AI And National Security

Military intelligence has always depended on sorting. During the Second World War, analysts worked through intercepted communications, aerial photographs, prisoner reports, shipping records, and field observations. Much of the labor was clerical before it was analytical: organizing reports, matching names, plotting movements, and comparing one observation with another.

The scale changed gradually. Radar created continuous streams of information rather than occasional reports. Reconnaissance aircraft produced repeated images of the same roads, airfields, and ports. During the Cold War, intelligence organizations built systems to track missile tests, submarine patrols, aircraft deployments, and radio activity across enormous distances. Computers helped store and retrieve records, but the central interpretive burden remained human.

A human analyst can recognize context that is difficult to encode. A new convoy may be routine if it appears during an annual exercise, but suspicious if it arrives after a change in diplomatic relations. A communications blackout may indicate concealment, equipment failure, a storm, or a deliberate effort to avoid detection. Analysts learn these distinctions through history, local knowledge, institutional memory, and conversations with colleagues. They also work under pressure, with incomplete information and deadlines that rarely wait for certainty.

Machine learning changes the balance by making comparison cheap. A system can examine thousands of images for changes between visits, compare current shipping behavior with years of recorded movement, or identify unusual connections among people, devices, locations, and events. It does not need to become tired, and it does not forget a pattern simply because the shift occurred across several months.

That strength is also its limitation. Algorithms are excellent at asking, “What is different?” They are much less reliable at answering, “Why is it different?”

The Signal-to-Shadow Method

The first part of the method is the signal: a measurable trace left in data. A vessel’s position is a signal. So is the timing of a radio transmission, the appearance of a vehicle in a satellite image, or the repeated use of an online account from locations that do not fit its previous behavior.

The second part is the pattern surrounding that trace. A single unusual event is often meaningless. A ship taking a different route may be avoiding rough water. A newly cleared area near a military facility may be construction, agriculture, or seasonal maintenance. But if the route change coincides with unusual port visits, altered radio behavior, and new activity at a nearby facility, the combined pattern becomes more important than any one clue.

This is where algorithms are particularly useful. They can join observations that humans often encounter in separate systems. One team may monitor imagery, another maritime data, and another communications. A machine can compare them across time and geography, then highlight relationships that would otherwise remain buried in organizational boundaries.

The method’s “shadow” is the uncertainty around every signal. Data can be incomplete, delayed, duplicated, or wrong. Sensors have blind spots. Public information can be manipulated. A model trained on past behavior may treat a new tactic as harmless simply because it has never seen it before. Conversely, it may flag normal activity because the surrounding conditions have changed.

A brief anecdote from the history of intelligence captures the problem. Analysts examining aerial photographs have long relied on repeated images, not just one dramatic picture. The difference between a storage yard and a military staging area may be visible only when vehicles accumulate, disappear, and return in a particular sequence. The image is not the answer. The answer emerges from time.

The surprising fact is that many detection systems are built less to recognize threats than to recognize normality.

That reversal matters. A model learns what ordinary traffic, ordinary construction, ordinary communications, or ordinary online behavior looks like. It then marks departures from that baseline. The system’s intelligence is therefore partly inherited from the past - and the past may not resemble the present. A rapidly changing adversary can exploit that gap by behaving just differently enough to remain inside the machine’s idea of normal.

Why Speed Changes the Meaning of Evidence

Speed is not merely a convenience. It changes what evidence can do.

An analyst reviewing a satellite image after several days may still identify a new structure, but the information may arrive after vehicles have moved, equipment has been concealed, or an operation has begun. An automated system can compare the image with earlier ones as soon as it is processed and place the change into a queue for review. The gain is not that the computer has solved the mystery. It is that the mystery has been noticed earlier.

This matters most when events unfold across many weak clues. A cyber intrusion may begin with a login from an unusual location, followed by access to an unfamiliar server, followed by a small transfer of data. None of these events necessarily proves hostile activity. Together, and in the right sequence, they may describe an attack in progress. Algorithms are well suited to sequence because they can preserve relationships among time, place, identity, and behavior at a scale that overwhelms manual review.

Natural-language systems add another layer. They can sort reports, identify recurring names and places, translate material, and connect references across documents. Their value lies less in producing elegant summaries than in reducing the number of records a person must inspect before reaching the relevant evidence. Yet language is especially vulnerable to ambiguity. A place name may refer to several locations. A translated phrase may lose political or cultural meaning. A rumor repeated across many accounts may look like confirmation when it is only repetition.

The best systems therefore behave less like oracles than like fast, tireless research assistants. They surface candidates, rank them, and show the evidence behind a pattern. Human analysts test those suggestions against sources, context, and competing explanations. The division of labor is not clean: analysts influence the data selected for training, and their judgments can become part of the model’s future behavior.

Errors also travel in both directions. If a model learns from biased historical reporting, it may reproduce the blind spots of the institutions that created the records. If analysts trust a machine’s ranking too readily, an uncertain lead can acquire the appearance of fact. A false alarm consumes attention; a missed signal may conceal a threat. The cost of each error depends on the setting, the available time, and what decision follows.

The Counterintuitive Problem of the Quiet Network

The most dangerous clue may be the absence of activity. A communications network that suddenly falls silent can indicate discipline, deception, technical failure, or nothing more than a damaged antenna. In some circumstances, however, silence itself becomes an unusual behavior because the network has a long history of regular transmissions.

This is counterintuitive because detection is usually associated with more evidence: more vehicles, more messages, more construction, more movement. In intelligence work, a disappearance can be equally informative. Algorithms are able to measure these absences by comparing current activity with a baseline, though they cannot determine intent from silence alone.

Why does this change the way the subject is understood? It shows that AI is not simply scanning the world for visible objects. It is modeling expectations - what should be present, when it should be present, and how much variation is ordinary. Threat detection becomes a study of missingness as well as presence. The machine may flag an empty road, a darkened transmitter, or a vessel that stops broadcasting, while the analyst must decide whether the blank space is concealment or coincidence.

The same issue appears in social and cyber data. A network can reveal a coordinated operation through sudden silence after a period of intense activity. Accounts may stop posting, devices may disconnect, or a group may abandon familiar channels. These changes can reflect a planned shift, but they can also reflect moderation, fear, technical disruption, or ordinary human behavior. Absence creates a question; it does not supply an answer.

A Human Case: Watching the Korean Peninsula

The Korean Peninsula provides a clear setting for this kind of analysis because it has been watched for decades through overlapping sources: satellite imagery, signals intelligence, diplomatic reporting, open-source material, and observations from military forces on both sides of the demilitarized zone. Facilities associated with missile development, nuclear activity, and military operations are not static. Buildings change, roads are used or abandoned, vehicles appear and vanish, and industrial sites follow rhythms that can be studied over time.

Commercial satellite companies have made some of this imagery available beyond government agencies, giving researchers and journalists the ability to examine changes at sites such as nuclear facilities and missile-related locations. Analysts compare images from different dates, looking for construction, excavation, vehicle patterns, and other indicators. Automated image-analysis tools can help identify changes across large collections, but the interpretation remains difficult. Snow, shadows, seasonal vegetation, image quality, and the angle of the satellite can all produce apparent changes that have nothing to do with military activity.

The human element is visible in the work of analysts who spend years learning the geography of a particular site. They know where a drainage channel runs, which buildings cast long shadows, when vegetation changes, and how construction typically proceeds. A model can mark a new roof or an altered road surface. An experienced analyst may recognize that the “new” feature is an old structure seen under different conditions - or notice that a minor change is important because it breaks a familiar pattern.

Here, the Signal-to-Shadow Method becomes concrete. The signal is a measurable change in imagery. The pattern is its relationship to earlier construction, vehicle movement, and activity at nearby facilities. The shadow is the uncertainty created by image conditions, incomplete reporting, and the possibility that a visible change is designed to mislead. AI accelerates the search across the archive; human judgment supplies the historical and political meaning.

The result is not certainty delivered by machine. It is a shorter path from millions of observations to a small number of questions worth investigating. That is a profound change in intelligence work, but it leaves the central responsibility intact: someone must decide what the pattern means, what evidence would challenge it, and how much confidence the evidence deserves.

The Human Shape Inside the Machine

Every algorithmic warning begins with a choice about what counts as normal. That choice may be made by engineers, analysts, commanders, data suppliers, or institutions whose assumptions are hidden inside old records. A system trained to detect yesterday’s threat can become remarkably efficient at overlooking tomorrow’s.

Yet the alternative is not a world without machines. The volume and speed of modern intelligence make purely manual analysis impossible in many domains. AI’s role is becoming less about replacing the analyst than about changing the analyst’s field of vision: from searching every record to examining the patterns a system has surfaced, challenged, or failed to explain.

Human beings have always searched for meaning in scattered traces. The difference now is that the traces arrive continuously, and machines can compare them before the story is obvious. Somewhere inside that comparison may be an early warning, a harmless irregularity, or a deception carefully shaped to resemble either one. The future of intelligence will depend not only on whether algorithms find the hidden threat, but on whether people remain curious about the shadows they cast.

End of chapter one. 4 more chapters and about 8,180 words in the full book.