Built, Not Stolen: How Commercial Data Is Changing Intelligence

An adversary assembles a targeting picture without accessing a single classified system. Commercial satellite imagery shows recent activity, aircraft tracking data reveals irregular movement patterns, maritime feeds confirm supporting presence. Individually, none of this information is sensitive. Aggregated, it is enough. No breach occurred, no system was compromised, the intelligence picture was built anyway.

The gap between “open source” and “classified” is shrinking. The underlying data is mundane: commercial imagery, aircraft tracking, maritime feeds, geospatial datasets, and social media. Each of these datasets are widely accessible and each are lawful to collect. What has changed about the data is the ability to fuse the information together in significant way, and the speed at which it can be processed by artificial intelligence.

Artificial intelligence enables continuous ingestion and correlation across these streams, producing time-indexed models of military activity –force posture reconstruction, pattern-of-life analysis, and increasingly, predictive assessments. The output is not a collection of observations; it is a synthesized intelligence picture. Sensitivity is no longer determined by origin, it is determined by aggregation. Data that is individually benign can, when fused, reveal operationally significant insight. Treating “open source” as categorically low risk is no longer defensible in an environment where aggregation produces effects comparable to classified intelligence. The IC’s own recent policy and strategy documents reflect that shift by trading commercially available information and OSINT as increasingly important intelligence inputs requiring more deliberate governance.

There is no credible open reporting that these data aggregation capabilities rely on unauthorized access to U.S. systems, which is precisely what makes them significant. The intelligence problem is not compromise, it is bypass. Adversaries no longer need to penetrate classified networks if the indicators of military activity are observable, the data is commercially available, and the analysis can be automated.

The exposure is structural, not technical. The United States built its security architecture around preventing access. It did not build it to prevent inference. The recent restriction of commercial satellite imagery during an active conflict, and U.S. response to its use  are two public signs that the market now produces intelligence effects once associated primarily with state collect systems. This reframes the problem set, where counterintelligence and cybersecurity remain necessary, but they are no longer sufficient. The relevant question is no longer how systems are protected, but how much of the operational behavior is visible without intrusion at all.

This shift has immediate implications under the law of armed conflict . An object may become a lawful military objective if, by its nature, purpose, or use, it makes an effective contribution to military action, and its destruction offers a definite military advantage. That standard does not require formal state control, functional contribution is sufficient. Commercial analytic platforms that directly enable targeting decisions—by identifying military assets, tracking movements, or providing operationally actionable intelligence—may in certain circumstances, approach that threshold. While this is a context-dependent determination, not a categorical rule, the possibility is still real.

At the same time, reliance on aggregated open-source intelligence introduces new risks into targeting decisions. Data may be incomplete, stale, or misinterpreted. Pattern-of-life analysis –particularly when generated at scale –can create false confidence. Commanders remain bound to act on information that is reasonably available at the time, but the expansion of what is “available” increases both opportunity and risk. The question is no longer whether open-source data can inform targeting. It is whether it can do so reliably enough to satisfy the requirements of distinction and proportionality.

If the law of armed conflict governs the use of intelligence, Executive Order 12333 and Department of Defense Manual 5240.01 govern how that intelligence is collected and handled. Both were built around a model of intelligence as a discrete activity –something that is tasked, collected, processed, and disseminated. That model is under strain, even as the IC has begun adapting to it through new policy on commercially available information, a new OSINT strategy, and new sourcing standards for publicly available information, and OSINT in analytic products.

AI-enabled systems do not collect in discrete moments. They ingest continuously, refine outputs over time, incorporate globally sourced data on a scale. Publicly available information has long been treated as lower risk within this framework. But lower restrictions are not the same as no restriction. When publicly available information is used for intelligence purposes, it remains subject to lawful purpose requirements, minimization rules, and controls retention and dissemination. At scale, those requirements become operationally difficult to apply. These systems can ingest data that includes incidental U.S. person information, generate outputs without discrete collection points, and evolve continuously without clear boundaries between collection and analysis.

The increasing reliance on commercial providers further complicates the picture. When the U.S. government relies on commercially derived analytics, it does not shed its legal obligations. The origin of the data does not determine the applicability of oversight. The use of the data does. Outsourcing collection does not outsource accountability, that is increasingly explicit in current IC policy: the government’s legal and governance obligations turn on the use of commercially available information, not simply on whether the data originated outside the government.

The United States operates within a dense web of legal constraints governing intelligence collection and use. Its competitors do not face equivalent restrictions when exploiting the same commercial data environment. The asymmetry is not new, but it is now amplified. The ODNI strategy implicitly recognizes that reality: commercially available information is becoming more important to U.S. intelligence work even as it raises novel privacy and civil-liberties issues that competitors may simply ignore. Adversaries can ingest global datasets without minimization requirements, fuse them without oversight constraints, and distribute analytic outputs without restriction. They can also tolerate lower thresholds of analytic confidence. United States can access the same data but must do so within a framework that imposes legal sufficiency, evidentiary standards, and compliance obligations. The result is not simply a difference in capability. It is a difference in how confidently each side can act on the intelligence it produces.

This is not a niche intelligence issue; it is an operational one. First, operational security must shift from protecting information to disrupting patterns. Securing classified systems is no longer sufficient if operational behavior remains observable. The objective is not just secrecy, but pattern denial. If commercial imagery providers are already delaying or restricting release of conflict-zone imagery to reduce adversary exploitation, commanders should assume the observable signature of operations is itself part of the contested battlespace. Second, the meaning of “unclassified” must be reassessed. Data that is individual benign can, when aggregated, produce operationally significant insight. Commanders and their staff should treat aggregation risk as a core planning consideration, not an edge case. Third, legal review must move upstream. The most consequential legal questions are no longer confined to the moment of strike authorization. These questions rise earlier—in decisions about data sourcing, vendor reliance, analytic methods, and integration into operational workflows. These decisions shape what information becomes “reasonably available,” and therefore what the law expects commanders to consider.

The policy response has begun, but the operational adjustment is still lagging. The United States is not losing control of its secrets, it is losing its monopoly against adversaries on producing operational intelligence. For decades, the law and doctrine of military operations assumed that the most sensitive information was also the most protected, that assumption no longer holds. What matters now is not what is classified, but what can be inferred. The battlefield is becoming transparent—not because it has been exposed, but because it can be reconstructed. The United States can continue to refine how it protects its systems, but unless it also changes how it manages its observable behavior it will remain visible to any adversary capable of assembling the pieces.

Major Aaron Conti is a Judge Advocate in the United States Army, currently serving as the Brigade Judge Advocate for the 513^th Military Intelligence Brigade. He previously served as the chief of national security law for the Combined Special Operations Joint Task Force in Iraq and as a Judge Advocate at multiple levels in the 1^st and 7^th Infantry Divisions.

Disclaimer: The views presented are those of the author and do not necessarily represent the official policy or position of the Department of War, the U.S. Army, or any other U.S. government agency.