Event / Incident: Data Point Intelligence Guide
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
An event is where every other data point converges: a time, a place, a set of actors, and the messy...
A messaging handle outlives phone numbers, domains and marketplaces. It is the thread that ties an operation together across years...
Court records are the only open dataset where an adversary is compelled to describe their own conduct under oath. Analysts...
A blockchain address is a pseudonymous account with a permanent, public and complete transaction history. That combination makes it the...
Companies are how money, liability and control get organised. Follow the entity and you find the people who preferred not...
A phone number is a globally routable identifier attached to a real contract and, increasingly, to every account a person...
A name is the weakest identifier in intelligence work and the one most likely to end a career when handled...
Litigation is an involuntary disclosure engine. Adversaries in court say, under oath and on the public record, what they will...
Criminal intelligence is not case notes with better formatting. It is the discipline that turns scattered incidents into an articulable...
Social platforms record behaviour, not truth: what was posted, when, by an account, to an audience. Social media intelligence keeps...
Human intelligence is the only discipline where the source can be harmed by your success. Every rule in the tradecraft...
Follow the money is a cliche because it works. Financial intelligence is the discipline of following value through the institutions...
Every company is a legal fiction held together by filings. Corporate intelligence reads those filings to establish who is actually...
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Piracy risk is not a map. It is a product of monsoon windows, mothership range, freeboard and speed, and how...
Grand corruption almost never appears in a budget line. It appears as a contract awarded in nineteen days to a...
The synthetic identity that just passed your onboarding checks has a credit file, a utility bill and eighteen months of...
Money laundering intelligence is not about spotting dirty money. It is about spotting structures whose only purpose is to make...
Most financial crime cases are not cracked by a clever trade reconstruction. They are cracked by an entity that should...
Looted antiquities rarely arrive with a forged export licence. They arrive with a vague provenance line, usually a private European...
A counterfeit is not a bad copy. It is a parallel supply chain with real factories, freight forwarders, payment processors...
A kidnap-for-ransom market has a price list, a broker layer and a settlement rail. Treat it as an economy rather...
Retaliation after a stabbing is usually measured in days, sometimes hours. The intelligence question is not who did it but...
The pattern that ends most sextortion cases is depressingly consistent: contact within hours, escalation within a day, and a payment...
A container declared as plastic scrap weighing four tonnes more than plastic scrap should weigh is the whole case. The...