OSINT // INT Types

Every intelligence collection discipline, broken down the same way: fact sheet, what it is, what it collects, how collection works, the public overlay, the line, products, fusion, failures, and a worked pass. The INT names the sensor. OSINT names the permission.

The access test

The FBI still lists five collection disciplines: HUMINT, SIGINT, IMINT, MASINT, and OSINT. Practitioners add GEOINT as IMINT's parent, TECHINT for hardware, and CYBINT for networks. The list keeps growing because people keep naming the thing they collect from.

Most of those names answer what. OSINT answers how you were allowed to take it. That is the whole distinction, and mixing them is how briefings go bad.

Family tree

Parent INTs are the working set. Children inherit the parent sensor and add a narrower source. Overlays are OSINT slices of a parent, not new physics. Tree is parentage. Web is how they get used together. Click a node to open its breakdown. Hover to isolate what it connects to.

Topology and charts

Five views of the same 67 disciplines, all generated from data/osint-int-types.db. Every chart carries its own numbers and opens as a table, so nothing here depends on telling shades apart.

Aliases and false friends

Terms that turn up in INT lists and are not disciplines, or are another name for one that is. They are here so the catalog cannot be accused of missing them.

Full catalog

Every named INT in this guide, including the ones that are retired names, purpose-labels, or levels rather than sensors. Filter, then click through to the breakdown.

Which INT

OSINT permission

Open-source intelligence is information collected from publicly available information (PAI) or commercially available information (CAI), processed to answer a stated question. The source being public does not make the output automatic, cheap, or true. Collection without a question is browsing.

What it is

OSINT is finished intelligence from open sources, not the sources themselves. NATO and the US IC treat it as a collection discipline equal in the process to HUMINT or SIGINT: direction, collection, processing, analysis, dissemination. ODNI's 2024–2026 OSINT strategy put a formal strategy on it. That is a recognition of volume and speed, not a claim that a search bar replaces a case officer or a satellite.

Two source classes, and only two:

What it collects

• News, broadcasts, government gazettes, hearings, speeches, budgets, official statistics.
• Academic and technical literature, patents, standards, conference proceedings, preprints.
• Public records: company registries, court dockets, land cadastres, procurement, sanctions, PEPs.
• The public web: sites, caches, archives, paste sites, public Git, package registries.
• Commercial data bought without impersonation: imagery, AIS/ADS-B tiers, credit headers where lawful.
• Gray literature that is distributed without classification: think-tank PDFs, trade glossies, manuals that landed in public.

How collection works

You are tasked with a question. You list the source classes that could answer it. You collect, you record the URL/date/hash, you evaluate the source (who published, why, what they could know), you write the answer and the gaps. That is the whole method. Tools change. The method does not.

Processing is most of the labor: language, OCR, geocoding, dedup, timezone normalization, entity resolution. Raw collection is the cheap step.

Cuts

• Internet / general — the public web, news, social, video.
• Scientific / technical — papers, patents, standards, catalogs. The OSINT twin of TECHINT.
• SOCMINT — social platforms as a slice. Still OSINT until you talk to someone.
• DARKINT — darknet services that remain PAI. Routing is not classification.
• HUMINT-flavored OSINT — trade shows, public interviews, association meetings you attend as yourself. The moment you elicit under pretext, it is HUMINT.

The line

If you needed a warrant, a recruited source, a login that was not offered to the public, a radio intercept, or a dump you knew was stolen, it is not OSINT. Terms of service are not criminal law, but they are still a line your employer may care about more than you do. If you need a lawyer to decide whether a source is still OSINT, it is not OSINT for your purposes. Pick another source.

Products

• A sourced narrative answering the question, with timestamps and URLs.
• An entity package: person, org, facility, vessel, domain — what is public, what is not.
• A source list with reliability tags, not a bookmark dump.
• A gap statement: what this INT cannot see.

Strengths and limits

Fuses with

Everything. OSINT is usually the first INT in and the last INT used to check a name, a coordinate, or a company. It does not replace HUMINT on intent, SIGINT on a live net, or MASINT on a yield. Tag the overlay: "IMINT-as-OSINT from Sentinel-2, 2026-04-11" is a finding. "OSINT indicates" is not.

HUMINT sensor: people

Human intelligence is information taken from a person who has access. It is the oldest INT. It is also the one OSINT operators most often pretend they are doing when they are only reading.

What it is

HUMINT exists because some facts only live in a head: intent, internal argument, the name that is not on the org chart, what a unit was told to do. No satellite sees a decision. A person who was in the room does.

Two regimes, and they are not a spectrum you ease across:

What it collects

• First-hand observation: who was in the building, which unit entered the village, where the warehouse is.
• Intent and argument: what was decided, who dissented, what they think happens next.
• Biographic and access data: job, clearance, grievances, family, travel.
• Documents or devices a person can take or photograph, which then become TECHINT / CYBINT / IMINT inputs.

How collection works

In the overt column: you ask, they answer, you write what they could have known and why they might lie. In the clandestine column: spotting, assessing, developing, recruiting, handling — a different profession. OSINT operators do not freelance the second column.

Source reliability and information credibility are scored separately (the old Admiralty system, or whatever your shop uses). A reliable source can pass a rumor. An unreliable source can pass a fact. Write both tags.

OSINT overlay

Read the human. Do not become one. Job posts, org charts, speaker bios, podcasts, memoirs, leaked-then-published interviews, "we just shipped" blogs, conference videos, parliamentary questions. The person already published. You did not task them. That is OSINT that happens to be human-sourced, and you should tag it that way: "HUMINT overlay / published interview, date."

The line

The moment you send a message, you are doing HUMINT. The moment you invent a persona to get them to talk, you have left OSINT. Elicitation over DM, sockpuppets, and "just asking as a journalist" when you are not one are the usual ways people fall off the overlay.

Products

• Intelligence information report: source description, access, verbatim or close-paraphrase, collector comment.
• Biographic file, spotting cable, debrief summary.
• On the overlay: a sourced quote with URL, not "a source said."

Strengths and limits

Fuses with

IMINT to confirm the warehouse the source named. SIGINT to confirm the net they described. FININT to confirm the company they named. OSINT to check whether the story already exists in public, which is how you catch a fabricator recycling the news.

SIGINT sensor: emissions

Signals intelligence is information taken from electromagnetic signals. Children split by what the signal is for, not by how you caught it.

What it is

Anything that radiates on purpose can be a SIGINT target in the classified world. The discipline includes content (what was said), externals (who talked to whom, when, on what frequency, from what bearing), and technical parameters of non-comms emitters. Traffic analysis is SIGINT even when you never read a word.

What it collects

• COMINT — speech, text, fax, chat, and the metadata of those messages.
• ELINT — radar, jammers, IFF, navaids, altimeters: electronics talking to electronics.
• FISINT — telemetry and command links from missiles, launchers, test aircraft. Old name: TELINT.

How collection works

Classified collection uses dedicated platforms: collection ships and aircraft, ground sites, satellites, and, where a statute allows it, lawful intercept of a named service. Direction finding locates the emitter. Demodulation and cryptanalysis recover content when that is the task. This page does not describe how to do any of that.

The overlay does not collect the signal. It reads a publication of a signal: a transponder that was designed to be public, a license, a table, a waterfall screenshot someone posted.

OSINT overlay

• ADS-B and Mode-S aggregators (aircraft that chose to squawk).
• AIS aggregators (vessels that chose to broadcast).
• APRS and other amateur position beacons.
• FCC / Ofcom / national licenses, ITU filings, published band plans.
• WiGLE and similar wardrive databases that are already public.
• Screenshots and recordings a third party posted, used as a document, not as a live intercept.

The line

ADS-B is broadcast for anyone. A trunked public-safety net, a cellular uplink, and a fire-control radar are also "in the air." Only the first is an OSINT overlay. The physics is not the law. If you are tuning a radio at a protected system, you have left OSINT regardless of encryption.

Products

• Emitter list: what, where, mode, first/last heard (classified SIGINT).
• Traffic analysis: who talks to whom, tempo, before/after an event.
• On the overlay: a track, a license row, a correlation ("this MMSI was in that berth at that time").

Strengths and limits

Fuses with

IMINT to put a hull or an aircraft under the track. GEOINT to put the emitter on a hill. TECHINT to name the box from the mode. MASINT/RADINT when the question is the signature of that exact copy, not the class.

COMINT

Communications intelligence. Content or metadata of messages between people. Phone, radio voice, email in flight, messaging apps. Decrypting a ciphertext you intercepted is still COMINT. Reading an email the sender posted on a blog is OSINT.

What it is

COMINT is SIGINT whose signal is a message. The message can be voice, text, image-as-fax, or a chat protocol. Externals (who, when, how long, to whom) are COMINT even when content is unreadable. Numbers stations, one-way voice links, and similar tradecraft are COMINT in the classified world; hobbyist recordings of those broadcasts, once posted, are documents.

What it collects

• Content: what was said or written, in the clear or after authorized decrypt.
• Externals: selectors, call duration, frequency, time, direction, network graph.
• Language, dialect, procedure words, unit names that leak in chatter.

How collection works

Classified: intercept under authority, then process (demod, decode, decrypt, translate). Overlay: read what a party already put in public. A Slack export in a public Git repo is OSINT (CYBINT-flavored). A call recorded off the air without authority is COMINT, and in most jurisdictions a crime.

OSINT overlay

• Press releases, speeches, parliamentary Hansard, court transcripts.
• Leaked-then-published cables and chats that are already in the press or archives.
• Public mailing lists, public Telegram/Discord channels, public comment threads.
• Hobbyist postings of numbers-station recordings, used as a document.

The line

Test: did a party to the communication publish it, or was it made public by law (a hearing, a docket). If you caught it in transit, it is COMINT and you needed authority. Encrypted-but-public (a public tweet) is OSINT. Encrypted-in-transit is COMINT.

Products

Classified: gist's, transcripts, selector reports, traffic diagrams. Overlay: a sourced quote with a URL and a time, plus a note on whether the speaker could know the thing they claimed.

Fuses with

HUMINT to test a source against chatter. FININT when the message is a payment instruction that later hits a public filing. GEOINT when they name a place. SOCMINT when the "message" was always a public post — tag SOCMINT, not COMINT.

ELINT

Electronic intelligence. Non-communications electromagnetic emissions. Radars, navigation aids, jammers, IFF interrogators, altimeters. ELINT does not care what anyone said. It cares that a box is radiating, and what kind of box that implies.

What it is

Two classical cuts, still the right ones:

• TechELINT — the emitter itself: frequency, PRF, pulse width, scan type, antenna, mode logic, side lobes. "What box is this."
• OpELINT — how it is used: where it sits, when it lights, what it covers, order of battle, emission control. "What are they doing with it."

Adjacent INTs steal the same pulse for different questions. MASINT/RADINT asks which exact copy (fingerprint). TECHINT asks what is inside the waveguide. ELINT asks what it is doing on the air right now.

What it collects

• Search, track, fire-control, and navigational radars.
• Jammers, decoys, and other electronic attack.
• IFF interrogators/transponders when treated as electronics, not as messages.
• Beacons, altimeters, some datalinks that are not person-to-person comms.

How collection works

Classified: a receiver with enough bandwidth and a location, plus processing to parametrize the pulse train. Overlay: you never take the pulse. You take a photo of the antenna, a license, a manufacturer brochure, an ADS-B track of the aircraft that carries it, a civilian weather-radar stream the operator put on the internet.

OSINT overlay

• ITU and national licenses, experimental authorizations, published band use.
• Manufacturer brochures, air-show and port photos of antennas, FCC ID internals.
• ADS-B of the aircraft carrying the radar; AIS of the ship; OSM/Wikimapia of the site.
• Public NOTAMs, published coverage maps, civilian weather-radar mosaics.

The line

Identifying, locating, and cataloguing from publications is the overlay. Pointing a receiver at a protected military emitter is ELINT collection, not OSINT, even if you "only looked at the waterfall."

Products

• TechELINT: parametric sheet for an emitter class or mode.
• OpELINT: site list, lighting times, coverage, association with units.
• Overlay: "antenna geometry in this photo matches brochure X; license Y is on that hill; coverage map Z is consistent."

Fuses with

IMINT for the antenna and the pad. TECHINT for the box. GEOINT for the site. MASINT when two emitters look the same and you need the copy. HUMINT for the unit that mans it.

FISINT / TELINT

Foreign instrumentation signals intelligence. Telemetry, beaconing, and command links from missiles, launch vehicles, aircraft under test, and similar foreign instrumentation. TELINT is the retired name for the telemetry slice. Use FISINT.

What it is

Test articles talk to their ranges. That talk — voltages, IMU samples, staging discretes, destruct-command status — is instrumentation, not a conversation. FISINT recovers it. It is how you learn what a missile did in flight without being on the range.

What it collects

• Missile and launch-vehicle telemetry.
• Aircraft and UAV test instrumentation.
• Range beacons, transponders, and command destruct links treated as instrumentation.
• Foreign space-object telemetry when it is instrumentation rather than comms.

How collection works

Classified: be on a geometry that sees the downlink, record, process. Overlay: you get the event from everything except the downlink — the webcast they ran, the NOTAM they filed, the pad image, the amateur decoder a cubesat operator published on purpose.

OSINT overlay

• Official launch webcasts and range press kits.
• Amateur radio telemetry the operator intended to be public, with a published decoder (typical cubesat).
• NOTAMs, maritime/airspace closures, NOTMAR, range schedules.
• IMINT of the pad, the plume, the debris; seismic/infrasound as MASINT overlay.

The line

Public cubesat TM with a published handbook is OSINT. A foreign ballistic missile's encrypted down-link is FISINT. Do not "SDR the launch" and file it under OSINT.

Products

Classified: reconstructed timeline of the test, performance estimates, fusing and staging notes. Overlay: "window was T to T+n, pad image shows a vehicle of class X, seismic detection at +t seconds, no public TM."

Fuses with

IMINT of the pad and the event. MASINT (seismic, infrasound, IR plume). TECHINT of the vehicle class. ELINT of the associated radars lighting for the test. OSINT of the NOTAM and the speech that claimed success.

GEOINT sensor: place

Geospatial intelligence is information about a location, fused from imagery, mapping, and terrain. NGA's framing: any intelligence in which location is the organizing principle. IMINT is the picture. GEOINT is the picture plus the map plus the elevation plus the history of that pixel.

What it is

GEOINT is not "maps for intel people." It is any intelligence that is indexed by where. A vessel MMSI in a berth is GEOINT plus a SIGINT overlay. A land-title polygon is GEOINT with no picture at all. IMINT is the biggest child, not the parent.

What it collects

• Imagery of places (see IMINT).
• Vector mapping: roads, buildings, fences, pipelines, cadastre, EEZ, FIR.
• Terrain: DEM/DTM, slope, line of sight, soil, land cover.
• Names and addresses: toponyms, geocoders, what this pixel is called.
• Movement: tracks, convoy spacing, parking patterns, change over time.

How collection works

Classified: tasked national or theater sensors, processed to a known sensor model, orthorectified, exploited by an imagery analyst, fused with the map and the elevation. Overlay: you take whatever public or commercial pixel and vector already exist, you put them in a CRS, you measure, you date, you say what you cannot see.

OSINT overlay

• OpenStreetMap, national cadastres, hydrographic offices, AIP/charts.
• Public DEMs (SRTM, Copernicus DEM, national lidar where released).
• Geocoders, gazetteers, Wikidata coordinates, official place-name lists.
• Plus everything under IMINT: Sentinel, Landsat, commercial browse, street-level.

The line

If you cannot put it on the earth, it is not GEOINT. A portrait is not GEOINT. A screenshot of a map without a CRS is a picture of a map, and you should say so. Measuring off Google Earth without recording the date and the vertical datum is how numbers go bad.

Products

• A point, polygon, or track with CRS, time, and source.
• Change detection: before / after / what moved.
• A site dossier: imagery, map, terrain, names, history of the pixel.

Strengths and limits

Fuses with

SIGINT overlay to cue a scene (AIS, ADS-B). HUMINT for the name of the unit in the building. TECHINT for the equipment on the pad. FININT for who owns the parcel. MASINT when the product is a measurement, not a view.

IMINT

Imagery intelligence. Photographs and other images from satellites, aircraft, drones, and commercial constellations, used as pictures of a place. If it is a picture of a place used as intelligence, it is IMINT. If the same photons are used as a spectrometer or a thermal product, you have crossed into MASINT.

What it is

IMINT answers what is on the ground (or the water, or the pad) at a time. Exploitation is a skill: scale, shadow, pattern, texture, association. Resolution is not the same as identifiability. A 30 cm pixel of a tarp is still a tarp.

What it collects

• Satellite EO: electro-optical stills, including commercial constellations.
• Aerial and UAV stills and full-motion video of a place.
• SAR used as an image (shape of a ship, a runway) rather than as a signature — the SAR-as-MASINT cut is RADINT.
• Street-level and ground photos of a place, including EXIF-bearing tourist photos.

How collection works

Classified: a sensor is tasked, a pass is taken, an analyst exploits it against a requirement. Overlay: you search archives (Copernicus, USGS, commercial browse), you pick a cloud-free date, you compare to another date, you write counts and changes. Cue from AIS/ADS-B so you are not searching the whole earth.

OSINT overlay

• Copernicus Sentinel-1 (SAR) and Sentinel-2 (EO), Landsat, ASTER.
• Commercial browse and licensed scenes (Maxar, Planet, Airbus) where the terms cover the use.
• Google Earth / Bing historical imagery, with the date recorded from the slider, not guessed.
• Mapillary, Kartaview, official street-level where it exists.
• On-site photos people posted, EXIF if it survived, used as a ground image of a place.

The line

Claiming 30 cm commercial is "as good as classified" without stating revisit, license, and tasking delay is a briefing failure. Using a screenshot with no date is a measurement failure. A photo of a person is not IMINT unless the place is the point.

Products

• Annotated image: north, scale, date, sensor, what the arrows mean.
• Count: roofs, tanks, vehicles, aircraft, by type if you can defend it.
• Change pair: T1 / T2, what appeared, what left, what is ambiguous.

Fuses with

GEOINT (the map and the DEM under the image). SIGINT overlay to cue. TECHINT to name the equipment. MASINT if you start measuring plume, heat, or RCS instead of looking at the picture as a picture.

PHOTINT

Photographic intelligence. Historical name for IMINT from when the product was wet film from a camera, often on an aircraft or an early satellite. The sensor physics did not change when the name did. Use IMINT unless you are writing history.

What it is

A period term. Useful when reading older doctrine, targeting manuals, and declassified mission reports. If the image is digital, call it IMINT. If you are exploiting a scanned Corona strip as history, you may say PHOTINT and you should still put coordinates and a date on it.

OSINT overlay

Declassified national imagery in public archives, reconnaissance photos released as history, the same commercial and civil sensors as IMINT.

MASINT sensor: signatures

Measurement and signature intelligence. Distinctive characteristics of a target, taken from instruments rather than from people or from pictures used as pictures. The Air Force Institute of Technology split it into six families. If you are measuring a physical phenomenon to identify or describe a thing, you are in MASINT.

What it is

MASINT is the INT people skip because it sounds like a lab. It is also how you tell two visually identical radars apart, confirm a nuclear event, or hear a submarine. IMINT looks at a picture. MASINT measures a phenomenon. The same satellite can do both in different modes.

OSINT can touch the public instruments. It cannot replace a classified sensor web. Write the instrument you actually had.

What it collects

Anything with a distinctive physical fingerprint: heat, light spectrum, radiation, sound, seismic waves, magnetic anomaly, radar return, chemical residue, unintentional RF. The six families below are the working list, not a law of nature. Shops collapse them.

How collection works

Classified: a calibrated sensor, a collection geometry, processing that turns a waveform or a sample into parameters, comparison to a library. Overlay: you use instruments that already publish — USGS/IRIS, CTBTO bulletins, FIRMS, Sentinel-1, national radiation monitors, papers that release spectra. You do not build a clandestine sensor.

OSINT overlay

Public seismic and infrasound, civil SAR, civil IR fire and weather, published radiation networks, AIS+weather fusion, academic spectra, FCC plots. Each family lists its own.

The line

Calling any number MASINT is how the word dies. "The AIS speed was 12 kn" is a SIGINT overlay. "The seismic waveform at station X matches a contained explosion of roughly this yield, not an earthquake" is MASINT.

Products

A parametric description, a detection/non-detection, a classification ("event is consistent with / not consistent with"), and the instrument chain. Overlay products should cite the public sensor and the processing you applied.

Strengths and limits

Fuses with

IMINT for the picture of the event. SIGINT/ELINT for the associated emitters. TECHINT for the object class. OSINT for the claim you are testing ("they said it was an earthquake").

Electro-optical MASINT / IRINT

Infrared, laser, spectroscopic, hyperspectral, staring IR. A color photo used as a picture is IMINT. The same photons used as a spectrometer or a thermal product are MASINT. IRINT is the common short name for the infrared cut.

What it collects

• Infrared bloom: engines, exhaust, fires, process heat, missile plumes.
• Spectra of materials and gases (chemical plants, fires, camouflage nets that fail in SWIR).
• Laser return and laser warning as a measurement, not as a picture.
• Space-based staring IR as event detection (launches, explosions).

OSINT overlay

VIIRS/MODIS fire products (FIRMS), public IR weather satellites, a few commercial IR previews, published lab spectra, papers on plume classification. Overlay is good at "something hot happened here" and weak at "this coating is X."

The line

Night-time EO is still IMINT. Thermal is IRINT. Hyperspectral cubes are MASINT even if you render them as a pretty image for the slide.

Products / fusion / failures

Product: a detection with band, time, and a class if you have a library. Fuses with IMINT (the picture of the fire) and TECHINT (what plant that is). Failure: briefing a JPEG of FIRMS as a missile launch.

NUCINT

Nuclear MASINT. Radiation, yield, debris, and the confirmation that an event was nuclear and of what kind. The overlay is bulletins and monitors, not a sampler you do not own.

What it collects

• Prompt radiation and optical of a nuclear detonation.
• Radionuclide sniffing (xenon, particulates) after an event.
• Dosimetry and contamination mapping.
• Effects on materials, when samples exist.

OSINT overlay

CTBTO detections that are public, national radiation-monitor networks, USGS/IRIS for the coupled seismic question, papers. You will often fuse NUCINT overlay with seismic MASINT and IMINT of a crater or a lack of one.

The line

"Twitter said it was a test" is OSINT, unevaluated. NUCINT is an instrument chain. Do not upgrade a rumor by putting NUCINT in the header.

ACINT / geophysical

Geophysical MASINT: acoustic intelligence (ACINT / ACOUSTINT), seismic, magnetic, gravitimetric, weather and sea as intelligence. Sound in water or air, shaking in the ground, anomalies in fields. A podcast is not ACINT.

What it collects

• ACINT: sonar, sound ranging, propeller signatures, explosion acoustics in air or water.
• Seismic: earthquakes vs explosions, bunker work, underground tests, some industrial activity.
• Magnetic / gravity: hulls, underground voids, geologic structure when that is the intelligence question.
• Weather and sea intelligence: not the forecast for its own sake — the state as a factor (can they launch, can they hear, can they see).

OSINT overlay

IRIS and USGS, public infrasound arrays, published hydrophone datasets, Copernicus marine, METAR/TAF as a factor, AIS fused with sea state to ask whether a track is plausible. You will not hear a submarine on an overlay.

The line

Acoustic intelligence is a sensor. A leaked recording of a meeting is COMINT or OSINT depending on how it was obtained. Do not badge audio as ACINT because it is sound.

RADINT

Radar MASINT. Line-of-sight radar, SAR, ISAR, non-cooperative target recognition, multistatic and passive covert radar. RADINT is the MASINT name. ELINT is the SIGINT name for the same emitter. Different question, often the same pulse.

What it collects

• Synthetic aperture and inverse SAR products used as signatures or as all-weather detection.
• Radar cross-section and non-cooperative identification.
• Passive and multistatic detections where the illuminator is not yours.

OSINT overlay

Sentinel-1 is the workhorse: ships in cloud, oil, change on a pad, flood, some structure. Public weather radar is meteorology unless you are using it as an operational factor. RCS papers are TECHINT-adjacent.

ELINT vs RADINT

ELINT: the emitter is radiating, here are its parameters. RADINT: here is how an object returned energy, or here is a SAR detection of that object. A fire-control radar can be ELINT (the beam) and RADINT (what it painted) in the same minute in a classified shop. On the overlay you usually have Sentinel-1, not the fire-control beam.

Materials MASINT

Chemical, biological, and nuclear-debris signatures from samples and instruments. In the field this is a lab INT. The overlay is published lab results, customs seizures that made the press, and safety data sheets — not a sample you were not given.

What it collects

• Chemical agents and industrial toxic chemicals as signatures.
• Biological materials when a lab has them (this is almost never OSINT).
• Nuclear debris chemistry (overlaps NUCINT).
• Explosives residue, metallurgy of fragments (overlaps TECHINT).

OSINT overlay

Published lab reports, SDS and REACH dossiers, customs or police seizures that were made public, papers. You identify what they said they found. You do not run the assay.

Radiofrequency MASINT

Frequency-domain fingerprints, electromagnetic pulse, unintentional radiation (compromising emanations, TEMPEST-adjacent). Overlaps ELINT hard. MASINT here is "which exact box." ELINT is "what class of box."

What it collects

• Unintentional radiation from electronics (compromising emanations).
• EMP signatures of events.
• Frequency-domain features that distinguish one emitter copy from another of the same class.

OSINT overlay

Thin. FCC / CE plots in public filings, papers, manufacturer spurious- emission charts. Enough to talk about a class. Not enough to fingerprint a copy in the field. Do not treat academic RF-fingerprint demos as a collection method you are going to run against a target.

TECHINT sensor: the thing

Technical intelligence is information taken from foreign weapons, equipment, and related environmental conditions. Capture a rifle, a radar, a UAV, a cipher machine; put it on a bench; write what it is, what it does, and what that implies for the force that fielded it.

What it is

TECHINT is the bench. Scientific and technical intelligence (S&TI) is the wider umbrella in some services: the science behind the box, not only the captured box. A patent is S&TI overlay. A cut-open seeker is TECHINT proper.

What it collects

• Weapons and munitions: calibre, fuzing, guidance, markings, lot numbers.
• Electronics: radios, radars, seekers, computers, crypto hardware as objects.
• Vehicles, aircraft, UAVs, ships as equipment, not as tracks (tracks are GEOINT/SIGINT).
• Environmental conditions that change how the equipment works: climate, dust, EM environment.

How collection works

Classified: the object arrives, a foreign-materiel team exploits it against a requirement, the report goes to the force that has to fight it. Overlay: you never hold the object. You read the patent, the catalog, the teardown video, the FCC ID internals, the stencil in a press photo, the public standard (MIL, STANAG, GOST).

OSINT overlay

• Patents and published applications.
• Export catalogs, air-show glossies, tenders, procurement specs.
• Maintenance manuals that landed on the public web.
• YouTube / trade teardowns, FCC ID internal photos, CE filings.
• Component markings readable in press photography; public standards.

The line

Identifying from a photo is overlay. Reverse-engineering a captured system is TECHINT proper and needs the object plus authority. Do not brief "the seeker works like this" from one crop of a parade photo.

Products

• Identification: type, variant, likely manufacturer, likely user.
• A variant tree: what changed between marks.
• Supply-chain notes: which COTS chip, which foundry marking, which catalog part.
• A performance band, labeled as estimate, with the measurements you actually had.

Strengths and limits

Fuses with

IMINT to find the object. ELINT to match it to an emitter class. FININT for the company that sold the part. CYBINT for the firmware once a hash is public. MASINT for materials and signatures.

CYBINT / DNINT sensor: networks

Cyber intelligence and digital network intelligence are information taken from computer systems and networks. DNINT is the NSA-flavored name; CYBINT is the name that escaped into industry. In practice: hosts, certs, software, routing, malware, identities on the network, and the people attached to them.

What it is

This is the INT that most often gets laundered as "just OSINT." Scanning a public banner is OSINT. Using a default password you found, authenticating, or exploiting is a computer crime in most jurisdictions. The public surface of a network is enormous. Stay on it.

What it collects

• Identity of hosts: names, IPs, certs, banners, software versions.
• Routing and addressing: BGP, IRR, RIR objects, ASNs.
• Code and config that was published: Git, packages, JS, comments, backups that landed in public.
• Malware samples that are already in public repositories, used as specimens.
• People attached to the network: emails in WHOIS, Git authors, security.txt.

How collection works

Overlay: query public datasets and look at what the host offers to an unauthenticated client — the same bytes it would offer anyone. Record banners, certs, headers. Do not authenticate. Do not fuzz. Do not "just check" a default password. Classified DNINT is a different authority and a different job.

OSINT overlay

• DNS, WHOIS / RDAP, zone files where published, passive DNS that is sold as CAI.
• crt.sh and other CT logs, HTML/JS, robots.txt, security.txt, /.well-known.
• Public Git, package registries, paste sites, wayback / archive.today.
• Shodan / Censys / ZoomEye banners as CAI (the banner, not the login).
• BGP looking glasses, RIPE/ARIN stats, routing registries.
• CVEs tied to versions you actually observed on the public surface.

The line

Crossing into an account, a share, an admin panel, or a VPN is not OSINT. Downloading a file the server offered to anonymous clients is usually still overlay; authenticating to get the rest is not. When unsure, stop.

Products

• Asset inventory: domains, IPs, certs, names, first/last seen.
• Software bill from banners and public repos, with CVE notes on observed versions.
• An attribution sketch: who appears to run it, fused with HUMINT overlay and FININT.

Strengths and limits

Fuses with

A hostname is GEOINT once it geolocates. A developer is HUMINT overlay once you read their talks. A wallet in the JS is FININT. A radio dongle's FCC ID is TECHINT. Name all of them in the report. Do not call the pile "OSINT" and stop.

OSINT overlays

These names are slices of OSINT, not new physics. Use them when they help a reader. Do not invent a new INT every time a platform appears.

SOCMINT

Social media intelligence. Platforms where people publish as themselves or as brands: posts, graphs, stories, livestreams, comments, metadata the platform still exposes. It is OSINT until you talk to them, and HUMINT the moment you do.

What it is

SOCMINT is OSINT with a platform-shaped source. The unit of collection is the account and the graph, not the web page. People forget that a like, a check-in, a friend list, and a livestream of a place are different sensors riding the same app: HUMINT overlay, GEOINT overlay, IMINT overlay.

What it collects

• Identity claims: name, bio, work, links out.
• Graph: follows, comments, tagged people, reposts.
• Time and place: post times, check-ins, geotags that still exist, backgrounds in video.
• Media: images and video as IMINT once a place is in frame.

How collection works

Use the public surface of the platform. Record URL, time, and a hash of what you saw; platforms delete. Do not scrape past what an ordinary logged- out or personal-account user is offered if that is your legal and ToS limit. Do not build a fake persona to get past a privacy setting.

The line

Public post: SOCMINT. Private account you followed as yourself after they accepted: still usually OSINT, and a bad idea. Fake persona: HUMINT. Bought DM dump: stolen data, not CAI.

Products

Account dossier with first/last activity, graph notes, claims vs other INTs, and archived copies of the posts you actually used. A spreadsheet of handles is collection, not a product.

Fuses with

IMINT when the video shows a place. GEOINT when you geolocate it. HUMINT overlay when they talk about work. FININT when they show a company or a receipt. CYBINT when they paste a hostname.

DARKINT

Darknet intelligence: Tor, I2P, Freenet services. "Dark" is a routing property, not a classification marking. A hidden service that anyone can open is still open source. A forum that requires a criminal introduction is not a source you should be using as OSINT.

What it is

The overlay is real and small: some news orgs, some leak sites, some political forums publish on Tor so they cannot be taken down as easily. That is PAI with a different URL. The rest of the "darknet" that people mean in briefings is markets and crime, and it is not your OSINT beat unless you are law enforcement with a policy for it.

What it collects

Whatever a reachable service publishes: text, images, mirrors of leak sets already in public, statements. You collect the document. You do not collect the market.

The line

If you needed a referral, a payment, or malware to get in, it is not OSINT. If the content is stolen data, paying for it does not launder it into CAI. OPSEC on Tor does not change the legal character of the source.

Products

URL, first/last seen, a hash of the page, a summary of what it claims, and a note that you have not verified the claim. Same standard as any other OSINT source, plus a reminder that mirrors lie about provenance.

WEBINT

A synonym for "OSINT that came from the web." Prefer OSINT, then name the sensor (SOCMINT, CYBINT, IMINT). WEBINT as a badge usually means the author did not want to pick.

What it is

Vendor language. Sometimes used in Europe as a bucket for "online OSINT." It does not earn a seat next to SIGINT. If the fact came from a page, tag OSINT and then tag the sensor: a satellite JPEG on the page is IMINT overlay; a JS config is CYBINT overlay; a quote is HUMINT overlay.

When to use the word

Internally, if your shop's taxonomy already has it, map it to OSINT and keep going. On a product line, never. The reader cannot fuse "WEBINT."

MARKINT

Market / business intelligence. Competitive and market information. Overlaps OSINT, FININT, and HUMINT (trade shows). A business-school name. Use it internally if your reader is a company; use FININT + OSINT if your reader is an analyst.

What it is

A customer of the other INTs, like CRIMINT. The question is "what is the market doing," not "what sensor did I use." When a consultant says MARKINT, ask which sensor collected the fact.

What it collects

• Prices, capacity, shipments, catalogs, tenders.
• Competitor org charts, hiring, patents, facilities (OSINT + FININT + IMINT).
• Trade-show observation as yourself (HUMINT overlay / overt).

The line

Dumpster-diving a competitor, pretexting as a customer, or hiring a plant is not MARKINT and is not OSINT. It is whatever crime or tort your jurisdiction uses for that fact pattern.

FININT sensor: money

Financial intelligence is information taken from monetary transactions and the entities that move money. In government it is often a FIU product (FinCEN and equivalents) built on legally compelled reports. In OSINT it is everything those institutions also publish, plus what the market publishes itself.

What it is

Money leaves paper. Companies, ships, aircraft, NGOs, and governments all have to file something somewhere if they want to exist in the legal economy. FININT is the INT that reads that paper and the movement it implies. BLOCKINT is the same INT when the ledger is a public chain.

What it collects

• Legal entities: companies, foundations, trusts where public, beneficial ownership where public.
• Filings: EDGAR, SEDAR, Companies House, gazettes, annual reports, 10-Ks.
• Sanctions, PEP lists, export-control lists, court judgments about money.
• Procurement, aid, grants, tenders, customs where published.
• Registries of high-value movables: vessels, aircraft, some land.
• Public ledgers (see BLOCKINT).

How collection works

Overlay: query registries, download filings, resolve names, build the graph, date every edge. Compelled FIU data is not overlay and is not something you "OSINT around" by buying a stolen bank dump.

OSINT overlay

• Company registries and beneficial-ownership registers where they exist and are public.
• EDGAR / SEDAR / Companies House / national gazettes.
• OFAC, UN, EU, UK sanctions; PEP lists that are public.
• Procurement portals, aid data, IMF/World Bank project docs.
• Vessel and aircraft registries; some land cadastres.
• Leaked-then-published bank docs already in the press — as documents, with provenance, not as a shopping list.

The line

Follow the public money. Do not follow a SWIFT message you were not sent. Do not buy account data. A single invoice in a press photo is a clue, not a network — you still need the entities on both sides.

Products

• Entity graph: nodes (legal persons), edges (owns, paid, sanctioned, directed), dates.
• A timeline of filings around an event.
• A "who owns this hull / this plant / this domain" note fused with GEOINT and CYBINT.

Strengths and limits

Fuses with

GEOINT for the parcel and the plant. CYBINT for the domain the company runs. HUMINT overlay for the directors' talks. IMINT for whether the facility exists. BLOCKINT when a wallet shows up in the JS or a seizure affidavit.

BLOCKINT

Blockchain intelligence. FININT whose ledger happens to be a public blockchain. The chain is PAI. The identity behind a cluster is usually not, until some other INT provides it.

What it is

Ledgers that anyone can replay are PAI. Clustering, peel chains, and known-entity labels are analysis. Identity arrives from OSINT (an address in a Git repo), HUMINT, a published affidavit, or a subpoena. The overlay stops at the graph plus public labels.

What it collects

• Transactions, amounts, times, fees, contract calls.
• Clusters of addresses that heuristics say are one controller.
• Public labels: exchange wallets, mixer announcements, seizure notices, Git comments.

How collection works

Read a node or an explorer, keep your own copy if the question matters, apply heuristics you can explain, attach only labels you can source. Paid attribution platforms are CAI if the vendor's terms cover the use; they are still not identity unless the vendor's source is.

The line

"This cluster funded that" is BLOCKINT. "This is John" with only a heuristic is a briefing failure. Mixers and bridges complicate the graph; they do not turn a guess into a name.

Products

A flow: addresses or clusters, amounts, times, sourced labels, and a confidence on the clustering. Identity in a separate sentence with a separate INT tag.

Fuses with

CYBINT when the address is in a repo or a page. FININT (fiat) when an exchange KYC or a company filing names the same entity. HUMINT overlay when someone tweets a receipt. OSINT for the affidavit that named the wallet in a public case.

CRIMINT consumer

Criminal intelligence is information about criminal activity and criminals, usually produced by law enforcement for prevention, investigation, or disruption. It is a purpose, not a sensor. A CRIMINT file is built from HUMINT, OSINT, SIGINT (where lawful), FININT, and CYBINT.

What it is

Treat CRIMINT as a customer of the other INTs. When a police analyst says "CRIMINT," ask which sensor actually collected the fact. The product is organized for a criminal-justice or disruption purpose: a gang, a market, a fraud series, a threat to a community.

What it collects

Nothing of its own. It consumes HUMINT (informants, interviews), OSINT (dockets, social, news), FININT (SARs where the FIU shares, public filings), CYBINT (lawful), sometimes SIGINT under warrant. The overlay for a non-LE OSINT operator is the public remainder: dockets, news, companies, the same SOCMINT rules as everyone else.

How collection works

Inside a force: a collection plan against a criminal problem, with legal authorities named. On this page: you may build a public-source picture of a crime problem the same way you would any other question, and you stop at PAI/CAI. You do not run informants, and you do not play policeman.

The line

OSINT on a public docket is OSINT. Talking to a witness is HUMINT and may make you a witness. Do not interview victims "for OSINT."

Products

For LE: problem profiles, target packages, association charts, with handling codes. For an OSINT shop: a public-source chronology of a case already in the press and the docket, tagged by the real INTs.

MEDINT child of TECHINT

Medical intelligence from records, epidemiology, and physiology: force health, leader health, medical logistics, disease as an operational factor. Public overlay: ministries of health, WHO, obituaries, public video. A chart, a genome from a clinical sample you were not given, or a covert medical exam is not OSINT.

What it is

Disease, blood supply, hospital beds, and a leader's gait can all change an operation. MEDINT exists so that is not left as a rumor in a HUMINT report. It is still health information, and the overlay should be conservative: published facts, not amateur diagnosis.

What it collects

• Force health: vaccination, casualties, medical logistics, field hospitals.
• Population health as an operational factor: outbreaks, famine disease, displaced-person health.
• Leader health only from what is public: obituaries, official medical bulletins, obvious public appearances.
• Medical equipment and supply as TECHINT of the health system.

How collection works

Overlay: read ministries, WHO/CDC equivalents, papers, official casualty figures, public video of appearances. Classified: records and exams under a lawful program. Do not mix them in a sentence.

The line

Obituaries and official bulletins are OSINT. A stolen chart is a crime. Diagnosing a leader from a handshake video is a briefing failure even when the video is public — you may note "appeared to use a cane on date D," not a disease name you cannot defend.

Products

A health-as-factor note with sources, or a logistics picture (beds, blood, vaccines) from public statistical releases. Leader-health products should be labeled as appearance notes unless an official bulletin exists.

Fuses with

HUMINT overlay for official statements. IMINT for hospitals and mass graves claims (careful). FININT for pharma procurement. TECHINT for equipment. OSINT for the bulletin you are testing.

Counterintelligence

CI is not a collection INT. It is a mission: detect, deter, and neutralize foreign intelligence activity, insider threats, and leaks. CI uses every INT, including OSINT (a walk-in who DMs you a PDF still needs to be evaluated).

What it is

Collection answers questions about them. CI answers questions about what they are doing to you. Same sensors, different customer. A CI file that cannot name the INT that collected each fact is as useless as any other untyped file.

What it collects

• Hostile HUMINT: approaches, recruitment attempts, unusual interest in your people.
• Hostile SIGINT/CYBINT against your networks and emissions.
• Leaks and insider paths, including what your own people posted (SOCMINT on yourselves).
• Denial and deception aimed at your collectors.

How collection works

For an OSINT operator the CI questions are local: is this source feeding you a narrative, are you the collection target, did you just become identifiable to the people you are looking at. OPSEC is the CI you actually own. You do not open a CI case from a desktop HTML file.

OSINT overlay

• What you and your shop have published: Git, talks, job ads, photos of badges.
• Public reporting of hostile services' methods, as context, not as a playbook you copy.
• Source criticism: is this leak too neat, too timely, too flattering to one side.

The line

CI is not a license to collect on colleagues as a hobby. It is not a synonym for "I got paranoid about my source." If you think you are being collected against, that is a report to whoever owns CI in your shop, not a new INT badge on your OSINT product.

Products

For CI shops: case files, threat assessments, after-action on leaks. For OSINT operators: an OPSEC note on your own collection (what you touched that touched you back) and source-criticism notes on dangled documents.

Fuses with

All INTs, in both directions. A dangle often arrives as OSINT (a too- perfect leak). HUMINT is how CI lives. CYBINT is how most modern CI notices the first ping.

SIGINT, continued

ELINT's two cuts, traffic analysis, direction finding, and the EW customer. TechSIGINT is NSA's wider technical bucket. TELINT remains the retired name for the FISINT telemetry slice — see FISINT above.

TechELINT / OpELINT ELINT cuts

ELINT split into two products more than forty years ago. TechELINT is the emitter as physics. OpELINT (OPELINT) is the emitter as a force. NSA's SIDtoday (2004) is still the cleanest public definition. TechSIGINT is the wider NSA bucket: all ELINT plus FISINT, PROFORMA, and COMINT externals.

What it is

TechELINT is careful analysis of the signal: pulse, scan, mode logic, what kind of box, what it can do, enough to build a warning receiver or a jammer. OpELINT is what the force needs today: where it is, how often it lights, what function it is performing, which weapon it belongs to. Newly intercepted emitters must go through TechELINT before OpELINT exists. TechSIGINT (NSA) folds ELINT, FISINT, PROFORMA (formatted machine data on comms channels), and communications externals into one technical shop.

What it collects

• TechELINT: signal characteristics, modes, functions, associations, capabilities, limitations, technology level.
• OpELINT: location, movement, employment, tactics, activity of the emitter and its weapon system.
• TechSIGINT extras: FISINT, PROFORMA, COMINT externals (not content).

OSINT overlay

Manufacturer parametric claims, FCC/ITU filings, air-show photos of antennas, published coverage maps. OpELINT overlay is IMINT of the site plus lighting inferred from NOTAMs and public activity, not a receiver tasked against it.

The line

Cataloguing a published radar class is overlay. Measuring a protected emitter's PRI from your dish is TechELINT collection.

Products

A parametric card (tech) or an order-of-battle lighting note (op), never mixed in one sentence without saying which.

Fuses with

TECHINT for the box. RADINT for the copy. IMINT for the pad. GEOINT for the hill.

TRAFFINT / DFINT SIGINT method

Traffic analysis is SIGINT that never reads a word: who talks to whom, how often, from where, in what tempo. Direction finding (DFINT as a shop label) is how you put that conversation on the earth. Both survive encryption. Both are still intercept, not OSINT, when you take the signal yourself.

What it is

When content is encrypted, externals remain. Volume, schedule, and who-calls-whom still describe a force. DF is the geometry problem: two or more bearings, or a time-difference, put the emitter on a map. GMTI is the radar analogue for movers; DFINT is the SIGINT analogue for emitters.

What it collects

• Selectors, call duration, frequency, time, direction, network graph.
• Bearings, TDOA/FDOA fixes, error ellipses.
• Tempo: surge before an attack, silence under EMCON.

OSINT overlay

AIS and ADS-B graphs (vessels/aircraft that chose to squawk), public trunked-radio license maps, amateur direction-finding contest results used as documents, published HFDL/ACARS aggregators.

The line

Plotting MMSI tracks is overlay. Taking a bearing on a military VHF net is DFINT collection.

Products

A graph with times, or a fix with an ellipse and a method. Overlay products must say the transponder was public.

Fuses with

GEOINT to put the fix on terrain. ELINT if the emitter is a radar. HUMINT to name the unit at that hill.

EWINT electronic warfare intel

Electronic warfare intelligence is the intelligence that makes EW work: what to jam, what not to jam, which receiver will see you, which decoy they will believe. It is mostly TechELINT plus TECHINT, written for an EW customer rather than an order-of-battle customer.

What it is

EWINT exists so a jammer is not a guess. It consumes TechELINT (what the victim radar looks like), TECHINT (what the jammer pod is), and OpELINT (when they light). DEWINT (directed-energy weapons intelligence) is the MASINT/S&TI cousin for lasers and high-power microwave.

What it collects

• Threat emitter parametric data for RWR libraries.
• Jammer / decoy / EA system identification.
• EMCON patterns, fratricide risks, spectrum conflicts.

OSINT overlay

Export catalogs of EW pods, patents on DRFM, public NATO EW exercise news, photos of antenna farms.

The line

Building a threat library from public PDFs is overlay. Testing a jammer against a protected radar is not.

Products

A technique card or a library update, with the INT that supplied each parameter tagged.

Fuses with

TechELINT, TECHINT, RADINT, DEWINT.

GEOINT, continued

Imagery used as a measurement (AGI), video of a place (FMV), and radar that paints movers (GMTI / AMTI). LiDAR sits under LASINT as well as GEOINT.

AGI advanced geospatial

Advanced geospatial intelligence is imagery used as a measurement, not as a picture. The UK Defence Intelligence Fusion Centre calls it imagery-derived MASINT. Non-literal analysis: SAR as signature, hyperspectral as material, OPIR as event, LiDAR as structure. NGA's GEOINT Division language: panchromatic, MSI, HSI, thermal, FMV, OPIR, LiDAR, SAR.

What it is

Literal IMINT says 'there is a building.' AGI says 'the roof is this material, the SAR return is consistent with a metal hall, the thermal bloom started at 03:12Z.' Same photons, different question. That is why DIFC staffs IMINT and MASINT in the same building.

What it collects

• SAR / ISAR used as signature.
• Hyperspectral and multispectral material ID.
• OPIR / thermal event detection.
• LiDAR structure and canopy.
• FMV as a time series of a place.

OSINT overlay

Sentinel-1 GRD/SLC, Landsat/Sentinel-2 MSI, ASTER, public AVIRIS-class cubes, FIRMS, COPDEM, national lidar portals.

The line

A pretty RGB render of a hyperspectral cube is still AGI if the finding is a spectrum. Caption the band.

Products

A detection with sensor, band, processing, and a class if you have a library.

Fuses with

IMINT for the picture, MASINT families for the physics, GEOINT for the map under it.

FMV full-motion video

Full-motion video is a GEOINT product: sequential or continuous images so you can watch a place change in time, not just exist in a frame. Drones and theater ISR made it ordinary. ATP 2-22.7 treats FMV as a GEOINT collection asset. It is IMINT with a clock.

What it is

A still is a state. FMV is a behavior: vehicles leaving, a crane working, a crowd forming. Exploitation is different — you watch, you note tempo, you pull keyframes as IMINT. NGA lists FMV alongside SAR and LiDAR as a GEOINT modality.

What it collects

• Persistent stare over a facility.
• Patrol video along a route.
• Strike / targeting-pod video used as intelligence after the fact.
• Public webcams and posted drone video of a place.

OSINT overlay

Port webcams, traffic cameras that are public, YouTube drone flyovers, Mapillary sequences, AIS-cued marine traffic cams.

The line

If you cannot geolocate the clip, it is not GEOINT. If you messaged the uploader, it is HUMINT.

Products

A time-stamped clip or a keyframe set with coordinates and a count of what moved.

Fuses with

IMINT keyframes, SIGINT overlay (AIS/ADS-B) to cue, SOCMINT if the clip arrived as a post.

GMTI / AMTI moving target indicator

Ground moving target indicator is radar that paints things that move against the earth. Airborne MTI (AMTI) does the same for aircraft. JSTARS was the famous GMTI platform; NRO and Space Force are fielding space-based GMTI, with operational talk aimed around 2027. This is GEOINT-as-radar and RADINT-as-track at once.

What it is

A SAR image is a still of structure. GMTI is a still of motion. Dots, not hull photos. You fuse GMTI with IMINT to name the dot. Space-based GMTI is the current build: track from orbit, pass to shooters. AMTI is the air picture analogue.

What it collects

• Ground vehicles and convoys as movers.
• Aircraft as movers (AMTI).
• Maritime movers when the radar is in that mode (often a different product).

OSINT overlay

There is no public GMTI feed. The overlay is the cooperative twin: ADS-B, AIS, public traffic APIs — and a note that anyone who went EMCON disappeared.

The line

Do not label a Sentinel-1 ship detection GMTI. That is a SAR detection (RADINT/IMINT). GMTI is a moving-target mode.

Products

A track file: time, location, heading, sensor. Overlay: a transponder track with the same fields, tagged cooperative.

Fuses with

IMINT to identify the dot. SIGINT overlay to cue. ELINT if a fire-control radar paints the same mover.

MASINT, continued

Named components from the FAS MASINT list and the AFIT geophysical family that were folded into six cards above: laser and hyperspectral, seismic / magnetic / gravity, weather as intelligence, and the older CBINT / DEWINT / RINT names.

LASINT / HSI laser and hyperspectral

Laser intelligence (LASINT) is MASINT from laser energy: rangefinding, imaging, warning, and chemical/bio detection by laser return. Hyperspectral imagery (HSI) cuts the spectrum into hundreds of bands so materials identify themselves. Both sit in electro-optical MASINT. FAS lists LASINT and spectroscopic intelligence as MASINT components. NGA treats HSI as a GEOINT modality that is really a measurement.

What it is

LiDAR measures time-of-flight to build elevation and structure. HSI measures reflectance per band to name a material or a gas. Laser warning and laser imaging are the tactical LASINT cuts. Camouflage that fools a panchromatic eye often fails in SWIR or in a hyperspectral cube.

What it collects

• LiDAR point clouds of facilities and terrain.
• Hyperspectral cubes for materials, gases, soil disturbance.
• Laser rangefinding and laser-warning events.
• Spectroscopic samples in the lab (then it is also materials MASINT).

OSINT overlay

USGS 3DEP and other national lidar, Copernicus DEM, NASA/JPL public HSI, published mineral and vegetation spectra, FIRMS as a coarse thermal cousin.

The line

Flying a lidar over a facility you do not have authority to collect against is not OSINT. Downloading 3DEP is.

Products

A point cloud, a classified material map, or a detection with band and library.

Fuses with

IMINT for context, GEOINT for the map, MATERIALS MASINT if you have a sample.

SEISINT / MAGINT / GRAVINT geophysical cuts

Three geophysical MASINT names that get used as if they were INTs. Seismic intelligence (SEISINT) is shaking: explosions vs earthquakes, bunker work, vehicle weight on a road. Magnetic intelligence (MAGINT) is anomalies: hulls, underground steel, unexploded ordnance. Gravitimetric intelligence (GRAVINT) is mass: voids, underground facilities. ACINT is the acoustic sibling.

What it is

ODNI's MASINT primer: geophysics pulls targets out of the Earth's own broadcast. Submarines, SLBMs, buried structures, and contained explosions are the classical problems. MAGINT at sea is MAD (magnetic anomaly detection). GRAVINT is slow and sparse; it is not a targeting sensor you task this afternoon.

What it collects

• Seismic waveforms and arrays.
• Magnetic anomaly maps and MAD tracks.
• Gravity surveys and gradiometry.

OSINT overlay

IRIS, USGS, ISC bulletins, NOAA/NCEI magnetic models (WMM 2025), academic grav lines, papers on UXO magnetometry.

The line

Do not call a public earthquake catalog 'we detected their bunker.' Depth, P/S, and a second INT are the minimum.

Products

An event bulletin with method, or an anomaly map with the survey's line spacing stated.

Fuses with

NUCINT for yield questions, IMINT for surface change, ACINT for the in-water twin, GEOINT for the void's location.

METINT weather and sea as intel

Meteorological intelligence is weather and sea state used as an operational factor, not as a forecast for its own sake. AFIT parked weather and sea under geophysical MASINT. Can they launch. Can they hear. Can they see. Can the SAR work. METINT is the INT that answers those, using the same models everyone else uses, asked a military question.

What it is

Weather is a civilian product until you ask 'does this deny their SAR' or 'does this duct their radar' or 'can a submarine hear in this layer.' Then it is intelligence. Acoustic climatology is METINT sitting on ACINT.

What it collects

• Wind, ceiling, vis, precip, ducting, sea state, thermocline, ice.
• Space weather when it affects HF, GNSS, or OPIR.
• Climatology of a range or a strait.

OSINT overlay

METAR, TAF, GFS/ECMWF public, Copernicus Marine, NSIDC ice, NOAA space weather, public tide tables.

The line

Do not brief a GFS meme as a launch postponement. Name the model, the valid time, and the operational question.

Products

A factor paragraph on a collection or ops note: sensor X degraded, window Y-Z.

Fuses with

IMINT (cloud), SAR (sea clutter), ACINT (sound speed), FISINT (range weather), GEOINT (the place).

CBINT / DEWINT / RINT MASINT named extras

Three FAS-listed MASINT components that shops treat as names. CBINT is chemical and biological signatures (overlaps materials MASINT and BIOINT/CHEMINT). DEWINT is directed-energy weapons: lasers, HPM, the S&TI of things that put energy on a target without a projectile. RINT is unintentional radiation intelligence — compromising emanations, the TEMPEST-adjacent cousin of RF MASINT.

What it is

FAS's MASINT list is older than the six-family AFIT cut and still useful as a name-finder. CBINT is the chem/bio sensor and the sample. DEWINT is lasers and microwave weapons as objects and as signatures. RINT is energy the machine did not mean to radiate. We already covered the physics under materials MASINT and RF MASINT; these names are how older reports will say it.

What it collects

• Chemical and biological agent signatures and debris.
• Laser / HPM system parameters and effects.
• Unintentional RF from electronics.

OSINT overlay

Public patents and papers, SDS, export catalogs of 'dazzlers,' FCC spurious plots. No field assay, no TEMPEST recreation.

The line

Reproducing an academic compromising-emanation demo against a machine you do not own is collection, often a crime.

Products

A name-translation: 'this 1990s RINT report is RF MASINT UER' — plus whatever overlay you actually have.

Fuses with

MATERIALS, RF MASINT, S&TI, TECHINT, NUCINT for debris.

Science, identity, cyber

S&TI as the science umbrella, chem/bio, identity intelligence and its enablers, then the cyber names that are not just CYBINT.

S&TI scientific and technical

Scientific and technical intelligence is foreign science and technology with warfare potential: characteristics, capabilities, vulnerabilities, limitations of weapon systems and the research behind them. War on the Rocks' working definition is still the right one. It is wider than captured-hardware TECHINT. DIA's S&T career field and the old CIA Office of Scientific Intelligence sit here. WMD analysis is the famous application, not the whole job.

What it is

TECHINT is the bench. S&TI is the science plus the bench plus the program. It asks what a foreign lab is doing before the object exists. Every service S&TI center (NGIC for ground, NASIC for air/space, etc.) eats MASINT because signatures are how you know the science without a tour of the lab.

What it collects

• Foreign R&D programs, papers, institutes, budgets.
• Weapon system characteristics and limits.
• WMD, missiles, space, cyber-physical, biotech, materials.
• Supply chains for the above.

OSINT overlay

arXiv and journals, patents, conference talks, university pages, five-year plans, customs for dual-use, CFIUS-like notices, export-control lists.

The line

Do not brief a preprint as a deployed capability. S&TI products separate research, development, and fielding.

Products

An estimate with a timeline band, sources tagged by INT, and a gap list (usually: we do not have the object).

Fuses with

TECHINT, MASINT, FININT (who paid), HUMINT overlay (who spoke), IMINT of the test site, FISINT of the test.

BIOINT / CHEMINT life and chemistry

Biological intelligence and chemical intelligence are S&TI / MASINT applied to organisms and chemicals as weapons, industry, or force-health problems. CBINT is the MASINT sensor name. BIOINT also covers foreign biotech with warfare potential, not only agents. NCMI (medical) and chem/bio S&TI shops split the customer; the physics is shared.

What it is

Chem/bio is hard collection: the access you want is a sample or a lab, and those are denied. Overlay is what they publish, what they buy, what they build (IMINT of a fermenter hall), and what an outbreak does to a force. Do not play epidemiologist from a Telegram video.

What it collects

• Agent characteristics, production signatures, delivery.
• Lab networks, dual-use equipment, personnel.
• Industrial toxic chemicals as operational hazards.
• Outbreak data as a force-health factor (shared with MEDINT).

OSINT overlay

WHO/FAO, journals, patents, company registries of dual-use firms, procurement of fermenters, IMINT of lab campuses, public BSL lists.

The line

A stolen clinical sample is a crime. A diagnosis of a leader from a handshake is a briefing failure.

Products

A sourced estimate of capability, not a scare sentence. Tag the INT for every claim.

Fuses with

MEDINT, MATERIALS, IMINT, FININT, S&TI, HUMINT overlay of scientists' talks.

I2 / IDINT identity intelligence

Identity intelligence is the intelligence resulting from processing identity attributes of individuals, groups, networks, or populations of interest. JP 2-0 put I2 into doctrine in 2013. Four attribute buckets: biographical, biological, behavioral, reputational. It fuses BEI (biometrics-enabled), FEI (forensics-enabled), and DOMEX with every other INT so a person is not anonymous across events.

What it is

I2 answers 'who is this, have we seen them, who do they connect to, what is the threat.' JP 3-05 (SOF): collection, analysis, exploitation, and management of identity attributes. Army MIPB: distinguish individuals, discover threats, characterize networks. It is not a sixth core INT. It is a fusion job whose raw inputs are biometrics, forensics, documents, SIGINT selectors, HUMINT names, and OSINT.

What it collects

• Biographical: names, IDs, addresses, records.
• Biological: fingerprints, face, iris, DNA, voice, gait.
• Behavioral: travel, phones, social, pattern of life.
• Reputational: criminal records, clearances, vouching, org role.

OSINT overlay

Public records, SOCMINT graphs, news, photos with faces that are already public, company director lists. Do not scrape a face into a recognition system against a population that did not put it there for that purpose unless your shop has a policy and a law.

The line

Enrolling someone biometrically is not OSINT. Buying a face-recognition search on a scraped internet is a legal and ethical line even when the photos were 'public.'

Products

A resolved identity with the attributes and the INTs that supplied them, plus a watchlist hit or a non-hit.

Fuses with

HUMINT, SIGINT selectors, SOCMINT, FININT, FORENSINT, DOMEX, CYBINT, GEOINT (pattern of life).

DOMEX / BEI / FEI I2 enablers

Three enabling processes under I2, not sensors of their own. DOMEX is processing, translation, analysis, and dissemination of hard-copy documents and electronic media under government physical control that are not publicly available (US Army / IC definition). BEI is intelligence from biometric matching. FEI is intelligence from forensic exploitation of material. A public PDF is OSINT. A captured laptop is DOMEX.

What it is

DOMEX has a 'deep' problem (this device) and a 'broad' problem (this file on many devices). ACM Queue's public write-up is the best unclassified explanation. BEI is the match against a gallery (DoD authoritative biometric database, Army AR 25-99 in 2026). FEI is the latent, the DNA, the residue, the toolmark. All three feed I2. None of them are OSINT.

What it collects

• Paper, phones, drives, identity cards in custody.
• Fingerprints, iris, face, DNA taken under authority.
• Forensic material from a site or an IED.

OSINT overlay

If the same document later appears on a public leak site, the public copy is OSINT with a provenance problem. The captured copy remains DOMEX. Do not launder custody by downloading the leak.

The line

A Git repo is CYBINT overlay. A phone taken at a checkpoint is DOMEX. A fingerprint from a glass in a bar you do not have authority to print is a crime.

Products

An exploitation report with chain of custody, or a match/non-match with gallery and score.

Fuses with

I2, HUMINT (the person who carried it), CYBINT (the disk), FININT (the ledger on the phone), TECHINT (the device).

DNINT digital network intel

Digital network intelligence is NSA's name for intelligence from digital networks. CYBINT is the name that escaped into industry. In DoD glossaries DNINT sits next to SIGINT because much of it was born as computer-network exploitation beside COMINT. Use DNINT when the customer is a SIGINT shop; use CYBINT when the customer is a defender or a CTI team. The overlay is the same: the public surface.

What it is

People use DNINT to sound more official than CYBINT. The work is hosts, sessions, malware, and the people attached. Classified DNINT includes collection on the wire and on the box under authority. Overlay remains unauthenticated public surface.

What it collects

• Network traffic and session metadata under authority.
• Host identification, certs, software.
• Malware and C2 as network objects.

OSINT overlay

Identical to the CYBINT overlay. Tag DNINT only if your shop's taxonomy requires the NSA-flavored name.

The line

Still: the banner is the INT. The login is the offense.

Products

Same as CYBINT. Do not produce two reports that differ only by acronym.

Fuses with

COMINT (the people), CYBINT/CTI, FININT, I2 selectors.

CTI cyber threat intelligence

Cyber threat intelligence is intelligence about adversaries in cyberspace, written for defenders and operators: who is doing what, with which malware, against whom, to what end. It is a customer of CYBINT, OSINT, HUMINT overlay, FININT, and MALINT — the CRIMINT of the SOC. Mandiant, government CTI shops, and ISACs produce it. It is not a sensor.

What it is

CTI has strategic (who and why), operational (campaigns), and tactical (IOCs) layers — the same level cut as all intelligence, applied to a SOC customer. It eats OSINT (public reports), MALINT (the sample), CYBINT (your telemetry), and sometimes HUMINT (a forum persona). Do not call a MISP feed CTI.

What it collects

• Intrusion sets, TTPs, malware families, infrastructure.
• Victimology, intent, capability.
• IOCs as the tactical residue, not the product.

OSINT overlay

Vendor reports, government advisories, public Git IOCs, malware-bazaar samples that are public, conference talks. Stolen dumps are not CAI.

The line

Scanning a C2 you do not own is not 'just CTI.' Malware detonation in a lab you own is MALINT overlay. Attacking back is not intelligence.

Products

An actor/campaign note with sources, confidence, and a detection so-what. IOCs attached, not leading.

Fuses with

MALINT, CYBINT, FININT (who paid the infra), SOCMINT (persona), HUMINT overlay (leaked chats that are public).

MALINT malware intelligence

Malware intelligence is TECHINT of code: what the sample is, what it does, who built it, what it talks to. Public samples in repositories are OSINT/CAI. A sample from a box you exploited is CNE. Reverse engineering a public sample in your lab is the overlay.

What it is

Malware is an object, so the method looks like TECHINT: strings, compiler, packing, C2 protocol, code overlap. Attribution that names a person is I2 plus HUMINT, not a compile timestamp.

What it collects

• Binaries, scripts, macros, firmware implants.
• C2 protocols and certificates.
• Build environment artifacts, stolen-cert signing.

OSINT overlay

Public sample stores, sandbox reports you generate from public files, YARA on public corpora, papers.

The line

Do not 'verify' a C2 by logging into it. Write the domain and the cert. Stop.

Products

A capability sheet and a family graph, with hashes as attachments.

Fuses with

CTI (the actor), CYBINT (the infra), FININT (who paid), TECHINT (the stolen cert's company).

OSINT slices and domain INTs

Deep web vs darknet, literature as S&TI overlay, then the domain and purpose labels: economy, politics, maritime, space, forensics, order of battle, WMD.

DEEPINT deep web, not darknet

Deep-web intelligence is OSINT from content that is not indexed by general search engines but is still reachable without a criminal introduction: databases behind search forms, academic portals, public records query pages, unlinked directories. It is not DARKINT. Dark is a routing property (Tor). Deep is an indexing property. Most useful government records are deep, not dark.

What it is

The deep web is larger than the indexed web and mostly boring: library catalogs, court query pages, company-register search, gazette search. Operators skip it because Google did not show it. That skip is the usual OSINT miss. DARKINT is a different slice.

What it collects

• Public-record query portals.
• Academic and gazette databases.
• Unlinked but crawlable directories, FTP that is still public, document clouds with guessable names.

OSINT overlay

The portal itself. Record the query. Do not brute-force a search form in a way that is an attack.

The line

If it asked for an account and you made a fake one to get past it, you have left OSINT. If it asked for a fee and you paid as yourself, that can still be CAI.

Products

A sourced record with portal, query, timestamp, and a hash of the result.

Fuses with

FININT (registers), GEOINT (cadastre portals), LITINT (academic), CYBINT (unlinked .git that is public — still the banner rule).

LITINT literature and S&T OSINT

Literature intelligence is OSINT from the scientific, technical, and professional literature: papers, preprints, proceedings, standards, manuals, gray literature. It is the public twin of S&TI. RAND's 'second-generation OSINT' work treated scientific/technical OSINT as its own subtype because the method (reading papers) is not the method of SOCMINT.

What it is

Before the web this was the bulk of OSINT: FBIS, journals, conference proceedings. It still is the bulk of S&TI overlay. Citation graphs, institute pages, and who-funds-whom are the value, not a single abstract.

What it collects

• Peer-reviewed papers, preprints, dissertations.
• Patents and standards.
• Conference programs and slides the authors posted.
• Gray literature: think tanks, labs, NGOs.

OSINT overlay

DOI, arXiv, agency pubs, Google Scholar as an index not a source, institutional repositories.

The line

Sci-Hub is stolen access. Do not launder it as OSINT. Use what the author or the institution posted.

Products

A bibliography with a so-what: program exists, capability claimed, fielding not shown.

Fuses with

S&TI, HUMINT overlay (who spoke), FININT (grants), IMINT of the lab.

ECONINT economic

Economic intelligence is intelligence about economies: growth, trade, industry, sanctions impact, resources, labor. It is a topical customer, like CRIMINT. The sensors are OSINT (stats, filings), FININT (flows), HUMINT (what officials say), IMINT (the plant). CIA and national economic shops produce it. Hard-target economies lie in the numbers; you need proxies.

What it is

JHU's hard-target teaching: economists want numbers; the numbers are often lies; trade partners lie too. Proxies: night lights (IMINT/AGI), AIS (trade), customs of counterparties, satellite of tank farms. That fusion is ECONINT.

What it collects

• National accounts, trade, prices, labor, energy, harvests.
• Sanctions and evasion.
• Industrial capacity and bottlenecks.

OSINT overlay

Statistical agencies, UN Comtrade, AIS, night-lights, filings, commodity exchanges, think-tank reconstructions.

The line

Do not brief a single official series as ECONINT. Show the proxy that disagrees, or say you have none.

Products

An estimate with series, proxies, and a confidence that names the lie.

Fuses with

FININT, IMINT/AGI, MARINT, HUMINT overlay, LITINT.

POLINT / BIOGINT / CULTINT people and power

Political intelligence, biographical intelligence, and cultural intelligence are topical customers of HUMINT overlay and OSINT. POLINT is who decides and how. BIOGINT is the person file: career, family, health-as-public, networks. CULTINT is how a group makes meaning: language, taboo, status — the thing that keeps you from reading a gesture wrong. None is a sensor.

What it is

Hard-target briefings live here: people are squirrelly, qualitative data is the unit of analysis, ACH is mandatory. CULTINT is not a vibe. It is sourced claims about how a formation actually behaves.

What it collects

• Decision processes, factions, succession.
• Biographics: career, assets, health-as-public, networks.
• Language, religion, status, what offends, what binds.

OSINT overlay

Gazettes, Hansard, talks, local papers, SOCMINT of officials, published ethnography, LITINT.

The line

Diagnosing a leader from a clip is still forbidden. 'Used a cane on date D' is allowed.

Products

A leadership piece with sources and competing hypotheses, or a biographic with first/last seen.

Fuses with

HUMINT, SOCMINT, FININT (assets), MEDINT overlay, I2.

MARINT maritime

Maritime intelligence is the domain cut: anything about the sea, ships, ports, undersea, law of the sea. Sensors are AIS (SIGINT overlay), IMINT/SAR, FININT of owners, HUMINT in ports, ACINT under water. ONI is the US shop. It is GEOINT plus FININT plus SIGINT, asked a maritime question.

What it is

A ship is a GEOINT object, a FININT company, a SIGINT transponder, and sometimes an ACINT contact. MARINT is the folder that holds all of that. Dark activity is a claim you prove with SAR plus registry plus a gap in AIS.

What it collects

• Hull identity, flag, owner, manager, beneficial owner.
• Tracks, port calls, STS, cargo.
• Undersea cables, survey, submarines as a classified cut.
• Maritime militia / fishing as a dual-use problem.

OSINT overlay

AIS aggregators, Equasis/IHS-class CAI, IMO/flag registries, Sentinel-1, port webcams, sanctions, court cargo claims.

The line

Boarding a ship is not OSINT. Spoofed AIS is a known overlay failure — check SAR.

Products

A hull dossier with INTs tagged per fact.

Fuses with

GEOINT, FININT, SIGINT overlay, IMINT, ACINT, I2 of crew, CRIMINT if the question is smuggling.

SPACEINT space and SSA

Space intelligence is the domain cut for objects in orbit, launch, and counterspace. Sensors are IMINT of pads, FISINT of launches, ELINT of space emitters, S&TI of the bus, SSA (space situational awareness) catalogs. NASIC and NRO sit here. Commercial SSA (LeoLabs-class, hobbyist TLE) is the overlay.

What it is

Space is not a new INT. It is a place where IMINT, MASINT, SIGINT, and S&TI already work. SSA catalogs are the GEOINT of orbit. Counterspace (dazzle, jam, kinetic) is S&TI plus ELINT. Proliferated LEO commercial ISR is CAI GEOINT.

What it collects

• Launch vehicles and pads.
• On-orbit objects, maneuvers, conjunctions.
• Payload mission: ISR, comms, weapons.
• Counterspace systems.

OSINT overlay

Space-Track / public TLE where licensed, commercial SSA CAI, ITU, Sentinel of pads, launch webcasts, hobbyist photometry.

The line

Do not task an optical sensor against a foreign satellite in a way that is collection you do not have authority for. Downloading a public TLE is overlay.

Products

An object dossier: NORAD, owner, function estimate, last maneuver.

Fuses with

FISINT, IMINT, ELINT, S&TI, METINT (space weather), FININT of the operator.

FORENSINT forensic intelligence

Forensic intelligence is intelligence from scientific evidence in an investigation: DNA, latents, toolmarks, digital traces, documents. In DoD it is FEI feeding I2. In policing it is the lab talking to the intelligence unit, not only to the prosecutor. A lab result is a sensor reading. The intelligence is the link to a person, a network, or a series.

What it is

The numbers-oddities list called it out as its own INT. It is closer to MASINT (a signature) plus I2 (a person). Series analysis of IEDs, documents, and malware-as-forensics lives here.

What it collects

• DNA, fingerprints, toolmarks, fibers, residue.
• Document examination, device forensics (overlaps DOMEX).
• Series and linkage: same maker, same hand.

OSINT overlay

Public judgments that cite lab results, INTERPOL notices that are public, academic forensic papers. Not a latent you lifted.

The line

DIY forensics on a crime scene you do not own is a crime. Reading the exhibit PDF is overlay.

Products

A linkage chart with lab method and confidence, or a sourced quote of a public exhibit.

Fuses with

I2, CRIMINT, MATERIALS, DOMEX, MALINT when the 'trace' is code.

OBINT order of battle

Order-of-battle intelligence is the product that says who is where with what, in what strength, under whose command. It is a customer of IMINT (counts), ELINT (emitters), HUMINT (unit names), OSINT (parade videos, gazettes), TECHINT (equipment). It is not a sensor. Every decent military intel shop's day job is OBINT whether they badge it or not.

What it is

OBINT fails when people treat a single INT as the ORBAT. A garrison count without a unit name is a parking lot. A unit name without a count is a rumor. Fusion is the method.

What it collects

• Unit identity and subordination.
• Basing and deployment.
• Equipment holdings and variants.
• Readiness and manning as estimates.

OSINT overlay

Google Earth of motor pools, Sentinel change, official websites, parade FMV, SOCMINT of soldiers, procurement.

The line

Do not name a battalion from a count you could not type. Do not type a count from a unit patch in one photo.

Products

A chart with each cell sourced: this cell is IMINT 2026-04-11, this cell is gazette 2026-01.

Fuses with

IMINT, ELINT, HUMINT overlay, TECHINT, GEOINT, SOCMINT.

WMDINT proliferation

WMD intelligence is S&TI plus NUCINT plus BIOINT/CHEMINT plus FISINT, asked the proliferation question. It is a mission (detect, characterize, disrupt) not a sensor. DOE intel, DTRA, MSIC, WINPAC-class shops. The aluminum-tube argument in 2002 is the permanent warning: technical experts can save you, and political customers can ignore them.

What it is

WMDINT is all-source by necessity. Dual-use is the overlay nightmare: every fermenter and every aluminum tube has a civilian story. The product must carry competing hypotheses or it is advocacy.

What it collects

• Materials, facilities, tests, delivery systems, doctrine.
• Procurement and evasion.
• Declarations and the gap against them.

OSINT overlay

IAEA/CTBTO public, papers, dual-use trade (FININT), site IMINT, seismic, customs cases that are public.

The line

Do not upgrade a press rumor with a WMDINT header. Wait for an instrument or a second INT.

Products

An estimate with hypotheses, sensors, and what would falsify it.

Fuses with

NUCINT, FISINT, IMINT, FININT, S&TI, HUMINT, LITINT.

All-source fusion, not a sensor

All-source intelligence is the product of more than one INT, evaluated together. DoD glossary: intelligence produced from multiple intelligence collection disciplines. It is the job, not a badge you print on a single-source report to make it look finished.

What it is

The two-INT rule on this page is all-source in miniature. I2, OBINT, WMDINT, ECONINT, CTI, CRIMINT are all-source customers. The fusion shop's failure mode is to let the loudest INT win.

What it collects

• Facts already collected by the INTs, plus the evaluation of how they independently agree.

OSINT overlay

You can do all-source from overlays only: Sentinel plus AIS plus a registry is already three INTs. Write that. Do not write 'all-source' as a vibe.

The line

If every citation is OSINT, it is an OSINT product. Call it that. It can still be good.

Products

An estimate with a source matrix: fact, INT, independence.

Fuses with

Everything, on purpose.

Strategic / operational / tactical levels, not INTs

Strategic, operational, and tactical are levels of intelligence, not collection disciplines. Britannica's old cut (strategic, tactical, counterintelligence) mixed a level with a mission. The modern cut is: strategic (national policy, years and countries), operational (campaigns, theaters, months), tactical (this unit, this afternoon). CTI stole the same three words. CI is a mission that runs at all three levels.

What it is

A satellite can serve a president and a platoon. The INT is IMINT. The level is who asked. OPINT as a badge usually means 'current operations intel' and still needs a sensor tag. BASICINT (basic intelligence) is the standing background: geography, ORBAT, personalities — refreshed, not current ops.

What it collects

• Strategic: capabilities and intentions of states, WMD, economy.
• Operational: campaigns, theater ORBAT, logistics.
• Tactical: this target, this watch, this patrol.
• Basic: the standing file.

OSINT overlay

The same public sensors, asked at different resolutions and latencies.

The line

If you cannot name the INT, the level will not save the briefing.

Products

A product line that states level and INT: 'tactical IMINT overlay' not 'TACINT.'

Fuses with

All INTs, all levels. Fusion does not change the level; the question does.

MOVINT GEOINT child

Movement Intelligence

MOVINT is GEOINT with time as the primary axis. It answers where something goes and when, not what it looked like once.

GMTI and AMTI are the sensor modes that feed it. MOVINT is the discipline sitting on top of them: the analyst question is not "what is in this frame" but "what does this track mean, and what broke the pattern".

The open overlay is unusually strong here. ADS-B and AIS are cooperative broadcast systems - the target is announcing itself - and the aggregators keep history. A year of published flight legs for one tail number is a MOVINT product built entirely from PAI.

PROTINT access tier

Protected Information Intelligence

PROTINT names the class of information that is neither published nor stolen - data held about a person under legal protection, reachable only with authority.

The term comes from Sir David Omand's work on the ethics of state access to bulk data. It is included here because it is the cleanest name for the boundary this whole page is organised around.

It matters to an OSINT operator as a stop sign. The moment a technique reaches records that exist only because an institution is legally obliged to hold them, the work has left OSINT. Broker-resold copies of the same records do not launder them back.

ORBINT SPACEINT child

Orbital Intelligence

ORBINT is SPACEINT narrowed to the objects themselves: what is up there, what it is doing, and what its manoeuvres imply.

Published two-line element sets, amateur trackers and launch telemetry make a serious amount of orbital work open. A manoeuvre shows up as a discontinuity in the element set long before anyone announces it.

The closed half is characterisation. Knowing an object changed orbit is open. Knowing what its sensor package is, and therefore what the manoeuvre was for, generally is not.

VATINT transport

Vehicle and Transportation Intelligence

VATINT is the transport cut: the vehicle, the fleet, the route, and who owns them.

It overlaps MOVINT and MARINT deliberately. MOVINT is the track, MARINT is the maritime domain, VATINT is the conveyance and its paperwork - registration, ownership chain, operator, manifest.

For OSINT work it is one of the richest open domains that exists, because transport is regulated and regulation publishes.

TRADINT OSINT slice

Trade Intelligence

TRADINT follows goods and the paperwork that moves them, which is how supply chains and sanctions evasion become visible.

Trade is the most document-heavy human activity there is, and most of those documents are published or resold. A bill of lading names shipper, consignee, commodity and weight.

It pairs with FININT and CORPINT: money says who paid, trade says what moved, corporate records say who owned the thing that moved it.

CORPINT OSINT slice

Corporate Intelligence

CORPINT is the entity layer: who owns a thing, who controls it, and what it has been party to.

It is the discipline most OSINT investigations actually spend their time in, because almost every other thread terminates in a legal entity.

Beneficial ownership is where it gets hard. The registry names a director; the director may be a nominee; the nominee may be a service company in a third jurisdiction. The product is the chain, with each link sourced.

ADINT OSINT slice

Advertising Intelligence

ADINT is surveillance purchased through the advertising stack - targeting and bidstream data used to locate and profile.

The name comes from the 2017 University of Washington work showing a modest ad spend could track an individual device through ordinary targeting controls. The ecosystem has grown since.

Include it here precisely because it is the sharpest counter-example to "if I can buy it, it is open source". Commercially available does not mean publicly available. Treat ADINT as its own category with its own legal exposure, not as a slice of OSINT.

DOCEX DOMEX sibling

Document Exploitation

DOCEX is the paper half of DOMEX: getting intelligence out of documents somebody else held.

It is an enabler rather than a sensor. Nothing is collected; something already collected is made readable and searchable.

The OSINT parallel is exact in technique and opposite in provenance. The same triage, translation and entity extraction applied to a leak archive is ordinary OSINT tradecraft.

CELLEX DOMEX sibling

Cellular Exploitation

CELLEX is getting intelligence off a physical handset. It is listed to mark a boundary OSINT never crosses.

A phone is the single richest collection object in modern intelligence, which is why the legal controls around it are the strictest.

It is here as a stop sign. Work that starts as account research and ends with somebody's device in hand has changed discipline, authority and law.

MEDEX DOMEX sibling

Media Exploitation

MEDEX is the digital half of DOMEX: drives and media rather than paper.

DOMEX is the umbrella; DOCEX, CELLEX and MEDEX are its three working cuts. The page listed the umbrella and not the cuts, which is the sort of gap somebody notices.

Open-source video verification borrows the whole MEDEX toolkit - metadata, error-level analysis, shadow and skyline geolocation - and applies it to material nobody seized.

ECONINT OSINT slice

Economic Intelligence

ECONINT reads the economy as a capability statement: what a state can build, buy, sustain, or is about to run out of.

It was already discussed on this page without a row of its own. It earns one: economic collapse, sanctions effect and industrial capacity are all ECONINT questions.

The modern open version leans on proxies - night lights, port throughput, rail loadings, thermal signatures of plants - because official statistics are exactly the thing a state under pressure edits first.

GRAVINT MASINT cut

Gravimetric Intelligence

GRAVINT reads mass. It is the MASINT cut that finds what is underground when nothing on the surface says so.

It shared a row with SEISINT and MAGINT. It is separated here because its question is different: seismic listens for events, magnetics reads material, gravimetry reads mass distribution.

The open overlay is real but coarse. Global gravity models are published and excellent for geodesy; they will not find a tunnel.

RUMINT not a real INT

Rumour Intelligence

RUMINT is the community's name for unsourced chatter treated as if it were collection. It is on this page as a warning, not a discipline.

It is included because it is the most common failure mode in open-source work: a claim acquires credibility through repetition rather than through sourcing.

Treat it as a tasking trigger and never as a product. If it cannot be attributed to an artefact somebody else can also see, it is not finished.

Comparison table

Filter by name, parent, or sensor. "OSINT overlay" is what you can touch without a classified system and without intrusion.

Fusion

All-source intelligence is the product of more than one INT, evaluated together. The IC's working rule is older than the acronyms: a fact you only have from one sensor is a report. A fact two sensors can see without sharing a collection path is a finding.

Analysis of competing hypotheses (ACH) is the cheapest insurance against falling in love with the first INT that answered. List the other explanations that would produce the same image, the same emission, or the same post, and kill them on purpose.

Words of estimative probability belong on the conclusion, not the source. "Sentinel-2 shows scarred earth at these coordinates" is a fact. "They are preparing a launch" is an estimate. Keep the INT tags on the facts.

Legal floor

• OSINT stops at PAI and lawful CAI. Terms of service are not criminal law, but they are still a line your employer may care about more than you do.
• COMINT, most ELINT against protected systems, clandestine HUMINT, and exploitation are not OSINT. Naming them here does not license them.
• A banner, a cert, a public image, a registry row, a transponder ping: those are the overlay. Authentication, interception, and pretext are the other side of the line.
• Personal data, minors, medical facts, and anything you would not put in a document that might be disclosed: collect less than you can, not all that you can.
• If you need a lawyer to decide whether a source is still OSINT, it is not OSINT for your purposes. Pick another source.

Common failures

Master reference

All 67 disciplines in one sorted table, straight from the database. Every acronym links to its own section. This is the sheet to print or search.

Sources and method

How this list was assembled, and what was deliberately left out.

• Wikipedia, List of intelligence gathering disciplinesThe canonical acronym list and the MASINT and SIGINT sub-branches.
• Wikipedia, Measurement and signature intelligenceThe six MASINT families used for the Signatures group.
• Maltego, Understanding the different types of intelligence collection disciplinesCurrent working definitions of the five core INTs.
• US Naval War College, Types of intelligence collectionDoctrinal framing of collection against the intelligence cycle.
• ShadowDragon, What is OSINT? (2026)Where the 2026 OSINT slices sit in practice.
• OH SHINT!, Business research and trade intelligenceTRADINT and CORPINT as the community actually uses them.
• Omand, Bartlett & Miller, Introducing social media intelligenceSOCMINT, and the PROTINT access category.
• Vines et al., ADINT: Using ad targeting for surveillance on a budgetThe work the ADINT entry is built on.

Last full review 22 September 2026. The database behind this page is data/osint-int-types.db; the page is generated from it.

Glossary