What is an indicator and warning (I&W) in imagery intelligence?

Indicators and warnings tradecraft didn't start with satellites. The vocabulary goes back to Cold War watch committees trying to answer one question: how do you tell routine military posture apart from the first moves of something that's about to happen. An indicator is a specific, observable fact that you've decided in advance will mean something if it shows up. A warning is what you issue once enough indicators line up to cross a threshold you've set.

In imagery intelligence, that definition gets concrete fast. An indicator isn't "increased activity at the site." It's "fuel trucks present at the motor pool on three of the last five passes," or "revetment doors open where they're normally closed." A vague indicator produces a vague warning, and a vague warning gets ignored by whoever has to act on it.

Why indicators need a baseline before they mean anything

Spotting that a single image looks different is the easy part of I&W work. Knowing what "different" means for that particular site is the hard part. A parking lot with forty vehicles is unremarkable at a logistics hub and worth flagging at a site that normally sits empty. Without a record of what normal looks like over weeks or months, an analyst is relying on memory instead of the site's own history.

The baseline is also the part of the tradecraft that a single-snapshot workflow quietly drops. Reviewing imagery one frame at a time, in whatever order tasking happens to deliver it, means carrying the baseline in your head, which holds up for a handful of sites but falls apart once you're covering a full watch list, or once you rotate off a target set for a few weeks and come back without the thread.

Building the indicator list follows a familiar process across disciplines: define the essential elements of information, derive specific observables from them, tie each one to a named area of interest, and set a threshold for when an observation, or a combination of them, triggers a warning. What changes from site to site is which observables matter most. A shipyard's indicators look nothing like an airfield's, and a motor pool's look nothing like either.

Turning an indicator list into an actual warning

A lot of I&W programs stall right here. Writing the indicator list is a one-afternoon exercise. Checking every new image against it, every day, for every site on the list, is the part that eats an analyst's week. Most of what comes back on any given day is nothing: the parking lot looks like it always looks, the revetments are closed the way they always are. That's useful information too, but it's easy to skim past when you're reviewing dozens of sites in an afternoon and the one real deviation is sitting in frame seventeen.

The gap shows up in the review, not in the indicator list. The indicators exist, and they're usually written well. What's missing is the time to apply them to every pass, consistently, instead of only when something already looks off.

Activity-Based Intel is built around that specific gap. It accumulates daily imagery of a named site into a running baseline and flags the pass that breaks from it, so the deviation surfaces as the thing to look at instead of one frame among dozens that all look the same.

If your indicator list is solid but the daily review is where warnings go to die, that's worth a look.