Pattern-of-Life Analysis.

What it is

A single image tells you what was happening at one moment. Pattern-of-life analysis tells you what normally happens, which is the only way to recognize what does not.

Built over days and weeks of persistent observation, it establishes the baseline: which routes are used and when, which locations connect to which, what a normal day looks like at a given crossing point. Against that baseline, anomaly becomes visible.

Revisit rate beats resolution

The most common procurement error in this area is buying a better sensor when the limiting factor is how often you look.

Consider a crossing used twice a week at irregular hours. A superb sensor overhead once a week has roughly a one-in-three chance of being there for any given event, and — more importantly — produces observations too sparse to establish whether the events are related. An adequate sensor overhead three times a day sees most of them, and after a fortnight the analyst can say which vehicles recur, which hours matter and which route is preferred.

The first option produces excellent images of very little. The second produces a pattern. The same budget usually buys either one, and buying the wrong one is difficult to correct later because the money is in the airframe and the sensor rather than in the flying.

This is why endurance, cost per hour and basing proximity matter more to this mission than sensor specification. It is also why unattended ground sensors earn their place: they watch continuously at almost no recurring cost, and they cue the aircraft so it is confirming rather than searching.

What it requires

Continuity of analysis. The value accumulates in the analyst’s understanding as much as in the archive. Rotating analysts through without a structured handover discards most of it, and it is the single most common way a program loses ground it had already made.

A searchable archive. Patterns are recognized retrospectively. Collection that is not retained, indexed and searchable cannot support the analysis it was gathered for — which is why metadata discipline is not a technical detail but the thing that makes the archive usable at all.

Enough analysts. A pattern is built by someone looking at the take repeatedly over weeks. Coverage without the exploitation cell to work it produces an archive that nobody queries.

What breaks it

Gaps, and they matter more than their duration suggests.

Weather, aircraft unserviceability and airspace restriction all interrupt persistence. A three-day hole in a four-week baseline is not eight percent of the picture missing — it is an invitation for the analyst to assume continuity across it. The discipline is to mark the gap explicitly in the assessment rather than smooth over it, and good analytical products say plainly where they stopped looking.

Adversary adaptation breaks it differently. Once a pattern is established and acted upon, the behavior that produced it usually changes. A baseline is perishable, and treating a six-month-old pattern as current is a recurring cause of failed operations.

What it cannot tell you

It describes behavior, not intent. It shows that a vehicle travels a route at a given hour; it does not show why, and it does not by itself justify action. Analysts who forget that distinction produce confident assessments that do not survive contact with ground truth.

The failure has a shape worth recognizing. An observed regularity acquires a label — “the resupply run” — and the label is then treated as established fact by everyone downstream who did not see the original caveats. Good practice is to state the observation and the inference separately, and to keep the confidence level attached as the assessment travels.

The authority question

Persistent observation of a defined population is a legal act in most countries, not merely a technical one.

What may be collected, how long it may be retained, who may see it, and whether a domestic legal instrument is required before a security service may task it are questions with real answers in national law — and they differ sharply between a border zone, territorial waters and a city. A program that establishes this before it flies proceeds smoothly. A program that establishes it afterwards is frequently suspended while it does.

This is squarely the customer’s decision and the customer’s law. What a supplier owes is to raise it early, to build the retention and access controls the answer implies, and to say so when a proposed tasking looks likely to exceed the authority the customer actually holds.

Why it changes a program

Once the picture is continuous rather than periodic, the adversary loses the ability to predict when they are being watched. That single change converts surveillance from a reporting function into an operational one — and it is achieved by flying often, not by flying well.