The terms an analyst actually uses. Definitions are short, methodological notes are honest, and every entry links back to the discipline that produced it. Curated by the Auspex research desk; corrections welcome at research@auspex.institute.
Open-Source Intelligence.
Intelligence produced exclusively from publicly available material — news wires, satellite imagery, corporate registries, transponder feeds, court filings, social platforms. Not classified, not obtained through covert means. When done rigorously it is often faster than classified reporting because it is not bottlenecked by clearance and compartmentation.
A structured method to fight confirmation bias.
Developed by CIA analyst Richards Heuer. You list every plausible hypothesis first, then score each piece of evidence against every hypothesis (does it support, contradict, or is it neutral?). The hypothesis you end up preferring is the one with the fewest contradictions, not the one with the most confirmations. Every Ex Umbra Weekly forecast is built on top of a small ACH matrix.
Geospatial intelligence.
Analysis of imagery and geospatial data (satellite, drone, cartographic). Modern OSINT-GEOINT relies heavily on Sentinel-2, Planet Labs, Maxar snippets released to media, plus tools like SentinelHub EO Browser and OpenStreetMap tracing. Order of accuracy: metric for Sentinel, sub-metric for Maxar/Planet SkySat.
Imagery intelligence.
Historically the analytical layer sitting above raw satellite imagery: identifying military vehicles, port infrastructure, damage patterns, deployments. In the open-source era, IMINT overlaps heavily with GEOINT but retains a specific focus on object identification and change detection.
Signals intelligence.
Traditionally a state-monopoly domain (COMINT + ELINT). The open-source flank is smaller but real: amateur radio operators, ADS-B, AIS, GPS-jamming reports collected by GPSJam, VDL Mode-2 aviation datalinks, cell-tower geolocation via crowdsourced databases. Auspex ingests four of these feeds.
VHF transponder mandatory on vessels >300 GT.
A VHF broadcast system sending ship identity, position, course, speed and cargo type every few seconds. Reception is passive; anyone with a coastal receiver or an aggregator like aisstream.io can monitor global shipping. When AIS goes dark on a vessel that should be transmitting, this is often the first sign of sanctions evasion, illegal fishing, or a covert transfer.
Aviation transponder — the aerial counterpart to AIS.
Aircraft broadcast their position and identity at 1090 MHz. Amateur networks like ADS-B Exchange (unfiltered) and Flightradar24 (filtered) aggregate this into public trackers. Military aircraft that stop broadcasting mid-flight often correlate with strike packages or reconnaissance missions.
Armed Conflict Location & Event Data project.
A widely-used academic-grade database of political violence events, with geolocation, actor identification and fatality estimates. Free for non-commercial use with registration. It is the backbone of quantitative conflict analysis but has known lag (7-14 days for some regions).
Global Database of Events, Language and Tone.
A firehose of geopolitical events extracted from world media in near-real-time. Enormous coverage but signal-to-noise ratio requires filtering. Used for early warning and macro-scale trend analysis rather than tactical assessment.
Uppsala Conflict Data Program.
Long-running academic dataset from Uppsala University, gold-standard for fatality figures at the annual level. Complements ACLED (event-level) with rigorous, methodologically transparent longitudinal counts. Cited in virtually every peer-reviewed conflict-research paper.
Aggregated global sanctions list.
A consolidated, machine-readable database merging OFAC (US), EU consolidated list, UK OFSI, UN Security Council, and dozens of national lists. Essential for tracking sanctioned entities, PEPs (politically exposed persons) and shell-company networks.
Individual with high-risk political influence.
A person entrusted with a prominent public function (heads of state, senior officials, judges, military brass) plus their close family and business associates. AML regulations require enhanced due diligence when a PEP is a customer or beneficiary. In OSINT, PEP flags are a shortcut to influence-mapping.
Human intelligence — from sources on the ground.
Classical espionage lane: people talking to people. Auspex does not do HUMINT, and no supporter contribution funds any activity that resembles it. What we do use is HUMINT-adjacent open reporting — journalism, diaspora testimony, court transcripts.
The discipline of not being trackable.
The set of practices that prevents an adversary from correlating your metadata into a profile. In our case: pseudonymous correspondents, no invoicing (no PII on our servers), Iceland hosting, no third-party trackers, hardened AI-chat with a zero-trust prompt boundary. OPSEC is why every byline on Ex Umbra Weekly is a persona, not a real name.
Sanctioned tankers moving in AIS silence.
The informal name for the fleet of ~600 aging tankers used to move sanctioned crude (Iranian, Russian, Venezuelan) outside the G7 price cap. Signatures: flag hopping, ship-to-ship transfers off Ceuta or Kalamata, AIS spoofing to false coordinates. AIS analytics is the primary OSINT lens on the dark fleet.
Below-threshold coercion.
State actions that pursue strategic ends while staying below the threshold of armed conflict: sabotage of undersea cables, GPS jamming, weaponised migration, financial coercion, information operations. The point is to force the adversary to either escalate (and be blamed) or accept the loss.
Denial vs. deception of positioning signals.
Jamming denies GPS reception in an area (blank screens on aircraft). Spoofing feeds a receiver false coordinates (planes appearing at wrong airports). Both are now routine over the Baltic, Black Sea, eastern Mediterranean and NW Iran. Tracked publicly by GPSJam.org using ADS-B signal-integrity metrics.
Sequence from detection to strike.
F2T2EA in the military lexicon — Find, Fix, Track, Target, Engage, Assess. In OSINT we reconstruct kill chains after the fact: satellite imagery of pre-strike deployment, ADS-B track of the aircraft, damage assessment on Sentinel-2 the next revisit. When a chain shortens, capability has improved.
Signals monitored to detect imminent action.
A predefined list of observable events that would precede a hostile action: troop massing, hospital surge preparations, media narrative shifts, air-traffic pattern changes, cross-border ambulance calls. Ex Umbra Weekly maintains rolling I&W panels per region and flags them when threshold conditions are met.
Pinning an action to a specific actor.
The hardest problem in cyber and grey-zone operations. Rigorous attribution combines technical indicators (malware family, C2 infrastructure, TLS fingerprint), tradecraft patterns (target selection, working hours, language) and geopolitical context (cui bono). A single vector is never enough; Auspex applies a minimum of three independent lines before attributing.
Fake persona used for social-media OSINT.
A fabricated online identity used by researchers to access closed groups, monitor influence operations or bait attribution. Setting up a robust sock puppet requires legend-building over months. Ethical use = passive monitoring; unethical use = active provocation.
State-backed shaping of foreign public opinion.
Coordinated inauthentic behavior, media laundering, funding of local proxies, algorithmic amplification. Tracked by StopFake, EU DisinfoLab, GEC (US State), and academic teams at Stanford IO and Oxford. Attribution is easier than in kinetic operations because platforms preserve metadata.
Following the money.
Tracing capital flows through corporate registries, SWIFT anomalies (via ICIJ leaks), shipping payments, blockchain analytics (Chainalysis, Arkham for open queries). Sanctions circumvention is discovered here more often than at any border.
Comparing imagery across time to spot movement.
The core GEOINT technique: two rasters, different dates, subtract. New vehicles at an airbase, new berthings at a port, new revetments at a firing position. Sentinel-2 revisit at 5 days is enough for macro-scale change; sub-metric commercial imagery is needed for tactical detail.
Measurement and Signature Intelligence.
The niche where scientific measurement (seismic, acoustic, thermal, electromagnetic, chemical) discloses activity that other disciplines miss. Volcano monitoring networks, seismic detection of underground nuclear tests, satellite thermal signatures of active smelters — all fall here.
The provenance ladder for a fatality claim.
Every fatality figure passes through a source hierarchy: local first responders → local ministry → national ministry → international body (WHO, OCHA) → academic dataset (UCDP). Each step adds latency and either compression or dilution. Ex Umbra Weekly always names the step it stopped at.
Every issue starts with roughly 400-1200 open-source signals (RSS, ACLED, GDELT, UCDP, OpenSanctions, AIS, ADS-B, government press pools) collected over a rolling window. A causal-chain layer clusters signals into scenarios; each scenario is then subjected to an Analysis of Competing Hypotheses (ACH) with explicit probability bands. Correspondents write in their region and their language. Nothing on the site is generated without a source citation — where you see none, it did not survive our review.
The correspondents who write under our localized personas are not a piece of software. We do not confirm the identity of any individual contributor — that is the whole point of the operational security described in our funding page — but we can say what the desk draws from. Our contributors include serving analysts at institutional and non-governmental organizations who choose to publish research under a pseudonym; former staff of national intelligence and diplomatic services who have retained field contacts and now write in a private capacity; independent researchers embedded in the regions they cover; and a small group of academic advisors who review methodology. We do not confirm or deny the presence of any specific former agency; we neither invite nor tolerate anyone under active service obligations who would be violating them by writing. The Auspex byline is a persona — the sources behind it are people.
ACLED, UCDP, GDELT, OpenSanctions, AIS (aisstream.io), ADS-B Exchange, Copernicus EMSC, NASA FIRMS, Marinetraffic public feeds, Reuters/AFP/AP wires, national government press services, regional independent media (curated allowlist), a hand-maintained set of Telegram OSINT channels for early warning, and academic security-studies databases.
Anything missing? Write to us. We add entries when analysts and readers ask for them, not on a schedule.
Contact the research desk →Ex Umbra Weekly is our supporter-funded magazine. First 4 pages of every issue are free.
See the latest preview →