Identity Intelligence (IDENT): Intelligence Discipline Guide

Identity resolution fails in two directions and only one of them is visible. A missed link costs you the investigation; a wrong merge costs someone else their reputation.

What Identity Intelligence is as a discipline

Identity intelligence is the disciplined resolution and verification of who a person or entity is across records: reconciling names, dates and places of birth, identifiers, addresses, roles and document data into a single asserted identity carrying a stated confidence. It covers document verification, biographic matching, register and sanctions cross-checks, role verification such as directorship or signing authority, and the disambiguation of common names. It is a lawful-basis-first discipline, where the question is never what can be found but what is proportionate to verify for a defined purpose.

Sub-methods include deterministic matching on strong identifiers, scored probabilistic matching on weak attributes, document authenticity checks including machine-readable zone check digits and issuing-state format rules, transliteration and naming-convention handling, and negative-evidence work that establishes when two records are demonstrably not the same person. In the cycle it is a processing discipline underwriting everything downstream, because every other finding is ultimately attached to an identity assertion.

Why it matters

Identity intelligence answers whether the person in this record is the person in that one, to what confidence, and on what evidence. It is what converts a sanctions or adverse media hit into a decision, what supports onboarding and beneficial ownership verification, and what stops an investigation attributing conduct to a namesake. It also answers the question people forget to ask: what evidence would prove these are different people.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Strong identifiers such as passport, national identity or company registration numbers that match or conclusively separate records.
• Date of birth, place of birth and nationality combinations that survive independently across two or more registers.
• Naming conventions treated correctly: patronymics, maternal surnames, honorifics, particles and transliteration variants.
• Document integrity checks including machine-readable zone check digits, issuing-state format rules and expiry logic.
• Role evidence such as directorships, filing signatures or professional registration tying a person to an organisation.
• Address and tenure histories in public registers that corroborate or contradict a claimed identity narrative.
• Distinguishing evidence that proves two similar records are different people, recorded as explicitly as any match.
• Identity documents or registrations issued suspiciously recently relative to the transaction they support.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• National company and beneficial ownership registers — Officer, shareholder and control records tying named people to entities with dates
• GLEIF LEI data — Verified legal entity identity with registration authority, address and parent relationships
• OpenSanctions — Consolidated sanctions and politically exposed person records with identifiers and source references
• PRADO document register — EU public reference on authentic identity and travel documents and their security features
• ICAO Doc 9303 standard — Specification for machine readable travel documents, including zone layout and check digit rules
• Professional and licensing registers — Regulator-maintained records confirming a person holds the qualification or authorisation claimed
• Official gazettes — Authoritative notices of appointments, name changes, insolvency and disqualification with dates
• Public court and insolvency registers — Judgments, bankruptcy and disqualification records identifying parties where publication is lawful

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Establish purpose and lawful basis — Define what you are verifying and why before any collection, since scope creep in identity work is both easy and unlawful.
2. Assemble the identity claim — Record the attributes asserted by the subject or the record under review, and note which are strong and which are weak.
3. Verify documents — Check document format, check digits and security features against the issuing state's published standard, not against memory.
4. Match on strong identifiers first — Resolve deterministically where hard identifiers exist, reserving probabilistic techniques for what genuinely cannot be resolved that way.
5. Score the remainder — Apply weighted probabilistic matching with documented thresholds, and route borderline cases to a second reviewer rather than to a default.
6. Record positive and negative evidence — Write down what confirms the identity and what rules out each rejected candidate, so the work is not silently repeated later.
7. Re-verify on cadence — Refresh identity assertions on a defined schedule and on trigger events, because roles, names and control relationships change.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Operational Security
• Insider Threat
• Human Trafficking
• Child Protection
• Anti-Money Laundering
• Fraud & Identity
• Transnational Repression
• Border Security & Migration

Operates on these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Email Address — Electronic mail address tied to an individual or organization.
• Username / Handle — Screen name or handle used across online platforms and services.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Password / Credential — An exposed password or credential pair from leaks or dumps.
• Credential / API Token — An exposed secret — API key, token, or JWT — granting access to systems and data.
• Device / Advertising ID — A mobile advertising or device identifier used in adtech data to track and locate devices.

Related disciplines

• Email Intelligence — Email Addresses, Headers, and Mail Infrastructure
• Telephony Intelligence — Phone Numbers, Networks, and Telephony Data

Inside the platform: where Identity Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=IDENT — Discipline hub
• source-catalog.php?disc=IDENT — Source catalogue filtered to this discipline
• search.php — Person / Name profile
• email-profile.php — Email Address profile
• phone-profile.php — Phone Number profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Establish purpose and lawful basis is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Verify documents turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Re-verify on cadence feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Identity Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Identity resolution in defence supports biometric-enabled watchlisting under specific legal authorities, vetting of locally employed staff and contractors, base access control, and confirmation that a detainee or interlocutor is who they claim to be. It feeds force protection and counter-intelligence products and underpins the integrity of any target or association reporting, since every finding attaches to an identity assertion. Constraints are heavy: biometric collection is governed by specific authorities and status of forces arrangements, retention and sharing are restricted, and the same discipline that verifies a contractor must never be turned on protected populations or used to de-anonymise civilians.

🕵 National intelligence

Agencies treat identity resolution as the substrate beneath all reporting: reconciling names across scripts, linking identifiers across systems, and maintaining confidence-scored identity assertions that other reporting hangs on. The analytic risk is silent merging, where two people become one record and every downstream judgement inherits the error. Handling requires that merge decisions be logged with evidence and reversible, that confidence be carried forward rather than dropped, and that identity data be minimised and access-controlled. Sharing with partners requires care because identity assertions travel further and last longer than the caveats attached to them.

👮 Law enforcement

Investigators use identity intelligence to confirm that the person in the record is the person under investigation, to detect identity fraud and document abuse, and to disambiguate common names before an arrest or charge. Evidential standards require certified records rather than aggregator extracts, expert examination for questioned documents, and disclosure of the material that excluded alternative candidates. Biometric collection and retention are governed by specific statutory regimes with strict limits, and facial recognition use is restricted or prohibited in several jurisdictions. Misidentification is one of the most serious failure modes in policing, so negative evidence must be recorded as carefully as positive.

🔍 Private investigation and corporate security

Corporate teams verify identity for onboarding, employment screening, counterparty due diligence and litigation. Legitimate work uses documents provided with consent, public registers, and regulated verification services under a defined lawful basis and purpose. What a private actor may not do is de-anonymise private individuals, attempt to unmask pseudonymous accounts, run facial recognition against people who have not consented where it is restricted, collect biometrics without explicit consent, or access government identity databases. The governing question is never what can be found but what is proportionate to verify for the stated purpose.

📰 Journalism and OSINT media

Journalists confirm that a named individual is the right person before publishing, which is the single most consequential verification in most stories. Standards require hard identifiers or documentary confirmation rather than name coincidence, and explicit consideration of how common the name is in the relevant population. Source protection means avoiding techniques that could expose a confidential source's identity. Ethics prohibit de-anonymising private individuals, including pseudonymous online accounts, absent a compelling public interest and a documented evidentiary standard, and require right of reply before publication of an identification.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian organisations resolve identity for beneficiary registration, family tracing, missing persons work and documentation of violations. Practice is protection-led: identity data about affected populations is among the most dangerous data an organisation can hold, so collection is minimised, storage is encrypted and access-controlled, and sharing with authorities is refused absent a protection rationale. Biometric registration carries specific risks in displacement contexts and requires genuine informed consent and a clear retention and deletion policy. Do-no-harm forbids resolution work that could expose people to persecution.

🎓 University and research

Researchers work on record linkage methodology, identity fraud, and the accuracy and bias of matching and biometric systems. Reproducibility requires publishing matching rules, thresholds, blocking strategies and evaluation against labelled data with error rates broken down by subgroup, since accuracy differs markedly across demographic groups. Ethics approval is mandatory where identifiable individuals are involved, and linkage of separately consented datasets often requires additional review. Data sharing generally requires controlled access or synthetic data, since linked identity datasets are re-identifiable almost by definition.

Playbook: working Identity Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish purpose and lawful basis

Write down why identity must be verified, to what standard, and under which lawful basis and purpose limitation. Identity work is high-risk processing and expands without limit unless bounded by a defined question: is this the person who signed the contract, is this director the sanctioned individual, is this applicant eligible. A good output is a purpose statement naming the attributes needed and the confidence required. Stop if the purpose does not justify the attributes being sought, and reduce the collection instead.

Phase 2 — Define the identity question precisely

Distinguish the three different tasks that get confused: verification that a person is who they claim, resolution of whether two records refer to the same person, and identification of an unknown person, which is the most intrusive and is usually outside private practice entirely. Each needs different evidence and carries different risk. A good output is a stated task type with its evidentiary requirement. Stop and reconsider if the task is identification of an unknown or pseudonymous individual.

Phase 3 — Collect only the needed attributes

Gather the minimum set that can decide the question: full name in its native form and order, date of birth, place of birth, nationality, and the strong identifiers relevant to the context such as company registration number, national identifier where lawfully available, or document number. Record the source and date of every attribute. Resist collecting attributes because they might be useful. A good output is an attribute set with provenance per field. Stop when the set can decide the question.

Phase 4 — Normalise names correctly

Handle names according to the conventions of the naming culture rather than a Western given-plus-family assumption: patronymics, multiple family names, honorifics and titles, generational suffixes, and the fact that many people have no family name at all. Apply a documented transliteration scheme per script and retain the native-script original. A good output is a normalised name record that preserves the original and states the scheme applied. Stop before allowing a normalisation to overwrite the source string.

Phase 5 — Match deterministically first

Attempt matching on strong identifiers before anything else: passport or document number with issuing state, company registration number, national identifier, or a verified biometric where lawfully held. A single confirmed strong identifier settles most cases and avoids the entire probabilistic apparatus. Record which identifier decided it. A good output is a deterministic decision with the identifier cited. Stop here when a strong identifier resolves the question.

Phase 6 — Score weak attributes honestly

Where only weak attributes exist, score similarity across name, date of birth, place, address and role rather than merging on approximate agreement. Weight by discriminating power in the relevant population: a common name in a large population carries almost no information, while an unusual name plus a matching date of birth may. Record the score and threshold. A good output is a scored candidate set with a documented threshold. Stop before merging on a score alone without human review for consequential decisions.

Phase 7 — Seek negative evidence deliberately

Actively look for what would break the match: a date of birth inconsistent across authoritative records, a document number with an invalid check digit or a format inconsistent with the issuing state, a registration that does not exist in the claimed jurisdiction, a person recorded as deceased, or two candidates who were simultaneously in different places. Negative evidence resolves cases faster than positive and defends clearing decisions. A good output is a recorded exclusion with its evidence. Stop when the alternative candidates are excluded or explicitly listed as unresolved.

Phase 8 — Verify documents structurally

Where documents are provided, check what can be checked without specialist equipment: machine-readable zone check digits, format and numbering conventions of the issuing state, expiry and issue date consistency, and consistency between the document data and other records. Recognise that structural validity is trivially satisfied by a competent forgery, so refer genuinely questioned documents to a document examiner. A good output is a documented structural check with its limits stated. Stop before treating a valid checksum as authentication.

Phase 9 — Handle biometrics under strict control

If biometric data is involved at all, confirm the specific lawful basis, since it is special category data almost everywhere and facial recognition is restricted or prohibited in several jurisdictions. Obtain explicit consent where consent is the basis, restrict retention severely, encrypt at rest, and never run comparisons against populations who did not consent. A good output is a documented authority, a retention limit and an access log. Stop and do not proceed absent a clear, specific legal basis.

Phase 10 — Record the assertion with confidence

Express the outcome as an identity assertion with a stated confidence, the evidence that supports it, the attributes that decided it, the date, and the analyst responsible. Do not record identity as a binary fact when it was a scored judgement, because downstream consumers will treat it as certain. A good output is a dated, evidenced assertion carrying its confidence forward. Stop when the assertion could be audited by someone who was not involved.

Phase 11 — Make merges reversible

Log every merge and every split with the evidence and the decision maker, and retain the underlying records separately so a merge can be undone. Silent, irreversible merging is the most damaging failure in identity work because every downstream finding inherits the error and no later analyst can detect it. A good output is an auditable merge history. Stop when the merge log would let a successor reconstruct and reverse any decision you made.

Phase 12 — Support correction and review

Provide a route for subjects to access, challenge and correct identity records, keep the data accurate and dated, set a retention period tied to the purpose, and review holdings on a cadence. Where an identity assertion drove an adverse decision, retain the evidence for the life of that decision. A good output is a maintained record with correction handling and a documented retention schedule. Stop when the file could be shown to a regulator and to the subject without embarrassment.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
National company registries	Registration	Statutory records of companies, directors and officers with registration numbers, appointment dates and filed addresses.	Authoritative confirmation of corporate identity and of an individual's role, using registration number as the strong identifier.
GLEIF Legal Entity Identifier data	Open	Global register of legal entity identifiers with verified legal name, jurisdiction and parent relationships.	Provides a globally unique identifier for legal entities, removing name ambiguity from cross-border resolution.
ICAO Doc 9303 machine readable travel document standards	Open	International specification for travel document structure, machine-readable zones, check digits and data element formats.	Basis for structural validation of travel documents and for detecting formats inconsistent with the claimed issuing state.
INTERPOL Stolen and Lost Travel Documents ecosystem	Licensed	International database of reported lost and stolen travel documents, accessible to authorised law enforcement and border agencies.	Authoritative check on document status, available through official channels only and not to private practitioners.
OpenSanctions	Open	Consolidated sanctions and politically exposed person records with identifiers, aliases and relationship data.	Cross-checks a resolved identity against designation and politically exposed person populations with hard identifiers where present.
ISO 3166 country codes and UN M49	Open	Standard country, territory and subdivision codes with change histories, and standard statistical groupings.	Canonical coding of nationality, place of birth and jurisdiction so identity attributes compare reliably across systems.
GeoNames	Open	Open gazetteer of place names including historic and alternate names across languages and scripts.	Resolves place of birth references that appear under different names, spellings or historic jurisdictions.
ROR and ORCID	Open	Persistent identifiers for research organisations and researchers with structured affiliation and output metadata.	Disambiguates individuals and institutions in academic and technical contexts where names are highly ambiguous.
Beneficial ownership registers and Open Ownership	Open	Declared beneficial ownership data published to a common standard by participating jurisdictions.	Links a natural person to controlling interests using declared identifiers rather than name matching alone.
Court and insolvency registers	Registration	Public records of proceedings, judgments, disqualifications and insolvency events naming individuals and companies.	Corroborates identity through independent official records and surfaces disqualifications tied to a resolved individual.
NIST biometric evaluation programmes	Open	Independent evaluations of face, fingerprint and iris recognition algorithms including demographic differential performance.	Evidence base for how accurate a biometric system actually is, and how error rates differ across demographic groups.
European Data Protection Board guidance	Open	Guidelines and opinions on biometric processing, facial recognition, identity verification and lawful basis for high-risk processing.	Determines what identity processing is lawful in the European Union and what safeguards must be in place.
FATF customer due diligence standards	Open	International standards on customer identification, verification, beneficial ownership and enhanced due diligence.	Defines the regulatory identity verification expectations that financial and designated non-financial sectors must meet.
Civil registration and vital statistics guidance	Open	International guidance on birth, death and marriage registration systems and the identity documents they produce.	Explains what a given country's civil documents actually evidence, which varies enormously and drives verification design.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Identity Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Record linkage libraries with blocking and scoring — Provide deterministic and probabilistic matching with configurable comparison functions. Limitation: thresholds trade false merges against missed links, and defaults are almost never right for a given population.
• Transliteration and name parsing libraries — Handle script conversion and name structure across cultures. Limitation: no scheme covers all naming conventions, and automated parsing of name order fails frequently outside Western formats.
• Machine-readable zone and check digit validators — Verify structural conformity of travel and identity document data. Limitation: they confirm well-formedness only, which a competent forgery satisfies trivially.
• Regulated identity verification services — Perform document authentication and liveness checks under a defined regulatory framework. Limitation: coverage and accuracy vary sharply by issuing country, and error rates differ across demographic groups.
• Entity resolution platforms with merge audit — Maintain identity clusters with logged, reversible merge decisions. Limitation: only valuable if merge reversibility is enforced in the data model rather than in analyst discipline.
• Registry search and filing retrieval services — Retrieve certified filings and officer records across jurisdictions. Limitation: aggregator extracts are not certified documents and are not sufficient for evidential purposes.
• Deceased and status registers where lawfully available — Exclude candidates on the basis of recorded death or status change. Limitation: coverage and currency vary widely and false positives cause serious harm to living individuals.
• Confidence-carrying case management — Records identity assertions with evidence, confidence and responsible analyst. Limitation: downstream systems routinely strip confidence, turning a scored judgement into an apparent fact.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• One strong identifier beats any amount of weak attribute agreement. A confirmed registration number or document number with issuing state settles a question that a hundred consistent soft attributes cannot.
• Negative evidence resolves more cases than positive evidence and is almost never recorded. Document the date of birth that does not match or the registration that does not exist, or the next analyst repeats the entire exercise.
• Name commonness is the missing variable in most matching. The same similarity score means completely different things for a rare name and for one of the twenty most common names in a population of a hundred million.
• Do not assume given name and family name. Patronymics, multiple family names, mononyms, generational suffixes and name order vary by culture, and a parser that assumes the Western pattern silently corrupts records at scale.
• Silent, irreversible merging is the most damaging failure in the discipline. Every downstream finding inherits the error, and without a merge log no later analyst can detect or unwind it.
• Confidence must travel with the assertion. Identity is almost always a scored judgement, but downstream consumers treat any recorded identity as fact unless the confidence is carried in the data model itself.
• A valid check digit is not authentication. Machine-readable zone validation confirms the data is well formed, which is precisely what a competent forger produces, so questioned documents need a specialist examiner.
• Biometric accuracy varies by demographic group, sometimes by an order of magnitude. Deploying a system without knowing its differential error rates guarantees that the harm falls unevenly on specific populations.
• The governing question is proportionality, not capability. In identity work the ability to find something is never the justification for finding it, and de-anonymising a private individual is outside legitimate practice regardless of technique.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Identity Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of identity assertions resolved on a strong identifier, rather than accepted on scored weak-attribute agreement.
• Recorded exclusion rate: share of cases where alternative candidates were explicitly excluded with documented negative evidence.
• False merge rate detected in periodic sampling audits, alongside the proportion of merges that were reversible from the audit log.
• Share of assertions carrying confidence, evidence, date and responsible analyst through to downstream systems without the confidence being stripped.
• Volume and outcome of subject correction requests, tracked as an accuracy indicator rather than a compliance overhead.
• Attribute minimisation performance, measured as the proportion of identity records holding only attributes justified by the stated purpose.
• For any biometric deployment, measured error rates disaggregated by demographic group, reviewed against published independent evaluations.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Matching on name and country alone in populations where a handful of names cover millions of people.
• Ignoring transliteration and naming conventions, which produces both false merges and confident misses.
• Allowing one analyst to merge records unreviewed, since a bad merge propagates invisibly through every downstream product.
• Treating an aggregator profile as a source rather than as a lead requiring verification at the register.
• Using facial or biometric comparison without validated method, trained reviewers and clear legal authority.
• Failing to record why a candidate was rejected, guaranteeing the same dead end is worked again.

Legal and ethical considerations

Identity work is high-risk processing. Establish lawful basis and purpose limitation first, collect only the attributes the verification question needs, and never de-anonymise or track private individuals who are not legitimately in scope. Biometric data is special category data, and facial recognition is restricted or prohibited in several jurisdictions. Subjects retain rights of access and rectification, so keep records accurate, dated and correctable, log every merge decision, and retain the evidence behind each identity assertion.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Identity Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 8 mission domains, 2 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How much agreement is enough to say two records are the same person?

It depends entirely on the discriminating power of the attributes in the relevant population. A matching rare name plus date of birth plus place of birth may be effectively conclusive; the same score on one of the most common names in a large country establishes almost nothing. Seek a strong identifier before scoring: registration number, document number with issuing state, or a verified national identifier where lawfully available. Where only weak attributes exist, produce a scored candidate set rather than a merge, require human review for any consequential decision, and record what would have broken the match.

Can a private investigator de-anonymise an online account?

No, and this is the clearest boundary in the discipline. Attempting to unmask a pseudonymous individual is disproportionate processing under data protection law in most jurisdictions, frequently breaches platform terms, and creates real risk of harm including harassment and, in repressive contexts, persecution. Where anonymous conduct constitutes a criminal offence, the lawful route is a complaint to law enforcement, who can obtain subscriber data through a production order. Where it constitutes a civil wrong, the route is a court application such as a Norwich Pharmacal or equivalent disclosure order, made with judicial oversight rather than by self-help.

Is facial recognition available for identity verification?

Only within narrow, regulated circumstances. Facial images are biometric data and special category data in the EU and many other regimes, requiring an explicit lawful basis, and several jurisdictions restrict or prohibit particular uses, especially real-time identification in public spaces and comparison against populations who have not consented. One-to-one verification against a document image with the subject's explicit consent, within a regulated onboarding process, is the common lawful pattern. One-to-many searching against scraped or non-consenting populations is unlawful in many places and outside legitimate practice everywhere.

What does a valid machine-readable zone actually prove?

That the data is internally consistent and correctly formatted, nothing more. Check digits are computed from the data itself, so any competently produced forgery passes them, and format conformity merely shows the producer knew the specification. Structural validation is useful for catching transcription errors and crude fakes, and for detecting formats inconsistent with the claimed issuing state. Genuine document authentication requires examination of security features, substrate and printing, which needs specialist equipment and training. Where a document is genuinely questioned, refer it to a document examiner rather than relying on software output.

How should common-name ambiguity be handled in reporting?

By stating it explicitly and by refusing to resolve it without evidence. Report that the name matches, state how common the name is in the relevant population, list what identifiers were and were not available, and describe which candidates could not be excluded. This is far more useful to a decision maker than an unqualified assertion, and it is defensible. Where a decision must be taken on an unresolved identity, escalate it as an unresolved identity decision rather than presenting a scored guess as a finding. Most serious misidentification failures begin as unstated ambiguity.

What identity data should not be collected?

Anything the stated purpose does not require. Biometrics without an explicit lawful basis and consent; health, religion, sexual orientation, political opinion and trade union membership unless a specific and justified basis exists; national identity numbers where a weaker identifier would suffice; family members not relevant to the verification; and historic addresses beyond the period in question. The proportionality test applies attribute by attribute. The practical discipline is defining the attribute set at the purpose stage and requiring justification to add to it, because identity files otherwise accumulate everything that was ever easy to obtain.

How do you prevent bad merges from propagating?

Design for reversibility and keep confidence in the data. Log every merge and split with the evidence, the threshold applied and the decision maker; retain source records separately so a merge can be unwound; carry a confidence score on every assertion through to downstream systems rather than flattening it to a binary; and sample merges periodically for manual audit. Also record the candidates you deliberately did not merge, since that judgement is invisible otherwise. Most organisations discover bad merges only when a subject complains, which is the most expensive possible detection mechanism.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• GDPR Articles 5, 6 and 9, governing lawful basis, purpose limitation, minimisation and the special category status of biometric data used to identify a person.
• ICAO Doc 9303, defining machine readable travel document structure, data elements and check digit computation.
• FATF Recommendation 10 on customer due diligence, defining identification and verification expectations including beneficial ownership.
• ISO/IEC 24760 framework for identity management, defining identity, attributes, assurance and lifecycle terminology.
• NIST Special Publication 800-63 digital identity guidelines, defining identity assurance, authentication and federation assurance levels.
• EU AI Act restrictions on biometric identification systems, which prohibit or heavily condition particular identification uses.
• European Data Protection Board guidance on facial recognition and biometric processing, setting the safeguards required for lawful deployment.
• UNHCR and ICRC data protection standards for humanitarian action, governing biometric registration and identity data about affected populations.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Machine Readable Travel Documents, Doc 9303 — International Civil Aviation Organization. International specification for travel document data structure and validation
2. Digital Identity Guidelines, SP 800-63 — US National Institute of Standards and Technology. Framework for identity assurance and verification levels
3. Face Recognition Technology Evaluation programme — US National Institute of Standards and Technology. Independent evaluation of recognition accuracy including demographic differentials
4. Guidelines on biometric and facial recognition processing — European Data Protection Board. Regulatory guidance on lawful basis and safeguards for biometric identification
5. FATF Recommendations on customer due diligence — Financial Action Task Force. International standards for customer identification and verification
6. Global LEI Index — Global Legal Entity Identifier Foundation. Verified identifiers for legal entities across jurisdictions
7. OpenSanctions datasets — OpenSanctions. Consolidated sanctions and politically exposed person records with identifiers
8. ORCID researcher identifiers — ORCID. Persistent identifiers disambiguating individual researchers
9. Beneficial Ownership Data Standard — Open Ownership. Structured standard linking natural persons to controlling interests
10. European e-Justice Portal — European Union. Access to national court, insolvency and business registers

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: purpose-bound resolution, scored matching and a full audit trail behind every merge decision. Explore the platform, or browse the rest of the library by following any tag above.