Beyond Turing
A contemporary military information system - a targeting platform integrated with signals intelligence streams, an analytical chain that fuses messaging-app interceptions with cellular telemetry and satellite imagery, a Big Data infrastructure ingesting tens of terabytes per day from heterogeneous sources - produces, at steady state, outputs with a syntactically familiar form: ranked lists of entities, each annotated with a confidence score. Each row is, formally, a record. But each record, the moment it designates a person or a building as a legitimate target, constitutes - under International Humanitarian Law as codified in the First Additional Protocol to the Geneva Conventions of 1977 - a legal act with irreversible consequences.
The categorical shift is stark. The record is an engineering artefact - schema, constraints, lineage, quality metrics. The target is a legal and ontological category - human life, principle of distinction, principle of proportionality. The engineering of data-driven targeting systems lives entirely within this tension: every pipeline that transforms a stream of messages into a list of targets is a sequence of design choices with measurable technical, legal and ethical consequences - and, ultimately, irreversible ones.
This article traces the architecture of such tension from the standpoint of the engineer who designs, validates or audits high-intensity data systems for security and defence applications. It is not an ethical commentary on contemporary conflicts - it is an engineering reading of publicly documented pipelines (Abraham, 2024; McKernan & Davies, 2023), of their failure modes, and of the non-functional requirements that International Humanitarian Law and the AI Act impose on those who build them.
§1. The message as engineering artefact
In the literature of OSINT-SIGINT fusion architectures (Open Source / Signal Intelligence), the digital message is characterised by a plurality of heterogeneous dimensions. The textual payload is only one of them - and often not the most informative. Associated metadata - timestamp, sender identifier, recipient identifier, device fingerprint, cellular geolocation, network latency, message size, presence of attachments - constitute what the technical literature calls social graph signal: the signal emerging from the topology of communications independently of their semantic content. It is a consolidated finding of network science that the contact graph, even in the absence of content, allows roles, hierarchies and operational proximities to be inferred with remarkable accuracy (Eagle et al., 2009).
A typical ingestion pipeline articulates this flow through canonical stages: streaming acquisition (Kafka, Pulsar) from SIGINT sources, schema normalisation, enrichment with lateral sources (registries, lawful intercept feeds), persistence into columnar data lakes (Parquet on S3 or equivalent), indexing for low-latency queries (Elasticsearch, OpenSearch), and - finally - exposure via feature stores for downstream model training and inference. Each stage carries verifiable engineering metrics: end-to-end latency, sustained throughput, drop rate, referential completeness, schema drift against baseline. Up to this point - and only up to this point - the message is a neutral artefact.
The nature of the flow changes radically the moment an identifier is bound - directly or indirectly - to a natural person. That binding, which in engineering language is a simple join between two tables, is - in the language of International Humanitarian Law - the first step towards qualifying a legitimate military target under art. 52(2) of the First Additional Protocol. The distinction between combatants and non-combatants, enshrined in art. 48 - the cornerstone of modern law of armed conflict - becomes, at this stage, a feature engineering choice: which attributes of the subject justify the classification, with which threshold, on which evidence, with which documented error margin.
§2. The data-driven target acquisition pipeline
Investigative reporting by +972 Magazine and Local Call (Abraham, 2024) and by the Guardian (McKernan & Davies, 2023) has documented operational target acquisition architectures - referred to in disclosed internal materials as Lavender, Where is Daddy? and The Gospel. While debate over their deployment and the human controls applied to them remains open, the technical features that have surfaced allow for a reference architectural reading. A typical pipeline is articulated in six sequential stages.
The acquisition stage integrates heterogeneous sources: messaging interceptions (Signal, Telegram, WhatsApp metadata where accessible), cellular network telemetry (CDR - Call Detail Records), terminal tracking, high-resolution satellite imagery, overhead video from aerial platforms, acoustic sensing. Aggregate volume is measured in petabytes; velocity in millions of events per minute. The normalisation stage reconciles cross-source identifiers: the same subject may appear with an MSISDN number, an IMEI, an account identifier on a messaging platform, a face captured by a camera. The entity resolution operation - technically a probabilistic record linkage problem (Fellegi & Sunter, 1969) - is the foundation everything else rests upon.
The feature engineering stage builds representation vectors for each entity: social graph features (centrality, community membership, tie strength), temporal activity patterns (hours, frequencies, periodicities), movement patterns (mobility fingerprint), semantic features extracted from text via NLP models. The scoring stage applies a classifier - typically a gradient boosting ensemble (XGBoost, LightGBM) or a deep neural network - trained on a historical dataset of positive entities (known ex post as militants) and negative entities (known as civilians). The output is a continuous score which, once it crosses a decision threshold, produces the operational label.
The ranking stage orders candidate entities by operational priority, combining the score with exogenous factors (urgency, windows of opportunity, resource constraints). The delivery stage exposes the list through an operational interface - typically a dashboard with map view, evidence chain detail, and action button. Each stage is, in abstract terms, an auditable software component. Each has - or should have - its own model card (Mitchell et al., 2019), its own technical documentation, its own regression test suite. The sum of these components is a decisional chain that ends, in many cases, with a lethal outcome.
§3. The false positive as legal category
Any binary classifier operates with a non-zero error rate. The confusion matrix - true positive, false positive, true negative, false negative - is the first didactic instrument in any introductory machine learning course. For most civilian applications, calibrating the trade-off between precision and recall is an optimisation exercise conditioned on expected costs: the cost of a false positive (a customer needlessly blocked by an antifraud system, a legitimate email landing in spam) is weighed against the cost of a false negative (a fraudulent transaction consumed, a threat undetected).
In target acquisition the asymmetry takes on a different ontological quality. A false positive is not a monetary unit in the cost function: it is - by the very qualification the system itself operates on the entity - the potential killing of a non-combatant. International Humanitarian Law codifies this asymmetry in the principle of distinction (art. 48 AP I), the principle of proportionality (art. 51(5)(b) AP I) and the principle of precautions in attack (art. 57 AP I). Translated into engineering language, these principles impose formal constraints on the pipeline: the false positive rate is a regulatory metric, not merely a performance one; classifier confidence must be calibrated in a quantified sense (Guo et al., 2017), not merely high; the final engagement decision must be documented, motivated, traceable to separable evidence.
The European Union's AI Act (Regulation EU 2024/1689), while declaring - at art. 2(3) - its non-applicability to systems developed or used exclusively for military, defence or national security purposes, nonetheless contains at art. 5 a list of prohibited AI practices that provides a conceptual reference. The prohibition of social scoring of natural persons (art. 5(1)(c)), of biometric categorisation based on sensitive data (art. 5(1)(g)) and of emotion recognition in given contexts (art. 5(1)(f)) draws a line that the European legislator considers untransitable for civilian applications. The ensuing engineering question is precise: to what extent do data-driven target acquisition systems replicate architectures that European civil law has qualified as unacceptable, with the difference that their deployment falls under a legal regime - the law of armed conflict - more tolerant of error? The answer is not univocal, but the question is today a design question.
§4. Human oversight and computational acceleration
Human oversight is the architectural safeguard most often invoked to justify algorithmic targeting systems. In the typical formalisation in the literature (Cummings, 2004), three topologies are distinguished. Human-in-the-loop requires that each operational decision pass through an explicit human validation before execution. Human-on-the-loop provides for an operator who monitors the system and may intervene, but does not individually validate each output. Human-in-command provides for human authority to be structural - rules of engagement, operational perimeters, deactivation powers - even in the absence of pointwise intervention.
The choice among the three topologies is not a political variable: it is system sizing. It determines admissible latency, sustainable throughput, operator cognitive load, interface specifications, training regime. A human-in-the-loop system that generates hundreds of candidates per day and requires a single operator to confirm them individually within a few seconds each is - operationally - a human-on-the-loop system that has self-declared as in-the-loop. The difference is not semantic: the same pipeline, under sustained operational load, can collapse from one control model to another without anyone modifying a line of code. It is enough for the average review time to fall below the threshold for substantive evaluation. The phenomenon is documented in the literature as automation bias (Parasuraman & Manzey, 2010): the operator's tendency to trust the system's output uncritically, especially under high cognitive load, fatigue and time pressure.
The engineering maturity of a targeting system therefore passes through the formal and measurable definition of the human oversight actually exercised. It is not enough to declare in system documentation that an operator is in the chain: one must define - and trace - the average review time per decision, the observed override rate, the distribution of override reasons, the correlation between override and subsequent documented outcomes. These data are - or should be - part of the logging required by art. 12 of the AI Act for high-risk systems in civilian contexts. The extension of such practice to the military domain is today an open question of International Law, debated within the United Nations Group of Governmental Experts on Lethal Autonomous Weapons Systems (GGE LAWS).
§5. The incalculable remainder
No pipeline, no model card, no human control topology exhausts the subject. This is not a project limitation - it is the project itself. Every classifier operates with a coverage gap: a region of the operational domain where its performance has not been characterised with sufficient statistical confidence. Every subject, on entering the system's decisional scope, is - at least in part - out-of-distribution with respect to the training dataset. The singularity of the individual case structurally exceeds the model's generalisation. In civilian systems this excess manifests as an error correctable ex post. In targeting systems it manifests as irreversibility.
Mature engineering does not close this gap: it declares it. It measures it - where possible - with uncertainty quantification techniques (Bayesian calibration, ensemble disagreement, conformal prediction). It inscribes it in fallback protocols as a zone of mandatory human deliberation. It flags it to the operator as such, not camouflaged as an apparently robust confidence score. These are concrete architectural decisions, not declarations of principle. The refusal to declare the gap is - in a strict engineering sense - a design error. When the design error operates on lethal decisions, it becomes a different category: a failure that International Humanitarian Law qualifies, in art. 57 AP I, as a violation of the duty of precaution.
The methodological point may be formulated thus: the dignity of the subject designated as a target is a design invariant. It is not a datum to be measured in order to define the engagement threshold; it is not a variable the pipeline elaborates; it is not a requirement satisfied by a compliance checkbox. It is a condition upon which the system must be built from the first commit - with the same rigour with which one designs high availability, transactional consistency and cryptographic security. It is the point where the principle of distinction of International Humanitarian Law, art. 14 of the AI Act on human oversight and ISO/IEC 42001 on AI management systems converge into a single architectural prescription: a system that decides upon a life must know when it does not know, and stop.
A target acquisition system designed with this awareness does not renounce analytical power - it renders it placeable. It knows where it operates well, where it operates poorly, where it must hand control to a human being who has the time, the training and the authority to exercise it. It knows that a subject is not the sum of its metadata, just as a pipeline is not the sum of its stages. This engineering awareness of its own edges is not a limitation of technique: it is the point where technique reaches its own maturity - and recognises that what the model does not know is, at times, precisely what law and humanity ask it to know.
The message can be classified. The target can be spared. They are not, and will never be, the same thing. A targeting system that acknowledges this distinction is not less powerful - it is better designed. And an engineering that does not forget this distinction is not less technical - it is more complete, for it has understood that the most important line of code, at times, is the one that suspends execution.