Geospatial Intelligence (GEOINT): Intelligence Discipline Guide

Place is the one attribute nearly every other data point carries. Geospatial intelligence makes place answer questions: what is here, what changed, and what would have to be true for this to be where it claims.

What Geospatial Intelligence is as a discipline

Geospatial intelligence is the analysis of activity referenced to location, fusing imagery, terrain, infrastructure, boundaries, movement tracks and demographic layers into a spatial picture. It covers geolocation and chronolocation of media, terrain and viewshed analysis, route and accessibility modelling, spatial statistics and change detection, and cartographic production for decision-makers. It is not the same as imagery interpretation. Imagery is one input among vector data, elevation models, sensor tracks, survey data and field reporting, all reconciled into a common coordinate reference system.

In the cycle it is processing and analysis with a strong production element, because the map or the confirmed geolocation is usually the deliverable. Sub-methods include coordinate and datum handling, georectification of oblique and historic material, proximity and buffer analysis, route and chokepoint modelling, spatial clustering of event data, and pattern analysis kept to lawful, aggregate use rather than the tracking of identifiable private individuals.

Why it matters

Geospatial intelligence answers where an event actually occurred, whether a claimed location is physically possible, what a site can and cannot support, and how terrain and infrastructure constrain movement. It reconciles claims against ground truth without cooperation from anyone at the location, and it converts scattered incident reporting into geography, which is what turns a list of events into a picture of where a problem concentrates and why.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Terrain profiles, horizon lines and building geometry in a photograph that match or contradict the claimed location.
Sun angle and shadow length, which constrain the date and time an outdoor image could have been captured.
Road, rail, port and pipeline connectivity determining whether a claimed logistics route is physically feasible.
Change over time at a site: new construction, cleared ground, spoil heaps, vehicle counts or track wear.
Clustering of incident data around specific corridors, borders, facilities or administrative boundaries.
Land use designations and jurisdictional boundaries determining which authority licenses or polices a site.
Elevation and viewshed constraints on observation, line-of-sight communication or approach routes into and out of a site.
Accessibility modelling showing realistic travel times rather than straight-line distance on a map.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

OpenStreetMap — Open vector base data for roads, buildings, land use and infrastructure, with edit history per feature
Copernicus Data Space Ecosystem — Free Sentinel optical and radar imagery with regular revisit for change detection
NASA Worldview and FIRMS — Daily global imagery browsing and near real-time thermal anomaly and fire detections
USGS EarthExplorer — Decades of Landsat and declassified historic imagery for long-baseline change analysis
Copernicus DEM and SRTM — Open elevation models supporting terrain, viewshed, routing and flood-related analysis
GeoNames — Open gazetteer with place name variants, coordinates and administrative hierarchy
Natural Earth — Public domain boundary, coastline and physical layers for clean small-scale cartography
ACLED — Geocoded conflict and protest events for spatial clustering and corridor analysis

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

State the geographic question — Define the area of interest, the timeframe and the decision the map or geolocation supports, so collection stays bounded.
Assemble base layers — Bring imagery, vector, elevation and boundary data into one coordinate reference system, recording the datum and projection used.
Ground the area — Establish what is normally present using recent imagery and open map data, so later change is measured against a baseline.
Geolocate and chronolocate — Match at least three independent features against reference imagery, then constrain time using shadows, vegetation and known construction.
Run the analysis — Apply change detection, proximity, routing or clustering as the question requires, documenting parameters so results are reproducible.
Validate independently — Confirm the finding against a different sensor, date or source before it leaves the analyst's screen.
Produce the map — Publish with scale, projection, capture dates, source credits and an explicit statement of positional uncertainty.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
Person / Name — A named individual — the subject of identity resolution and profiling.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
Satellite Imagery — Overhead imagery of an area of interest, used for change detection and site analysis.
Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.

Related disciplines

Imagery Intelligence — Interpretation of Visual Imagery

Inside the platform: where Geospatial Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=GEOINT — Discipline hub
source-catalog.php?disc=GEOINT — Source catalogue filtered to this discipline
search.php — Company / Organization profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Score Country Risk
Sync Intel Domains
Resolve Everything
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. State the geographic question is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Ground the area turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Produce the map feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Geospatial Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Geospatial intelligence is the backbone of intelligence preparation of the battlespace and of every targeting and manoeuvre product. Analysts build terrain and infrastructure layers, model mobility corridors, chokepoints, viewsheds and lines of communication, and maintain the common operating picture in a shared coordinate reference system so fires, movement and logistics all reference the same ground. It supports collateral damage estimation, force protection and route planning, and feeds J2 products with named area of interest overlays. Constraints are strict: datum and projection errors produce real-world consequences, imagery licensing follows into products shared with partners, and protected sites recorded under international humanitarian law must be maintained and respected in every geospatial product.

🕵 National intelligence

National agencies use geospatial intelligence as the fusion surface for everything else. Reporting from technical, human and open sources is resolved onto a common geography, which is what allows contradictory reports to be tested against terrain and distance. Requirements drive persistent monitoring of named locations, change detection at strategic facilities, and geospatial support to policy questions about infrastructure, resources and population movement. Classification usually follows the source rather than the geography, so unclassified derived products are built deliberately to enable partner sharing. Dissemination discipline includes recording the coordinate reference system, the source imagery date and the confidence in each geolocation.

👮 Law enforcement

Investigators use geospatial analysis for crime series mapping, route and cell of activity analysis, scene reconstruction and the geolocation of user-generated media in evidence. Evidential standards require that a geolocation be reproducible: the reference imagery, its date, the matched features and the coordinate system must be recorded so an expert for the other side can check it. Location data held by third parties, including handset and vehicle telematics, requires legal process and does not become available because a map can display it. Crime mapping that affects policing of specific communities raises proportionality and discrimination considerations that should be addressed before deployment, not after.

🔍 Private investigation and corporate security

Corporate security uses geospatial work for site and route risk assessment, supply chain mapping, asset verification and litigation support such as establishing whether a facility existed on a given date. Open and commercial imagery, boundary data and infrastructure layers support this well. What a private actor may not do is track identifiable individuals: sustained location monitoring of a person, whether by device, vehicle or aggregated location data purchase, is unlawful or heavily regulated in most jurisdictions and is a common route to criminal liability. Drone collection is separately governed by aviation and privacy law and usually requires permissions and notification.

📰 Journalism and OSINT media

Newsrooms use geolocation to establish where a photograph or video was taken, which is often the difference between a verified story and an unverifiable claim. The standard is a documented match: named reference imagery with its date, at least three independent matched features, and consistency of shadows, terrain and vegetation with the claimed time. Publish the method so readers can check it. Ethics require withholding precise coordinates where publication would endanger people, expose shelters, medical facilities or the homes of private individuals, and a right of reply where a location finding underpins an allegation against a named party.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights teams use geospatial analysis for needs assessment, access and route planning, damage assessment and incident documentation for accountability. Do-no-harm dominates the publication decision: precise coordinates of shelters, safe houses, medical facilities, witnesses and mass grave sites can directly endanger people, so products are aggregated to administrative units or delayed. Documentation for accountability requires recording the imagery source, date and processing chain so a future mechanism can rely on it. Duty of care includes protecting field staff whose reported positions can be inferred from published maps, and controlling access to any dataset that could locate beneficiaries.

🎓 University and research

Researchers use geospatial methods for conflict, environment, urbanisation and displacement studies. Reproducibility requires publishing the coordinate reference system, the source datasets with versions and dates, the processing steps and the code, since a map is not a method. Ethics approval is engaged where analysis could locate identifiable people or vulnerable populations even in aggregate, and spatial data on small populations is re-identifiable more often than researchers expect. Data sharing must respect imagery licences, which frequently prohibit redistribution of the source while permitting publication of derived measurements, and open datasets carry attribution and share-alike obligations that follow into publications.

Playbook: working Geospatial Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the geospatial question

State what must be established about a place: whether an object is present, when a change occurred, whether a route is passable, whether a claimed location is correct, or how a population is distributed relative to a hazard. Attach the decision and the required precision, because a hundred-metre answer and a one-metre answer demand entirely different collection. A good output is a question with an explicit accuracy requirement and deadline. Stop when the accuracy requirement is agreed, since it determines every subsequent source choice.

Phase 2 — Fix the reference frame

Decide and record the coordinate reference system, datum and projection for the work, and convert everything into it on ingest rather than at the point of use. Note the vertical datum separately if elevation matters. Datum mismatch produces silent horizontal shifts of tens to hundreds of metres, which is the single most common cause of confidently wrong geospatial products. A good output is a documented reference frame recorded in the project metadata. Stop when every incoming dataset has been checked and transformed, not merely assumed correct.

Phase 3 — Assemble the base layers

Bring in administrative boundaries with their official codes, transport networks, hydrology, elevation, land cover and settlement data at a resolution matched to the question. Record the source, version, date and licence for each. Check boundary vintage against the analysis period, because administrative geography changes and using current boundaries for historic data produces uncomparable results. A good output is a documented layer inventory. Stop when the base supports the question at the required accuracy rather than when it looks complete.

Phase 4 — Task or select imagery

Choose imagery on the basis of the accuracy requirement, the revisit interval needed to bound a change in time, and cloud or illumination constraints. Open Sentinel and Landsat archives establish long baselines and rough change; commercial high resolution is required for object identification; radar is used where cloud or darkness would otherwise block coverage. Record every scene identifier and acquisition timestamp. A good output is an imagery list bracketing the event in time. Stop when the before and after coverage genuinely bounds the change window.

Phase 5 — Georeference and align

Georectify oblique, historic or scanned material against control points visible in reference imagery, and record the residual error rather than reporting a coordinate as exact. Align all raster and vector layers, then check alignment on independent features away from the control points used. A good output is a stated positional accuracy for the product, expressed as a distance. Stop when the residual error is smaller than the accuracy requirement fixed at the start, or when the shortfall is documented.

Phase 6 — Geolocate the media

For user-generated imagery, work from the general to the specific: terrain profile and horizon shape, then road and building geometry, then distinctive features such as signage, towers, unusual roof forms and vegetation patterns. Require at least three independent, non-repeating features before asserting a location, and reconcile the perspective and camera height with the claimed position. A good output is an annotated comparison showing each matched feature. Stop when the match is over-determined rather than merely plausible.

Phase 7 — Chronolocate

Bound the time of capture independently of any claimed timestamp. Use shadow direction and length against solar position for the candidate date, weather records, vegetation state, construction progress visible in dated imagery, and the presence or absence of features whose appearance date is known. State the resulting window rather than a point. A good output is a defensible time range with the method shown. Stop when the window is tight enough for the decision or when further narrowing would require data you cannot obtain.

Phase 8 — Detect and characterise change

Compare aligned imagery across dates, distinguishing genuine change from seasonal, illumination, sensor and processing differences. Use radar coherence where optical comparison is unreliable and thermal or spectral indices where the change is not visible in true colour. Describe what is measurably different before interpreting what it means. A good output is a change record with dates, the observed difference and a separately stated interpretation. Stop when the change is described in terms another analyst could verify from the same scenes.

Phase 9 — Model the spatial question

Apply the analysis the question actually needs: viewshed for observation and fires, least-cost path or network routing for movement, buffers and proximity for exposure, spatial clustering for event patterns, or population-weighted overlay for consequence. Document parameters and check outputs against known ground truth. Avoid presenting model output as observation. A good output is a modelled result with parameters, assumptions and a sanity check recorded. Stop when the model has been tested against at least one case with a known answer.

Phase 10 — Apply the harm test

Before release, assess what the product enables. Precise coordinates of shelters, clinics, schools, witnesses, private homes, minority communities and grave sites can cause direct harm, and aggregation of individually harmless layers can locate people. Decide whether to generalise to administrative unit, delay release, or withhold. Record what was withheld and why. A good output is a documented harm review signed by someone other than the analyst. Stop when the released detail is the minimum the decision requires.

Phase 11 — Produce the cartography

Design the product for the decision: correct scale, a legible legend, an explicit north arrow and scale bar, stated coordinate reference system, source and date of every layer, and the positional accuracy of the analysis. Use colour that survives greyscale printing and colour vision deficiency. Distinguish observed features from modelled ones visually. A good output is a map that cannot be misread about what is measured and what is inferred. Stop when a reader unfamiliar with the project can state the source and date of every element.

Phase 12 — Archive and reproduce

Store source scenes or their identifiers, the processing chain, the parameters, the control points and the output with hashes, so the finding can be reproduced after the imagery provider changes its catalogue. Record the licence attached to every input and the redistribution rights of the output. A good output is a package a second analyst can rerun. Stop when reproduction has actually been tested by someone else, not merely assumed possible.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Copernicus Data Space Ecosystem	Registration	Free access to Sentinel-1 radar and Sentinel-2 optical imagery with processing tools and a browsing interface.	Primary open source for change detection and all-weather radar coverage where commercial tasking is unavailable.
USGS EarthExplorer	Registration	Archive of Landsat, aerial photography, declassified historic imagery and elevation products from US civil programmes.	Builds decades-long baselines for a site so recent change can be distinguished from long-term normal variation.
NASA Worldview and FIRMS	Open	Near real time global satellite imagery browsing and active fire and thermal anomaly detections from MODIS and VIIRS.	Rapid confirmation of fires, flaring and large thermal events with timestamps that bound an incident in time.
OpenStreetMap	Open	Community-maintained global vector map of roads, buildings, land use and points of interest with full edit history.	Supplies routable networks and building footprints for geolocation and access analysis; edit history dates feature appearance.
GeoNames	Open	Open gazetteer of place names with alternate and historic names, feature classes, coordinates and population.	Resolves place-name references in text and media captions to coordinates across languages and transliterations.
NGA GEOnet Names Server	Open	Official gazetteer of foreign geographic names with approved and variant forms and feature designation codes.	Authoritative naming for foreign features where consistency with official reporting conventions is required.
Copernicus Emergency Management Service	Open	Rapid mapping and risk and recovery products for disasters, including damage grading and delineation maps.	Provides validated damage and extent mapping for events where independent production would be slower or less rigorous.
UNOSAT	Open	Satellite-derived analyses for humanitarian and human rights purposes, including damage assessment and displacement mapping.	Independent, citable geospatial assessments produced to a documented standard for accountability and humanitarian use.
Humanitarian Data Exchange common operational datasets	Open	Administrative boundaries, place codes, population and settlement data curated per country for humanitarian response.	Supplies the official boundary and place-code framework so products join with other agencies' data.
ACLED	Registration	Georeferenced political violence and protest events with dates, actors, location precision codes and source notes.	Enables spatial clustering and pattern analysis of conflict events with a documented geolocation precision field.
EPSG Geodetic Parameter Dataset	Open	Registry of coordinate reference systems, datums, projections and transformation parameters with stable identifiers.	Ensures correct datum handling and documented transformations rather than assuming all coordinates are WGS 84.
Global Human Settlement Layer	Open	Global built-up area, population grid and settlement classification products derived from satellite and census data.	Provides consistent population and built-up exposure denominators for consequence and vulnerability analysis.
Mapillary and street-level imagery collections	Registration	Crowd-contributed street-level photographs with positions and capture dates covering many road networks worldwide.	Confirms ground-level detail such as signage, kerb layout and building facades during geolocation of user-generated media.
Global Fishing Watch	Registration	Vessel activity and apparent fishing effort derived from transponder data with vessel identity and port visit information.	Adds maritime movement to the spatial picture where activity of interest occurs at sea rather than on land.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Geospatial Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

QGIS — Open desktop geographic information system with strong format support, processing toolbox and plugin ecosystem. Limitation: heavy raster workflows and very large datasets outpace it without external processing.
GDAL and PROJ — Command line libraries for raster and vector conversion, reprojection and coordinate transformation. Limitation: correct transformations still yield wrong results if the source datum was mislabelled upstream.
Google Earth Pro — Historic imagery viewer with measurement, elevation profile and rapid visual comparison across dates. Limitation: imagery dates are approximate and the licence restricts many professional redistribution uses.
SNAP and Sentinel toolboxes — Processing environment for Sentinel radar and optical data including coherence and interferometry workflows. Limitation: steep learning curve and radar results are easy to misinterpret without training.
SunCalc and solar position calculators — Compute sun azimuth and elevation for a date, time and location to test shadow consistency. Limitation: they establish consistency with a candidate date, not proof of it, since many dates share similar geometry.
Overpass Turbo — Query OpenStreetMap features by tag within an area, useful for finding candidate structures during geolocation. Limitation: results reflect uneven community mapping density, so absence proves nothing.
Elevation and viewshed tooling on SRTM or Copernicus DEM — Models line of sight, terrain profiles and observation coverage. Limitation: standard digital elevation models exclude buildings and vegetation, so urban viewsheds are systematically optimistic.
Georeferencing tools for oblique and historic imagery — Fit non-nadir or scanned imagery to a reference frame using control points. Limitation: accuracy depends entirely on control point quality and residual error must be reported, not hidden.
Web map archiving and tile capture utilities — Preserve the exact basemap state relied on for a finding. Limitation: provider terms often restrict tile retention and redistribution even for evidential purposes.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
Sync Intel Domains — Refreshes the reference and country-level intelligence datasets from their authorities.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Datum before analysis, always. A coordinate without a stated reference system is not a location, and the resulting shift is large enough to put a finding in the wrong field, the wrong building or the wrong side of a border.
Require over-determination in geolocation. Three independent, non-repeating features that all fit is a match; one distinctive feature that fits is a hypothesis, and the difference is where confident errors are made.
Chronolocate independently of any claimed timestamp. Shadows, vegetation state, construction progress and weather records bound the capture window without relying on metadata that is trivially altered or stripped by platforms.
Describe change before interpreting it. Recording that a fifty metre revetment appeared between two dated scenes is verifiable; recording that a unit deployed is an inference that a reviewer must be able to dispute separately.
Standard elevation models do not include buildings or trees, so urban and forested viewsheds are systematically too generous. Say which model you used and what it omits whenever line of sight matters.
Aggregation of harmless layers can locate people. Combining a generalised incident map with a settlement layer and a road network can identify a household, so run the harm test on the assembled product rather than each input.
Imagery licensing follows into derived products more often than analysts assume. Measurements and annotations are usually publishable where the underlying scene is not, but the distinction must be checked before delivery, not after.
Boundary vintage matters as much as boundary accuracy. Analysing historic events against current administrative geography produces figures that cannot be reconciled with contemporaneous official statistics.
Radar coherence answers questions optical imagery cannot, particularly structural change under cloud or at night, but it is easy to over-read; check any coherence loss against an independent optical or ground observation before asserting damage.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Geospatial Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Stated positional accuracy accompanying every geolocation product, and the proportion of products where an independent analyst reproduced the location from the published method.
Median time from event to bounded chronolocation window, tracked alongside the width of that window rather than speed alone.
Proportion of change detections later corroborated by an independent source or sensor, and the rate of retracted detections attributable to seasonal or illumination artefacts.
Share of published products carrying full layer provenance: source, version, acquisition date, coordinate reference system and licence for every element.
Number of harm reviews resulting in generalisation, delay or withholding, recorded as evidence that the review is a real control rather than a formality.
Reproduction success rate when archived analysis packages are rerun by a different analyst after the source catalogue has changed.
Error rate detected in periodic datum and alignment audits of production layers, trended to show whether ingest controls are holding.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Coordinate confusion. A wrong datum, projection or reversed latitude and longitude displaces everything silently and consistently.
Confirming a location from a single matching feature, when many junctions, roofs and treelines look alike.
Uneven map completeness, where sparse coverage in under-mapped regions is mistaken for absence of infrastructure.
Treating the imagery capture date as the event date, when the nearest pass may be days either side.
Publishing precise coordinates that expose shelters, witnesses or vulnerable sites to harm.
Claiming detail finer than the ground sample distance supports, which no reviewer can reproduce.

Legal and ethical considerations

Publishing precise locations of people, shelters, medical facilities or protected sites can cause direct harm, so apply a do-no-harm test before releasing coordinates. Satellite data licensing varies sharply: Copernicus and Landsat are open, most commercial imagery is not, and redistribution terms follow into your products. Some jurisdictions restrict mapping, survey or aerial imaging of specific areas, and drone collection is governed by aviation and privacy law. Keep movement analysis aggregated rather than tracking identifiable private individuals.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Geospatial Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How many matched features are enough to call a geolocation confirmed?

Three independent, non-repeating features is the working minimum, and more is better where the environment is repetitive. Independence is the operative word: three identical apartment blocks in a planned development are effectively one feature, whereas a road junction geometry, a distinctive roof structure and a terrain horizon are three. Reconcile perspective too, since features can all be present but in geometrically impossible relative positions. Publish an annotated comparison showing each match against named reference imagery with its date, so a reader or opposing expert can check the work rather than trusting the conclusion.

Can shadows prove the date a photograph was taken?

They establish consistency, not proof. Solar azimuth and elevation for a given location repeat approximately twice a year, so a shadow analysis typically yields two candidate date ranges rather than one. Use it alongside independent constraints: weather records, vegetation state, snow cover, construction progress visible in dated satellite imagery, and the presence of features whose appearance date is known. Report a window rather than a date. Also confirm the camera location first, because shadow analysis against the wrong position produces a confident and entirely wrong date.

When should coordinates be withheld from publication?

Whenever precision adds nothing to the reader's understanding but adds risk to people. That covers shelters, safe houses, clinics, schools, witness residences, minority community locations, humanitarian facilities in conflict, and suspected grave sites where perpetrators could interfere with evidence. Generalise to an administrative unit, publish a cropped or rotated image, or delay release until the risk changes. Record what was withheld and why so the decision is auditable. The countervailing case is where precise location is itself the finding, such as a strike on a protected site, and even then consider timing and consultation with those at risk.

Is open imagery good enough, or is commercial tasking necessary?

It depends on the accuracy requirement set at the start. Sentinel-2 at ten metres and Landsat at thirty establish extent, land cover change, large construction and long baselines extremely well and cost nothing. Object identification, counting vehicles, or assessing damage to individual structures generally requires sub-metre commercial imagery. Sentinel-1 radar is often the better answer under persistent cloud or at night, and its coherence products detect structural change that optical cannot see. The usual mistake is tasking expensive imagery before the open archive has been used to bound the change window.

How should drone-collected imagery be handled?

As a regulated collection activity, not as photography. Aviation authorities govern where and how flights may occur, including restrictions near airports, crowds, borders and critical infrastructure, and permissions and operator competence requirements vary by jurisdiction and by weight class. Privacy law applies to imagery of people and private property, and several states restrict aerial imaging of designated sites entirely. In conflict areas a drone may be mistaken for a military system, endangering the operator and others. Record permissions, flight logs and sensor parameters, and preserve original files with metadata if the imagery may become evidence.

What makes geospatial analysis admissible or usable for accountability?

Reproducibility and provenance. Record the source scenes with identifiers and acquisition timestamps, the coordinate reference system and any transformation applied, the processing steps and parameters, the control points used, and the residual positional error. Preserve original files with hashes and a chain of custody. State clearly which elements are observed and which are modelled. The Berkeley Protocol sets the expectation for open source derived material in international accountability contexts. The practical test is whether an independent analyst, given your package, reaches the same result without contacting you.

Why do two teams get different coordinates for the same feature?

Usually datum or basemap offset. Different providers align imagery to different reference frames and some basemaps carry systematic shifts, notably where national coordinate systems or deliberate offsets apply. Georectification residuals add more. Before disputing the substance, compare the coordinate reference systems, check both positions against a common high-quality reference, and measure the offset on independent control features. If the discrepancy is a consistent vector, it is a frame problem; if it varies, it is a matching problem. Publish the stated accuracy with every location so this can be diagnosed rather than argued.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

OGC standards including WMS, WFS and GeoPackage, governing interoperable exchange of geospatial data between systems and organisations.
EPSG Geodetic Parameter Dataset and ISO 19111, governing coordinate reference systems, datums and the documentation of transformations.
ISO 19115 geographic metadata, defining how source, lineage, accuracy, dates and licensing are recorded alongside spatial datasets.
Berkeley Protocol on Digital Open Source Investigations, setting collection, preservation and verification standards for geolocated open source material used in accountability work.
International humanitarian law protections for medical facilities, cultural property and civilian objects, which constrain what may be published about protected locations in conflict.
Copernicus and Landsat open data policies, which permit broad reuse subject to attribution, in contrast to commercial imagery licences restricting redistribution and derivative products.
National civil aviation regulations for uncrewed aircraft, governing where drone collection may occur, operator competence and notification requirements.
Do no harm principles in humanitarian information management, governing aggregation, generalisation and withholding of location detail that could expose populations.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Copernicus Data Space Ecosystem — European Space Agency and European Commission. Open access to Sentinel radar and optical satellite imagery
EarthExplorer — US Geological Survey. Archive of Landsat, aerial and declassified historic imagery
Worldview and Fire Information for Resource Management System — NASA. Near real time imagery browsing and active fire and thermal anomaly detections
Copernicus Emergency Management Service — European Commission. Rapid mapping and damage assessment products for disaster response
UNOSAT satellite analysis for humanitarian and human rights use — UNITAR. Independent satellite-derived damage and displacement assessments
OpenStreetMap — OpenStreetMap Foundation. Open global vector map data with full edit history
EPSG Geodetic Parameter Dataset — International Association of Oil and Gas Producers. Registry of coordinate reference systems and transformation parameters
OGC standards — Open Geospatial Consortium. Interoperability standards for geospatial data services and formats
Berkeley Protocol on Digital Open Source Investigations — UN Human Rights Office and Human Rights Center, UC Berkeley. Standards for open source collection, verification and preservation
Humanitarian Data Exchange — UN OCHA Centre for Humanitarian Data. Common operational datasets including administrative boundaries and place codes

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: layered basemaps, event geocoding and change monitoring across every area of interest you define. Explore the platform, or browse the rest of the library by following any tag above.