GEOINT Workflow Guide
BLUF
Fact: Commercial GEOINT has democratized satellite imagery access. Analysts who a decade ago required institutional intelligence-community (IC) access can now obtain sub-meter resolution imagery within hours of tasking — and free 10-meter Sentinel-2 imagery within 24-72 hours of acquisition. The gap between classified and open-source GEOINT has narrowed significantly since 2014, when Bellingcat’s MH17 investigation demonstrated that open-source satellite evidence could be marshaled to evidentiary standards in international accountability proceedings.
Assessment: The open-source GEOINT practitioner today operates with capabilities approximating mid-2000s IC analyst tradecraft — minus persistent tasking authority, minus classified comparative imagery libraries, but with broader sensor diversity (multiple commercial providers, SAR availability, daily revisit cadence from Planet Labs). The principal constraints are cost (high-resolution commercial imagery remains expensive at scale) and tradecraft (SAR interpretation, change detection workflows, and chain-of-custody practices require sustained training).
This guide covers the practitioner workflow for open-source GEOINT — from imagery acquisition through analysis, verification, and integration with OSINT, SOCMINT, and IMINT workflows for intelligence production.
1. GEOINT Discipline Map
GEOINT is not a single sensor type but a family of imaging and geospatial analytic disciplines. A competent practitioner selects the sensor appropriate to the intelligence question.
| Sub-discipline | Sensor type | Strengths | Limitations |
|---|---|---|---|
| EO (Electro-Optical) | Visible/near-IR cameras | Highest resolution; intuitive visual interpretation | Weather-dependent (cloud blocks); daylight-only |
| SAR (Synthetic Aperture Radar) | Microwave radar | All-weather, day/night; phase-difference change detection | Lower visual resolution; specialist interpretation required |
| Multispectral / Hyperspectral | Multiple wavelength bands | Vegetation/mineral mapping; chemical signature detection | Large data volumes; advanced processing required |
| Thermal IR | Long-wave infrared | Heat signature detection (vehicle engines, fires, building heating) | Low spatial resolution; ambient temperature confound |
| Elevation / DEM | LIDAR or radar-derived | Line-of-sight, blast-radius, terrain analysis | Derived product; vertical accuracy varies |
Assessment: For the OSINT practitioner the operational core is EO + SAR + DEM. Multispectral analysis is high-value for agricultural, environmental, and certain materials-mapping cases but represents specialist tradecraft. Thermal IR at open-source resolutions (Landsat 8/9 TIRS at 100m) is too coarse for tactical work.
2. Open-Source Imagery Platforms
Free or Near-Free Archives
| Platform | Resolution | Revisit Cadence | Coverage | Best For |
|---|---|---|---|---|
| Copernicus Open Access Hub (ESA Sentinel-2) | 10m optical | 5 days | Global | Change detection, large-area monitoring |
| Copernicus Hub (Sentinel-1 SAR) | 5-20m | 6-12 days | Global | All-weather, cloud-blocked AOIs |
| USGS Earth Explorer (Landsat 8/9) | 30m (15m pan) | 16 days | Global | Long historical archive (1972-present via Landsat program) |
| NASA Worldview / Earthdata | Variable (MODIS 250m, VIIRS 375m) | Daily | Global | Wildfires, large-scale environmental events |
| Google Earth (historical) | Variable | Variable (historic mosaic) | Global | Historical reference; baseline imagery |
| Open Aerial Map | Sub-meter (drone) | Event-driven | Spotty | Crisis response, post-disaster |
Commercial (Subscription or Per-Image)
| Provider | Resolution | Sensor | Key Capability |
|---|---|---|---|
| Maxar WorldView Legion | 30cm | EO | Highest commercial EO resolution; daily revisit |
| Planet Labs (PlanetScope) | 3m | EO | Daily global coverage at medium resolution |
| Planet Labs (SkySat) | 50cm | EO | High-res tasking on PlanetScope cued tips |
| Airbus Pléiades Neo | 30cm | EO | Very-high resolution EO; tri-stereo capable |
| Capella Space | 50cm | SAR | All-weather, day/night; on-demand tasking |
| ICEYE | 25cm SAR | SAR | High-cadence SAR constellation |
| Umbra | 16cm SAR | SAR | Highest commercial SAR resolution |
| Satellogic | 70cm | EO | Cost-effective daily cadence |
OSINT Aggregators and Front-Ends
- Sentinel Hub (EO Browser) — browser-based front-end to Copernicus archive; free tier sufficient for most OSINT work; subscription unlocks higher request quotas
- UP42 — commercial imagery marketplace; aggregates Maxar, Pléiades, Planet, Capella
- SkyFi — consumer-facing interface to Planet and Maxar archives; lowers tasking friction for one-off requests
- Soar.earth — community-curated imagery and mapping marketplace
Gap: No single open-source aggregator yet provides unified search across all free and commercial archives. Practitioners maintain a mental matrix of which archive to query for which AOI, sensor, and date range.
3. Analysis Tools and Software
Free / Open-Source
| Tool | Function | Notes |
|---|---|---|
| QGIS | Full-featured desktop GIS | Vector + raster + analysis; the open-source standard |
| NASA SNAP (Sentinel Application Platform) | SAR and multispectral processing | Required for Sentinel-1 SAR preprocessing |
| Google Earth Pro | Historical imagery, measurement tools | Reference baseline; ruler tool for distance/area |
| Copernicus EO Browser | Web-based Sentinel analysis | Quick visual change detection without local install |
| OpenStreetMap + Overpass API | Ground-truth map layer | Programmatic queries for feature extraction |
| SunCalc.org | Sun angle / shadow analysis | Chronolocation (see Geolocation Methodology) |
| MapWarper | Georeferencing historical maps | Aligning legacy cartography to modern WGS84 |
| GDAL / OGR | Command-line geospatial library | Underlies most GIS tooling; essential for scripted pipelines |
Commercial
| Tool | Function |
|---|---|
| ArcGIS Online / Pro | Enterprise GIS (Esri ecosystem) |
| ENVI / SARscape | Advanced multispectral and SAR analysis |
| Maxar Geospatial Platform | Successor to DigitalGlobe GBDX; commercial cloud-native imagery access |
| Descartes Labs Platform | Industrial-scale geospatial analytics |
4. The GEOINT Analysis Workflow
Step 1 — Requirements Definition
Define the intelligence question (IQ) explicitly before tasking any sensor:
- What physical feature, object, or activity are you detecting or monitoring?
- What is the area of interest (AOI) — coordinates, bounding box, or named location?
- What temporal frame applies — point-in-time confirmation, before-and-after, or sustained time-series monitoring?
- What is the decision the analysis will support?
Tradecraft note: A vague IQ (“is there activity at site X?”) produces vague answers. A precise IQ (“has new revetment construction occurred at site X between dates A and B?”) produces a tractable analytic task.
Step 2 — Source Selection
Match resolution to requirement:
- Tactical / object-level identification (vehicles, individual aircraft, equipment): <1m resolution. Commercial EO (Maxar, Pléiades) or high-res SAR (Umbra, ICEYE).
- Operational / facility-level monitoring (construction, force concentration, large infrastructure): 1-5m. Planet SkySat, Satellogic, or commercial SAR.
- Strategic / regional change detection (deforestation, urban expansion, agricultural shifts): 5-30m. Free Sentinel-2 or Landsat.
Match sensor to environment: persistent cloud cover (monsoon, polar night, smoke obscuration) drives the practitioner to SAR. Sub-canopy or sub-roof activity requires either thermal cueing or human-source corroboration.
Step 3 — Collection / Acquisition
- Bulk historical: Earth Explorer, Copernicus Hub — free, batch-downloadable
- On-demand tasking: Planet, Maxar — typical turnaround 24-48h for non-priority tasking
- Emergency / time-sensitive: commercial SAR (Capella, ICEYE) — near-real-time tasking; pricing reflects urgency
Step 4 — Preprocessing
Imagery as delivered is rarely analysis-ready. Standard preprocessing chain:
- Radiometric calibration — converting raw digital numbers to physical reflectance/backscatter values
- Atmospheric correction — removing scattering and absorption effects (Sentinel SNAP Sen2Cor processor for S2)
- Orthorectification — correcting for terrain-induced geometric distortion
- Projection normalization — reprojecting to WGS84 (EPSG:4326) or appropriate UTM zone
Step 5 — Analysis
Core analytic operations:
- Change detection: pixel-differencing between two registered images of the same AOI at different times
- Object identification: vehicles, aircraft, vessels, infrastructure by visual or radar signature
- Counting and measurement: force concentration estimates, runway length, building footprints, dispersal distances
- Shadow analysis: chronolocation (SunCalc correlation) and height estimation from shadow length
Step 6 — Verification and Chain-of-Custody
A GEOINT finding without corroboration is a hypothesis, not an assessment.
- Corroborate with independent source — SOCMINT tip, HUMINT report, SIGINT geolocation cue
- Document provenance: platform, sensor, image acquisition date/time (UTC), processing chain, software versions
- Hash the source imagery file (SHA-256) for evidential chain-of-custody — particularly important when work may enter attribution or accountability proceedings
Step 7 — Integration and Dissemination
- Annotate with analytical markings: bounding boxes around objects of interest, labels, confidence tags (high/moderate/low)
- Integrate imagery findings into narrative assessment with OSINT/HUMINT context
- Export to appropriate format: KML/KMZ for Google Earth consumption, GeoTIFF for downstream GIS work, annotated JPEG/PNG for publication
5. Change Detection — Core GEOINT Technique
Change detection is the workhorse GEOINT analytic. Three principal approaches:
Simple pixel differencing: subtract image at time T₂ from image at time T₁ after co-registration. Bright pixels in the difference image indicate change. Works best for EO imagery of stable AOIs (no seasonal vegetation cycle confound).
NDVI change: Normalized Difference Vegetation Index uses red and near-IR bands to quantify vegetation. NDVI differencing between dates isolates vegetation loss (deforestation, fire scars, agricultural clearance) from broader scene change.
SAR coherence change detection: comparing the interferometric phase coherence between two SAR acquisitions. Areas where coherence drops below a threshold have experienced surface disturbance between acquisitions. Particularly useful for detecting construction, mining, cratering from ordnance, and earthworks — surface changes that may be visually subtle in EO but produce strong SAR signatures.
Case application: BuzzFeed News (2020) documented the Xinjiang detention facility construction program by applying Sentinel-2 time-series change detection across hundreds of suspected sites, showing facility expansion from 2017-2019 correlated with surveillance technology deployment timelines and policy announcements. The work demonstrated that systematic free-imagery analysis at continental scale was within reach of a small editorial team.
6. SAR for the OSINT Analyst
SAR is the discipline most underutilized by general OSINT practitioners and most rewarding to learn. Key concepts:
- Backscatter: how strongly a surface reflects the incident radar pulse back to the sensor. Smooth water surfaces produce specular reflection away from the sensor (dark pixels). Buildings, vehicles, and any structure with corner-reflector geometry produce bright returns. Vegetation backscatter varies with moisture and structure.
- Coherence: comparing the phase relationship between two SAR acquisitions of the same scene. High coherence = unchanged surface. Low coherence = surface disturbance between acquisitions.
- InSAR (Interferometric SAR): comparing phase across two acquisitions enables millimeter-level surface deformation detection — earthquake damage, mining subsidence, volcanic inflation, dam settlement.
Practical SAR Workflow — Sentinel-1 GRD in SNAP
- Download Sentinel-1 GRD (Ground Range Detected) product from Copernicus Hub
- Apply precise orbit file → Radiometric Calibration → Speckle Filter (Lee/Refined Lee) → Range Doppler Terrain Correction → geocode to WGS84
- Export the calibrated, terrain-corrected product as GeoTIFF
- Load into QGIS for visualization, threshold analysis, or change detection workflow
Assessment: SAR interpretation requires more training than EO. False attribution of backscatter artifacts (corner reflectors from irrelevant infrastructure, layover effects in mountainous terrain, radio-frequency interference) as targets is a common error among novice analysts. Cross-validate SAR findings with EO imagery whenever cloud conditions permit.
7. Vessel and Aircraft Tracking (MASINT-Adjacent)
GEOINT in the maritime and aviation domains is fused with cooperative-emitter tracking:
- AIS (Automatic Identification System): vessel position, identity, course, speed broadcast over VHF — aggregated globally by MarineTraffic, VesselFinder, Spire. Cooperative system; vessels can disable transponders.
- ADS-B (Automatic Dependent Surveillance-Broadcast): aircraft position, identity, altitude. Aggregated by FlightAware, FlightRadar24, and ADSB Exchange (the latter is unfiltered and includes military aircraft that other aggregators suppress).
- Dark vessel detection: SAR detection of vessels that have disabled AIS — common in sanctions evasion (Iran, North Korea, Russia oil flows), illegal fishing, and intelligence-collection operations. Commercial platforms Windward and SkyLight (Allen Institute) fuse AIS with SAR for dark-vessel monitoring.
- Correlation tradecraft: cross-reference an AIS-dark vessel detected in SAR imagery against historic AIS tracks (vessel disabled AIS at coordinates X, where did it last report?), shipping registry data, and port-call records.
See: MASINT for the broader emitter-signature discipline of which this work is a part.
8. Legal and Ethical Constraints
- Privacy law: imaging identifiable individuals in non-public spaces via commercial satellite remains rare at current commercial resolutions (30cm is at the practical edge of person-identification), but the question becomes operationally relevant as <30cm imagery proliferates and as AI-assisted re-identification matures.
- Export controls: commercial imagery over denied areas may be subject to national security licensing (US “shutter control” provisions; analogous constraints under EU dual-use regulations). The Pléiades, WorldView, and SkySat catalogs over Israel-Palestine were historically subject to resolution caps under the Kyl-Bingaman Amendment until partial repeal in 2020.
- Evidence standards: satellite imagery as court evidence requires authentication — established chain-of-custody, sensor metadata, processing documentation. The MH17 JIT proceedings established practical precedent for open-source satellite imagery in international criminal accountability.
See: OSINT Ethics, OSINT Legal Framework for fuller treatment of the regulatory and ethical landscape.
9. Integration with Other INT Disciplines
GEOINT rarely stands alone. Its analytic value compounds when fused with other collection disciplines:
- GEOINT + HUMINT: imagery confirms or refutes physical access claimed by a source; HUMINT provides context (function, ownership, personnel) for an identified installation.
- GEOINT + SIGINT: imagery corroborates SIGINT-derived geolocation cues (emitter at coordinates X → imagery of structure at coordinates X reveals associated facility).
- GEOINT + SOCMINT: user-posted geotagged imagery on social platforms tips the analyst to an AOI; GEOINT then provides scale, persistence, and pre/post context.
- GEOINT + general OSINT: GEOINT serves as a verifiable anchor for broader open-source assessments — when pattern-of-life claims about a facility are made on the basis of social-media or news reporting, GEOINT change detection is the discipline that can falsify or corroborate them.
10. Common Pitfalls
Single-image overinterpretation: A single satellite image is a snapshot. Activity inferred from one image is hypothesis, not assessment. Require time-series corroboration before drawing operational conclusions.
Resolution mismatch: Tasking 30cm imagery for an AOI where the analytic question only requires 3m resolution wastes budget. Tasking 10m Sentinel for a question requiring vehicle identification produces nothing usable.
SAR misinterpretation: Mistaking layover, foreshortening, or RFI artifacts for genuine target signatures. Cross-validate against EO when possible.
Stale baseline: Comparing recent imagery against a “baseline” that is itself years out of date — particularly in active conflict zones where the baseline state may have changed multiple times.
OPSEC leakage on the analyst side: EO Browser and similar web tools log AOI queries. Sensitive investigations should use account hygiene, VPN routing, and where possible local processing of bulk-downloaded archives.
11. Sources
- NGA (National Geospatial-Intelligence Agency), Geospatial Intelligence Standards — High
- Bellingcat OSINT guides (bellingcat.com/resources) — High (practitioner community standard)
- ESA Sentinel-2 User Handbook — High
- ESA Sentinel-1 SAR User Guide — High
- Planet Labs developer documentation (developers.planet.com) — High
- Copernicus Open Access Hub user guide — High
- Lillesand, Kiefer, & Chipman — Remote Sensing and Image Interpretation (Wiley, 7th ed.) — Medium
- Weir, Karen (ed.) — Principles of Geospatial Intelligence — Medium
Key Connections
- GEOINT — the parent intelligence discipline
- OSINT — the broader open-source intelligence framework
- IMINT — imagery intelligence as the historical lineage
- MASINT — measurement and signature intelligence (overlap in SAR, thermal, multispectral)
- Geolocation Methodology — feature-matching geolocation tradecraft for ground-level imagery
- Pattern of Life Analysis — analytical framework for which GEOINT time-series supplies physical evidence
- Attribution — the accountability use case (MH17 precedent)
- OSINT Ethics — ethical constraints on imagery collection and analysis
- OSINT Legal Framework — the legal/regulatory perimeter
- Social Media Intelligence — SOCMINT integration for tipping and corroboration
- Shodan-Censys Guide — network-infrastructure correlate for physical-infrastructure GEOINT