Vehicle Intelligence (VEHINT): Intelligence Discipline Guide

A vehicle is a seventeen-character identifier attached to an engine. Decode it properly and you get the plant, the year, the specification and the honest history behind the sales listing.

What Vehicle Intelligence is as a discipline

Vehicle intelligence covers the identification, ownership, history and movement of road vehicles. It rests on structured identifiers, principally the vehicle identification number, which encodes manufacturer, plant, model year and specification in a standardised format, together with registration marks, engine and chassis numbers and commercial operator identifiers. Practitioners decode and validate identifiers, retrieve title and history records, resolve registered keepers and fleet operators, and analyse movement and usage where lawful data exists, such as commercial carrier inspection and crash records.

Sub-methods include VIN decoding and check-digit validation, title and branding history research, theft and export screening, commercial carrier and fleet analysis, and vehicle specification assessment for capability questions such as payload, armour or modification. In the cycle it is a targeting and corroboration discipline: a vehicle links a person to a place and time more reliably than most other everyday identifiers.

Why it matters

Only vehicle intelligence answers whether a specific vehicle is what it claims to be. It answers whether a VIN is structurally valid or cloned, whether a vehicle has a salvage, flood or odometer branding hidden by retitling across jurisdictions, who operates a commercial fleet and what safety record it carries, whether a vehicle was reported stolen and subsequently exported, and whether an observed vehicle's specification is consistent with a claimed civilian use or indicates modification.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

VIN structure: world manufacturer identifier, vehicle descriptor section, check digit, model year code and assembly plant code
Check digit validation failures indicating a fabricated, mistyped or deliberately cloned vehicle identification number
Title branding history including salvage, rebuilt, flood and odometer rollback markers, and retitling across jurisdictions
Registered keeper and fleet operator records linking a vehicle to a person, company or leasing structure
Commercial carrier identifiers with inspection, crash and out-of-service history for freight and passenger operators
Theft and export screening hits where a vehicle reported stolen appears in a foreign registration or shipping record
Specification and option codes revealing engine, drivetrain, armour packages and factory modifications relevant to capability
Auction, insurance total loss and export records that document a vehicle's transition between markets and identities

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

NHTSA vPIC — Free VIN decoding API returning manufacturer, plant, model, engine and safety equipment for a wide range of vehicles
NICB VINCheck — Free limited check against insurance industry theft and total loss records for US vehicles
NMVTIS — US national title information system consolidating brands and odometer readings across states via approved providers
FMCSA SAFER and Company Snapshot — Free US commercial carrier records with fleet size, inspection, crash and out-of-service history by USDOT number
EU vehicle type approval and national registration authorities — Type approval documentation and, where available, registration lookup services for European vehicles
NHTSA recall and complaint databases — Recall campaigns, defect investigations and owner complaints tied to specific vehicle models and years
Auction and salvage listing archives — Historical listings with photographs, damage descriptions and VINs documenting a vehicle's condition at resale
INTERPOL Stolen Motor Vehicle database — International stolen vehicle records, accessible through law enforcement channels for cross-border theft verification

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Validate the identifier — Run check digit and structure validation on the VIN before anything else; an invalid VIN changes the investigation from history research to fraud.
Decode the specification — Resolve manufacturer, plant, model year and build specification, then compare against how the vehicle is described in listings or reports.
Pull the title history — Retrieve branding, odometer and retitling records across jurisdictions to expose washed titles and undisclosed damage.
Resolve the keeper or operator — Identify the registered keeper, leasing company or commercial operator, then resolve corporate entities in company registries.
Screen for theft and export — Check theft databases and, for cross-border cases, shipping and customs records for the VIN or container consignment.
Assess physical consistency — Compare photographs and observed features against the decoded specification to detect cloning, re-VINing and undisclosed modification.
Document with provenance — Record every source, query date and result verbatim, since vehicle findings frequently support insurance, criminal or civil proceedings.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Border Security & Migration

Operates on these data points

Person / Name — A named individual — the subject of identity resolution and profiling.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
National ID Number — A government-issued personal identification number — highly sensitive PII.
Biometric Identifier — Face, fingerprint, iris, gait, or voice templates used for identification — most sensitive PII class.

Related disciplines

Aviation Intelligence — Aircraft, Flights, and the Aviation Domain
Logistics Intelligence — Cargo, Freight, and Physical Movement
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Supply Chain Intelligence — Supplier Networks, Dependencies, and Integrity

Inside the platform: where Vehicle Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=VEHINT — Discipline hub
source-catalog.php?disc=VEHINT — Source catalogue filtered to this discipline
search.php — Person / Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Validate the identifier is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Pull the title history turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Document with provenance feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Vehicle Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Vehicle intelligence supports convoy and checkpoint operations, force protection and equipment recognition. Analysts characterise vehicle types in an area of operations, identify modifications indicating weapons mounting, armour or improvised use, and assess fleet composition from imagery and recovered documentation. Serial and chassis numbers on recovered vehicles support tracing to point of manufacture and export, which feeds counter-threat network work. Products feed IPB, recognition guides and vehicle-borne threat assessments. Constraints include host nation ownership records being unavailable or unreliable, and the requirement to handle information about civilian vehicle owners under applicable data protection and status of forces arrangements.

🕵 National intelligence

National intelligence uses vehicle data in sanctions and export control work, in tracing procurement of specialised chassis and heavy transporters, and in supporting attribution of incidents to specific fleets or operators. Vehicle identification numbers and specification data establish exactly what was built and where, which distinguishes a domestically produced platform from a rebadged import. Access to keeper data is a national law question in every jurisdiction and generally requires statutory process, so collection plans should route through the correct legal mechanism rather than commercial data brokers whose provenance cannot be defended.

👮 Law enforcement

This is the discipline's core setting. Investigators validate identifiers, decode specification, trace title and branding history, resolve keepers and operators through statutory process, and screen for theft and export. In the United States, access to personal information from motor vehicle records is governed by the Driver's Privacy Protection Act and requires a permissible purpose; in the United Kingdom, keeper details are requested from DVLA using the V888 process on reasonable cause. Evidentially, every query and result must be recorded verbatim with date and source, because vehicle findings routinely support criminal, civil and insurance proceedings.

🔍 Private investigation and corporate security

Private investigators and corporate security use vehicle intelligence for fleet due diligence, insurance investigation, asset location in judgment enforcement and pre-purchase verification. Public identifier decoding, recall data, salvage and auction history and commercial carrier safety records are all lawfully available. Keeper and registration data is not open: it must be requested through the statutory route with a permissible purpose, and misrepresenting that purpose is itself an offence. Never attempt to identify a private individual from a licence plate through open source inference or informal contacts, which is unlawful in most jurisdictions and professionally disqualifying.

📰 Journalism and OSINT media

Journalists use vehicle identification in conflict documentation, sanctions reporting and consumer investigations. Verification standards require decoding the identifier properly rather than relying on a listing description, checking check digits, and corroborating claimed specification against visible features in imagery. Publishing a licence plate or an identifier that identifies a private individual is a privacy intrusion that needs specific justification, and in many jurisdictions obtaining keeper details for journalism does not meet the statutory access test. Blur plates by default, and give companies and fleet operators a right of reply.

🌍 NGO, humanitarian and human rights

Human rights and conflict monitoring organisations use vehicle identification to document the presence of specific fleets at incident sites, to trace armoured and security vehicles to their exporters, and to support arms transfer accountability. Documentation should record identifiers, markings and modifications with imagery provenance and timestamps. Do no harm applies strongly: publishing identifiers of civilian vehicles can expose owners to retaliation, and imagery of vehicles at protests can be used to identify participants. Focus on state and corporate fleets, minimise private vehicle detail, and store raw imagery securely.

🎓 University and research

Researchers use vehicle data in transport safety, emissions, theft and market research. Public identifier decoding services, recall and complaint databases, and carrier safety records support large-scale study without personal data. Any linkage to registration or keeper records is personal data processing and requires both a lawful basis and ethics approval, and in the United States is separately restricted by driver privacy legislation. Reproducibility requires citing the decoder version, standard revision and extraction date, since identifier standards and manufacturer world identifiers change and decoded specification can differ between services.

Playbook: working Vehicle Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Validate the identifier before anything else

Run structure and check digit validation on the vehicle identification number. A seventeen-character identifier has a defined format, prohibited characters and, in North American practice, a computable check digit. An invalid identifier changes the investigation from history research to suspected fraud or cloning. A good output records the identifier as observed, the validation result and any transcription ambiguity such as confusable characters. Stop and treat the vehicle as suspect rather than proceeding to history lookups if validation fails.

Phase 2 — Decode manufacturer, plant and specification

Resolve the world manufacturer identifier, the descriptor section and the model year and plant code using an authoritative decoder, then record the build specification: model, body, engine, drivetrain, restraint systems and installed equipment. A good output is a decoded specification with the decoder and standard version cited. Stop when the decode is complete and note explicitly where manufacturer-specific descriptor fields cannot be resolved by public decoders, which is common outside North America.

Phase 3 — Compare specification against description

Test the decoded specification against how the vehicle is described in a listing, a report or an insurance claim. Mismatches in engine, body style, trim or model year are the fastest indicator of misrepresentation or of an identifier transplanted from another vehicle. A good output is a discrepancy table. Stop and escalate to a physical inspection recommendation where a material mismatch appears, since remote analysis cannot resolve cloning on its own.

Phase 4 — Retrieve title and branding history

Pull title, branding and odometer history across jurisdictions using the appropriate national systems. Salvage, flood, rebuilt and total loss brandings are frequently washed by retitling in a jurisdiction that does not carry the brand forward. A good output is a chronological title history showing every jurisdiction, date and brand. Stop when the history is continuous across the vehicle's life or a gap is documented, since gaps are where washing occurs.

Phase 5 — Screen for theft and outstanding interests

Check theft databases and, where available, records of finance interests and liens over the vehicle. For cross-border cases include international stolen vehicle checking through the appropriate law enforcement channel. A good output is a screening record with database, query date and result verbatim. Stop and notify the relevant authority immediately where a theft match arises, rather than continuing to investigate or contacting the current possessor.

Phase 6 — Route keeper and registration enquiries through statutory process

Obtain registered keeper or owner information only through the lawful mechanism for the jurisdiction: in the United States a permissible purpose under the Driver's Privacy Protection Act, in the United Kingdom a V888 request to DVLA on reasonable cause, and equivalent processes elsewhere. Record the purpose asserted and the authority relied on. A good output is a keeper result with the statutory basis documented. Stop absolutely at open source inference about private individuals from a plate, which is unlawful and unusable.

Phase 7 — Resolve commercial operators and fleets

For commercial vehicles, identify the carrier or operator through public safety and licensing systems, then resolve the operating entity in corporate registries. Carrier records carry inspection history, crash records, safety ratings and out-of-service actions that characterise the operation. A good output links the vehicle to an operator with a licence identifier and a safety profile. Stop when the operating entity is resolved to a registered company rather than a trading name.

Phase 8 — Assess physical consistency from imagery

Compare photographs and observed features against the decoded specification: badging, trim, wheel and light configuration, panel gaps, weld and paint evidence around identifier plates, and aftermarket modification. Inconsistency indicates cloning, re-identification or undisclosed damage repair. A good output is an annotated comparison with each feature referenced to the specification. Stop before concluding cloning from photographs alone; recommend physical inspection of secondary identifiers by a competent examiner.

Phase 9 — Analyse capability where the question is operational

Where the question concerns what a vehicle can do, derive payload, towing, protection level, ground clearance and range from manufacturer specification and visible modification. Armour, weapon mounts, communications fits and suspension changes all alter capability and are visible. A good output is a bounded capability statement naming the limiting factor. Stop before asserting a protection level from appearance, since applique armour and factory protection are not distinguishable from photographs alone.

Phase 10 — Check recall, defect and inspection records

Retrieve manufacturer recalls, safety defect investigations, consumer complaints and periodic inspection records where public. Unremedied recalls and repeated inspection failures matter in liability and insurance work and characterise fleet maintenance standards. A good output summarises outstanding safety actions affecting the specific build. Stop when the records for the decoded model year and variant are covered rather than for the model family generally.

Phase 11 — Trace export and cross-border movement

Where a vehicle has crossed borders, check export declarations, shipping records and container consignments referencing the identifier, and destination country registration where accessible. Stolen vehicle export is a large and well-documented flow. A good output is a movement chronology with documentary sources. Stop when the vehicle's presence in the destination jurisdiction is documented, and refer suspected trafficking to law enforcement rather than pursuing recovery independently.

Phase 12 — Document with full provenance

Record every source, query string, query date, response verbatim and the statutory basis for each restricted lookup, and preserve screenshots or exports with hashes. Vehicle findings routinely support insurance, criminal and civil proceedings years later, and databases change without notice. A good output can be re-verified by a third party from the record alone. Stop before delivering any product that mixes statutorily obtained keeper data with open source material without marking which is which.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
NHTSA vPIC vehicle identification decoder	Open	Free API and web decoder returning manufacturer, plant, model, body, engine and safety equipment from an identifier	Authoritative first-pass decode and specification retrieval for vehicles sold in the United States
NHTSA recalls, complaints and investigations	Open	Safety recall records, defect investigations, consumer complaints and safety ratings by make, model and year	Identifies outstanding safety actions affecting the specific build and supports liability analysis
National Motor Vehicle Title Information System	Registration	US federal title, brand and odometer data consolidated across participating states through approved providers	Detects washed titles and undisclosed salvage or flood branding across state boundaries
NICB VINCheck	Open	Free check against insurance industry records of theft and total loss reports for a given identifier	Rapid free screen for reported theft and insurance total loss before deeper record purchase
FMCSA SAFER and company snapshot	Open	US commercial carrier registration, operating authority, fleet size, inspection, crash and out-of-service records	Resolves commercial vehicles to a carrier and characterises that operator's safety performance
DVLA vehicle enquiry and V888 process	Open	UK public vehicle enquiry showing tax and MOT status, plus the statutory route for requesting keeper details on reasonable cause	Confirms UK vehicle status openly and provides the only lawful route to keeper information
UK MOT history service	Open	Test history for UK vehicles including dates, results, advisories and recorded mileage at each test	Independent mileage record that exposes odometer tampering and documents condition over time
UNECE World Forum for Harmonization of Vehicle Regulations	Open	International vehicle regulations, type approval requirements and standards including identification numbering	Defines the identifier standard and type approval framework used outside North America
EU vehicle type approval information	Open	European whole vehicle type approval framework, certificates of conformity requirements and national approval authorities	Establishes what specification a vehicle was approved to and which authority issued the approval
INTERPOL Stolen Motor Vehicle database	Registration	International database of reported stolen vehicles accessible to law enforcement through national central bureaux	Cross-border theft screening, the only reliable check once a vehicle has left its origin country
Auction and salvage listing archives	Registration	Historical listings from salvage and wholesale auctions with photographs, damage descriptions and sale dates	Documents pre-repair damage and mileage that a later retail listing conceals
ISO 3779 and 3780 identification standards	Licensed	International standards defining vehicle identification number structure and world manufacturer identifier assignment	Authoritative reference for validating identifier structure and interpreting world manufacturer codes outside North America
SAE standards and manufacturer service documentation	Licensed	Technical standards and manufacturer service manuals describing identifier locations, build plates and specification codes	Locates secondary identifiers and build plates used to detect re-identification during a physical inspection
Conflict Armament Research field documentation	Open	Documented vehicles, components and markings recovered in conflict, traced to manufacture and export	Reference methodology and comparison data for tracing vehicles used in conflict to lawful transfer
UN Comtrade vehicle trade statistics	Registration	Bilateral trade in vehicles and parts by harmonised system code, value and quantity	Quantifies export flows of used and specialised vehicles into destination markets of interest
European Automobile Manufacturers Association and national registration statistics	Open	Registration volumes, fleet composition and model share statistics by market and period	Baselines for judging whether an observed vehicle type is common or unusual in a given market

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Vehicle Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

NHTSA vPIC API — Programmatic identifier decoding and specification retrieval at scale; free and authoritative for US market vehicles, weaker outside it.
Check digit validation scripts — Verifies identifier structure and computes the North American check digit; simple and decisive, though the check digit is not used in all markets.
Commercial history report providers — Aggregate title, mileage, damage and auction records into one report; convenient, and coverage gaps mean a clean report is not proof of a clean history.
Image comparison and metadata tools — Examines photographs for specification consistency and manipulation; metadata is frequently stripped by platforms, limiting provenance.
Corporate registry search tooling — Resolves fleet operators and lessors to legal entities; essential for commercial vehicle work, coverage varies by jurisdiction.
QGIS — Maps carrier operating areas, incident locations and inspection sites; useful for fleet pattern analysis, dependent on data quality.
Case management with query logging — Records every restricted lookup with purpose and authority; unglamorous but the difference between defensible and indefensible work.
OCR for plates and build plates in imagery — Extracts identifiers from photographs; error-prone on confusable characters, so results must be validated before use.
Recall and defect monitoring feeds — Alerts on new safety actions affecting a monitored fleet; effective for fleets, noisy if configured at model family level.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Validate before you research. An identifier that fails structure or check digit validation turns the job from history research into a fraud enquiry, and every downstream record you pull on an invalid identifier is about a different vehicle or no vehicle at all.
Keeper data comes through statutory process, never inference. The Driver's Privacy Protection Act in the United States and the DVLA V888 route in the United Kingdom exist precisely because plate-to-person lookup is restricted. Open source inference about a private individual from a plate is unlawful and professionally fatal.
Title washing is a jurisdictional exploit. Brands do not always carry across state or national borders, so a salvage record disappears when a vehicle is retitled elsewhere. Always search every jurisdiction in the vehicle's history, not just the current one.
Specification mismatch beats paperwork. Comparing the decoded build against visible features exposes cloning and misrepresentation faster than any document check, because the paperwork is what the fraudster controls and the metal is not.
Mileage evidence lives in inspection records. Periodic test histories such as the UK MOT record capture odometer readings at intervals from an independent party, which is the most reliable open evidence of tampering available.
Commercial vehicles carry a public safety record. Carrier registration, inspection outcomes, crash history and out-of-service actions characterise an operator's standards in a way no private vehicle record ever does, and they are open.
Record the query, not just the answer. Vehicle databases change silently and results are frequently challenged years later in insurance or criminal proceedings, so preserve the query string, timestamp, source version and verbatim response.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Vehicle Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of enquiries where the identifier was validated before any record retrieval, tracked as a basic quality gate.
Rate of specification mismatches detected between decoded build and described vehicle, which measures whether the comparison step is being done.
Compliance rate for restricted lookups, measured by the share with a documented statutory basis and recorded permissible purpose.
Detection rate for washed titles, measured by branding found in a jurisdiction other than the current title state.
Time from a theft screening hit to notification of the relevant law enforcement authority, measured in hours rather than days.
Reproducibility of findings, tested by whether a second analyst reaches the same conclusion from the preserved query record.
Number of insurance, criminal or civil matters where the vehicle product was relied upon without successful challenge to its provenance.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Trusting a VIN plate without physical verification against secondary stamped locations, which is exactly how cloning succeeds
Assuming decoder completeness; free decoders cover some markets and manufacturers far better than others, especially outside North America
Missing title washing where a branded vehicle is retitled clean in a jurisdiction that does not carry the brand forward
Confusing registered keeper with driver or beneficial owner, particularly for leased and fleet vehicles
Reading number plate observations as vehicle identity when plates are cheap to swap, clone or fabricate
Handling licence plate reader or telematics data without a lawful basis, which creates serious privacy exposure

Legal and ethical considerations

Access to vehicle registration and keeper data is restricted in most jurisdictions. In the United States the Driver's Privacy Protection Act limits who may obtain personal information from motor vehicle records and for what permissible purposes; equivalent restrictions apply across Europe. Automated licence plate reader and telematics data is personal data and requires a lawful basis, usually confined to law enforcement or specific contractual rights. Findings used in insurance or credit decisions may trigger consumer reporting obligations. Never misrepresent your purpose to obtain records.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Vehicle Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 data points, 1 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can I find out who owns a car from its licence plate?

Only through the statutory route, and only with a qualifying purpose. In the United States the Driver's Privacy Protection Act restricts disclosure of personal information from motor vehicle records to enumerated permissible purposes, and obtaining it by misrepresentation is an offence. In the United Kingdom, DVLA releases registered keeper details in response to a V888 request where the applicant demonstrates reasonable cause, such as a collision or trespass. Similar restrictions apply across Europe and beyond. Attempting to identify a private individual from a plate through open sources, social media or informal contacts is unlawful and produces evidence you cannot use.

How do I detect a cloned vehicle?

Start with structure and check digit validation, then compare the decoded specification against the vehicle as described and as photographed: engine, body style, trim, equipment, colour and model year features. Look for a mismatch between the displayed identifier and the vehicle's actual build. Check whether the same identifier appears in two places at once across listings, insurance or inspection records. Physical confirmation requires a competent examiner to check secondary identifiers stamped or etched elsewhere on the vehicle, along with evidence of tampering around the visible plate. Remote analysis raises suspicion; inspection resolves it.

What does a salvage brand actually mean?

It means an insurer or authority declared the vehicle a total loss or otherwise recorded significant damage, with the exact meaning varying by jurisdiction: salvage, rebuilt, flood, hail, junk and non-repairable are distinct categories with different implications. The important analytic point is that brands do not always transfer when a vehicle is retitled in another jurisdiction, which is the mechanism of title washing. Always check the full jurisdictional history rather than the current title, and treat a clean current title with an out-of-state gap in history as a specific question to answer.

Are commercial vehicle records more accessible than private ones?

Considerably, because commercial operation is a licensed activity with a public safety interest. In the United States, carrier registration, operating authority, fleet size, inspection results, crash records and out-of-service actions are published and searchable, and equivalent regimes exist elsewhere. This makes fleet and operator analysis possible without touching restricted personal data. The distinction is worth maintaining rigorously in practice: work commercial questions through the open carrier record, and route anything about an individual driver or private keeper through the statutory process.

How reliable are commercial vehicle history reports?

Useful and incomplete. They aggregate title, insurance, auction, service and inspection records from participating sources, and coverage varies by jurisdiction, insurer and repairer participation. A clean report means no participating source reported an event, not that no event occurred, and unreported damage repair is routine. Use them as a screening layer, corroborate with independent inspection records such as periodic test histories, auction photographs and physical examination, and never present a clean report as evidence of a clean history in a professional product.

Can I trace a vehicle after it has been exported?

Partly, and it usually needs law enforcement channels. Export declarations and shipping records referencing the identifier or the container consignment establish departure. Arrival and re-registration in the destination country depend entirely on that country's registry accessibility, which is often nil. For stolen vehicles, the INTERPOL stolen motor vehicle database is checked at borders and by member country police, and a match requires a national central bureau route rather than a private query. Document what you can establish and refer the recovery question to law enforcement rather than pursuing it commercially.

How should imagery of vehicles at protests or incidents be handled?

With deliberate minimisation. Licence plates and distinctive vehicles identify individuals, and publishing them can expose protesters, journalists and bystanders to state or private retaliation. Blur plates by default, store raw imagery encrypted and access-controlled, and restrict identification work to state, security and corporate fleets where accountability is the purpose. If identification of a private vehicle is genuinely necessary for an accountability finding, document the justification, keep the identifying detail out of the published product, and take advice on the data protection position before processing.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 3779 and ISO 3780, which define vehicle identification number structure and the assignment of world manufacturer identifiers.
US Driver's Privacy Protection Act, which restricts disclosure and use of personal information from state motor vehicle records to enumerated permissible purposes.
UK DVLA disclosure policy and the V888 process, which sets reasonable cause as the test for releasing registered keeper information.
UNECE 1958 and 1998 Agreements and the World Forum for Harmonization of Vehicle Regulations, which govern international vehicle type approval and construction standards.
EU whole vehicle type approval framework and certificate of conformity requirements, which define approved specification and the issuing authority.
National Motor Vehicle Title Information System requirements, which oblige participating jurisdictions and insurers to report title and total loss data.
FMCSA safety regulations and the Compliance, Safety, Accountability programme, which generate the public carrier inspection and crash record.
Data protection law including UK GDPR and Regulation (EU) 2016/679, which governs any processing of registration data linked to an identifiable person.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

vPIC vehicle identification number decoder and API — US National Highway Traffic Safety Administration. Free authoritative decoding of identifiers into manufacturer, plant and build specification
Recalls, investigations and complaints database — US National Highway Traffic Safety Administration. Safety recall and defect records searchable by identifier, make, model and year
National Motor Vehicle Title Information System — US Bureau of Justice Assistance. Federal system consolidating state title, brand and odometer data to prevent title washing
VINCheck theft and total loss screening — National Insurance Crime Bureau. Free check of insurance industry theft and total loss records by identifier
SAFER company snapshot and carrier records — US Federal Motor Carrier Safety Administration. Public commercial carrier registration, inspection, crash and safety rating data
Vehicle enquiry service and keeper information requests — UK Driver and Vehicle Licensing Agency. Public vehicle status checking and the statutory V888 route for keeper details on reasonable cause
MOT history service — UK Driver and Vehicle Standards Agency. Independent record of test results, advisories and recorded mileage over a vehicle's life
World Forum for Harmonization of Vehicle Regulations — UNECE. International vehicle regulations including identification numbering and type approval requirements
Stolen Motor Vehicle database — INTERPOL. International stolen vehicle records checked through national central bureaux at borders
Field documentation methodology for recovered materiel — Conflict Armament Research. Documented tracing of vehicles and components from recovery to manufacture and lawful transfer

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: validates identifiers, decodes specifications and links vehicles to keepers, fleets and case entities with full provenance. Explore the platform, or browse the rest of the library by following any tag above.