Regulation treats images of identifiable people as personal data, and biometric processing as special category data.
• The Minnesota Protocol and the Istanbul Protocol frame documentation standards for imagery evidencing unlawful death and torture.
• The IPTC photo metadata standard defines rights, credit and caption fields relied on in publication and syndication.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. ExifTool metadata reader — Phil Harvey. The reference tool for extracting embedded image and video metadata.
2. Berkeley Protocol on Digital Open Source Investigations — United Nations Office of the High Commissioner for Human Rights. Standards for collecting, preserving and verifying open source imagery evidence.
3. Content Credentials technical specification — Coalition for Content Provenance and Authenticity. Open standard for signed provenance manifests attached to media files.
4. InVID and WeVerify verification toolkit — InVID and WeVerify projects. Browser plugin combining keyframe extraction, metadata reading and reverse search.
5. TinEye reverse image search — TinEye. Search focused on exact and modified copies with first-seen dates.
6. Photo metadata standard — International Press Telecommunications Council. The standard defining caption, credit and rights fields in professional imagery.
7. Online investigation toolkit and methodology guides — Bellingcat. Maintained reference for current verification and geolocation tooling.
8. Best practices for digital and multimedia evidence — Scientific Working Group on Digital Evidence. Handling and examination guidance for image evidence.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: extracts image metadata, hashes originals and runs geolocation and prior-publication checks. Explore the platform, or browse the rest of the library by following any tag above.