iTrace (CAR): Intelligence Source Guide

iTrace records weapons, ammunition and components that Conflict Armament Research investigators physically held in a conflict zone, then traces them backwards through manufacturers and export records to the point where they left legal control. It is evidence rather than estimate, and its sample is shaped entirely by where investigators were allowed to go.

At a glance

Source	iTrace (CAR)
Category	Conflict, Crime & Human Security › Military, Weapons & CBRN
Homepage	https://itrace.conflictarm.com/
Machine interface	`https://itrace.conflictarm.com/`
Format	`HTML`
Access	Restricted — eligibility-gated (member states, institutions or vetted users) The platform catalogue records this as open. That is wrong, and the correction is explained under Access, licensing and what you may do with it below.
Disciplines	Weapons Intelligence, Geospatial Intelligence
Mission domains	Weapons Trafficking, Conflict & Humanitarian

Field-traced illicit arms. — as catalogued in the platform’s own source registry.

iTrace is the global weapon reporting mechanism operated by Conflict Armament Research, an investigative organisation that deploys field teams into conflict-affected areas to document arms and ammunition in situ. The method is physical. An investigator inspects the item, records its type and model, photographs and transcribes every marking on it – manufacturer stamps, factory codes, serial numbers, lot and batch numbers, headstamps on cartridge cases, markings on packaging and crates – and records where and when the item was documented and from whom it was recovered. That record is then traced: formal enquiries go to the manufacturer and to the government of the producing state, seeking the export record for that serial or lot, and where those are answered the chain of custody is reconstructed from factory to the last documented lawful holder. The point at which the item left that chain is what CAR calls the point of diversion, and it is the analytical product. The results are published through the iTrace platform, which presents documented items on a map with their identification and tracing status, and through detailed investigation reports. The programme has been funded principally by the European Union under its common foreign and security policy instruments, with additional support from other governments.

What iTrace does that no other source does is convert a weapon in a conflict into an evidentiary chain back to a specific transfer decision. Estimate-based sources tell you roughly how many weapons are circulating; transfer databases tell you what states agreed to send; iTrace tells you that this specific rifle, this crate of ammunition, or this guidance component was manufactured here, exported there under this contract, and turned up in the hands of that group. That is a categorically different kind of claim and it is the only kind that survives a denial. For WEAPINT and GEOINT work the practical consequence is that iTrace supplies the ground truth against which everything else is calibrated: it can demonstrate that a documented state-to-state transfer was diverted, that a supply relationship exists which neither party has acknowledged, or that a weapon system depends on components from countries that have no arms relationship with the manufacturer at all. Its component-level work on modern systems is a distinct and increasingly important strand, because it establishes technological dependency and sanctions exposure at a level of granularity that trade statistics cannot reach.

Who publishes it, and why that matters

Conflict Armament Research is a specialist investigative organisation, not a research institute or an intergovernmental body, and its position is unusual: it does work that resembles a UN panel of experts but is contracted and funded largely by the European Union under successive foreign policy instruments, with support from other governments. That arrangement determines several things you should factor into how you read the output. Field access is negotiated with national authorities and partner forces, which means the organisation's ability to work in a theatre depends on relationships it must preserve, and the sample of documented items reflects where those relationships exist. Tracing depends on the cooperation of manufacturers and producing states, which is voluntary, uneven and politically conditioned; some states answer trace requests promptly and some never answer. Funding through a single dominant donor is efficient and creates a concentration risk, and the geographic priorities of that donor shape which conflicts get sustained investigation. None of this undermines the evidential quality of an individual documented item, which is as good as this field gets. It shapes what is documented and what is not, which is a different and equally important thing.

Provenance is the first question to ask of any dataset and the one most often skipped. Who collects it, what their incentive is, whether they publish a methodology, and whether they correct the record when they get something wrong all bear directly on how much weight a finding drawn from it can carry.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`item_category`	enum	Whether the record is a weapon, ammunition, a weapon component or subsystem, improvised device material, or related equipment. Component records behave differently from weapon records in almost every respect and should not be aggregated with them.	Investigation reports covering the same category and theatre; supply chain analysis for components.
`type_model`	string	The identified type and model of the item, established from physical inspection rather than reported. This is generally the most reliable identification available for any weapon in a conflict zone because someone held it.	Production history, licensed manufacture, and observed use in visually documented losses.
`manufacturer`	string	The producing entity as established from markings and factory codes. Manufacturer is not the same as supplier and the distinction is the most frequently collapsed one in downstream reporting.	Corporate records, ownership, parent groups and sanctions status of the producing entity.
`country_of_manufacture`	string	Where the item was produced, which under licensed production may differ from where the design originated and says nothing on its own about who exported it.	National export control regime, transfer records for the same producing state, and licensed production arrangements.
`production_date`	timestamp	Year or period of manufacture from lot markings, factory codes or headstamps. Establishes an earliest-possible date for the transfer chain and is often the only reliable date on an item.	Contemporaneous export records; correlation with known transfer periods.
`lot_batch_marking`	string	The production batch identifier, especially important for ammunition where individual serialisation does not exist. A lot links a cartridge to a production run and thereby to a shipment.	Other documented items from the same lot in the same or different theatres, which is how supply routes are established.
`serial_number`	string	Present for serialised weapons and central to tracing, but frequently withheld or partially redacted in public outputs for source protection and because trace correspondence with states is confidential.	Formal trace requests through mandated channels; not a field to pivot on from open outputs.
`documentation_date`	timestamp	When the investigator physically recorded the item. It is not the date of capture, the date of use or the date of diversion, and treating it as an event date produces a timeline that describes fieldwork rather than the conflict.	Conflict event data for the same location and period, to establish the context in which the item was recovered.
`documentation_location`	string	Where the item was recorded, with the precision CAR judges safe to publish. Locations may be generalised to protect sources, partner forces or ongoing operations.	Geographic correlation with conflict events, control maps and route analysis, at the published precision only.
`recovered_from`	string	The force, group or circumstance from which the item was recovered, where this can be stated. Recovery from a group establishes possession, not supply, and the difference matters enormously.	Actor profiles and other documented items associated with the same group.
`chain_of_custody`	array	The reconstructed sequence of lawful transfers from manufacture onwards, populated only where manufacturers and states answered trace requests. Partial chains are common and the gap is itself the finding.	Arms transfer records for the same supplier-recipient pairs; contract and end-user documentation where disclosed.
`point_of_diversion`	string	The last documented lawful holder before the item entered illicit circulation. It identifies where control failed, which is not the same as identifying who is culpable, and CAR is careful about this distinction in a way secondary reporting rarely is.	Stockpile security assessment, sanctions analysis, and the export control record of the state concerned.
`trace_status`	enum	Whether a trace was requested, answered, partially answered or refused. A high proportion of unanswered requests for a given producing state is a finding about that state's transparency in its own right.	State cooperation patterns; reporting under international transparency instruments.

Coverage — and what is not in it

Coverage is theatre-based and access-driven rather than global. CAR has run sustained field investigation in a series of conflicts – among them Iraq and Syria, Yemen, Libya, the Sahel and West Africa, Sudan, and Ukraine – and the density of documented items in each reflects how long teams operated there and how much access they were granted. Within a theatre, coverage is further shaped by which forces cooperated: items recovered by a partner force and made available for inspection are documented, items held by parties with no relationship to CAR are not. The entity types covered have broadened over time from small arms and ammunition to include guided weapons, unmanned systems and, significantly, the commercial electronic components inside them, which has made the programme relevant to sanctions and export control work as well as to arms trafficking. Update rhythm is continuous in the sense that fieldwork proceeds constantly, and discontinuous in the sense that publication follows investigation and tracing cycles that take months to years. The platform accumulates rather than refreshes: an item documented three years ago remains a valid record of what was in that place at that time, and the absence of recent items from a theatre usually means access ended rather than that the flow stopped.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which iTrace (CAR) will not show you something that is nevertheless real:

Only what investigators physically reached is recorded, and access is negotiated with national authorities and partner forces, so the sample is systematically shaped by which parties were willing to grant it and which were not.
Areas held by parties hostile to or uninterested in CAR are effectively invisible, which frequently means the most significant weapon holdings in a conflict are the least documented.
Tracing requires manufacturers and producing states to answer enquiries, and non-response is common. A chain that stops at a national border may indicate diversion, or may indicate a government that does not reply.
Old weapons predating computerised production and export records often cannot be traced at all, which biases traceable findings toward recent production and toward states with modern record-keeping.
Ammunition without adequate markings, and weapons with obliterated or re-stamped markings, resist tracing regardless of how well they are documented, and deliberate mark removal is itself a trafficking behaviour.
Publication lags investigation substantially, because tracing correspondence with governments takes time and because operational security for teams and partners requires delay. Recent flows are the least represented.
Serial numbers and precise locations are frequently withheld from public outputs, so open users cannot independently verify the chain and must rely on CAR's own account of it.
Counts of documented items are not a sample from any defined population and cannot support prevalence claims. More documented items from one supplier may mean that supplier is dominant, or that its products were recovered in the areas CAR could reach.
Component-level findings establish presence in a system, not a transaction. A commercially available part in a weapon does not by itself demonstrate that its maker or its home state supplied anything to anyone.

Write the blind spot into the product. A statement that something “was not observed in iTrace (CAR)” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Restricted — eligibility-gated: member states, accredited institutions or vetted users only

The iTrace platform is reached through the CAR website and requires registration. The level of detail available varies by user, with fuller access to sensitive fields such as serial numbers and precise locations restricted to appropriate government and institutional users, and public outputs generalised accordingly; confirm the current access arrangements with CAR rather than relying on any secondhand description, because they have changed over the life of the programme. There is no public bulk export or programmatic API, and the practical route for most analysts is the published investigation reports, which are detailed, freely available and contain the reasoning that the platform's map view compresses. For institutions with a legitimate need for the fuller dataset, the correct approach is to contact CAR directly and explain the use case; this is a relationship-based access model rather than a subscription, and the organisation has obligations to its partners and funders that shape what it can share and with whom.

Licence

Terms are set by CAR and by the funding instruments behind the programme, and they are not a standard open data licence. Reports are published for public use with attribution; platform data is provided under the conditions attached to your access, which for restricted users typically include limits on onward sharing that exist to protect field partners and the confidentiality of state trace correspondence. Those limits are not bureaucratic. Serial numbers and precise recovery locations can identify the units, individuals or partner forces that made documentation possible, and onward disclosure has consequences for people rather than for compliance. Confirm what you may republish before you republish it, cite the specific investigation report rather than the platform in general, and treat any restriction on redistribution as a source protection measure to be honoured rather than a licensing formality to be negotiated.

Rate limits and fair use

Not a technical question. This is a low-volume, high-value source consulted by analysts, not a feed to be polled. Reports appear on an investigative cadence measured in months; monitoring the publications listing at a low frequency is the entire automated collection requirement. Where you hold platform access, use it for specific analytical questions rather than scraping, both because the terms of access will generally prohibit bulk extraction and because the organisation's infrastructure exists to support investigation rather than to serve data volume.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How iTrace (CAR) is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Investigation report monitoring	HTML	monthly is ample	Watch the reports listing and pull new publications on release. The reports carry the reasoning, the caveats and the chain-of-custody detail that any use of a finding depends on.
Report archival	bulk	on release	Store the full document with its publication date. Findings are cited for years and the specific wording of a diversion attribution matters when the finding is contested, which it frequently is.
Platform queries under granted access	HTML	per analytical question	Where your organisation holds access, use it for targeted questions about specific types, manufacturers or theatres, and respect the sharing restrictions attached to whatever you retrieve.
Analyst coding of findings	JSON	per report	Extract items, manufacturers, chains and diversion points from report narrative into structured records, since the analytical substance lives in prose that no automated parse will capture correctly.
Direct engagement for institutional users	bulk	as agreed	For agencies with a mandated need, the route is a relationship with CAR rather than a data pull. Expect conditions on use and expect them to be enforced.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register with access conditions attached — Add iTrace in sources.php recording the access tier your organisation holds and the sharing restrictions that come with it, so that handling constraints travel with every derived record rather than being remembered by whoever ingested it.
Monitor publications, do not scrape the platform — Point collect.php at the reports listing under cron.php for release detection, and keep platform interaction as an analyst activity. Bulk extraction from a restricted-access investigative platform is a terms violation and a source protection risk.
Model items with their evidential status — Import records through import.php with documentation date, trace status and publication precision as explicit fields, so that a partially traced item is never rendered alongside a fully traced one as though the two claims were equally supported.
Resolve manufacturers to organisations — Push producing entities through enrich.php to canonical organisation entities visible on org-profile.php, linking to ownership, parent groups and sanctions status, which is where component-level findings become supply chain findings.
Geolocate at published precision only — Place documentation locations through resolve-everything.php at the precision CAR published and no finer. Never infer a coordinate from a generalised location description, because the generalisation exists to protect people.
Correlate with transfers and events — Use correlate.php to align documented items with recorded arms transfers for the same supplier and recipient and with conflict events at the same place and time, which is how a single item becomes an argument about a supply route.
Surface in the mission views — Expose findings on sanctions.php and organized-crime.php where diversion and circumvention are the analytical questions, and on theater.php where the question is what is present in a conflict.
Enforce handling on export — Configure export.php and sharing.php so that restricted fields cannot leave the platform in any format, and ensure reports generated through reports.php cite the specific investigation. The Summarise skill describes existing records only; no attribution, chain or diversion point in the platform is produced by a model.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

For the individual record this is the strongest evidence available anywhere in the open arms domain, and the basis for that judgement is simple: an investigator held the item and transcribed its markings. There is no reporting chain to degrade, no misidentification from a low-resolution photograph, no reliance on a claim by an interested party. Where a trace has been completed with manufacturer and state cooperation, the resulting chain of custody is documentary evidence of the kind that supports formal accountability processes. The weaknesses are not about accuracy but about representativeness and completeness. The set of documented items is not a sample from a defined population and cannot be treated as one; the chains are frequently truncated by non-response; and the published precision is deliberately reduced. CAR is unusually careful about the difference between what it documented and what it infers, and its reports state the limits of each attribution explicitly, which is precisely why secondary reporting that strips those statements is so damaging. Confidence should be very high for the identification and markings of a documented item, high for a completed chain of custody, moderate for the interpretation of a diversion point, and explicitly low for any prevalence or proportion claim built by counting records.

Characteristic false positives

Treating counts of documented items as a measure of what is present in a theatre. The count measures fieldwork, and building a share-of-supply figure from it produces a statistic about access rather than about arms flows.
Reading the point of diversion as an allegation of culpability. The last lawful holder may have been robbed, overrun or defeated, and CAR's own framing distinguishes control failure from complicity in a way that headlines rarely preserve.
Equating country of manufacture with supplier state, ignoring licensed production, re-export, second-hand transfer and the long intervals between production and diversion.
Over-reading component findings. Commercially available electronics in a weapon system establish a dependency and a sanctions question; they do not establish that the component maker or its government transferred anything.
Interpreting a truncated chain as evidence of concealment when it may simply reflect a state that does not answer trace requests, or records that were never computerised.
Using production date as a proxy for transfer date. Items sit in stockpiles for decades, and the gap between manufacture and diversion is frequently the most interesting unknown in the record.
Inferring precise locations from generalised published ones, or aggregating generalised locations to a coordinate. The generalisation is a source protection measure and defeating it endangers people.
Reading recovery from a group as supply to that group. Weapons are captured, bought, inherited and looted between actors, and possession at the moment of documentation is the weakest link in the chain to any supply conclusion.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

Individual records do not go stale in the way a feed does: an item documented in a given place at a given time remains a true statement about that place and time indefinitely, and its value in establishing a historical supply route only grows as other items from the same lot appear elsewhere. What ages is the currency of the picture. Because publication lags investigation by months to years, the platform is never a description of what is flowing now, and a theatre that has dropped out of recent output has usually dropped out of access rather than out of conflict. Chains of custody age in the opposite direction, improving over time as states answer outstanding trace requests, so a record that was truncated when published may be complete in a later report. Component findings age fastest in relevance, because sanctions regimes, corporate structures and procurement routes change quickly, and a supply chain documented two years ago may have been deliberately restructured since. A stale reading of this source looks like an analyst describing current arms flows into a conflict on the basis of items documented before the current phase of the fighting began.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Serves these mission domains

Yields these data points

How each sector uses iTrace (CAR)

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

For forces operating in or planning for a theatre this is the most reliable available answer to what the adversary is actually carrying and where it came from, based on inspection rather than assessment. It supports threat characterisation at the level of specific weapon types, ammunition compatibility and the technical performance of systems in the hands of non-state actors, and its component work supports judgements about how a system might be degraded or interdicted at the supply level. Force protection planners should note that the documented sample reflects what partner forces recovered, and treat the absence of a system from the record as uninformative. Use it alongside visually confirmed loss documentation, which covers what was destroyed rather than what was recovered.

🕵 National intelligence

This is a primary evidentiary source for proliferation, diversion and sanctions circumvention work, and its distinctive contribution is that its findings are physical rather than reported. The high-value analytical products are lot-level linkages, where items from the same production batch appear in multiple theatres and reveal a supply route, and component findings, which map technological dependency and identify circumvention pathways at the level of specific parts and intermediaries. Handle trace status as a signal in its own right: which states answer enquiries and which do not is a durable indicator of transparency behaviour. Access to fuller detail is a relationship rather than a subscription, and the conditions attached to it should be treated as binding.

👮 Law enforcement

For agencies working arms trafficking, sanctions enforcement and export control violations, iTrace demonstrates what a completed trace looks like and identifies the diversion points that indicate where legal control failed. It is not a case management system and it is not a substitute for a formal trace: any specific weapon in an investigation must be traced through the mandated national point of contact and international police channels, with the evidentiary handling that implies. What CAR provides is the pattern picture that turns a single seizure into a route hypothesis, and a demonstration that markings and record-keeping standards are the difference between a traceable weapon and an untraceable one. Findings implicating identifiable current trafficking should be pursued through official channels.

🔍 Private investigation and corporate security

Corporate investigators, export compliance functions and defence supply chain teams have a specific and growing interest in the component-level work, which repeatedly shows widely available commercial electronics inside weapon systems operated by sanctioned parties. That is a due diligence problem for manufacturers and distributors and a reputational exposure that is best discovered from a public report before a regulator discovers it. The appropriate response is to trace one's own distribution chain, not to speculate about how a part arrived. Note that CAR's findings identify products and manufacturers by name and that the resulting attention is often unwelcome and occasionally unfair; the report language distinguishes presence from supply and any commercial analysis should preserve that distinction.

📰 Journalism and OSINT media

For investigative journalism this is unusually citable material because it is evidence rather than assessment, and unusually easy to overstate. The two errors that recur are reporting a diversion point as an accusation against the state named, and reporting the presence of a component as proof that a company supplied a weapons programme. CAR's reports state these distinctions plainly and the discipline is simply to keep them. Cite the specific report, quote the attribution language rather than paraphrasing it, and remember that precise locations and serials are withheld to protect the people who made the documentation possible, so do not seek to reconstruct them.

🌍 NGO, humanitarian and human rights

For arms control, human rights and accountability organisations this is the highest-value evidence available for demonstrating that transfers reached parties they should not have reached. It supports arguments about diversion risk assessment under transfer control obligations, about stockpile security failures, and about the practical effect of marking and record-keeping standards. It also supports documentation work on unlawful weapons use, where establishing the type and origin of a munition is a precondition for any legal argument. Organisations should be conscious that publicising findings can compromise field access for the investigators who produced them, and that the correct escalation route for evidence of violations is usually a mandated mechanism rather than a press release.

🎓 University and research

For researchers this is a rich and difficult dataset: exceptionally high internal validity per record and no external validity as a sample. It cannot support prevalence estimates, market share calculations or any inferential statistics that assume representative sampling, and papers attempting those exist and are wrong. It is properly used as case evidence, for lot-level network analysis of supply routes, for studying diversion mechanisms, and as a validation source against modelled estimates from elsewhere. Researchers should engage directly with CAR about access rather than working from generalised public outputs, and should expect and respect conditions on what can be published.

Playbook: working iTrace (CAR) end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Understand what a record is before you use one

An iTrace record is an investigator's physical documentation of an object, plus whatever tracing has been completed. It is not a report of an incident, not an estimate of a flow, and not a sample from a population. Analysts who internalise this in the first hour avoid the entire class of errors that follows from treating documented counts as measurements.

Phase 2 — Establish the access geometry for your theatre

Before drawing any conclusion, work out where CAR teams have operated in your area of interest, with whom, and over what period. This determines what could have been documented and therefore what the absence of a finding means. Write it down, because every negative inference you later make depends on it.

Phase 3 — Read the report, not the map pin

The platform compresses findings into points; the investigation report contains the reasoning, the caveats and the precise attribution language. Any conclusion you intend to publish must rest on the report text, because that is where CAR states what it is and is not claiming.

Phase 4 — Separate documentation from diversion in your timeline

Build the chronology explicitly with production date, known transfer dates, diversion point and documentation date as separate elements. These can span decades. A timeline that collapses them produces a story in which a weapon was manufactured, exported and diverted in a single motion, which is almost never what happened.

Phase 5 — Work the lot, not just the item

The most analytically productive linkages come from lot and batch markings, which connect items across theatres and time to a single production run and therefore a single shipment. Query for the lot rather than the item wherever the marking permits, since one lot appearing in two conflicts is a route finding that no individual item can produce.

Phase 6 — Interrogate the chain gaps

For each incomplete chain, determine why: no response from the producing state, records predating computerisation, obliterated markings, or an unmarked item. Each has a different meaning and only one of them suggests deliberate concealment. Reporting all gaps as evasion is a common and consequential error.

Phase 7 — Distinguish possession from supply, in writing

State plainly, in your product, whether you are claiming that a party held an item or that a party was supplied it, and what evidence supports the stronger claim if you are making it. This is where most published misreadings of CAR's work originate and it is entirely preventable at the drafting stage.

Phase 8 — Treat component findings as a supply chain problem

Where the record concerns electronics or subsystems, pivot to the corporate layer: manufacturer, distributor network, intermediaries and the jurisdictions involved. The question is how a controlled or uncontrolled part reached a prohibited end user, and it is answered in company records and trade routes rather than in the weapon.

Phase 9 — Cross-check against transfer and loss records

Align documented items with recorded state-to-state transfers and with visually confirmed equipment losses in the same theatre. Agreement strengthens a route hypothesis; disagreement usually points at an undocumented transfer, a second-hand sale or a capture event, all of which are findings.

Phase 10 — Respect the redactions as a design constraint

Build your analysis so that it does not require the withheld serials and precise locations. If your conclusion depends on defeating a source protection measure, it is the wrong conclusion, and attempting to reconstruct that detail from other sources puts field partners at risk for a marginal analytical gain.

Phase 11 — Route actionable findings to the mandated channel

Where analysis identifies live trafficking, sanctions circumvention or a specific weapon relevant to a criminal or accountability process, the destination is the competent national authority, the relevant international mechanism, or CAR itself, not a public product. Publishing first can destroy an enforcement option that would otherwise have existed.

Phase 12 — State the sampling limitation in every product

Any finished assessment using this source should say, in the body, that the documented set reflects investigator access and is not representative. Without that sentence readers will construct their own denominator, and it will be wrong in whichever direction the headline suggests.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
Small Arms Survey	extends	Modelled estimates of holdings and flows for the same weapon categories, which supply the population-level context that physically documented items cannot.
SIPRI Arms Transfers Database	corroborates	The record of authorised state-to-state transfers of major systems, against which a documented diversion can be checked for an originating legal transfer.
Oryx OSINT Equipment Losses	corroborates	Visually confirmed equipment losses in the same theatres. Losses and recoveries are different observations of the same materiel population and each covers what the other misses.
ACLED Conflict Events	extends	Dated, geocoded conflict events providing the operational context in which an item was recovered and the activity picture along a suspected supply route.
UNODC	extends	The criminal justice framing of firearms trafficking, including the legal instruments under which diversion becomes an offence and cross-border cases are pursued.
INTERPOL	prerequisite	The channel through which an individual weapon is actually traced between jurisdictions in a law enforcement context, which no research platform substitutes for.
Arms Trade Treaty	extends	The diversion prevention obligations that a documented diversion is evidence against, and the reporting framework in which state responses are assessed.
Wassenaar Arrangement	extends	Control lists and best practice for conventional arms and dual-use goods, which is the regulatory vocabulary for component-level findings and circumvention analysis.
European External Action Service	extends	The European Union foreign policy machinery through which the iTrace programme has been funded and to which its findings feed, useful context for understanding the programme's mandate and priorities.

Legal, ethical and operational constraints

Three constraints bind use of this source and none of them is optional. First, access conditions: restricted fields are restricted to protect field partners and to honour the confidentiality of trace correspondence with governments, and onward disclosure in breach of those conditions is a source protection failure with physical consequences for identifiable people, not a compliance technicality. Second, attribution language: CAR's findings distinguish carefully between documented facts, reconstructed chains and inferences about responsibility, and restating them in stronger terms can amount to a defamatory allegation against a state or a company, which is a real and litigated risk in this field. Third, the underlying subject matter engages arms control and sanctions law in most jurisdictions, including obligations that may attach to knowledge of specific circumvention activity, and analysts should understand what their own legal framework requires them to report and to whom. Beyond the legal frame, the ethical position is straightforward: this material exists to support accountability, enforcement and control, and nothing in this library will assist with acquiring weapons, identifying supply opportunities, or evading the controls the source documents.

Operational security

This is one of the higher-exposure sources in the catalogue and should be treated as such. Platform access is credentialed and every query is attributable to your organisation, which means the pattern of what you look at is visible to the operator and, through the funding and reporting relationships behind the programme, potentially to others. That is appropriate for legitimate institutional use and a genuine consideration if your interest in a particular supplier or theatre is sensitive. More significant is the exposure running the other way: analysts who publish or circulate findings in ways that identify where documentation occurred, or that allow inference about which partner force cooperated, can compromise field access and endanger people. Handle iTrace-derived material inside your own systems with access controls proportionate to that risk, never combine published generalised locations with other sources in a document that could be shared outward without review, and treat any request to reconstruct a withheld serial or coordinate as a decision requiring authorisation rather than a research task.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether iTrace (CAR) is contributing anything, and they are worth baselining now so the answer is available later.

Report capture completeness: whether every publication touching your theatres or supplier states of interest has been archived, since findings are cited for years and the reasoning lives only in the document.
Trace completion rate in your area of interest: the proportion of documented items with a full chain of custody, which measures how much of the picture is evidential rather than partial.
State response pattern: which producing states answer trace requests and which do not, tracked over time as an independent transparency indicator that is useful well beyond the individual case.
Lot linkage yield: how many cross-theatre or cross-actor connections your analysis establishes from shared production batches, which is the highest-value analytical output the source enables.
Corroboration against transfer records: how often a documented diversion maps to an identifiable authorised transfer, which tests both datasets and exposes undocumented supply.
Attribution discipline: the proportion of internal products that preserve the possession-versus-supply and diversion-versus-culpability distinctions, audited by review rather than assumed.
Handling compliance: incidents in which restricted fields or generalised locations were exported, shared or refined, which should be zero and should be measured rather than presumed.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Documented does not mean prevalent. The number of items CAR recorded from a given source measures where investigators went, and any percentage built from those counts is a statement about access dressed as a statement about arms flows.
The point of diversion identifies where control failed, not who is to blame. States lose weapons to theft, defeat and corruption, and the report language reflects that distinction precisely because the difference is legally and politically enormous.
Manufacture, export and diversion can be separated by decades. Any narrative that runs them together is describing a supply chain that did not exist and will collapse under scrutiny from anyone who checks the dates.
Lot markings are the most underused field in the entire source. Individual items are anecdotes; a lot appearing in two theatres is a route, and that is where the analytical leverage is.
An unanswered trace request is data. Systematic non-response by a producing state is a durable finding about that state's transparency, and treating it merely as a missing value throws away a signal.
Recovery from an actor establishes possession at a moment in time, nothing more. Weapons change hands constantly in conflict and the supply inference requires evidence the possession record does not contain.
Component presence is not component supply. The correct question is how a widely traded part reached a prohibited end user, and it is answered in distributor networks and intermediaries rather than by naming the manufacturer.
The redactions exist to keep people alive. Analysts who treat them as an obstacle to be worked around have misunderstood both the source and their obligations to it.
Read the attribution verbs. CAR distinguishes documented, traced, indicated and assessed, and reproducing a finding with a stronger verb than the original is the most common way this evidence gets misused.

Questions analysts actually ask

Can I count records to work out which country supplies most weapons to a conflict?

No. The documented set reflects where investigators had access and what partner forces made available, not a sample of what is present. Any share-of-supply figure derived from record counts measures fieldwork geography, and publishing one will be corrected by anyone familiar with the methodology.

Does a point of diversion mean the state named is arming the group?

No. It identifies the last documented lawful holder before the item left legal control, which can result from theft, battlefield capture, corruption or defeat as easily as from deliberate transfer. CAR's reports are explicit on this and the distinction must be preserved.

Why are serial numbers missing from the public output?

Because they can identify the units and partners who enabled documentation, and because trace correspondence with governments is confidential. The redaction is a source protection measure. Build analyses that do not depend on defeating it.

How current is the data?

It is not current. Investigation, tracing correspondence and operational security for field teams all impose delay, so publication lags documentation by months to years. Use it for structural and historical questions, not for describing flows this month.

How do I get fuller access?

By approaching CAR directly with a legitimate institutional use case. This is a relationship-based access model with conditions attached rather than a subscription, and the conditions exist for reasons that will be explained and should be honoured.

What does a component finding actually prove?

That a specific part was physically present inside a system recovered in a conflict. It establishes technological dependency and raises a sanctions and export control question about how the part travelled. It does not establish that the manufacturer or its government transferred anything to the end user.

Can I use this to trace a weapon in my own investigation?

Not directly. Formal tracing runs through the manufacturer, the national point of contact of the producing state and international police channels, with the evidentiary handling those require. iTrace shows what completed traces look like and provides the route context around your case.

Why does the chain stop at a national border?

Usually because the state concerned did not answer the trace request, or because records from that period were never systematically kept. Occasionally because the transfer was not lawful in the first place. The report will say which, and assuming the third when it says the first is a serious error.

What does the platform add?

Archived reports with their attribution language intact, findings coded into structured records with trace status and published precision preserved, manufacturers resolved to organisation entities for supply chain work, and correlation against transfer records and conflict events. Handling restrictions are enforced on export, and no chain or diversion point is ever model-generated.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

The International Tracing Instrument defines the marking and record-keeping obligations that make tracing possible, and CAR's findings are in effect a continuous audit of whether states are meeting them.
Arms Trade Treaty provisions on diversion prevention are the legal frame in which a documented diversion becomes a compliance question for the exporting state.
The UN Firearms Protocol supplementing the transnational organised crime convention supplies the criminal law definitions for illicit manufacturing and trafficking that enforcement users work within.
United Nations panel of experts methodology under sanctions regimes closely parallels CAR's documentation practice, and findings from each are routinely used to inform the other.
MOSAIC standards for stockpile management, marking and record-keeping describe the controls whose failure produces the diversion points CAR documents.
Export control classification under national munitions lists and the Wassenaar dual-use lists is the vocabulary required for any component-level circumvention analysis.
Evidentiary chain-of-custody practice governs how documented material can be used in accountability processes, and is the reason documentation discipline in the field matters as much as the finding.
In the platform, documented items normalise to observation records linked to organisation and country entities, exportable as STIX 2.1, MISP, CSV and JSON subject to the field-level handling restrictions.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

iTrace — Conflict Armament Research. The platform itself. Registration is required and the level of detail depends on user category; start here to establish what access your organisation can obtain.
Conflict Armament Research — Conflict Armament Research. The organisation, its programmes and its funding relationships. Necessary context for understanding why coverage sits where it does.
CAR methodology — Conflict Armament Research. How field documentation and tracing actually work, including the limits of what a trace can establish. Read before interpreting any finding.
CAR reports — Conflict Armament Research. The investigation reports, which contain the reasoning and the precise attribution language that the platform's map view necessarily compresses.
iTrace programme — Conflict Armament Research. The programme description covering scope, funding and the reporting mechanism, which explains the institutional shape of the output.
European External Action Service — European Union. The EU foreign policy machinery under which the iTrace programme has been funded, and part of the audience its findings are produced for.
UN Office for Disarmament Affairs — United Nations. The international tracing instrument and the small arms control framework whose implementation CAR's findings continuously test.
Arms Trade Treaty — ATT Secretariat. Diversion prevention obligations and state party reporting, the legal context in which documented diversions are assessed.
Small Arms Survey — Small Arms Survey. Population-level estimates and regional research that supply the context physically documented items cannot, and a useful cross-check on route hypotheses.
UNODC — United Nations Office on Drugs and Crime. Firearms trafficking research and the criminal law instruments under which diversion is prosecuted across jurisdictions.
INTERPOL — INTERPOL. The operational channel for tracing individual firearms between jurisdictions, which no research platform replaces.
Wassenaar Arrangement — Wassenaar Arrangement Secretariat. Control lists for conventional arms and dual-use goods, the regulatory vocabulary for component-level circumvention findings.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it archives each investigation report with its attribution language intact, models documented items with trace status and published precision as structure, resolves manufacturers to organisation entities for supply chain work, and enforces the source protection restrictions on every export.. Browse the full source catalogue, or follow any tag above into the rest of the library.