GEP · 002 / OF 006 |
Geopolitical Risk |
Armed group identification and tracking is the structured application of open-source video analysis, satellite imagery, geolocation and corporate record investigation to determine the commanders, organisational structure, equipment and operational patterns of non-state armed actors. It is a method of convergence, not of isolated observation: visual forensics (insignia, uniforms, weapons and vehicle markings) are combined with geospatial verification, social media monitoring and supply chain tracing to produce attribution at the level of named individuals and documented commands. The outputs serve accountability journalism, sanctions work, international criminal proceedings and human rights documentation.
The method applies when a named armed group requires attribution, when a claimed location or timeline needs spatial verification, when equipment or weapons supply chains connect to identified actors, or when pattern-of-life evidence is required to establish command presence. No single evidence type is sufficient: a uniform patch does not confirm group membership, satellite imagery of a convoy does not identify its passengers, and a geotagged post can be falsified. Each indicator, taken in isolation, is ambiguous. The pattern, corroborated across imagery, video and records, is what carries attribution.
GEP-002 sets out the methodology for identifying, geolocating and attributing non-state armed actors and their commanders to evidentiary standard, building on techniques developed by human rights researchers, newsrooms and litigators across the field.
Forensic count Eight workflow steps, six tooling sources, five false-positive checks, six chain-of-custody requirements. |
01 Required Tools Six platforms covering shadow analysis, satellite imagery and network mapping. | 02 OPSEC Conflict-zone investigation risks, fixer exposure and encrypted storage requirements. |
03 Workflow Eight-step sequence from evidence preservation to exhibit documentation. | 04 False Positives Copied insignia, falsified geotags, staged video and impersonated commanders. |
05 Chain of Custody File hashing, satellite image documentation and per-claim attribution logging. | 06 Key Queries Five operator queries across SunCalc, InVID, Copernicus Browser, OCCRP Aleph and Telegram. |
Download the card.
A PDF version of GEP-002 is available below for Signal subscribers.
The rest of this card is for Signal subscribers.
What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalSignal includes:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
- OSINT Hub community access