Location / Coordinates: Data Point Intelligence Guide

A place name is not a point. It is a claim about where something happened, carrying a resolution, a source and an error you should state out loud.

Understanding the Location / Coordinates as an intelligence artifact

A location is a named or bounded geographic reference: a settlement, an administrative area, a postal address, a landmark or a region. Unlike a coordinate pair it is inherently fuzzy, and its analytic value depends on stated resolution, from country down to building. Geocoding converts the name into a point or polygon; reverse geocoding converts a point back into a hierarchy of administrative names. Both operations introduce error, and that error should travel with the datum rather than being quietly discarded downstream.

Place references arrive as gazetteer identifiers, postal addresses, administrative codes, standard port and inland location codes, and free-text descriptions in human reporting. Names change with politics, language and transliteration, and are heavily duplicated: dozens of settlements often share one name inside a single country. Boundaries are contested, so different datasets place the same point in different states. Polygons, not points, are the honest representation of most reported locations.

Why it matters

Location is the join key between human reporting, corporate records, imagery and movement data. It turns scattered incidents into density, sequence and proximity: what else happened nearby, which entities are registered at the address, what infrastructure lies within reach. It supports aggregate pattern analysis and site selection for imagery tasking. It also constrains claims, because a stated location inconsistent with terrain, infrastructure or travel time is directly testable against open mapping data.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Administrative hierarchy from reverse geocoding tells you which police force, court, registry and regulator hold jurisdiction.
• Proximity to ports, borders, airfields and rail links explains why an actor selected that particular site.
• Clusters of incidents around one location indicate a persistent facility rather than a series of transient events.
• Company registry addresses matching the location connect corporate structures to a physical presence you can observe.
• Named landmarks in reporting allow independent verification against mapping and street-level imagery.
• Discrepancies between claimed and inferred locations indicate deception or reporting error worth pursuing directly.
• Terrain, elevation and land cover constrain which activities are physically plausible at the stated place.
• Local time zone and daylight hours at the place test the plausibility of timestamps in the underlying report.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• OpenStreetMap and Nominatim — Free geocoding, reverse geocoding and detailed feature data including buildings and infrastructure.
• Overpass API — Queries OSM for features of a given type within a radius or polygon around your location.
• GeoNames — Gazetteer of populated places and features with alternate names, admin codes and population.
• NGA GEOnet Names Server — Authoritative foreign place names with variant spellings and transliterations.
• USGS GNIS — United States domestic feature names, types and official coordinates.
• Wikidata — Place entities linking names across languages to identifiers used by other datasets.
• GADM and Natural Earth — Administrative boundary polygons for assigning points to jurisdictions and disputed areas.
• UN/LOCODE — Standard codes for ports and inland locations used throughout trade and shipping records.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Capture the raw reference — Preserve the location exactly as reported, including original language and spelling, before any normalisation is applied.
2. Geocode with alternatives — Resolve against a gazetteer and keep every candidate, recording how many places share that name in the country.
3. Attach a resolution — State whether you have country, district, settlement or building confidence, and carry an explicit uncertainty radius forward.
4. Reverse geocode for jurisdiction — Assign administrative units so you know which registries, courts and authorities apply to any subsequent request.
5. Enrich the surroundings — Query nearby infrastructure, registered entities and prior incidents within the uncertainty radius rather than at a point.
6. Test consistency — Check the location against terrain, travel times, time zone and any imagery available for the reported date.
7. Record provenance — Log the gazetteer, its version and the exact query used so another analyst can reproduce the resolution.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Geospatial Intelligence — Intelligence Derived from Place
• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Human Intelligence — Information from People, Ethically Obtained
• Risk Intelligence — Structured Assessment of Threat and Consequence
• Environmental Intelligence — Environmental Conditions, Damage, and Crime
• Imagery Intelligence — Interpretation of Visual Imagery
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Logistics Intelligence — Cargo, Freight, and Physical Movement
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Economic Intelligence — Economic Conditions, Trade, and Market Signals

Investigated in these domains

• Critical Infrastructure
• Drug Trafficking
• Human Trafficking
• Wildlife Trafficking
• Gangs & Street Crime
• Kidnap, Hostage & Extortion
• Art & Antiquities Trafficking
• Mining & Resource Crime
• Forced Labour & Modern Slavery
• Counter-Terrorism

Pivots to these data points

• GPS Coordinates — Precise latitude/longitude coordinates identifying an exact point on Earth — the atomic unit of GEOINT analysi
• Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
• Satellite Imagery — Overhead imagery of an area of interest, used for change detection and site analysis.

Inside the platform: where Location / Coordinates lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_location — Data point hub
• domain.php?d=critinfra — Critical Infrastructure dashboard
• domain.php?d=drugs — Drug Trafficking dashboard
• human-trafficking.php — Human Trafficking dashboard
• domain.php?d=wildlife — Wildlife Trafficking dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Capture the raw reference is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Attach a resolution turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Record provenance feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Location / Coordinates

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Place references are the raw input to intelligence preparation of the battlespace and to the common operating picture. An analyst converts human reporting into named areas with stated resolution, assigns them to administrative and terrain units, and feeds the result into route studies, force protection assessments and civil considerations. The discipline that matters is honest resolution: a report naming the nearest town is a district-level datum, and passing it forward as a point invites a targeting error. Under the law of armed conflict, precision claims carry proportionality obligations, so location confidence must be stated explicitly in every product. Civilian sites, medical facilities and cultural property should be recorded as protected objects on the same layer.

🕵 National intelligence

National intelligence uses place references to bound collection and to fuse reporting that shares no common identifier. Requirements are usually stated in geographic terms, so normalising names to gazetteer identifiers and polygons is what allows human, signals and imagery reporting on the same area to be compared at all. Handling depends on precision: coarse administrative references are generally releasable, while a resolved building associated with a person is not. Dissemination should carry the uncertainty forward, because downstream consumers routinely strip the caveat and keep the point. Record the gazetteer and version used so a partner service can reproduce the resolution independently.

👮 Law enforcement

For investigators a location is where jurisdiction, warrant scope and evidence all attach. Reverse geocoding establishes which force, prosecutor and court have authority, which matters before any application is drafted. Search warrants must describe the place with particularity, and a geocoded point with an unstated error radius is not particularity: verify the address against the land registry, the postal authority and a physical check before it goes on a warrant face. Witness descriptions of place should be preserved verbatim and geocoded separately, with the conversion documented, because the geocoding is analysis and may need to be explained by the analyst who performed it in evidence.

🔍 Private investigation and corporate security

Corporate investigators use place references for asset tracing, site verification, supplier auditing and litigation support: confirming that a registered address is a real operating site rather than a service address, or that a claimed facility exists. Public mapping, registry records and commissioned lawful site visits are the tools. What a private actor may not do is build a pattern-of-life around an individual's home, use covert trackers, trespass to observe, or aggregate incidental sightings into a movement history. Those cross into surveillance requiring authority in many jurisdictions and into harassment in most. Work at the coarsest resolution the engagement needs and document why any finer resolution was necessary.

📰 Journalism and OSINT media

Journalists must verify place claims independently, usually by matching described features against mapping and street-level imagery, and by finding a second source who can confirm the location. State the resolution you actually established: a district, a village or a specific building are different claims with different risks. Publishing precise locations of homes, shelters, sources or displaced people can get them killed, and it is not made acceptable by the information being technically available. Redact to the level that supports the story, agree publication detail with local contributors who bear the risk, and give named parties a right of reply about a site before it is identified.

🌍 NGO, humanitarian and human rights

Humanitarian and human-rights work is location-dense and location-dangerous. Incident documentation, protection monitoring and needs assessment all require place data, and all of it can be turned against the people who provided it. Do no harm means recording at the resolution needed for the response, aggregating before sharing, and never publishing a location that identifies a survivor's residence, a safe house, a clandestine clinic or a witness's village where the perpetrator is still present. For accountability documentation, precise references may be needed for a future prosecution, so hold them securely and separately from operational data. Duty of care extends to field staff, whose reported locations expose them too.

🎓 University and research

Researchers use place data for spatial epidemiology, conflict event analysis, environmental monitoring and migration studies. Reproducibility depends on documenting the gazetteer, its version, the geocoder and the exact query, since geocoders change and results are not stable over time. Ethics review is normally required whenever locations relate to identifiable people or vulnerable populations, and boards increasingly expect a spatial masking plan such as aggregation to administrative units or geographic jittering with a stated radius. Share the analysis code and the masked data, not the raw coordinates, and cite the underlying gazetteers properly since they are datasets with their own licence terms and attribution requirements.

Playbook: working Location / Coordinates end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Capture the reference verbatim

Record the location exactly as reported, in the original language and spelling, with the reporting person or document and the date. Do not normalise, translate or correct at capture. The raw string is the evidence and the normalisation is your analysis, which must remain separable. A good output is a field holding the original text alongside empty fields awaiting resolution. Stop when the source form is preserved somewhere it cannot be overwritten by later processing.

Phase 2 — Decide the resolution you need

Before geocoding, state the coarsest resolution that answers the question: country for a trade flow, district for a conflict incident, building only where the investigation genuinely requires it. This is a proportionality decision and it belongs in writing, with the purpose and lawful basis for any finer resolution. A good output is a one-line justification recorded against the record. Stop when you can defend the chosen precision to someone who was not in the room.

Phase 3 — Geocode with alternatives retained

Resolve against a gazetteer and keep every candidate rather than the top hit, recording how many places share the name in that country and the type of each. Duplicated settlement names are the norm, not an edge case. A good output is a candidate list with identifiers, feature types and populations. Stop when you either have a single candidate supported by corroborating detail or an explicit statement that the reference is ambiguous.

Phase 4 — Disambiguate with context

Use administrative context, neighbouring features, road and river names, distances stated in the report and the reporter's likely knowledge to discriminate between candidates. A named landmark or a stated travel time is often decisive. Record which evidence eliminated each rejected candidate. A good output is a short disambiguation note attached to the resolved record. Stop when a rejected candidate can no longer be revived by a plausible reading of the source.

Phase 5 — Represent as a polygon

Store the resolution as an area, not a point: an administrative boundary, a settlement footprint or a buffer whose radius reflects genuine uncertainty. Points imply precision the source does not support and survive downstream far longer than any caveat text does. A good output is a geometry with an explicit uncertainty attribute. Stop when the stored shape would not mislead an analyst who never reads your notes.

Phase 6 — Assign jurisdiction

Reverse geocode to administrative units and record which police force, prosecutor, court, registry and regulator apply. Note where boundaries are disputed and which dataset you used, because boundary files encode political positions. A good output is a jurisdiction stack from country down to municipality with the boundary source named. Stop when you can identify the correct authority for any subsequent lawful request.

Phase 7 — Enrich within the uncertainty area

Query infrastructure, registered entities, prior incidents and imagery across the whole uncertainty polygon rather than at a notional centre. Nearby ports, borders, airfields, industrial sites and rail links often explain why the location was chosen. A good output is a context list keyed to the polygon with distances stated as ranges. Stop when further enrichment stops changing your understanding of the site's function.

Phase 8 — Test consistency

Check the location against terrain, land cover, travel times, local time zone and any imagery for the reported date. Claims that are inconsistent with the physical world are the most productive leads you will get, and they are cheap to test. A good output is a short plausibility note recording each check and its result. Stop when the inconsistencies are either resolved or documented as unresolved.

Phase 9 — Aggregate before analysis of people

Where the records relate to individuals, aggregate to a unit that cannot be reversed to a household before doing pattern analysis, and set the unit by population rather than by area so sparse rural cells do not become identifying. A good output is an aggregated dataset with a stated minimum count per cell. Stop when no output cell could single out a person or a household.

Phase 10 — Downgrade for sharing

Produce the shareable version at the coarsest resolution that still carries the finding, and hold the precise reference in a restricted store with access logging. Assume any published map will be re-digitised by someone with different intentions. A good output is a published product whose precision was chosen deliberately and recorded. Stop when the difference between the internal and published resolution is documented.

Phase 11 — Record provenance and review

Log the gazetteer, its version, the geocoder, the query, the date and the analyst, and set a review point because names, boundaries and administrative structures change. A good output allows another analyst to reproduce the resolution exactly or to show that the source data has since changed. Stop when the record is reproducible without your involvement. Set the review date against the case rather than leaving the record to age silently in place.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
OpenStreetMap and Nominatim	Open	Global collaborative map with detailed buildings, land use, roads and points of interest, plus geocoding and reverse geocoding.	Primary free resolution of names and addresses to geometry, and the source of surrounding feature context within an uncertainty polygon.
Overpass API	Open	Query language and endpoint for retrieving OpenStreetMap features by type within a radius, bounding box or polygon.	Enumerates what infrastructure and registered features actually exist inside the uncertainty area rather than at a single point.
GeoNames	Open	Gazetteer of over ten million populated places and features with alternate names, administrative codes, feature classes and population.	Establishes how many places share a reported name in a country, which is the core disambiguation step.
NGA GEOnet Names Server	Open	Authoritative foreign geographic names database with variant spellings, transliterations and historical names outside the United States.	Resolves transliterated and historical place names in reporting that modern commercial geocoders fail to match.
USGS Geographic Names Information System	Open	Official United States domestic names, feature classes and coordinates maintained by the national mapping agency.	The authoritative reference for domestic United States place names, including obsolete and variant forms.
GADM administrative areas	Open	Global database of administrative boundaries at multiple levels, distributed as polygons for academic and non-commercial use.	Assigns resolved locations to administrative units for jurisdiction determination and for aggregation before sharing.
Natural Earth	Open	Public domain cartographic dataset of boundaries, populated places, coastlines and physical features at several scales.	Provides licence-clean base geometry for published maps where GADM terms or contested boundaries are a problem.
UN/LOCODE	Open	United Nations code list for ports, airports, inland terminals and other trade-relevant locations, with coordinates and function codes.	Normalises place references appearing in trade, shipping and customs records into a standard code set.
Wikidata	Open	Structured knowledge base linking place entities across languages with identifiers used by gazetteers and national datasets.	Bridges names between languages and links a place to its identifiers in other datasets you already hold.
WHO GIS and humanitarian data exchange	Open	Operational administrative boundaries and place codes maintained for humanitarian response, including common operational datasets.	Supplies the place codes used by humanitarian reporting, which frequently differ from national administrative codes.
National address and cadastral registers	Registration	Official address, parcel and land title data published by national mapping or land registry agencies.	Confirms that a geocoded address exists and corresponds to a real parcel before it is relied upon in a warrant or report.
ACLED and armed conflict event data	Registration	Coded conflict and protest events with dates, actors, locations and an explicit geographic precision code per record.	Provides a working model of how to record location precision honestly, and a corroboration source for reported incidents.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Location / Coordinates. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• QGIS — Open desktop geographic information system for geocoding, spatial joins, buffering and map production; projection handling errors are the most common source of silent spatial mistakes.
• Nominatim self-hosted — Runs geocoding locally without sending queries to a third party, which matters for sensitive subjects; requires substantial storage and regular data refresh.
• GDAL and OGR — Command line conversion and reprojection across dozens of spatial formats; extremely capable but silent about datum assumptions unless explicitly instructed.
• PostGIS — Spatial database for containment, proximity and aggregation queries at scale; index and projection choices dominate performance and correctness.
• geopy and pygeocodio style clients — Scripted access to multiple geocoding providers with fallback; results differ between providers, so provider identity must be stored with every result.
• H3 or geohash aggregation libraries — Bins point data into hierarchical cells for privacy-preserving aggregation; cell size must be chosen by population density, not by convenience.
• Mapillary and street-level imagery viewers — Ground-level reference for confirming that a resolved location matches described features; coverage is uneven and imagery may be years out of date.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Geocoders answer confidently and wrongly. They return the most popular match and discard the rest, so the first discipline is to demand the candidate list and count how many places in that country share the name before accepting any resolution.
• Human reporting names the nearest place people know, not the place where the event happened. Treat a settlement name in a rural incident report as the centre of an area with a radius of several kilometres, and record it that way.
• Points are a lie that outlives its caveat. Store polygons. Every downstream consumer will strip your uncertainty text and keep the geometry, so the geometry itself has to encode the honesty.
• Boundary datasets are political documents. Which country a point falls in depends on whose boundary file you loaded, and in contested areas the choice will be read as a position. Name the dataset in the product and be prepared to show the alternative.
• Aggregation is not anonymisation if the cells are sparse. A single incident in a district of two hundred people identifies a household. Size cells by population, apply a minimum count, and suppress rather than publish thin cells.
• Test time zone and daylight against the narrative. A report describing daylight activity at a stated local time is checkable against sunrise and sunset for that place and date, and this cheap test catches fabricated and misattributed reporting regularly.
• Name changes break joins silently. Regime change, language policy and transliteration reform all rewrite gazetteers, so historical records must be matched against contemporaneous name variants rather than current ones.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Location / Coordinates is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of location records stored with an explicit resolution or uncertainty attribute rather than as a bare point.
• Rate at which resolved locations are later corrected, tracked by source type, as a measure of geocoding discipline rather than volume.
• Share of published products where the disclosed resolution was chosen by documented proportionality decision rather than by default.
• Number of ambiguous references escalated for disambiguation rather than silently resolved to the top geocoder hit.
• Proportion of person-related spatial outputs passing a minimum cell count check before release, with suppressed cells reported rather than quietly dropped.
• Median time to identify the correct jurisdiction and authority for a lawful request after a location is resolved.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Geocoders return the most popular match, silently discarding dozens of identically named places elsewhere in the country.
• Reported locations often name the nearest known settlement rather than the actual site, inflating apparent precision.
• Boundary datasets encode political positions, so the assigned country may be contested or legally disputed.
• Place names change with regime, language and transliteration, quietly breaking joins against historical records.
• Treating a geocoded point as exact conceals an error radius that can span many kilometres in rural areas.
• Aggregating fine-grained location data about individuals recreates sensitive patterns even when each record looked innocuous.

Legal and ethical considerations

Location data about identifiable people is sensitive in most jurisdictions and can reveal home, worship, health and association. Work at the coarsest resolution that answers the question, and justify any move to finer granularity with a documented purpose and lawful basis. Apply proportionality by aggregating and generalising in published products, and avoid resolving to a residence unless a legal authority requires it. Retain only for the investigative purpose and restrict access to precise references.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Location / Coordinates, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 10 mission domains, 3 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

The geocoder returned one result with high confidence. Is that good enough?

No. Geocoder confidence measures string similarity and internal ranking, not real-world correctness, and single-result interfaces hide the fact that several identically named places may exist. Query for candidates rather than a single answer, check the gazetteer for how many settlements share the name in that country, and disambiguate using context from the source: administrative region, nearby features, stated distances, the reporter's likely local knowledge. Record what eliminated each rejected candidate. If nothing eliminates them, the honest output is an ambiguous reference with two or three candidate polygons, which is far more useful downstream than a confident wrong point.

How coarse should a published location be?

As coarse as the story or finding will bear, decided deliberately and recorded. For most reporting, district or municipality carries the meaning without exposing anyone. Village level is often identifying in sparsely populated areas. Building level should be reserved for sites that are institutional and non-residential, or where a court has already made the location public. The test is not whether the information is technically available but whether your publication increases the risk to a specific person. Where local contributors bear that risk, they should have a say in the resolution published, and their view should normally decide it.

Different boundary datasets put my point in different countries. What do I do?

Say so, and pick deliberately. Contested boundaries are encoded differently by GADM, Natural Earth, national mapping agencies and United Nations sources, and every choice carries a political reading. Report the administrative assignment under each relevant dataset where the difference is material, name the dataset used for your primary analysis, and avoid language that treats one assignment as objective fact. For legal or jurisdictional questions, the operative boundary is whichever the relevant authority applies in practice, which may be neither of the mapped versions, so establish who actually exercises control before drafting a request.

Can I use registered company addresses as physical locations?

Only after testing them. A large share of registered addresses are accountants, company formation agents or virtual office providers, and one such address may host thousands of companies. That is analytically useful in itself, since a shared service address links entities, but it is not evidence of physical presence. Check the address against mapping and street-level imagery, count how many other entities are registered there, and look for a separate trading or operational address in filings, permits or shipping records. Where physical presence matters, corroborate with an independent observation rather than inferring it from the register.

How do I document a location described only in a witness statement?

Preserve the description verbatim, then treat your geocoding as separate analysis with its own record. Note the exact words, the language, the interpreter if any, and the date. Then document the resolution process: which gazetteer, which candidates, what evidence discriminated between them, and what uncertainty remains. In a criminal matter the analyst who performed that conversion may have to explain it under cross-examination, so the reasoning must stand on its own. Never overwrite the witness's words with a normalised place name, because the original phrasing may carry detail that becomes significant much later.

Is aggregating incident locations enough to protect people?

Not automatically. Aggregation protects only if each output cell contains enough records and enough population that no individual can be singled out, and sparse rural areas routinely fail that test even at district level. Set a minimum count per cell, suppress cells below it rather than publishing them, and consider whether the combination of location with date, incident type and victim characteristics re-identifies someone even in a populated cell. Where a dataset will be published openly, apply the check to every field combination a determined reader might use, not just to the geography in isolation.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• ISO 19115 defines geographic metadata, including the lineage, positional accuracy and resolution statements that should accompany any location record.
• ISO 19157 covers geographic data quality, giving the vocabulary for expressing positional uncertainty in a comparable way.
• ISO 3166 provides country and subdivision codes, the base layer for administrative assignment across datasets.
• UN/LOCODE standardises trade and transport location codes used throughout shipping, customs and logistics records.
• The OGC Simple Features and GeoJSON specifications define the geometry representations in which polygons and uncertainty areas should be exchanged.
• The Berkeley Protocol on Digital Open Source Investigations sets standards for documenting and verifying geographic claims for accountability purposes.
• The Humanitarian Data Exchange common operational datasets define the administrative boundaries and place codes used across humanitarian response.
• The EU General Data Protection Regulation treats location data about identifiable persons as personal data, requiring lawful basis, necessity and minimisation.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. OpenStreetMap and Nominatim geocoding — OpenStreetMap Foundation. Open global map data and geocoding used for resolution and context enrichment.
2. GeoNames geographical database — GeoNames. Open gazetteer of populated places with alternate names and administrative codes.
3. GEOnet Names Server — United States National Geospatial-Intelligence Agency. Authoritative foreign place names with variants and transliterations.
4. Geographic Names Information System — United States Geological Survey. Official domestic United States feature names and coordinates.
5. UN/LOCODE code list — United Nations Economic Commission for Europe. Standard codes for ports and inland locations used in trade records.
6. Berkeley Protocol on Digital Open Source Investigations — United Nations Office of the High Commissioner for Human Rights. Standards for verifying and documenting open source geographic evidence.
7. Humanitarian Data Exchange common operational datasets — United Nations Office for the Coordination of Humanitarian Affairs. Administrative boundaries and place codes used across humanitarian operations.
8. GADM database of global administrative areas — GADM. Multi-level administrative boundary polygons for jurisdiction assignment.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: normalises place references to jurisdictions and polygons, with uncertainty carried through every pivot. Explore the platform, or browse the rest of the library by following any tag above.