Open Source Intelligence and GIS Integration Training Course

Participants can apply lawful and proportionate controls to OSINT collection and retention.

• Legality, necessity and proportionality tested before initiating collection activity
• Data-protection principles applied to personal data, special categories and retention
• Terms-of-service restrictions assessed before collecting platform-hosted material
• Privacy impact considerations recorded for intrusive or persistent monitoring
• Jurisdictional limits identified for cross-border collection and data transfer
• Disclosure, retention and deletion decisions documented through case governance records

Participants can build targeted, reproducible search strategies for intelligence questions.

• Search hypotheses convert intelligence questions into testable collection assumptions
• Boolean operators structure precise queries across search engines and databases
• Site, filetype, intitle and date operators narrow high-value results
• Keyword matrices capture aliases, languages, locations, events and identifiers
• Collection funnels prioritise high-confidence sources before lower-confidence leads
• Search logs preserve queries, dates, platforms, results and analyst decisions

Participants can assess source reliability and corroborate material before reporting it.

• Admiralty Code separates source reliability from information credibility assessments
• Lateral reading checks publisher identity, funding, expertise and editorial standards
• Corroboration matrices compare independent sources, claims, dates and locations
• Primary-source preference reduces dependence on repeated secondary reporting
• Deception indicators include coordinated wording, recycled imagery and fabricated attribution
• Confidence statements distinguish confirmed facts, plausible assessments and information gaps

Participants can preserve OSINT material with sufficient provenance for review and disclosure.

• Capture records retain URLs, timestamps, account names, screenshots and context
• Hash values establish file integrity for downloaded documents and media
• Chain-of-custody logs record acquisition, handling, transfer, storage and access
• Metadata fields distinguish original content from analyst-created derivatives
• Version control preserves changes to datasets, maps, reports and annotations
• Evidence registers link collected items to intelligence requirements and findings

Participants can structure geographic data for basic intelligence mapping and analysis.

• Vector layers represent points, lines, polygons and associated attributes
• Raster data supports imagery interpretation, elevation analysis and surface modelling
• Coordinate reference systems control positional accuracy and layer alignment
• Geocoding converts structured addresses into mapped geographic coordinates
• Attribute tables store identifiers, dates, source references and assessment fields
• GeoPackage format packages layers, attributes and styles within portable files

Participants can create a structured GIS dataset from collected OSINT records.

• Entity-event-location model links people, incidents, places and time
• Data dictionaries define mandatory fields, controlled values and validation rules
• Unique identifiers connect source records, mapped features and analytic findings
• Geographic uncertainty recorded through precision values, buffers and confidence fields
• Normalised tables reduce duplicate subjects, locations and event records
• Quality assurance checks detect missing coordinates, inconsistent dates and duplicate entries

Participants can geolocate digital content using observable geographic evidence and documented reasoning.

• Visual geolocation uses landmarks, street furniture, terrain and building features
• Reverse image search identifies earlier appearances and altered image versions
• Sun position estimates orientation, time windows and directional plausibility
• Road markings, language and vehicle features support regional identification
• Map comparison tests candidate locations against visible physical evidence
• Geolocation worksheets record observations, alternatives, sources and confidence ratings

Participants can use publicly available imagery to identify relevant site conditions and changes.

• Satellite imagery selection considers resolution, date, cloud cover and licensing
• Image interpretation examines tone, texture, shape, shadow and spatial association
• Before-and-after comparison identifies construction, displacement and site activity changes
• Historical imagery establishes baseline conditions before reported incidents
• Elevation models support terrain, visibility, access and drainage assessments
• Imagery limitations documented through currency, resolution and interpretation uncertainty

Participants can organise events over time and identify meaningful temporal patterns.

• Event chronologies combine timestamps, locations, sources, actors and reported actions
• Time-zone normalisation prevents false sequencing across international source material
• Temporal uncertainty represented through ranges, qualifiers and source-specific timestamps
• Timeline analysis identifies escalation, recurrence, gaps and anomalous activity
• Date filters isolate pre-incident, incident and post-incident information periods
• Chronology tables connect mapped events with supporting evidence references

Participants can apply core spatial methods to identify patterns relevant to security decisions.

• Point pattern mapping reveals concentrations of incidents, reports and observations
• Kernel density estimation displays relative concentrations across a defined area
• Buffer analysis identifies assets, events or subjects near sensitive locations
• Proximity analysis measures distances between incidents, routes and infrastructure
• Hotspot interpretation separates meaningful concentrations from reporting artefacts
• Spatial queries filter events by location, date, category and confidence

Participants can assess routes, movement constraints and access relationships using GIS.

• Network datasets model roads, paths, crossings, barriers and transport links
• Least-cost paths compare feasible movement routes across terrain and restrictions
• Service areas estimate travel access from response locations and facilities
• Route analysis identifies chokepoints, diversion options and vulnerable segments
• Terrain constraints incorporate slope, water crossings, vegetation and built barriers
• Access assumptions documented with data currency, permissions and seasonal limitations

Participants can connect entities, events and locations while controlling for mistaken identity.

• Entity resolution compares names, aliases, identifiers, addresses and account attributes
• Link charts visualise relationships among people, organisations, events and places
• Association types distinguish direct contact, co-location, transaction and shared identifiers
• False-positive controls test common names, reused addresses and duplicate accounts
• Network centrality measures identify highly connected entities within defined datasets
• Analytic notes separate observed links from inferred relationships and hypotheses

Participants can test competing explanations and communicate calibrated analytical judgements.

• Analysis of Competing Hypotheses tests evidence against alternative explanations
• Key assumptions checks identify fragile beliefs underlying intelligence judgements
• Indicators and warnings matrices define observable signs of emerging threats
• Devil's advocacy challenges dominant explanations, missing evidence and group assumptions
• Red-team review examines adversary incentives, capabilities, constraints and likely responses
• Confidence language reflects evidence quality, corroboration and analytical uncertainty

Participants can develop geographically focused threat assessments with explicit risk logic.

• Threat assessment separates intent, capability, opportunity and target vulnerability
• Risk matrices combine likelihood, consequence, exposure and control effectiveness
• Critical asset mapping identifies facilities, dependencies, access points and service areas
• Vulnerability layers capture crowd density, visibility, barriers and response capacity
• Scenario mapping compares credible threat pathways and protective control options
• Risk registers assign owners, actions, residual risk and review dates

Participants can create clear maps that support rather than distort intelligence judgements.

• Map purpose determines scale, extent, audience, classification and detail level
• Symbology differentiates confirmed, assessed and unverified information without ambiguity
• Classification markings and handling caveats appear on every intelligence product
• Scale bars, north arrows and coordinate grids support operational use
• Generalisation protects sensitive locations while retaining decision-relevant spatial meaning
• Map quality checks test readability, source citation, currency and analytical consistency

Participants can communicate OSINT-GIS findings in concise, decision-focused intelligence products.

• Intelligence reports separate key judgements, evidence, assumptions and information gaps
• BLUF structure presents decision-relevant findings before supporting detail and context
• Source citations link statements, maps and annexes to traceable evidence
• Confidence qualifiers prevent certainty inflation in briefings and written assessments
• Executive maps pair spatial findings with implications, risks and recommended actions
• Briefing preparation anticipates challenge questions about sources, methods and limitations

Participants can embed OSINT-GIS workflows within operational approvals, controls and review processes.

• Standard operating procedures define tasking, collection, review, dissemination and retention
• Role-based access controls protect sensitive datasets, source records and products
• Quality assurance gates test legality, provenance, analysis and presentation standards
• Escalation criteria identify urgent threats, safeguarding concerns and disclosure triggers
• Collection review cycles retire stale requirements and refresh priority indicators
• Performance measures track timeliness, source quality, actionability and rework rates

Participants can integrate diverse open sources and GIS evidence into a coherent incident assessment.

• Case scoping defines incident boundaries, decision questions and operational constraints
• Collection priorities align public reporting, imagery, records and location evidence
• Source triage ranks material by relevance, reliability, urgency and verification need
• Spatial joins connect incident records with assets, boundaries and demographic layers
• Competing explanations tested against chronology, geolocation and corroborated evidence
• Assessment review identifies evidential gaps, uncertainties and collection follow-up actions

Participants can build, review and present a complete OSINT-GIS intelligence package for an operational decision.

• Intelligence requirement defines the decision, scope, geography, timeframe and priority questions
• Collection plan records lawful sources, search terms, responsibilities and deadlines
• Evidence register documents provenance, metadata, reliability and corroboration status
• GIS analysis maps events, entities, risk factors, routes and spatial patterns
• Structured assessment states key judgements, alternatives, confidence and information gaps
• Peer review tests legal controls, analytic logic, map quality and source traceability
• Decision briefing presents findings, implications, recommended actions and collection priorities