Drug Trafficking: Mission Domain Intelligence Guide

A cluster of six overdoses in one town over a weekend is not a public health footnote. It is the first observable trace of a supply change that happened weeks earlier and several countries away.

What Drug Trafficking covers as a mission domain

Drug trafficking intelligence supports interdiction, prosecution and harm reduction by characterising illicit drug markets and the networks that supply them. Analysts study substance availability, purity and price, trafficking routes and logistics, precursor chemical diversion, distribution structures including online vendor markets, and the financial flows that follow. The practice is inherently multi-agency, drawing on forensic toxicology, customs seizure data, health surveillance and financial reporting. Assessments are used to place enforcement effort where it reduces harm, and to warn health services before a contaminated supply reaches users.

The domain divides into plant-based production and its supply chains, synthetic manufacture dependent on precursor and pre-precursor chemicals, maritime and air cargo trafficking, postal and parcel distribution driven by online vendor markets, and retail distribution structures that frequently exploit children and vulnerable adults. Actor types run from transnational networks with logistics capability to local distributors and coerced couriers who are often themselves victims.

Why it matters

Synthetic opioids have made supply variability lethal at doses users cannot perceive. Overdose deaths in several countries now exceed road fatalities. Beyond mortality, drug markets drive acquisitive crime, exploitation of children in distribution roles, violence over territory, and the laundering infrastructure that services other criminal markets. Effective intelligence in this domain saves lives primarily through early warning to health services, not only through seizures.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Imports of precursor or pre-precursor chemicals in volumes inconsistent with the importer's declared industrial activity or historical demand
Sudden divergence between street price and purity in a local market, indicating a supply change before any seizure confirms it
Overdose cluster alerts from emergency services or coroners concentrated by geography and time, often preceding forensic identification
Novel psychoactive substances or unexpected adulterants appearing in post-mortem toxicology and drug-checking service results
Vessels showing AIS gaps on known trafficking corridors, followed by fuel or crew changes inconsistent with the declared voyage
Parcel volume anomalies at sorting hubs, with repeated sender addresses, uniform packaging and declared contents inconsistent with weight
Online vendor listings whose stated dispatch country conflicts with customer complaints about customs interception patterns
Cash deposits structured below reporting thresholds across multiple branches, matched to individuals with no declared trading income

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

UNODC World Drug Report and Early Warning Advisory on NPS — Global market estimates, seizure trends and early identification of newly detected psychoactive substances
EUDA (formerly EMCDDA) reporting and the SCORE wastewater programme — European market indicators, harm data and comparative city-level wastewater estimates of population drug consumption
INCB precursor control and PEN Online reporting — International controls, scheduled chemicals and pre-export notification data on precursor movements
DEA National Drug Threat Assessment — United States market structure, trafficking route analysis and synthetic opioid supply chain detail
Europol and INTERPOL drug threat assessments — Cross-border network typologies, port infrastructure abuse and enforcement operation outcomes
National forensic and toxicology datasets and drug-checking services — Ground truth on actual composition, adulterants and potency reaching users
National mortality statistics and coroner reporting — Drug-related death trends by substance and demographic, the outcome measure that matters most
WHO Expert Committee on Drug Dependence reviews — Evidence-based scheduling recommendations and pharmacological risk assessments for emerging substances

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Characterise the market — Establish which substances are actually present locally, at what purity and price, using forensic, health and drug-checking data rather than assumption.
Map the supply chain — Work backwards from retail to importation, identifying chokepoints in precursor supply, freight consolidation, ports and parcel infrastructure.
Analyse logistics and entities — Examine freight forwarders, haulage firms, importers and port access records for the facilitation layer that makes volume trafficking possible.
Trace the proceeds — Follow cash handling, money service businesses, trade-based laundering and cryptocurrency cash-out to identify controllers rather than couriers.
Corroborate with forensic profiling — Use impurity profiling and packaging comparison across seizures to link consignments and confirm or refute assumed route hypotheses.
Convert to interventions — Issue health warnings for contaminated supply, brief regulators on precursor diversion, and support enforcement targeting of facilitators.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Criminal Intelligence — Intelligence Supporting Criminal Investigation
Dark Web Intelligence — Hidden Services and Closed Criminal Venues
Financial Intelligence — Following Value Through the Financial System
Logistics Intelligence — Cargo, Freight, and Physical Movement
Geospatial Intelligence — Intelligence Derived from Place
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Human Intelligence — Information from People, Ethically Obtained

Worked in these data points

Person / Name — A named individual — the subject of identity resolution and profiling.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Shipping Container — An ISO container identifier — trackable across ports, vessels, and customs events.
Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
Onion / Hidden Service — A Tor hidden service address on the dark web.
Vessel / Ship — A maritime vessel identified by IMO, MMSI, or call sign.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.

Adjacent mission domains

Inside the platform: where Drug Trafficking lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=drugs — Drug Trafficking dashboard
theater.php?d=drugs — Threat theater view
search.php — Person / Name profile
blockchain.php — Cryptocurrency Address profile
ioc-type.php?t=onion — Onion / Hidden Service profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Drug Trafficking:

Cryptocurrency Tracing — a step-checked workflow with the pivots, sources and handling rules already wired in.
Human Trafficking Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.
Sanctions Screening & Escalation — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Export STIX/MISP
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Characterise the market is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Analyse logistics and entities turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Convert to interventions feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Drug Trafficking

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence involvement is normally in support of civil authorities or partner nations: maritime and air domain awareness, surveillance assets supporting interdiction, and counter narcotics capacity building. Analysts assess trafficking corridors that intersect with force protection, corruption of host nation partners and the funding of armed groups through drug revenue. Products feed maritime patrol tasking, partner nation assessment and threat finance work. Constraints are firm: military forces generally have no arrest power in domestic settings, evidence handling must satisfy civil courts, and any support to a partner force requires human rights vetting so that assistance does not enable abuses.

🕵 National intelligence

National services track the strategic layer: the networks that move volume, the precursor supply from legitimate chemical industry, the corruption that protects routes, and the convergence of drug revenue with armed groups and sanctions evasion. Requirements focus on structure and chokepoints rather than individual consignments. Fusion is essential because a single stream never establishes a route: shipping data, financial intelligence, forensic profiling and human reporting each supply part. Handling considerations include passing material to law enforcement without compromising sources, and reporting honestly on the limits of seizure data as an indicator of flow.

👮 Law enforcement

Law enforcement runs interdiction, network investigation and prosecution. Evidence requirements dominate: continuity of exhibits from seizure to laboratory, validated analytical methods for identification and purity, authenticated communications data obtained under proper authority, and financial records traced to specific defendants. Forensic drug profiling can link seizures to a common source, which supports conspiracy charges. Investigators increasingly work upstream to precursors and downstream to laundering, since these produce documentary evidence less dependent on witnesses. Charging strategy should account for the reality that low level defendants are frequently exploited or coerced and may require a victim pathway rather than prosecution.

🔍 Private investigation and corporate security

Private sector involvement is mainly compliance and supply chain integrity: chemical companies meeting precursor control obligations, logistics operators screening for contamination of legitimate freight, and employers dealing with workplace incidents. Diligence questions concern customer legitimacy, end use plausibility and shipment anomalies. A private actor may not conduct covert surveillance of individuals, test people without lawful basis and consent, or investigate suspected trafficking independently. Suspicion of criminal activity should be reported to the competent authority. Reports should be written for regulatory scrutiny, since precursor and know your customer obligations are enforced.

📰 Journalism and OSINT media

Reporting on drug markets carries specific ethical requirements. Never publish detail that functions as instruction on production, concealment or acquisition. People who use drugs are a vulnerable population, frequently criminalised, and identifying them can cost them housing, employment, custody of children or their liberty, so consent must be genuinely informed. Verification means treating seizure statistics carefully, since they measure enforcement activity as much as supply, and corroborating claims about purity or adulteration with laboratory evidence. Coverage of overdose clusters should include harm reduction information and avoid method detail that could increase risk.

🌍 NGO, humanitarian and human rights

Harm reduction, health and human rights organisations work with people who use drugs, communities affected by trafficking, and those criminalised by enforcement. Practice is health led and non judgemental: services depend on trust, and any perception that an organisation shares information with police destroys it. Documentation for accountability covers extrajudicial violence, forced treatment and displacement caused by eradication. Data about service users is highly sensitive and should be minimised and protected accordingly. Duty of care includes staff exposed to overdose response and to trauma, and includes advocating for the people in the data rather than only about them.

🎓 University and research

Research spans epidemiology, market economics, forensic chemistry and policy evaluation. Methodological care is essential because most indicators are contaminated by enforcement activity: seizures measure interdiction, arrests measure policing, and both are frequently misread as measures of supply. Wastewater analysis, treatment presentations and survey data offer independent measures with their own biases. Ethics approval is mandatory for research involving people who use drugs, with particular attention to confidentiality against legal compulsion. Never publish synthesis routes or methods that would assist production. Share instruments and analysis code, and be explicit about which indicator each conclusion rests on.

Playbook: working Drug Trafficking end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the harm question

Decide what the work is for: reducing deaths, disrupting a supply route, supporting a prosecution or informing policy. These lead to different analysis and sometimes to conflicting recommendations, so the question must be explicit at the start. A good output is a written statement of the harm being addressed and the decision it supports, agreed with the commissioning body, because enforcement success and health outcomes are not the same measure and conflating them produces bad advice.

Phase 2 — Baseline the market with independent indicators

Combine several measures that fail in different directions: treatment presentations, wastewater analysis, hospital and overdose data, survey prevalence, price and purity from forensic testing, and seizure records. Never rely on seizures alone, which reflect enforcement effort. The output is a picture with each indicator's bias stated, so a change in one can be interpreted correctly rather than being read straight through as a change in supply.

Phase 3 — Map the supply architecture

Establish where production occurs, which precursors and equipment are required, which routes and modes are used, and who controls each segment. Work at the level of corridors and organisations rather than individual consignments. Note where legitimate commerce is exploited, such as containerised freight and postal networks. A good output identifies the segments that are hard to replace, which is where disruption has lasting effect.

Phase 4 — Track precursor and equipment anomalies

Work with regulators and industry on unusual orders, new customers with implausible end uses, designer precursors created to evade scheduling, and diversion from legitimate manufacture. This is a compliance and reporting exercise, not an operational one. The output is a set of reportable anomalies passed to the competent authority through established channels, plus feedback to industry on what to look for.

Phase 5 — Use forensic profiling to link

Laboratory analysis of impurity profiles, cutting agents and packaging can link separate seizures to a common batch or production facility, which supports conspiracy cases and route mapping. Ensure exhibits are handled to preserve continuity and that methods are validated and accredited. A good output is a documented linkage with stated statistical strength, presented in terms a court can weigh rather than as an unqualified match.

Phase 6 — Detect adulteration and overdose clusters early

Monitor for sudden changes in potency, novel synthetic opioids and unexpected adulterants through drug checking services, coroner and emergency department data, and community reports. Speed matters because clusters kill within days. The output is a public health alert routed to services, prescribers and people who use drugs, written without detail that would increase risk, and issued fast enough to change behaviour.

Phase 7 — Follow the money

Trace proceeds through cash movement, trade based laundering, informal value transfer, casinos, property and virtual assets. Financial evidence usually produces stronger cases than testimony and reaches the organisers rather than the couriers. Identify assets early for restraint. A good output maps the specific points where value enters regulated systems, since that is where lawful intervention is available. Coordinate with financial investigators early, since restraint timing drives the whole case.

Phase 8 — Screen for exploitation and coercion

Cultivation, courier and street level roles are frequently filled by trafficked or coerced people, including children. Screen every low level suspect for exploitation indicators before charging: debt bondage, control of documents, threats to family, recruitment through deception. Where indicators exist, refer through the national trafficking referral mechanism and treat the person as a potential victim. This is a legal duty in many jurisdictions and also produces better intelligence than prosecuting a replaceable courier.

Phase 9 — Plan interdiction against consequence

Assess what a seizure will actually achieve: whether the network can absorb the loss, whether it will displace to a more dangerous route, whether it will trigger violence over debt, and whether it removes a substitutable or non substitutable function. Coordinate with health services where a supply interruption could push people to unfamiliar and more dangerous substances. The output is an operation with an assessed consequence, not simply an achievable seizure.

Phase 10 — Coordinate health and enforcement responses

Establish a route by which enforcement intelligence about adulteration or supply changes reaches health services quickly, and by which health data informs enforcement priorities, without breaching the confidentiality that harm reduction services depend on. Agree what is shared in aggregate and what never leaves the service. A good output is a documented information sharing protocol that both sectors trust and use routinely.

Phase 11 — Support prosecution properly

Package exhibits with unbroken continuity, laboratory certificates from accredited facilities, financial analysis linked to named defendants, and communications evidence obtained under proper authority. Anticipate challenge to sampling methodology and to purity extrapolation. The output is a case file where each element can be explained by the person who produced it, and where the analytic and evidential records are clearly separate.

Phase 12 — Evaluate the effect honestly

Measure what changed in the market and in harm: price, purity, availability, overdose rates, violence, and time to replacement of the disrupted function. Set the baseline before the operation. A good output is an evaluation that is willing to report that an expensive operation produced displacement rather than reduction, because that is the only way the disruption model improves rather than repeating.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
UNODC World Drug Report and data portal	Open	Global estimates of production, seizures, prevalence and market trends compiled from member state reporting.	Authoritative baseline for market scale and trend framing in strategic assessments. Also documents the limitations of member state reported data.
European Union Drugs Agency	Open	European monitoring of prevalence, treatment, harms, new psychoactive substances and market indicators.	Comparable European indicator data and early warning on novel substances. Provides definitions that make cross country comparison possible.
International Narcotics Control Board	Open	Monitoring of licit trade in controlled substances and precursor chemicals under the international conventions.	Reference on precursor control obligations and reported diversion incidents. Also lists substances added to international control schedules.
EU Early Warning System on new psychoactive substances	Open	Rapid notification system for newly detected substances, with formal risk assessment where warranted.	Timely identification of novel substances appearing in a national market. Notifications travel faster than formal scheduling decisions.
WHO expert committee on drug dependence	Open	International scheduling recommendations and reviews of substances based on dependence and harm evidence.	Authoritative evidence on harm profiles when advising on scheduling or health response.
National overdose surveillance data	Open	Coroner, emergency department and public health datasets on drug related deaths and non fatal overdose.	Detecting clusters and evaluating whether interventions reduced or displaced harm. Coding practice varies, so check definitions before comparing areas.
Wastewater analysis networks	Open	Community level consumption estimates derived from municipal wastewater sampling across many cities.	Independent consumption indicator unaffected by enforcement activity or self report bias. Provides consumption trends where survey data is unavailable or stale.
Drug checking and community testing services	Open	Laboratory results on samples submitted by people who use drugs, showing adulterants and potency.	Earliest reliable warning of dangerous adulteration in a local market. Route results to services and communities rather than only to enforcement.
Forensic laboratory profiling programmes	Licensed	Impurity and isotopic profiling of seized material linking samples to production batches or regions.	Evidential linkage between separate seizures and identification of production origin. Requires accredited laboratories and documented exhibit continuity.
Customs and border enforcement reporting	Open	Seizure statistics, concealment trend reporting and risk indicators published by customs authorities.	Understanding interdiction patterns while treating seizures as an enforcement rather than supply measure.
Europol and INTERPOL assessments	Open	Operational and strategic reporting on trafficking networks, routes and disruption operations. Includes route analysis and joint operation outcomes across member states.	Network and route context, and identification of cooperation channels for cross border work.
Harm reduction service data and guidance	Open	Aggregate service data and practice guidance from needle exchange, naloxone and treatment providers.	Understanding what is happening among people who use drugs before it appears in official statistics.
Shipping and containerised trade data	Licensed	Vessel movement, container flows and port call records for legitimate freight used as a trafficking vector.	Route analysis and identification of transhipment patterns exploited for concealment. Absence of a record proves nothing, since coverage is partial.
Global Initiative and academic market research	Open	Field research on illicit economies, market governance and the effects of enforcement on communities.	Context on how disruption actually plays out for affected populations. Useful for assessing the community cost of enforcement operations.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Drug Trafficking. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Laboratory analytical instrumentation under accreditation — Identifies substances and quantifies purity to evidential standard. Limitation: accreditation, validated methods and continuity are prerequisites, and backlogs delay cases.
Impurity profiling databases — Compare seizure profiles to link batches and infer production origin. Limitation: reference collections are incomplete and comparisons carry statistical uncertainty that must be stated.
Wastewater sampling programmes — Estimate community consumption independent of enforcement data. Limitation: cannot distinguish user numbers from dose, and catchment population estimates introduce error.
Overdose alert and surveillance systems — Detect clusters quickly from emergency and coroner data. Limitation: reporting lags and inconsistent coding delay recognition of exactly the events that need speed.
Container and freight risk targeting systems — Score consignments against risk indicators for inspection prioritisation. Limitation: high volume and low base rate mean most alerts are false positives.
Financial analysis platforms — Map proceeds through accounts, trade and virtual assets. Limitation: depends on records obtained through legal process, which is slow across jurisdictions.
Precursor reporting systems for industry — Structured channels for chemical companies to report suspicious orders. Limitation: only effective where staff are trained to recognise anomalies and are not commercially discouraged from reporting.
Case management with exhibit continuity tracking — Maintains chain of custody across seizure, laboratory and court. Limitation: continuity failures usually originate in handover practice rather than in the system.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Export STIX/MISP — Streams the selection in CTI standard formats for sharing with partners and ISACs.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Seizure data measures enforcement, not supply. A rise can mean more trafficking, better interdiction or a change in tasking, and analysts who present it as a supply indicator mislead the decision maker who acts on it.
Triangulate with indicators that fail differently. Wastewater, treatment presentations, price and purity, and overdose data have unrelated biases, so agreement between them is meaningful in a way that any single series never is.
Purity and price are the most informative routine indicators. Sustained falling price with rising purity indicates supply exceeding demand far more reliably than any seizure total.
Screen every low level suspect for exploitation. Cultivation and courier roles are routinely filled by trafficked or coerced people including children, and treating them as offenders is both a safeguarding failure and a wasted intelligence opportunity.
Disruption can increase harm. Removing a known supply can push people toward unfamiliar and more potent substances, so health services need warning before an operation, not after the overdose cluster.
Never publish or circulate synthesis or concealment detail. This is a hard rule in analysis, briefing and media engagement, and it applies regardless of how much of the information appears to be already public.
Harm reduction services depend on not being an intelligence source. A single breach of that boundary can end a service's reach into the population that carries the most risk, so information sharing protocols must be explicit and aggregate.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Drug Trafficking is producing anything, and they are worth baselining before you change process or tooling.

Drug related deaths and non fatal overdose rates in the affected area, measured against a baseline established before intervention.
Time from first detection of a dangerous adulterant to a public health alert reaching frontline services and affected communities.
Price and purity trends at retail level from forensic testing, as an indicator of supply pressure rather than enforcement activity.
Proportion of low level suspects screened for exploitation indicators and referred to a victim pathway where indicators were present.
Time to replacement of a disrupted supply function, which measures whether the chokepoint analysis was correct.
Value of criminal assets identified before arrest as a share of assets ultimately restrained. Assets identified after arrest should be tracked separately, because recovery rates differ sharply.
Number of precursor diversion reports received from industry that resulted in verified findings, tracking reporting quality rather than volume.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Reading seizure volumes as market size, when they largely measure enforcement effort, resourcing and port scanning capacity
Using arrest counts for possession as a trafficking indicator, which conflates dependent users with distribution networks
Ignoring displacement, where a successful route disruption relocates rather than reduces flow and can raise harm during transition
Inconsistent substance naming across health, forensic and enforcement datasets, causing double counting or missed trend signals
Treating a single toxicology result as a market signal without confirming the analytical method and detection limits used
Targeting the visible retail layer, which is frequently staffed by exploited children and replaced within days

Legal and ethical considerations

Handling of controlled substances and forensic exhibits is governed by strict chain of custody and licensing rules, and analysts should never take possession of material. Informant and undercover activity is statutorily regulated. Health and drug-checking data is often collected under confidentiality assurances that are essential to its existence, and breaching them destroys the source; agree data sharing terms with public health partners in advance. Products must not contain manufacturing, synthesis or concealment detail, and cross-border evidence requires formal mutual legal assistance.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Drug Trafficking, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 7 data points, 7 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Why is seizure data such a poor measure of the market?

Because it records what enforcement found, which depends on tasking, resourcing, intelligence and luck rather than on how much is moving. A doubling of seizures at a port may reflect a new scanner rather than increased trafficking, and a fall may reflect officers being reassigned. Seizure data is also lumpy: a single container distorts an annual series. Use it alongside indicators generated by different processes, such as wastewater consumption estimates, treatment presentations and forensic price and purity data, and state explicitly which indicator each conclusion rests on.

How should an analyst handle a suspected exploited courier?

Treat exploitation indicators as a trigger for referral, not a mitigation to raise at sentencing. Look for debt owed to organisers, control of identity documents by another person, recruitment through deception, restricted movement, threats to family, and youth. Where present, refer through the national mechanism for potential trafficking victims and ensure the person receives support and legal advice independent of the investigation. Many jurisdictions provide a statutory defence for offences committed as a direct consequence of trafficking, and failing to identify this early leads to unsafe convictions.

What can private companies actually do about precursor diversion?

Apply know your customer discipline to chemical and equipment sales, and use the reporting channels that exist. In practice that means verifying the business legitimacy and plausible end use of new customers, checking whether the quantity and combination ordered makes sense for the stated purpose, watching for requests to split shipments or ship to unrelated addresses, and reporting anomalies to the national competent authority. Train sales and logistics staff, since they see the anomaly first. Companies should not investigate suspected customers themselves, which risks tipping off and legal exposure.

Does drug checking encourage use?

The evidence does not support that concern, and services report behaviour change including disposal of dangerous samples and reduced dosing when results are communicated. The stronger operational point for an analyst is that drug checking provides the earliest reliable signal of a dangerous adulterant in a local market, often days ahead of coroner or hospital data. That signal has repeatedly prevented deaths when routed quickly to services and to people who use drugs. Treating these services as a public health surveillance asset rather than as a policy controversy improves outcomes measurably.

How do we share information between enforcement and health services safely?

Through a written protocol that specifies what moves in each direction and at what level of aggregation. Health services can supply aggregate and de-identified signals about harm and substance changes without exposing individuals. Enforcement can supply timely warnings about supply changes, adulteration and market disruption without requiring anything in return. What must never happen is police access to individual service user records, since that ends the service's reach into the highest risk population. Agree the protocol in advance, publish it, and audit compliance.

What should never appear in a drugs intelligence product?

Anything that functions as instruction: synthesis routes, precursor substitution methods, concealment techniques, dosing to avoid detection, or sourcing information. This applies to internal products as well as published ones, because products circulate. Describe that a method exists and its detection implications without describing how it works. The same discipline applies to media engagement and to conference presentations. Where technical detail is genuinely necessary for a laboratory or regulatory audience, restrict distribution to that audience through a controlled channel.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

Single Convention on Narcotic Drugs 1961, the foundational international scheduling instrument.
Convention on Psychotropic Substances 1971, extending international control to psychotropic substances.
UN Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances 1988, covering trafficking offences and precursor control.
UN Convention against Transnational Organized Crime, providing cooperation mechanisms against trafficking networks.
ISO/IEC 17025 laboratory competence, governing accreditation of forensic drug analysis.
UNODC scientific and forensic guidelines on sampling, analysis and drug characterisation.
National referral mechanisms and statutory defences for trafficking victims compelled to commit offences.
WHO guidance on the management of substance use disorders and on opioid overdose response including naloxone provision.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

World Drug Report — UN Office on Drugs and Crime. Annual global assessment of drug markets, production and harms.
European Drug Report — European Union Drugs Agency. Annual European monitoring of prevalence, harms and market indicators.
Annual Report on precursor control — International Narcotics Control Board. Monitoring of licit trade and diversion of controlled precursors.
Expert Committee on Drug Dependence reviews — World Health Organization. Evidence based reviews informing international scheduling decisions.
Drug overdose surveillance data — Centers for Disease Control and Prevention. National surveillance of fatal and non fatal overdose.
Global State of Harm Reduction — Harm Reduction International. Reference report on harm reduction service coverage and policy worldwide.
WEDINOS drug sample analysis — Public Health Wales. Published analysis of submitted drug samples showing content and adulterants.
Illicit economies research — Global Initiative Against Transnational Organized Crime. Field research on drug markets and the effects of enforcement on communities.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: correlates precursor anomalies, route indicators, forensic profiles and overdose cluster alerts for interdiction and harm reduction. Explore the platform, or browse the rest of the library by following any tag above.