Annotation in Defence Contexts – Confidentiality and Traceability

Some geospatial projects are not judged on quality alone. The annotation arrangement itself becomes the object of scrutiny just as much as the result, and a provider beyond reproach on the substance finds itself set aside for reasons having nothing to do with its work.

This article sets out those constraints. It extends the article on annotation quality.

What this context adds

Five requirements are added to those of an ordinary satellite imagery project.

A strict restriction on who may access the data.

Traceability of every consultation as well as every modification.

An imposed location for the processing as well as the storage.

A limitation of subcontracting as well as of its depth.

And an obligation of destruction at the term of the contract.

One important practical consequence follows. Those five requirements all bear on the organisation rather than on the annotation itself, which shifts the selection of a provider from quality criteria towards compliance criteria.

What the nature of the data imposes

Four characteristics distinguish these images in satellite imagery.

Their circulation is governed by precise rules.

Holding them directly engages the holder’s liability.

Their combination with other sources may itself be restricted.

And their age alone does not necessarily lift the restriction.

One important observation follows for a satellite imagery project. The third characteristic often surprises, two freely held datasets being able to become sensitive once brought together with one another, which requires reasoning about the whole holding rather than about each source taken in isolation.

What traceability covers

Five elements compose a usable access log.

The precise identity of the person who accessed the data.

The date as well as the hour of each consultation.

The exact nature of the action carried out on the data.

The workstation or else the environment the access came from.

And the retention of that log across an agreed duration.

One practical consequence follows. Those five elements must be produced with no particular effort at the moment of an inspection, a log reconstituted afterwards holding strictly no value, which presupposes an arrangement designed from the outset rather than added some time later.

What the personnel implies

Five points concern the people accessing the satellite imagery.

Their individual clearance, where the framework requires one.

Their nationality or else their place of residence, sometimes governed.

Their confidentiality undertaking, both written and individual.

Their training in the precise obligations attaching to the data.

And the nominative list, kept up to date, of authorised persons.

One observation follows. The last point is often neglected and is checked first, a list that has become obsolete signalling immediately that no real arrangement governs access.

What the working environment requires

Five conditions characterise a compliant satellite imagery arrangement.

A network entirely isolated from ordinary Internet access.

Dedicated workstations, without persistent local storage.

Premises whose physical access remains controlled.

A prohibition on removable media as well as on personal devices.

And a strict separation from all the organisation’s other projects.

One important practical consequence follows for a satellite imagery project. Those five conditions cost a great deal to put in place and justify themselves badly on a single project, which explains why few providers commit to them and why those who have done so hold this segment lastingly.

What the annotation tool must permit

Five characteristics distinguish a satellite imagery tool admissible here.

Hosting whose location stays controlled and demonstrable.

Rights management conducted per user rather than per team.

Native logging of accesses as well as of actions.

A total absence of data flowing back to a third-party service.

And a verifiable deletion procedure for closed projects.

One important practical consequence follows for a satellite imagery project. The fourth characteristic rules out most common tools, a platform sending usage statistics to its publisher constituting an outflow of data the framework does not permit, which considerably narrows the choice and pushes towards solutions installed directly at the provider’s premises.

What subcontracting changes

Four rules govern recourse to a third party in satellite imagery.

Its identity must be known and then accepted by the client.

The main contract’s obligations then carry over in full.

The depth of subcontracting is often limited.

And the main provider remains liable for the whole.

One important observation follows. The last rule discourages subcontracting on this kind of project, a breach committed by a third party directly engaging whoever signed, which makes bringing the work in house markedly preferable even where it costs more.

What the data lifecycle imposes

Five stages are explicitly contracted for in satellite imagery.

The initial handover as well as its mode of transfer.

The exact duration for which holding is authorised.

The copies permitted as well as their maximum number.

The return or else the destruction at the term of the contract.

And the proof actually supplied of that destruction.

One important practical consequence follows. The last stage is prepared from the beginning rather than at the end, a destruction of which nothing can be proved amounting purely to retention in the client’s eyes, which makes the proof arrangement as important as the operation itself.

What responding to a tender requires

Five documents accompany a candidacy on such a satellite imagery contract.

The description of the technical arrangement as well as of its isolation.

The nominative list of the people called upon to work on it.

The precise location of the processing as well as the storage.

The precise undertakings given regarding subcontracting.

And the traceability as well as destruction procedures.

One important observation follows for a satellite imagery project. Those five documents are very hard to obtain within a tender’s deadline alone, which markedly favours providers who assembled them in calm conditions and explains why a compliance file kept up to date is worth more than a well written commercial response.

What quality becomes in this framework

Four shifts affect quality control in constrained satellite imagery.

The reviewer necessarily belongs to the same restricted circle as the annotator.

Double annotation then mobilises two cleared people rather than one.

Exporting samples to a third party becomes quite simply impossible.

And the quality report itself circulates under heavy constraint.

One important practical consequence follows. The second shift bears directly on price, a double annotation arrangement then becoming markedly more expensive once the pool of eligible operators is counted in tens rather than in hundreds.

What throughput becomes in this framework

Four factors slow production in a constrained context.

Access to the dedicated workstation is planned ahead rather than improvised.

The restricted pool of eligible operators limits parallelisation.

Exchanges bearing on a difficult case happen with no screen capture at all.

And any change to the arrangement first goes through a prior validation.

One important observation follows for a satellite imagery project. The third factor weighs more than one imagines, an annotation question being settled elsewhere within seconds thanks to a simple shared image, which lengthens every adjudication here and justifies a written reference more detailed than usual.

What an incident requires providing for

Five points are settled before an incident occurs.

The exact delay within which the client must be informed.

The person named to carry that information.

The elements to preserve in order to establish what happened.

The precautionary measures that must be taken immediately.

And the way in which resuming the work will be decided.

One important practical consequence follows for a satellite imagery project. The first point is almost always neglected and proves decisive, an incident reported late always being judged far more severely than one declared at once, which makes the notification delay more determining than the initial gravity of the fact itself.

What the duration of the contract changes here

Four effects accompany an engagement running several years.

The list of authorised persons evolves and calls for updating.

The technical arrangement ages and calls for an upgrade.

The regulatory framework itself may change along the way.

And the proof of compliance is redone periodically rather than once.

One important observation follows for a satellite imagery project. The first effect calls for lasting discipline, a departure or else an arrival not carried through onto the list producing a non-compliance nobody notices before an inspection, which makes updating access a recurring task rather than an opening formality.

What the end of the contract requires

Five operations compose a properly conducted closure.

The return of the data by the mode precisely agreed at the outset.

The deletion of every existing copy, including working ones.

The revocation of access for each of the people concerned.

The handover of the full log covering the contract’s duration.

And the drawing up of the document formally attesting destruction.

One important practical consequence follows for a satellite imagery project. The second operation proves harder than announced, working copies surviving in locations nobody took the trouble to inventory, which makes an inventory of storage locations necessary at the project’s opening rather than at its closure.

What the first batch must establish

Four results justify a trial batch before full commitment.

The real throughput obtained on a dedicated workstation deprived of removable media.

The delay in producing a complete access log, on simple request.

The number of eligible operators genuinely mobilisable in parallel on the project.

And the time to settle a difficult case in the absence of any shared image.

One important observation follows for a satellite imagery project. The last result often surprises teams coming from ordinary projects, an adjudication settled elsewhere within minutes taking up to half a day here, a gap a trial batch reveals before costing rather than after signature.

Three errors proper to this context

Three satellite imagery defects do not belong to the work itself.

A compliance file assembled in the sole urgency of a tender.

An access log produced on request rather than fed continuously.

And a destruction carried out correctly but remaining undemonstrable.

Those three defects set aside a provider whose work is beyond reproach, they are corrected beforehand and never afterwards, and their common point is to bear on the proof rather than on the fact.

What this chapter shares with the rest of the course

Four findings recur from the first chapter onwards.

What is prepared in calm conditions largely determines what is produced afterwards.

An absent proof amounts purely to an obligation unfulfilled.

An arrangement is demonstrated by a concrete trial rather than by a discourse.

And an entry barrier lastingly protects whoever has crossed it.

One important observation follows for a satellite imagery project. Those four findings were already met on LiDAR and on crisis management, which suggests that the most demanding segments of geospatial work resemble each other more than they resemble the ordinary projects of the same field.

What this segment has that is particular commercially

Four traits separate this market from the course’s others.

Selection bears first on compliance and only then on quality.

The number of eligible providers stays small and well known.

Contracts run over time rather than as one-off assignments.

And price weighs markedly less than on any other segment.

One important practical consequence follows. The last trait deserves understanding correctly, a constrained client not choosing the cheapest provider among all candidates but among the eligible ones alone, which shifts the commercial effort from negotiating on rate towards entering that restricted list.

What the client must specify here

Five pieces of information come from the client and condition the whole satellite imagery project.

The applicable regulatory framework as well as its level of demand.

The precise restrictions bearing on authorised persons.

The imposed location of the processing as well as the storage.

The authorised holding duration as well as its conditions.

And the modes of proof expected at the term of the contract.

One important observation follows for a satellite imagery project. The first piece is often missing at the first exchange, the client merely referring to a general framework without specifying what it implies concretely, which obliges the provider to ask precise questions before committing rather than to assume a maximum requirement out of caution.

What this chapter does not address

Three subjects stay outside this chapter’s scope.

The content of the images as well as what is being looked for in them.

The annotation references proper to these uses.

And detailed regulatory frameworks, which vary greatly between countries.

One important observation follows for a satellite imagery project. Those three subjects are handled with the client and their supervising authority rather than in public documentation, which explains why a serious provider readily describes their own arrangement and never the projects they have conducted.

What the provider brings here

Four contributions distinguish a satellite imagery engagement in a constrained context.

A technical arrangement isolated then documented before the very first contract.

A restricted team, trained then followed nominatively.

Traceability produced by the tool itself rather than by a manual procedure.

And a destruction chain whose proof is provided for from the outset.

One important practical consequence follows. The first contribution is not demonstrated by a discourse, a serious client asking to see the arrangement itself rather than to read a description of it, which makes a visit or an audit far more convincing than any commercial documentation.

Approaching a project in a constrained context

Five questions scope such a satellite imagery project.

Which regulatory framework applies. It varies between countries.

Who may access the data. The list must be nominative.

Where does processing take place. Location is often imposed.

Is subcontracting permitted. It is often restricted.

And how is destruction proved. Without proof it does not count.

Those five answers determine the provider’s eligibility. Asking them before any technical discussion avoids committing to a project compliance will set aside.

The question that frames the commitment

One question determines whether this segment is worth entering in satellite imagery.

Will this market be an exception or a lasting activity.

An exception justifies neither the network isolation, nor the dedicated workstations, nor the compliance file, the fixed cost far exceeding a single contract’s margin.

A lasting activity amortises those investments across several years and builds a position unequipped competitors cannot contest on price.

That question belongs to the provider’s strategy and not to the client, it is asked before the first response, and it separates a wasted outlay from a durable entry barrier.

Three decisions before committing

Three decisions precede any candidacy on a constrained satellite imagery project.

Verifying the arrangement’s eligibility before committing any commercial work at all.

Assembling the compliance file in calm conditions rather than at the moment of a tender.

And deciding whether full internalisation is possible, subcontracting being often restricted.

Those three decisions cost several weeks, they precede any technical discussion, and their absence leads to investing in a response compliance will set aside.

Three checks on a compliant arrangement

Three checks qualify a satellite imagery provider in a constrained context.

The nominative list of authorised persons, kept up to date and dated.

The access log, produced immediately rather than reconstituted.

And the destruction procedure, described before the contract begins.

Those three checks are each asked in one question, they require no legal competence, and their absence indicates an arrangement announced rather than existing.

What this chapter teaches

One cross-cutting observation deserves closing this examination.

Here the arrangement counts as much as the result.

Three findings compose it.

Two freely held datasets can become sensitive once brought together.

An access log reconstituted afterwards holds no value.

And a destruction of which nothing can be proved amounts to retention.

That finding departs from the preceding chapters, the quality of the work becoming here a necessary but in no way sufficient condition.

What this chapter leaves to the next

All these requirements translate sooner or later into a line on a quotation.

Three questions stay open in satellite imagery.

What genuinely composes the price of a geospatial annotation.

Why a per-tile rate misleads on most projects.

And how to compare two proposals built on different units.

Those three questions belong to a project’s economics, which constitutes the subject of the following chapter.

Why the compliance file is worth building before it is needed

One point about timing belongs at the close of this chapter.

The file cannot be assembled once a tender has been published.

Three reasons follow in satellite imagery.

Isolating a network takes months, not the weeks a tender allows.

Clearances belong to people, and people are recruited slowly.

And a log has no history until it has been running for a while.

One important practical consequence follows for a satellite imagery provider. Building it before any contract exists is an act of faith that pays asymmetrically, since the cost is bounded and known while the return is entry to a list of eligible providers that stays short for years, and nobody outside that list gets the chance to compete on anything else.

Common mistakes

These failures recur often enough that naming them is usually enough to avoid them.

  • Treating compliance as a subject coming after the technical choice.
  • Reconstituting an access log after an inspection.
  • Subcontracting without the client’s explicit agreement.
  • Keeping a nominative list that is no longer up to date.
  • Neglecting the proof of destruction at the term of the contract.
  • Reasoning source by source rather than about the whole holding.
  • Assuming that older data is no longer governed.
  • Mixing these projects with the others within the organisation.
  • Promising a processing location without being able to demonstrate it.
  • Responding to a tender without first checking eligibility.

What to take away

In a constrained context, the annotation arrangement counts as much as its result.

Three readings emerge. Two freely held datasets can become sensitive once brought together with one another, which requires reasoning about the whole holding rather than about each source taken in isolation. An access log reconstituted afterwards holds no value at all, which presupposes a traceability arrangement designed from the outset rather than added at the moment of an inspection. And a destruction of which nothing can be proved amounts to retention in the client’s eyes, which makes the proof arrangement as important as the operation itself.

For a project’s economics, the article on the cost of satellite annotation details the lines. For recent tools, the article on geospatial foundation models sets it out.

To explore delivery arrangements, supported formats and applicable control mechanisms, see our dedicated page on annotation for geospatial. And if you are preparing a project in a constrained context, let us discuss your need.

Tags

Découvrez nos articles