Biometric Identifier: Data Point Intelligence Guide
Biometrics are the only identifier a person cannot change after it leaks. That single property should govern every decision you...
Username / Handle
National ID Number: Data Point Intelligence Guide
A national ID number is the closest thing that exists to a primary key for a human being. It is...
Device / Advertising ID: Data Point Intelligence Guide
An advertising identifier was designed to be a resettable, privacy-preserving marketing token. In practice it became one of the most...
Social Profile: Data Point Intelligence Guide
A social profile is a persona's self-published intelligence report. The metadata around it is usually more truthful than anything written...
Physical Address: Data Point Intelligence Guide
A physical address is where the digital investigation touches the ground. It is also where thousands of shell companies quietly...
Phone Number: Data Point Intelligence Guide
A phone number is a globally routable identifier attached to a real contract and, increasingly, to every account a person...
Username / Handle: Data Point Intelligence Guide
People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
Person / Name: Data Point Intelligence Guide
A name is the weakest identifier in intelligence work and the one most likely to end a career when handled...
News Intelligence (NEWSINT): Intelligence Discipline Guide
Reporting is evidence of what was published, by whom, when and sourced how. Treated that way it is one of...
Disinformation Intelligence (DISINFOINT): Intelligence Discipline Guide
The finding is rarely that a claim is false. It is that a set of accounts, sites and outlets behaved...
Identity Intelligence (IDENT): Intelligence Discipline Guide
Identity resolution fails in two directions and only one of them is visible. A missed link costs you the investigation;...
Social Media Intelligence (SOCMINT): Intelligence Discipline Guide
Social platforms record behaviour, not truth: what was posted, when, by an account, to an audience. Social media intelligence keeps...
Human Intelligence (HUMINT): Intelligence Discipline Guide
Human intelligence is the only discipline where the source can be harmed by your success. Every rule in the tradecraft...
Election Intelligence (ELECTINT): Intelligence Discipline Guide
An election is the most predictable high-risk event on any calendar: fixed date, known actors, published rules. Election intelligence is...
Paste Site Intelligence (PASTINT): Intelligence Discipline Guide
Paste sites are where data goes to be shared quickly and forgotten slowly. A dump that lives for eleven minutes...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Attack Surface Intelligence (ASMINT): Intelligence Discipline Guide
You cannot defend what you do not know you own. Attack surface intelligence is the discipline of inventorying your exposed...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
Election Security & PSYOP: Mission Domain Intelligence Guide
The claim that the count was rigged was already trending three weeks before polls opened. The infrastructure held perfectly. The...
Extremism & Radicalization: Mission Domain Intelligence Guide
Radicalisation is not a conveyor belt. It is a set of grievances, communities and content economies, and most of what...
Child Protection: Mission Domain Intelligence Guide
The pattern that ends most sextortion cases is depressingly consistent: contact within hours, escalation within a day, and a payment...
Insider Threat: Mission Domain Intelligence Guide
The insider case that goes to court usually has a boring first indicator: an access request that was granted because...
Operational Security: Mission Domain Intelligence Guide
Investigations are compromised by their own footprint far more often than by adversary brilliance. A referrer header, a reused persona,...
Dark Web Intel: Mission Domain Intelligence Guide
Most of what is posted on a criminal forum is advertising. The intelligence value is not in the claim but...
