Social Media Intelligence (SOCMINT): Intelligence Discipline Guide

Social platforms record behaviour, not truth: what was posted, when, by an account, to an audience. Social media intelligence keeps those four things separate and never quietly assumes a fifth.

What Social Media Intelligence is as a discipline

Social media intelligence is the collection and analysis of publicly accessible platform content and its metadata: posts, media, timestamps, engagement, account attributes, community structure and the interactions between them. It covers content analysis, account behaviour assessment, network and community detection, coordinated behaviour detection, and geolocation of user-generated media. Done properly it treats platform data as a biased sample that must be characterised as such, and it is governed by platform terms and data-protection law before the first query is run.

Sub-methods include narrative and keyword monitoring, account-level behavioural profiling for authenticity assessment, network mapping of amplification structures, cross-platform tracing of the same content, and immediate archiving of ephemeral material before deletion. In the cycle it is collection and processing; the analytic value usually appears only after fusion with other disciplines, because platform data alone rarely establishes identity, location or intent to any defensible standard.

Why it matters

Social media intelligence answers what a community is actually saying and to whom, how a narrative spread and through which nodes, and what user-generated media shows from places no other collection reaches. It is frequently the earliest visible indicator of mobilisation, of threats against people or sites, and of reputational events, and it captures vernacular framing that formal media reporting smooths away.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Posting time distributions and cadence indicating automation, shift patterns, or a time zone different from the claimed one.
• Account creation dates clustering tightly around an event, product launch or campaign start.
• Reposting and amplification chains showing which accounts seed content and which merely distribute it.
• Near-identical text or media reused across accounts, indicating coordination rather than organic spread.
• User-generated imagery and video containing geolocatable features from the scene of an event.
• Bios, links and cross-platform handles that a subject has themselves chosen to publish.
• Engagement patterns inconsistent with stated follower counts, suggesting purchased amplification or an inauthentic audience.
• Deletion and editing behaviour, visible only because the material was archived with metadata at the time.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Meta Content Library and API — Approved research access to public Facebook and Instagram content with structured metadata
• TikTok Research API — Vetted access to public video, comment and account data for approved research purposes
• YouTube Data API — Public video, channel and comment metadata with documented quotas and terms
• EU DSA Transparency Database — Platform content moderation decisions at scale, with reasons, categories and dates
• Platform transparency and threat reports — Published takedown findings on coordinated inauthentic behaviour, with indicators and attribution reasoning
• Bluesky and Mastodon public APIs — Open protocol access to public posts and social graph on decentralised networks
• Internet Archive Wayback Machine — Independent captures of profiles and posts that were later edited or deleted
• Public Telegram channels — Openly broadcast channel content, valuable for early event reporting and narrative tracking

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define the requirement and scope — Specify the narrative, entity or event, the platforms in scope, the languages and the time window before collecting anything.
2. Check terms and lawful basis — Confirm the collection method is permitted by platform terms and supported by a documented lawful basis and proportionality assessment.
3. Collect and archive immediately — Capture content with full metadata, hashes and original files, because posts are edited and deleted faster than analysis proceeds.
4. Characterise the sample — State what the dataset covers and misses, including platform, language, sampling method and quota limits, before drawing inferences.
5. Analyse behaviour and network — Assess account behaviour and map the interaction network, distinguishing coordination from popularity and from ordinary community structure.
6. Corroborate off-platform — Verify claims and identities against records outside the platform, since profile data is self-asserted and easily fabricated.
7. Report with explicit limits — Publish findings that state what the data supports, and mark identity, location and intent claims as inference where they are.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Dark Web Intel
• Organized Crime
• Human Trafficking
• Wildlife Trafficking
• Child Protection
• Gangs & Street Crime
• Forced Labour & Modern Slavery
• Counter-Terrorism
• Extremism & Radicalization
• Conflict & Humanitarian

Operates on these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
• Username / Handle — Screen name or handle used across online platforms and services.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.
• Court Case / Docket — A filed legal proceeding — the authoritative record of disputes, judgments, and enforcement.
• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.

Related disciplines

• Human Intelligence — Information from People, Ethically Obtained

Inside the platform: where Social Media Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=SOCMINT — Discipline hub
• source-catalog.php?disc=SOCMINT — Source catalogue filtered to this discipline
• search.php — Person / Name profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the requirement and scope is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Collect and archive immediately turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report with explicit limits feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Social Media Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence use focuses on the information environment around an operation: public sentiment in an area of operations, indications of planned unrest affecting movement, adversary messaging themes, and open indications of activity relevant to force protection. It supports the civil environment assessment and information operations awareness, and it can cue other collection when a post contains something checkable such as a location or a piece of equipment. Constraints are significant: host-nation law and platform terms apply, monitoring of domestic populations is usually prohibited or tightly restricted, and any activity that shades into influence rather than collection engages entirely different legal and policy authorities.

🕵 National intelligence

Agencies use platform data as one collection stream among many, valued for early indications and for insight into public discourse in denied environments. The analytic discipline is treating platform data as a badly biased sample: demographics, platform choice, language and moderation all shape what is visible, and inference from it to a population is usually invalid. Requirements should specify the question rather than the platform. Handling includes recognising that bulk platform data about identifiable people is personal data with retention obligations, and that collection under false identity may breach terms, local law and policy.

👮 Law enforcement

Investigators use publicly accessible platform content for lead generation, corroboration and, where properly collected, evidence. The evidential bar requires collection with a documented method, preservation of the original file with hash and timestamp, and recording of the account state at collection since posts are edited and deleted. Content held by the platform, including private messages, deleted material and subscriber data, requires a production order or MLAT and is not obtainable by viewing. Sustained monitoring of an individual may constitute directed surveillance requiring authorisation, and the use of false personas is governed by covert human intelligence source regimes in several jurisdictions.

🔍 Private investigation and corporate security

Corporate use covers brand and executive threat monitoring, insider risk indicators, due diligence and litigation support. The differentiator is method and restraint. A private actor must respect platform terms, which commonly prohibit automated collection and republication; must not create fake accounts where prohibited or where doing so involves deception of individuals; must not access private or friends-only content by any means; and must have a lawful basis and proportionality justification before profiling a private individual. Employee monitoring engages employment law, works council consultation and specific notification duties in many jurisdictions.

📰 Journalism and OSINT media

Newsrooms use platform content for discovery, verification and reporting on discourse itself. The standard is that platform content is a claim until verified: establish who posted it, whether they are who they claim, when it was originally posted, and whether the media is original or recirculated. Archive before contacting anyone, because accounts are deleted once approached. Ethics require care with people who did not seek public attention, particularly minors and bystanders, consideration of whether quoting a small account exposes an ordinary person to mass abuse, and right of reply before publishing accusations.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian teams use platform data to document incidents, monitor hate speech and incitement, and detect protection risks in fast-moving situations. Preservation is the priority, since material documenting atrocities is routinely removed by moderation before anyone archives it. Do-no-harm requires care not to expose people who posted under duress or without understanding the visibility, and not to publish content that identifies survivors. Duty of care to staff exposed to graphic and abusive material requires exposure limits, rotation and support. Consent norms apply when using content created by identifiable individuals.

🎓 University and research

Researchers study discourse, networks, coordination and platform effects. Reproducibility is genuinely difficult because platform data access has narrowed and datasets cannot usually be redistributed, so publish collection code, query specifications, sampling frames and post identifiers rather than content. Ethics approval is required even for public data where it concerns identifiable individuals, and public availability does not imply consent to research use. Legal routes such as the EU Digital Services Act researcher access provisions are the appropriate mechanism for platform data rather than terms-breaching scraping.

Playbook: working Social Media Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the question and the lawful basis

State what you need to establish and whether platform data can establish it, since identity, location and intent are rarely determinable from posts alone to any defensible standard. In parallel, establish the lawful basis, the applicable platform terms, and whether the activity could amount to regulated surveillance of an individual. A good output is a scoped question with a documented legal and terms assessment signed off before collection. Stop if the question requires access to non-public content, which requires legal process instead.

Phase 2 — Characterise the sample

Establish who is actually visible on the platforms in scope: which demographics use them in this geography, in which languages, what proportion of accounts are public, and how moderation and geoblocking shape what you can see. Write the bias down before collecting, because it constrains every conclusion that follows. A good output is a short sampling note stating what the data can and cannot represent. Stop when the note is honest enough to prevent population-level inference from platform data.

Phase 3 — Set up collection safely

Configure the collection environment: attribution posture appropriate to the subject and consistent across the team, storage with hashing, and a capture method that records the account state, post identifiers, timestamps with timezone and the retrieval time. Decide the identity you present and do not create fake personas where the platform or jurisdiction prohibits it or where it would deceive individuals. A good output is a documented, reproducible collection setup. Stop when a colleague could replicate it from your note.

Phase 4 — Preserve before analysing

Archive immediately and to more than one location. Platform content is edited, deleted, moderated and geoblocked constantly, and material documenting serious incidents is removed fastest of all. Capture the media file itself rather than a screenshot of it, retain post and account identifiers, and record the hash. Push public pages to an independent archive as well. A good output is a preserved record that survives deletion of the original. Stop when nothing your analysis depends on exists only on the platform.

Phase 5 — Verify content provenance

Establish whether the media is original to this post or recirculated: reverse-search images and video keyframes for earlier appearances, examine any surviving metadata, and check whether the account has posted material inconsistent with its claimed location or history. Trace to the earliest identifiable posting. A good output is a provenance note stating the earliest appearance found and the confidence. Stop before treating a widely shared item as an eyewitness account without establishing its origin.

Phase 6 — Assess account authenticity behaviourally

Evaluate accounts on behaviour rather than on profile appearance: creation date, posting rhythm and volume, language and register consistency, activity concentration, and the relationship between follower composition and content. Recognise that many indicators used to call accounts inauthentic also describe enthusiastic real people, marketing accounts and users in restrictive environments who obscure their identity. A good output is a behavioural assessment with the evidence stated. Stop before labelling an account as fake on profile characteristics alone.

Phase 7 — Map networks and interaction

Build the network from actual interactions such as replies, quotes and shares rather than from follower lists, which are noisy and often purchased. Look for structure: which accounts consistently seed content, which amplify, and whether communities are genuinely separate or an artefact of the sampling window. Record the time window, because networks look entirely different across different periods. A good output is a network with defined edge semantics and a stated window. Stop before inferring organisation from co-occurrence alone.

Phase 8 — Detect coordination carefully

Look for evidence that requires explanation: near-simultaneous posting of identical or near-identical text across unrelated accounts, shared unusual assets such as the same cropped image or link shortener, synchronised creation dates, and coordinated topic switching. Then test the mundane explanation, since campaigns, fandoms and news events produce synchrony naturally. Remember that coordination is not by itself inauthentic or unlawful. A good output is a coordination finding with the alternative explanations addressed. Stop before conflating coordination with foreign or covert operation.

Phase 9 — Fuse before concluding

Platform data rarely establishes identity, location or intent alone. Take what the posts give you as pivots and corroborate with other disciplines: geolocation of imagery against reference sources, registry records for claimed affiliations, infrastructure analysis for linked domains, and reporting from other sources. State clearly which conclusions depend on platform data alone. A good output is a finding whose load-bearing claims rest on corroborated evidence. Stop before attributing an operation to a named person on platform evidence alone.

Phase 10 — Apply proportionality and minimisation

Review what has been collected about people who are not the subject of the requirement, and delete it. Bulk collection accumulates data about uninvolved individuals extremely quickly, and retaining it is both unlawful in many regimes and indefensible if examined. Apply retention limits, restrict access, and record the justification for anything kept about an identifiable private individual. A good output is a minimised dataset with a documented retention decision. Stop when what remains is proportionate to the stated question.

Phase 11 — Run the harm review

Before publication or dissemination, assess the consequences for the people in the data. Quoting a small account can expose an ordinary person to mass abuse; identifying a poster in a repressive environment can be dangerous; naming an individual as an operative carries defamation and safety risk requiring a documented evidentiary standard. Consider minors, bystanders and survivors specifically. A good output is a documented harm review by someone other than the analyst. Stop when the residual risk is proportionate to the public or client interest.

Phase 12 — Document and hand over

Produce the report with the sampling bias stated, the collection method described, each load-bearing claim linked to a preserved artefact, and the limits of what platform data could establish written plainly. Include the terms and lawful basis assessment in the case file. Where material may become evidence, transfer it under chain of custody with hashes. A good output is a package another analyst can audit and reproduce. Stop when the reproduction test has been met rather than when the narrative is satisfying.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Platform transparency reports and researcher access programmes	Registration	Periodic reporting on enforcement actions, government requests and, where offered, structured research data access.	Legitimate access route to platform data and context on how moderation shapes what is visible to collection.
DSA Transparency Database	Open	Statements of reasons for content moderation decisions taken by very large online platforms serving the European Union.	Structured, comprehensive record of moderation actions, useful for studying enforcement patterns without scraping platforms.
Google Ads Transparency Center	Open	Searchable repository of advertisers and advertising creatives including political and issue advertising with spend data.	Identifies paid amplification behind a narrative and the advertiser identity where organic analysis cannot.
Internet Archive Wayback Machine (archived)	Open	Historic snapshots of web pages including profile and post pages, with on-demand capture of live pages.	Independent preservation of platform content before deletion, and evidence of what a page showed at a given time.
Conifer web archiving service	Open	High-fidelity on-demand web archiving producing browsable captures of dynamic pages, hosted by Rhizome.	Second independent archive for content that resists other capture methods, reducing single-point preservation risk.
InVID-WeVerify verification plugin	Open	Toolkit for video keyframe extraction, multi-engine reverse image search, metadata inspection and image forensics.	Establishes whether media in a post is original or recirculated, which is the first verification question.
GDELT Project	Open	Machine-coded global news and event dataset with broad language coverage and public query interfaces.	Correlates platform narratives with news reporting to test whether online discourse tracks or precedes real events.
Media Cloud	Registration	Open platform for analysing online news content across large source collections with topic and source tools.	Traces how a narrative moved between platform discourse and news outlets, and identifies the seeding source.
EU DisinfoLab and EDMO research outputs	Open	Published investigations and methodology on coordinated influence operations, platform manipulation and detection techniques.	Reference methodology and prior findings on known networks, preventing rediscovery of documented operations.
DFRLab research publications	Open	Open source investigations into information operations, coordinated inauthentic behaviour and platform manipulation cases.	Worked examples of behavioural and infrastructure evidence standards applied to attribution of online operations.
Certificate transparency logs	Open	Public append-only logs of issued TLS certificates including subject hostnames and issuance timestamps.	Links websites promoted through platform accounts to shared infrastructure, providing corroboration outside the platform.
RDAP registration data services	Open	Structured domain registration data including registrar, status and creation dates from registries and registrars.	Dates and connects domains amplified by accounts under study, supporting infrastructure rather than content attribution.
Berkeley Protocol on Digital Open Source Investigations	Open	Standards for collection, preservation, verification and analysis of digital open source material for accountability.	Sets the preservation and verification standard for platform material intended to support accountability processes.
Platform terms of service and developer policies	Open	Contractual rules governing automated collection, storage, republication and research use of platform content.	Determines what collection is contractually permitted, which affects both legal exposure and evidential admissibility.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Social Media Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Web archiving and capture tooling — Preserves rendered pages with timestamps and hashes before content is deleted or edited. Limitation: dynamically loaded content, infinite scroll and login-gated pages are captured poorly or not at all.
• InVID-WeVerify plugin — Extracts keyframes, runs reverse image search across engines and inspects metadata. Limitation: reverse search coverage varies sharply by region and language, so negative results prove very little.
• Network analysis and graph visualisation software — Maps interaction structures and detects communities within collected datasets. Limitation: community structure is highly sensitive to the collection window and to edge definition, so results are easy to overstate.
• Temporal analysis and posting rhythm tooling — Surfaces synchrony, burst patterns and diurnal signatures across accounts. Limitation: synchrony arises naturally from news events and shared time zones, so it flags rather than establishes coordination.
• Perceptual image hashing — Finds re-uploads and near-duplicates of the same media across accounts and platforms. Limitation: crops, overlays, re-encoding and screen recording defeat many hashing schemes.
• Machine translation with human review — Makes multilingual monitoring feasible across the languages that matter locally. Limitation: irony, slang, coded language and dialect are exactly what matters in this discipline and translate worst.
• Case management with hashing and chain of custody — Records provenance for every captured item and supports evidential handover. Limitation: only works if capture discipline is applied at collection time rather than reconstructed later.
• Platform native search and advanced operators — Provides terms-compliant access to public content without automation. Limitation: results are personalised, incomplete and non-reproducible, so queries and retrieval times must be logged carefully.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Platform data is a badly biased sample and almost never supports population-level inference. Write down who is visible and who is not before collecting, because the bias determines what your conclusions can legitimately be about.
• Preserve before you analyse, and preserve the media file rather than a screenshot. Material documenting serious incidents is removed by moderation faster than anything else, and the version you needed is gone within hours.
• Coordination is not the same as inauthenticity, and inauthenticity is not the same as foreign operation. Collapsing these three questions is the most common analytic failure in the discipline and the one most likely to produce a false attribution.
• Assess accounts on behaviour, not on appearance. Missing profile photographs, alphanumeric handles and recent creation dates describe real people in restrictive environments as often as they describe automation.
• Build networks from interactions rather than follower graphs. Followers are noisy, purchasable and stale, whereas replies, quotes and shares within a defined window reflect actual behaviour and can be dated.
• Contacting an account destroys the record. Archive fully before any approach, because accounts are deleted, locked or scrubbed within minutes of a subject realising they are being examined.
• Quoting a small account in a published product can expose an ordinary person to mass abuse. Treat amplification as an intervention with consequences, not as neutral citation, particularly for minors and bystanders.
• Platform terms are not merely a legal formality. Breaching them can taint evidence, create contractual exposure and, in research contexts, invalidate ethics approval, so record the terms assessment in the case file.
• Never attribute an operation to a named individual on platform evidence alone. Behaviour and infrastructure support attribution to an operation; naming a person requires corroboration proportionate to the harm the naming would cause.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Social Media Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of load-bearing findings preserved to two independent archives with hashes and post identifiers before analysis began.
• Verification rate of media in reported findings, tracking how often original provenance was established rather than assumed from the posting account.
• Share of published or disseminated findings where load-bearing claims rest on corroboration outside the platform rather than on platform data alone.
• Volume of personal data about uninvolved individuals deleted at minimisation review, tracked as evidence the control is operating rather than nominal.
• Number of harm reviews resulting in withheld quotes, redacted account names or delayed publication, with reasons recorded.
• Time from incident to preservation for high-priority events, measured against the observed moderation removal window for that content type.
• Rate of retracted or amended attribution claims, examined for whether the error was coordination misread as inauthenticity or inauthenticity misread as state operation.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Mistaking engagement volume for prevalence, when platform populations differ sharply from the public.
• Declaring a coordinated campaign from a pattern that fits fandom, activism or a shared content source equally well.
• Attributing an account to a person on handle similarity alone, a mistake that is hard to retract.
• Losing evidence to deletion because material was screenshotted rather than archived with metadata and hashes.
• Collecting from a personal account, contaminating both the investigation and the analyst's own exposure.
• Trusting platform-declared location or language fields, which are user-set and frequently wrong.

Legal and ethical considerations

Platform terms restrict automated collection and republication, and breaching them can taint evidence and create contractual exposure. Publicly visible personal data is still personal data: establish lawful basis, minimise collection about uninvolved people, apply retention limits, and do not build profiles of private individuals without clear justification. Monitoring of employees, journalists or activists raises human rights concerns and often separate legal duties. Preserve original files with hashes where material may be evidential, and document every collection decision.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Social Media Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is scraping public posts lawful?

It depends on jurisdiction, on the platform's terms and on what you do with the data, and the three answers frequently differ. Terms of service commonly prohibit automated collection even of content a human may lawfully view, so scraping can be a contractual breach and, in some jurisdictions, engage computer misuse law. Separately, data protection law applies to personal data regardless of public availability, requiring lawful basis, minimisation and retention limits. For research, the EU Digital Services Act creates a formal researcher access route that is preferable to scraping. Document the terms and legal assessment before collection, because remedying it afterwards is not possible.

How do you tell a bot from an enthusiastic person?

Usually you cannot from the profile, and the attempt is where most errors originate. Assess behaviour over time: posting volume beyond human sustainability, perfectly regular intervals, activity without diurnal pattern, identical text across unrelated accounts, and content that does not respond to context. Then weigh the alternatives, because scheduling tools, shared accounts, marketing operations and highly online individuals produce similar signatures, and people in restrictive environments deliberately obscure identity. State the evidence and the confidence rather than applying a binary label, and prefer describing the behaviour to asserting automation.

Can social media evidence be used in court?

Yes, when collected properly. Capture the original media file rather than a screenshot, record post and account identifiers, the URL, retrieval time with timezone and the tool used, and hash the file at collection. Preserve the surrounding account state, since context is frequently disputed. Document the method contemporaneously. Note that content not publicly visible, deleted material, private messages and subscriber information require a production order or MLAT to the platform and cannot lawfully be obtained by other means. Material collected in breach of platform terms may face admissibility challenges depending on jurisdiction.

Are fake accounts ever acceptable for collection?

Rarely, and the constraints are serious. Platform terms usually prohibit them outright. In several jurisdictions, using a false identity to interact with individuals engages covert human intelligence source regimes requiring authorisation that is unavailable to private actors. Even where a passive, non-interacting research account is permissible, it must not deceive individuals into disclosing information. For journalists, NGOs and private practitioners the defensible position is normally open collection of publicly accessible content with a documented attribution posture. Where the requirement genuinely needs covert access, the answer is a referral to authorities holding that power.

What does coordinated inauthentic behaviour actually look like in evidence?

It looks like patterns that require explanation and survive the mundane alternatives. Typical evidence includes identical or near-identical text posted within seconds across accounts with no organic relationship, shared unusual artefacts such as the same idiosyncratically cropped image or a private link shortener, clustered account creation dates, coordinated switching between unrelated topics, and infrastructure links between promoted sites. The strength comes from combination, not from any single indicator. Always address why the pattern is not simply a campaign, a fandom or a news event, because those produce synchrony naturally and are far more common.

How should employee social media monitoring be handled?

With great caution and legal advice. Employment law, data protection law and, in many European jurisdictions, works council consultation requirements apply. Monitoring must be necessary and proportionate to a specific risk, notified in advance through a clear policy, limited in scope, and not extended to private life or protected activity such as trade union membership or lawful political expression. Blanket monitoring of employees' personal accounts is generally unlawful in Europe and legally hazardous elsewhere. Where a genuine insider risk exists, targeted investigation with documented authorisation is the defensible route rather than continuous surveillance.

How do you protect people whose posts you use?

Assume publication amplifies. Quoting a small account in a widely read product can produce mass abuse for someone who never sought attention, and identifying a poster in a repressive environment can put them in danger. Consider whether the account is a public figure or an ordinary person, whether the post was made in a context where the poster understood the visibility, and whether minors, bystanders or survivors are involved. Options include describing content without naming the account, seeking consent, delaying publication, or omitting the example. Record the decision and have it reviewed by someone other than the analyst.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• EU Digital Services Act, governing platform transparency, advertising repositories, systemic risk assessment and vetted researcher data access.
• GDPR and equivalent data protection regimes, applying lawful basis, minimisation, retention and profiling restrictions to publicly available personal data.
• Berkeley Protocol on Digital Open Source Investigations, setting collection, preservation and verification standards for platform material used in accountability work.
• ISO/IEC 27037, governing identification, collection and preservation of digital evidence including social media artefacts.
• National covert surveillance regimes such as the UK RIPA and Investigatory Powers framework, which can bring sustained monitoring and false persona use within authorisation requirements.
• Platform terms of service and developer policies, which contractually govern automated collection, storage and republication of content.
• Santa Clara Principles on transparency and accountability in content moderation, framing how moderation decisions should be documented and appealable.
• DART Center guidance on vicarious trauma, governing exposure management for analysts reviewing graphic and abusive material at volume.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. DSA Transparency Database — European Commission. Structured record of platform content moderation decisions in the EU
2. Platform transparency reporting — Meta. Enforcement, government request and advertising transparency reporting
3. Ads Transparency Center — Google. Searchable repository of advertisers and advertising creatives including political ads
4. Wayback Machine — Internet Archive. Public web archive used to preserve platform content before deletion (archived copy — the publisher moved or withdrew the original)
5. InVID-WeVerify verification tools — WeVerify project consortium. Toolkit for verifying whether posted media is original or recirculated
6. European Digital Media Observatory — EDMO. Research network publishing methodology and findings on platform manipulation
7. Digital Forensic Research Lab publications — Atlantic Council. Open source investigations into coordinated inauthentic behaviour
8. Berkeley Protocol on Digital Open Source Investigations — UN Human Rights Office and Human Rights Center, UC Berkeley. Standards for collecting and preserving digital open source material
9. Certificate transparency search — crt.sh. Public log of issued TLS certificates used for infrastructure corroboration
10. Media Cloud — Media Cloud. Open platform for analysing how narratives move across online news sources

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: compliant platform collection, metadata-preserving archiving and network analysis you can defend. Explore the platform, or browse the rest of the library by following any tag above.