The Domestication of the Kill Chain: ISTAR, Hybrid Warfare, and the Colonisation of the Cognitive Domain
Etienne Darcas | Rise to Peace | January 2026
The diagram appears rather innocuous at first glance. A series of boxes laid out and connected by arrows, the kind of systems architecture one might find in any corporate strategy deck. Yet this particular schematic, that which the Pentagon calls an OV-1 diagram, traces the operational logic of how artificial intelligence transforms raw surveillance data into targeting decisions. Intelligence, Surveillance, Target Acquisition, Reconnaissance. ISTAR. The bureaucratic acronym belies the machinery it describes, for it is a technological apparatus that harvests human data, processes it through algorithmic systems, and outputs coordinates for kinetic action. In plain terms, what is called a ‘kill chain’.
What demands our attention now is not merely the existence of such systems, for their deployment in theatres from Gaza to Ukraine has been extensively documented, but rather their accelerating migration from foreign battlefields and into domestic contexts. The surveillance architectures that enabled what Amnesty International described as “live-streamed genocide” in Gaza are not confined to distant conflict zones. Rather, they are being integrated into American law enforcement infrastructure with remarkable speed and minimal democratic oversight. Understanding this trajectory requires us to examine how contemporary warfare has fundamentally mutated, and with it, the relationship between the state, the individual, and the technological mediation of violence.
The Architecture of Fifth Generation Warfare
Traditional military doctrine conceived of warfare as the clash of organised forces across defined battlefields. Even as theorists acknowledged war’s political character – Clausewitz’s famous dictum that war is politics continued by other means – they understood it as fundamentally about the physical control of territory and the destruction of enemy forces. This conception has become dangerously inadequate in our current moment.
What military strategists now term Fifth Generation Warfare (5GW) represents a categorical shift in how conflict is waged. As Professor Armin Krishnan argues in his examination of the doctrine, 5GW “bypasses the battlefield and targets society as a whole, rather than its military forces.” The objective is no longer territorial conquest but the manipulation of perception, the colonisation of what defence planners call the “cognitive domain.” Violence becomes dispersed, often covert, designed to produce psychological and social effects rather than purely military outcomes.
The ISTAR systems at the heart of this transformation serve a dual function. Kinetically, they enable precision targeting through the drone strikes and guided munitions that have become the signature of contemporary conflict. Their more significant role, however, lies in the construction of what the military terms a “common operating picture”: a unified view across all fighting domains, be it land, air, maritime, space, cyber, and cognitive, that enables coordinated action across multiple vectors simultaneously. Social media monitoring, influence operations, economic pressure, and conventional military force become integrated components of a single strategic apparatus.
The French philosopher Paul Virilio, writing decades before the current technological moment and AI boom, identified the essential logic at work. In his concept of “dromology”, the study of speed as the determining factor in warfare and politics, Virilio recognised that modern conflict would increasingly be fought at the speed of information rather than the speed of armies. “The state of emergency, the age of intensiveness, is linked to the primacy of speed,” he observed. This prescient warning, now, seems to have been realised in how we observe warfare conducted at algorithmic velocity, where targeting decisions that once required human deliberation are compressed into milliseconds of machine processing.
From Gaza to Denver: The Domestic Migration of Military Surveillance
The technologies developed for foreign conflict zones do not remain abroad. This is not conspiracy but institutional logic. Defence contractors, as a rule, seek new markets and ever high returns on their investments; law enforcement agencies seek new capabilities; and the political barriers between military and domestic application have proven remarkably porous, much to the detriment of individual rights to privacy and the well-being of civil society.
We can observe the trajectory of drone surveillance as a case study here. The same platforms that provide persistent aerial observation over conflict zones, be they tracking individuals, mapping social networks or identifying patterns of life, are now being deployed over American cities. Denver, Los Angeles, Chicago. The Flock and Skydio systems being integrated into municipal police departments operate on fundamentally similar principles to military ISR platforms: the collection of vast quantities of surveillance data, its algorithmic processing, and its transformation into actionable intelligence. The difference is one of degree rather than kind. In fact, we can see a remarkably, if not disturbing, similarity in the language of the foreign battlefield transposed onto a domestic application when reading about these programs. Skydio markets its drone surveillance products as “a force multiplier for your agency” and lists it military capabilities and use-cases directly adjacent to its law enforcement section, highlighting the intended symbiosis of the domestic, policing application and the military one.
The implications, though, extend beyond aerial platforms. Palantir Technologies, whose software has been central to military and intelligence operations, also provides the analytical backbone for Immigration and Customs Enforcement. The company’s Gotham platform enables the integration of disparate data streams from financial records, travel histories, social media activity and biometric data into unified surveillance profiles. What began as legitimate and warranted counterterrorism capabilities has been repurposed for immigration enforcement, predictive policing, and domestic security operations.
All this follows a certain logic of simulation, or rather, these simulations and abstractions of threats in real space: systems designed for one context become abstracted, detached from their original purpose, and deployed according to their own internal logic rather than any external referent. The question is no longer whether a particular target poses a genuine threat but whether they match the algorithmic pattern of threat. The model potentially becomes more real than the reality it ostensibly represents. We run the risk of not looking at the risk profile of a situation and making our own human assessments in favour of an automatically calibrated algorithmic assessment, which is culturally reinforced as being infallible. But data comes from humans and the human experience, and so is almost certainly always fallible as humans are as a reflection of our own biases, desires and contradictory inputs.
Hybrid Operations and the Weaponisation of Information
The ISTAR apparatus does not merely enable kinetic strikes. Its more insidious application lies in what military doctrine terms “hybrid operations” in the integration of conventional military action with information warfare, economic coercion, and covert influence campaigns. When the internet becomes a battlefield, the distinction between combatant and civilian, between wartime and peacetime, begins to dissolve.
The cognitive domain of public opinion, social media, influence and reputation becomes a legitimate target for manipulation. As digital warfare scholars P.W. Singer and Emerson Brooking observe, “Power on this battlefield is thus measured not by physical strength or high-tech hardware, but by the command of attention.” A tweet can determine a drone strike target. A coordinated disinformation campaign can destabilise a government. The boundaries between military action and information operation become increasingly indistinct.
This has profound implications for how we understand emerging threats. Traditional counter-terrorism frameworks focus on identifiable organisations, hierarchical structures, ideological coherence. But these are increasingly outdated conceptual frameworks regarding terrorism, applicable increasingly only for the terrorism of previous decades, rather than the liminal and asynchronous nature of terror today. 5GW operates through ambiguity, through activities that are difficult to perceive as war precisely because they do not conform to our inherited categories. The operation remains covert not through secrecy but through categorical confusion, for all such actions could be criminal, could be political, could be military, but nonetheless resist definitive classification.
What this means practically is that the surveillance apparatus constructed for “foreign” adversaries inevitably turns inward. The same systems that monitor Telegram channels for extremist content monitor domestic social media. The same analytical tools that map insurgent networks map protest movements. The institutional logic of maximum surveillance, once established, does not recognise jurisdictional boundaries.
The Narrative Apparatus
Hybrid warfare requires not only the surveillance and targeting capabilities of ISTAR but also control of the narrative environment. The kinetic action is often less significant than its mediation in how it is presented, interpreted, and integrated into public consciousness.
This explains the outsized role of media institutions in contemporary conflict, such as The New York Times preferencing of Palantir executives for scoops rather than whistleblowers, allowing Palantir to effectively sculpt the mediation of truth in tandem with one of the most prestigious papers of record in America. Both claim to be systems of record, to arbitrate fact from fiction. Both exercise enormous power in determining which narratives circulate and which are suppressed. When legacy media platforms editorial decisions about which conflicts to cover, which sources to cite, which framings to adopt, they become willing participants in hybrid warfare operations domestically and abroad.
The concentration of such narrative power in a small number of institutional actors creates dangerous vulnerabilities. When major media outlets fail to challenge the premises of military and intelligence operations, they become functionally complicit in their legitimisation. One striking instantiation of this recently was the news that the New York Times and Washington Post both knew of the upcoming illegal strikes on Venezuela and plan to capture its president, Maduro, in an act that drew widespread condemnation, and yet chose not to report on it. The same institutional gatekeeping that once provided some check on state power can become an instrument of it, laundering official narratives through the credibility of journalistic independence.
This is not to suggest conspiratorial coordination. The dynamic is more structural than intentional. Access journalism creates dependencies. Source relationships generate obligations. The competitive pressure for scoops incentivises deference to official sources or higher-ranking sources. The result is a media ecosystem that, whatever the intentions of individual journalists, tends to reproduce rather than challenge the narratives of institutional power.
Implications for Counter-Terrorism and Policy
For those of us working in counter-terrorism and security research, these developments demand a fundamental reassessment of our analytical frameworks.
First, we must recognise that the technologies of surveillance and targeting cannot be neatly confined to legitimate counter-terrorism applications. The same capabilities that enable the disruption of genuine terrorist networks can be and are being repurposed for political surveillance, immigration enforcement, and the suppression of dissent. Technical capability tends toward maximal application absent robust institutional constraints and the dual-use of technologies or programs that may have had a more strictly counter-terrorism purpose originally for other domestic applications should be cause for concern.
Second, the concept of “terrorism” itself is being instrumentalised within hybrid warfare contexts. When the same analytical tools and targeting logics are applied to protest movements, immigrant communities, and political opposition as to genuine security threats, the category becomes a vector for repression rather than a meaningful analytical distinction. The expansion of FBI domestic terrorism designations to include categories defined more by political orientation than operational capability represents precisely this danger.
Third, the cognitive domain requires sustained analytical attention. The information environment through which publics understand conflict, threat, and security is itself a contested space. Disinformation, influence operations, and narrative manipulation are not peripheral to security concerns – they are central to how contemporary conflict is waged. Counter-terrorism research that ignores this dimension misses a fundamental aspect of the threat landscape.
Finally, we must attend to the question of democratic accountability. The speed at which ISTAR systems operate, the opacity of algorithmic decision-making, and the classified nature of their deployment create profound challenges for democratic oversight. When targeting decisions are made at machine speed, when surveillance operates through proprietary algorithms, when the categories of threat are determined by systems that resist public scrutiny, the possibility of meaningful accountability becomes increasingly remote.
Toward Resistance
The trajectory traced here is not inevitable. We must remember that technologies are social products, shaped by institutional choices, regulatory frameworks, and political struggle. The domestication of military surveillance capabilities is a policy choice, not a natural law.
What resistance looks like in this context remains contested. Some advocate for technical solutions like encryption, digital security practices and platform alternatives that resist centralised surveillance. Others focus on regulatory intervention in the form of legislation that constrains algorithmic decision-making, mandates transparency, establishes meaningful oversight mechanisms. Still others emphasise the need for broader political mobilisation against the national security state and its technological infrastructure.
None of these approaches is sufficient in isolation. The challenge is structural, embedded in the institutional arrangements that govern technology development, deployment, and oversight. Meaningful response requires simultaneous action across multiple domains: technical countermeasures, regulatory reform, political organising, and the patient work of public education about the systems that increasingly govern our lives.
What cannot be sustained is ignorance. The kill chains being constructed in our name, the surveillance apparatus expanding under the banner of security, the erosion of the boundaries between military and civilian, foreign and domestic; all these developments demand our attention and our response. The alternative, otherwise, is a world in which the cognitive domain itself becomes occupied territory.
Etienne Darcas is Program Lead for Rise to Peace. His research focuses on digital radicalization, hybrid threats, and algorithmic amplification of violent content.
