Human Intelligence (HUMINT): Intelligence Discipline Guide

Human intelligence is the only discipline where the source can be harmed by your success. Every rule in the tradecraft follows from that single fact.

What Human Intelligence is as a discipline

Human intelligence is information obtained from people through lawful, ethical and consensual engagement: interviews, debriefs, expert consultation, witness and whistleblower handling, and professional networks built on transparency about who you are and what the information will be used for. In private sector, investigative and journalistic practice it means voluntary cooperation with informed consent, no inducement to breach law or duty, careful handling of any material a source is legally bound to protect, and a duty of care that outlasts the engagement itself.

Sub-methods include structured interviewing built on rapport, free recall and open questions, trauma-informed interviewing for survivors and witnesses, subject matter expert consultation, and source evaluation that grades reliability of the source separately from credibility of the information. In the cycle it is a collection discipline that must be tasked narrowly, because unfocused questioning increases exposure for the source while producing weaker, less checkable reporting.

Why it matters

Human intelligence answers intent, reasoning and internal context that no document or sensor carries: why a decision was taken, what was said in a room, what people inside an organisation expect to happen next. It fills gaps where records were never created or were destroyed, and it lets you test open source findings against someone who was actually present. It also surfaces the questions you did not know to ask.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• First-hand accounts explicitly separated from hearsay, with the source's actual vantage point recorded alongside the claim.
• Intent, motivation and internal disagreement inside an organisation, which documents almost never capture.
• Corroborating detail that can be independently checked afterwards, such as dates, names, places and document references.
• Inconsistencies between accounts indicating partial vantage, ordinary memory error or deliberate misdirection.
• The source's own motivation for speaking, which conditions how their reporting should be weighted.
• Access and placement: what this person can genuinely know first-hand versus what they are repeating.
• Changes in a source's willingness, anxiety or safety position, which are risk indicators requiring action.
• What the source declines to discuss, recorded neutrally rather than treated as confirmation.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Mendez Principles on Effective Interviewing — International standard for non-coercive, rapport-based interviewing with safeguards for the interviewee
• College of Policing investigative interviewing guidance — Published PEACE model practice on planning, engagement, free recall and evaluation
• Berkeley Protocol on Digital Open Source Investigations — Standards for witness handling, consent and evidence integrity in accountability work
• DART Center for Journalism and Trauma — Practical guidance on trauma-informed interviewing and avoiding re-traumatisation of interviewees
• ICRC Professional Standards for Protection Work — Do-no-harm, informed consent and data handling standards for information about affected people
• UNODC anti-trafficking interviewing guidance — Victim-centred interviewing practice where vulnerability, coercion and safety are central
• Admiralty source and information grading scale — Widely published convention for grading source reliability separately from information credibility
• National data protection authority guidance — Lawful basis, consent, retention and security expectations for interview records and notes

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define the gap that needs a person — Establish what cannot be answered from documents or open sources, so you engage people only where there is genuine analytic need.
2. Assess risk before contact — Consider what exposure the engagement creates for the source, their family and colleagues, and whether the value justifies that risk.
3. Obtain informed consent — Explain who you are, the purpose, how the information will be used and attributed, and confirm the source agrees on that basis.
4. Interview with open questions — Build rapport, take a full free-recall account first, then probe with open questions, avoiding anything that suggests the answer.
5. Grade source and information — Record reliability of the source and credibility of each item separately, so a trusted source's weak claim is not inflated.
6. Corroborate independently — Test checkable detail against documents, records or a second source before the reporting supports any conclusion.
7. Aftercare and secure handling — Store records securely with minimal identifying detail, honour anonymity commitments, and stay reachable if the source's situation changes.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Dark Web Intel
• Insider Threat
• Organized Crime
• Drug Trafficking
• Human Trafficking
• Child Protection
• Gangs & Street Crime
• Kidnap, Hostage & Extortion
• Art & Antiquities Trafficking
• Forced Labour & Modern Slavery

Operates on these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Court Case / Docket — A filed legal proceeding — the authoritative record of disputes, judgments, and enforcement.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
• Username / Handle — Screen name or handle used across online platforms and services.
• Company / Organization — A legal entity — corporation, LLC, NGO, or business.

Related disciplines

• Social Media Intelligence — Intelligence from Social Platforms and Networks

Inside the platform: where Human Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=HUMINT — Discipline hub
• source-catalog.php?disc=HUMINT — Source catalogue filtered to this discipline
• search.php — Person / Name profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the gap that needs a person is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Obtain informed consent turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Aftercare and secure handling feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Human Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

In a defence context the lawful, consent-based end of this discipline covers debriefs of own personnel, structured engagement with local authorities, key leader engagement, and interviews with people who choose to speak. Practitioners are transparent about who they are, take only what is volunteered, and never induce a breach of law or duty. It supports the civil environment picture, force protection and understanding of local governance. Constraints are strict and non-negotiable: no coercion, no deception of vulnerable people, no inducement, full compliance with international humanitarian law and the Mendez Principles on effective interviewing, and a documented duty of care extending after the engagement.

🕵 National intelligence

For agencies operating lawfully, the relevant practice here is voluntary source engagement, expert consultation and defector or walk-in debriefing conducted under legal authority with informed consent and welfare provision. The analytic contribution is unique perspective on intent, decision-making and internal dynamics that no technical source provides, but it is also the most fragile: reporting must be graded for source reliability and information credibility separately, and single-source judgements flagged as such. Handling involves strict compartmentation to protect the person, dissemination that cannot identify them by inference, and an aftercare obligation that survives the end of the relationship.

👮 Law enforcement

Investigative interviewing is the core lawful practice: planned, recorded, rapport-based interviewing of witnesses, victims and suspects under the applicable code, with cautions and legal representation where required. Evidential standards demand accurate recording, disclosure of the full interview, and avoidance of leading or suggestive questioning that would render an account unreliable. Vulnerable and intimidated witnesses require special measures. Coercive or deceptive techniques produce inadmissible and unreliable evidence and are prohibited under the Mendez Principles. Witness protection and safeguarding obligations are part of the investigation, not an afterthought.

🔍 Private investigation and corporate security

Private practice is limited to voluntary cooperation with informed consent. Legitimate work includes expert consultation, industry interviews, whistleblower engagement through protected channels, and witness statements taken openly. What a private actor may not do is misrepresent identity to obtain information, induce anyone to breach a contract, confidentiality obligation or the law, pay for information in a way that pressures a person to produce results, or approach a represented party in litigation. Covert recording is unlawful in several jurisdictions. Interview records are personal data requiring lawful basis, security and retention limits.

📰 Journalism and OSINT media

Journalistic source work rests on informed consent about attribution, accurate representation of what was said, and protection of identity where anonymity was agreed. Verification requires corroboration of source claims against documents or independent accounts, since a single account however compelling is not established fact. Source protection extends to digital hygiene, because metadata and contact patterns identify sources more often than published detail does. Trauma-informed practice is required with survivors: consent that can be withdrawn, control over what is used, and no pressure to relive events for narrative effect. Right of reply goes to those the source accuses.

🌍 NGO, humanitarian and human rights

Human rights documentation and humanitarian protection work depend on interviewing survivors and witnesses safely. Practice is victim-centred: informed consent covering exactly how the account will be used, the right to stop or withdraw, no promises that cannot be kept, and referral pathways to medical, psychosocial and legal support offered regardless of whether the person provides information. Do-no-harm requires assessing reprisal risk before, during and after. Documentation for accountability follows established methodologies so accounts are usable later. Duty of care extends to interpreters and local staff, who carry the highest residual risk.

🎓 University and research

Research interviewing is governed by ethics approval, informed consent and confidentiality commitments that must be kept even under pressure. Methodology requires transparency about sampling, interview protocol and analytic approach, and acknowledgement that interview data reflects what people chose to say to a particular researcher in a particular setting. Data sharing is constrained: transcripts are rarely shareable without re-identification risk, so publish protocols, coding frameworks and anonymised excerpts. Duty of care covers participants, research assistants and interpreters, and reprisal risk assessment is part of the protocol rather than a formality.

Playbook: working Human Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the requirement and the ethical basis

Define narrowly what you need to learn and why a person is the right source, because unfocused questioning increases risk to the individual while producing weaker reporting. At the same time establish the ethical and legal basis: lawful purpose, voluntary participation, no inducement to breach duty, and the applicable interviewing code. A good output is a tasking note stating the question, the justification for approaching a person at all, and the safeguards. Stop when someone independent agrees the approach is proportionate.

Phase 2 — Assess risk to the person

Before any contact, assess what could happen to them: employment consequences, legal exposure, family and community reprisal, and physical danger. Consider how contact itself could expose them, including through call records, visitor logs and digital traces. Decide whether the value of the information justifies the risk to them, and be prepared to conclude that it does not. A good output is a written risk assessment naming specific threats and mitigations. Stop and do not proceed where the risk cannot be mitigated to a level the person could reasonably accept.

Phase 3 — Plan the engagement

Plan the meeting: place, timing, who is present, interpreter requirements, and how the person's participation can be kept discreet if they wish. Prepare the topic structure rather than a script, ordered from general to specific so free recall precedes any focused questioning. Decide in advance what you will not ask. Prepare referral information for support services. A good output is a written plan including the consent script and the contingencies. Stop when the plan protects the person as carefully as it serves the requirement.

Phase 4 — Obtain informed consent

Explain plainly who you are, who you work for, what the information will be used for, who will see it, what attribution options exist, that participation is voluntary, that they may decline any question or stop at any time, and that they may withdraw afterwards within a stated window. Do not make promises you cannot keep, particularly about anonymity in legal proceedings. Record consent, including any limits they set. A good output is documented, specific consent. Stop and do not proceed without it.

Phase 5 — Build rapport before content

Spend real time establishing a working relationship: explain the process, answer their questions, address practical concerns, and let them set some of the pace. Rapport is not a technique for extraction; it is the condition under which accurate recall happens and the person retains agency. In trauma-informed practice, explain what will happen and give control over pauses and breaks. A good output is a person who understands the process and is choosing to continue. Stop the interview if they show distress that outweighs their willingness.

Phase 6 — Use free recall first

Ask an open invitation to describe what happened in their own words and their own order, and do not interrupt. Silence and minimal encouragers produce more accurate detail than questions. Only when free recall is exhausted move to open probes on specific topics they raised. Never lead, never suggest details, never present information from other sources as fact to be confirmed. A good output is an uncontaminated account in the person's own language. Stop questioning a topic when they say they do not know rather than pressing.

Phase 7 — Clarify and test gently

Return to points needing clarification with open questions, and check your understanding by summarising back and inviting correction. Where an account conflicts with other information, explore it neutrally rather than challenging: ask them to describe the sequence again, or ask what would explain the difference. Accept that memory is reconstructive and inconsistency is not evidence of dishonesty. A good output is a clarified account with the person's own explanation of apparent conflicts. Stop before the interaction becomes an interrogation.

Phase 8 — Record accurately and securely

Record contemporaneously by the agreed method, noting that covert recording is unlawful in several jurisdictions and always a breach of consent-based practice. Distinguish in the record what the person said, what you observed, and what you inferred. Store securely with access control, hold identity separately from content where risk warrants it, and apply a retention period. A good output is an accurate record the person would recognise as fair. Stop when the record is stored under the security the risk assessment specified.

Phase 9 — Grade source and information separately

Evaluate the person's reliability, meaning their access, track record and any motive that might shape their account, and separately evaluate the credibility of each item of information against other evidence. A generally reliable person can pass on a rumour, and a person with obvious motive can report accurately. Record what they could know first hand versus what they were told. A good output is a graded report where the basis of each claim is visible. Stop before allowing a compelling narrative to substitute for corroboration.

Phase 10 — Corroborate independently

Treat a single account as a lead requiring corroboration from documents, records, imagery or independent accounts, particularly before it supports an allegation against a named person. Corroboration must not create risk for the source through the way it is sought. Where corroboration is impossible, report the claim as uncorroborated and say why. A good output is a claim-by-claim corroboration status. Stop before publishing or acting on an uncorroborated single-source allegation of serious wrongdoing.

Phase 11 — Deliver aftercare

Aftercare is an obligation, not a courtesy. Check in as agreed, provide the referral information for medical, psychosocial and legal support regardless of what they provided, monitor for reprisal indicators, and have a plan for what you will do if the risk changes. Tell them honestly what happened to their information. A good output is a documented aftercare arrangement with named responsibility. Stop only when the person is genuinely no longer at risk from having spoken to you, which may be much later.

Phase 12 — Protect identity in publication

Before any product leaves the team, test whether the person could be identified by inference: role, location, timing, distinctive phrasing, the combination of facts only a few people know, or the pattern of what was and was not reported. Anonymisation frequently fails at this stage. Consult the person where possible about how their account is used. A good output is a product reviewed for inferential identification by someone who did not conduct the interview. Stop when identification risk is reduced to what the person consented to accept.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Principles on Effective Interviewing for Investigations and Information Gathering	Open	International standard, known as the Mendez Principles, setting non-coercive, rapport-based interviewing practice and associated safeguards.	The reference standard for lawful and effective interviewing, replacing coercive models with evidence-based rapport techniques.
UN Human Rights Office monitoring and documentation guidance	Open	Manuals and training material on human rights monitoring, interviewing victims and witnesses, and documentation standards.	Establishes victim-centred interviewing and documentation practice usable by accountability mechanisms.
Istanbul Protocol	Open	Manual on effective investigation and documentation of torture and other cruel, inhuman or degrading treatment.	Defines how accounts and medical evidence of ill-treatment are documented to an internationally recognised standard.
Minnesota Protocol on the Investigation of Potentially Unlawful Death	Open	International standard for investigating potentially unlawful deaths including witness interviewing and evidence handling.	Governs interviewing and documentation where the subject matter is a death that may engage state responsibility.
ICRC professional standards for protection work	Open	Standards for humanitarian and human rights actors carrying out protection activities, including data and interview management.	Sets the do-no-harm, consent and information management expectations for interviewing affected populations.
DART Center for Journalism and Trauma	Open	Guidance on trauma-informed interviewing, working with survivors, and managing vicarious trauma among practitioners.	Practical trauma-informed technique and duty of care guidance for interviewers and for the people they interview.
WHO ethical and safety recommendations for research on violence against women	Open	Ethical and safety standards for interviewing survivors of gender-based violence, including consent, referral and interviewer safety.	Defines the minimum safety and referral conditions before any interview about sexual or gender-based violence is attempted.
UNODC guidance on victim interviewing in trafficking cases	Open	Guidance on victim-centred, trauma-informed practice in human trafficking investigations and victim identification.	Frames interviewing where the person may be a victim of trafficking and requires protection rather than investigation.
Global Investigative Journalism Network resources	Open	Practical guides on source protection, secure communication, interviewing and investigative methodology for journalists.	Operational source protection practice, particularly digital hygiene that prevents inferential identification of sources.
Whistleblower protection frameworks and national reporting channels	Open	Statutory protected disclosure regimes, designated reporting channels and the protections available to disclosers.	The lawful route for a person reporting wrongdoing, which practitioners should signpost rather than substituting for it.
Berkeley Protocol on Digital Open Source Investigations	Open	Standards for open source investigation including handling of user-generated material and interaction with content creators.	Governs how material sourced from individuals online is obtained, verified and preserved without exposing the contributor.
Council of Europe and national investigative interviewing codes	Open	National codes of practice governing the conduct, recording and disclosure of investigative interviews.	Determines the mandatory procedural requirements where an interview may become evidence in criminal proceedings.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Human Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Structured interview planning templates — Organise topics from general to specific and record what will deliberately not be asked. Limitation: a plan followed too rigidly suppresses free recall, which produces most of the accurate detail.
• Consent recording forms with attribution options — Document exactly what the person agreed to, including limits and withdrawal rights. Limitation: written consent is unsafe for the person in some settings, requiring recorded verbal consent handled with equal care.
• Encrypted communication and secure contact procedures — Reduce the chance that contact itself exposes the person. Limitation: metadata and contact patterns often identify sources even when content is protected, so procedure matters more than the application.
• Separated identity and content storage — Holds identifying information apart from interview content under different access control. Limitation: adds operational friction that teams abandon under time pressure unless it is enforced by system design.
• Professional interpreters with confidentiality agreements — Enable accurate communication and cultural understanding. Limitation: interpreters carry the highest residual risk in the room and are frequently omitted from risk assessments and aftercare planning.
• Referral pathway directories — Provide vetted medical, psychosocial and legal support contacts to offer regardless of what the person discloses. Limitation: must be verified as currently functioning, since referring to a closed service is worse than not referring.
• Source and information grading schemes — Record reliability and credibility separately and consistently across reports. Limitation: grades become decorative unless reviewers actually challenge them, and inflation is common over time.
• Inferential identification review checklists — Test whether a published account could identify the person through role, timing or distinctive detail. Limitation: works only when applied by someone who did not conduct the interview and does not know the answer.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Free recall in the person's own words and order produces more accurate detail than any question sequence. Interrupting to clarify early contaminates the account and cannot be undone, so hold clarification until they have finished.
• Rapport is a condition for accurate recall, not a technique for extraction. The distinction matters ethically and practically: a person who feels manipulated withholds, and a person who retains control remembers better.
• Inconsistency is not dishonesty. Memory is reconstructive and trauma affects encoding and recall in documented ways, so treating a changed detail as a credibility problem discards accurate accounts and re-traumatises people.
• Never present information from another source as established fact to be confirmed. It contaminates the account, produces false corroboration, and destroys the evidential value of everything the person says afterwards.
• Grade the source and the information separately, every time. A person with an obvious motive can report accurately, a generally reliable person can pass on a rumour, and collapsing the two into one confidence rating hides which is which.
• Interpreters carry the highest residual risk in most engagements and are the most frequently forgotten in risk assessment and aftercare. Include them explicitly in every safeguarding plan.
• Anonymisation usually fails by inference rather than by naming. Role, location, timing and the specific combination of facts only a few people could know identify a source far more often than any published detail.
• Payment corrupts reporting. Arrangements that reward productive information create pressure to produce it, and the resulting reporting is both unreliable and impossible to defend later, so keep any reimbursement to documented, modest actual costs.
• Aftercare is part of the collection, not a follow-up courtesy. A discipline that treats duty of care as ending with the interview will eventually harm someone, and it will also find that people stop talking to it.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Human Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of engagements with a documented pre-contact risk assessment naming specific threats to the person and the mitigations applied.
• Share of interviews where recorded consent specifies use, attribution, distribution and withdrawal rights, rather than a general agreement to speak.
• Corroboration status of single-source claims used in products, tracked as the proportion acted on or published without independent support.
• Completion rate of agreed aftercare contacts, and the number of reprisal indicators detected and acted on after engagement ended.
• Results of inferential identification reviews, measured as the number of products amended before release because a source could have been identified.
• Proportion of interview records stored with identity separated from content under the access controls specified in the risk assessment.
• Interpreter and local staff safeguarding coverage, measured as the share of engagements where they were explicitly included in risk assessment and aftercare.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Allowing rapport to become obligation, so the source tells you what they sense you want to hear.
• Leading questions that contaminate the account and cannot be undone in later interviews.
• Over-weighting one well-placed source, whose vantage is still partial and whose interests are still their own.
• Failing to separate source reliability from information credibility, so status substitutes for evidence.
• Promising confidentiality you cannot deliver legally or technically, including against disclosure in proceedings.
• Re-interviewing survivors unnecessarily, compounding harm for detail already on the record elsewhere.

Legal and ethical considerations

Engagement must be voluntary and informed. Never induce anyone to breach a contract, confidentiality obligation, official secrets duty or the law, and avoid payment arrangements that create pressure to produce results. Where a person is reporting wrongdoing, point them to protected whistleblowing channels. Interview records are personal data requiring lawful basis, minimisation, security and retention limits, and covert recording is unlawful in some jurisdictions. Duty of care persists after the engagement ends, including safety planning and anonymisation before publication.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Human Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What separates lawful source engagement from manipulation?

Transparency, voluntariness and the absence of inducement. Lawful practice means the person knows who you are, who you work for, what the information will be used for and who will see it; they can decline any question and stop at any time; and nothing is offered or implied that pressures them to produce information or to breach a legal, contractual or professional duty. Manipulation involves misrepresenting identity or purpose, exploiting vulnerability, creating obligation through payment or favours, or applying pressure of any kind. The test is whether the person, fully informed, would still choose to speak. If the approach depends on them not understanding it, it is not consent.

Should sources be paid?

Generally no, and never in a way that rewards productive information. Payment creates pressure to produce results, which corrupts reporting and destroys its evidential value, and it can amount to inducement to breach a duty. Reimbursement of documented, modest actual costs such as transport is different and should be recorded transparently. In humanitarian and human rights work, payment can also distort the relationship with an entire community and create risk for the person who is seen to receive it. Where a person needs support, the answer is a referral to appropriate services, offered regardless of whether they provide information.

How do you interview someone who has experienced trauma?

Slowly, with control in their hands. Explain what will happen, that they can pause or stop at any point, and that they choose what to discuss. Use free recall and open questions, avoid pressing for detail that serves narrative rather than the requirement, and expect that memory of traumatic events is fragmented and non-linear rather than treating that as inconsistency. Have referral pathways ready and offer them regardless of what is disclosed. Manage your own exposure too, since vicarious trauma degrades both wellbeing and judgement. DART Center and WHO ethical guidance set out the practical standards.

Can a private investigator interview a company's employees?

Only openly and voluntarily, and with care about several traps. You may not misrepresent who you are or who you act for, may not induce anyone to breach their contract of employment or a confidentiality obligation, and may not approach a party represented by counsel in litigation. Covert recording is unlawful in several jurisdictions and always inconsistent with consent-based practice. Where a person wishes to report wrongdoing, signpost them to the protected disclosure channel rather than becoming an unregulated substitute for it. Interview records are personal data with lawful basis, security and retention obligations attached.

How is a source protected in publication?

By testing for inferential identification, not just removing the name. Ask who else could have known these specific facts, whether the role or location narrows it to a handful of people, whether the timing points to who was present, and whether distinctive phrasing is recognisable. Have the review done by someone who did not conduct the interview. Protect the digital trail too: contact metadata, travel records and visitor logs identify sources more often than published content. Where possible, consult the person about how their account will be used, and be honest if you cannot guarantee protection.

What do you do when a source is at risk after the engagement?

Act on the plan you should already have. Aftercare arrangements should name who is responsible, how contact is maintained, what reprisal indicators are watched for, and what options exist if risk escalates: pausing use of the material, altering publication, contacting protection organisations, or supporting relocation where that is genuinely available. Do not make commitments you cannot deliver. Tell the person honestly what you can and cannot do. If the escalation stems from your product, delay or amend it; no story or assessment is worth a source's safety, and the discipline depends on that being true in practice.

How much weight should a single human account carry?

Enough to task collection, rarely enough to publish or act against a named person. A single account, however detailed and credible, is one person's recollection filtered through their access, motive and memory. Grade reliability and credibility separately, record what they know first hand versus what they were told, and seek corroboration from documents, records, imagery or independent accounts. Where corroboration is impossible, report the claim as uncorroborated and explain why, rather than allowing a compelling narrative to substitute. Serious allegations against named individuals require corroboration proportionate to the harm publication would cause.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Principles on Effective Interviewing for Investigations and Information Gathering, known as the Mendez Principles, establishing non-coercive rapport-based interviewing and associated safeguards.
• UN Convention against Torture and the Istanbul Protocol, prohibiting coercive interrogation and governing documentation of ill-treatment.
• Minnesota Protocol on the Investigation of Potentially Unlawful Death, governing witness interviewing and evidence handling in death investigations.
• ICRC Professional Standards for Protection Work, governing consent, data management and do-no-harm in interviews with affected populations.
• WHO ethical and safety recommendations for research and documentation on violence against women, setting consent, referral and safety preconditions.
• National investigative interviewing codes such as the UK PACE codes, governing caution, recording, disclosure and treatment of vulnerable interviewees.
• GDPR and equivalent regimes, treating interview records as personal data with lawful basis, security, minimisation and retention obligations.
• Whistleblower protection frameworks including the EU Whistleblowing Directive, which define the protected channels a discloser should be directed to.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Principles on Effective Interviewing for Investigations and Information Gathering — Association for the Prevention of Torture and partners. International standard for non-coercive, rapport-based interviewing
2. Istanbul Protocol — UN Human Rights Office. Manual on investigation and documentation of torture and ill-treatment
3. Minnesota Protocol on the Investigation of Potentially Unlawful Death — UN Human Rights Office. Standard for investigating potentially unlawful deaths including witness interviewing
4. Professional Standards for Protection Work — International Committee of the Red Cross. Standards for protection activities including interviewing and data management
5. Trauma-informed interviewing and self-care resources — Dart Center for Journalism and Trauma. Guidance on interviewing survivors and managing vicarious trauma
6. Ethical and safety recommendations for research on violence against women — World Health Organization. Consent, referral and safety standards for interviewing survivors
7. Guidance on victim-centred practice in trafficking cases — UN Office on Drugs and Crime. Victim-centred and trauma-informed interviewing in trafficking investigations
8. Source protection and investigative methodology guides — Global Investigative Journalism Network. Practical guidance on protecting sources including digital hygiene
9. Whistleblower protection and integrity frameworks — Organisation for Economic Co-operation and Development. Comparative guidance on protected disclosure regimes and channels
10. Human rights monitoring and documentation training material — UN Human Rights Office. Methodology for victim-centred documentation usable by accountability mechanisms

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: consent-tracked source records, separated grading, secure storage and corroboration against open collection. Explore the platform, or browse the rest of the library by following any tag above.