January 6, 2021; Shortly after President Trump concluded his speech to supporters gathered in front of the white house, by calling them to march on Congress, an organized mob of protesters stormed the capitol building in Washington D.C. causing damage to infrastructure, temporarily impeding the final announcement of the 2020 election results, and shocking spectators around the globe.

Inquiries regarding the circumstances around the event promptly emerged but one thing was clear, words and social media were key in orchestrating the storming of Capitol Hill. For years now, forums, social media platforms and mobile applications are the go-to places to socialize and share experiences with likeminded others. They are also an ideal place to organize the masses and plan events such as demonstrations. Capitalizing on this, individuals such as President Trump, have been able to rapidly reach millions of followers and extend their ideology. In turn some of Trump’s supporters, specifically alt-right organizations, use the same medium to spread their ideology, propaganda, extremism, and organize events such as those on January 6, 2021. The use of OSINT tools, such as the ProFoundTM platform, to monitor these organizations can increase law enforcement preparedness to respond to similar post mortem investigations and other events in the future.


This happening is not unique to the United States. With no physical or intellectual boundaries, ideologies, which until recently were local, have gained mass support on the web and have been reignited to the point of becoming global phenomenon. White ethno-nationalism, or the idea of an ethno-state of, and for, whites, is just one of them. Social media and mass communication outlets, combined with lack of hate speech regulation, have amplified alt-right organizations’ messages in turn facilitating propaganda, recruitment, and fundraising activities. Using ProFoundTM platform’s social media monitoring and discourse analysis capabilities, investigators can stay ahead of extremist organizations, curb the spread of propaganda, and prepare for public order disturbances appropriately.


Recently Digital Clues’ investigators combed the surface, deep and dark web for communication channels being used by known alt-right groups to disseminate propaganda, fundraise, recruit, and instigate calls for violence, utilizing mass data collection capabilities available through the ProFoundTM platform.  A broad tailored query surfaced relevant communication channels and provided insight that Telegram was the most prevalent network being used by these entities.

Eleven Telegram channels were mapped out and their content was collected for further analysis. To trace the dissemination of propaganda, investigators used the ProFoundTM platforms’ advanced analysis capabilities to identify dominant hashtags, recurrent visual content, and shared phone numbers. The intelligence gathered demonstrated an organized multi-channel recruitment and propaganda campaign that idealized Brenton Tarrant, a white nationalist who perpetrated a mass shooting in New Zealand in April 2019. The investigators created alerts and continued to monitor the hashtag related discourse to prepare for mass demonstrations, rallies and preempt violent clashes being instigated through calls for violence.

Furthermore, the investigators recognized that phone numbers being distributed through the Telegram channels were not of alt-right members, but instead individuals being targeted by the group through existing calls for violence. This intelligence proved crucial in alerting possible targets, many of which were in law enforcement, of potential danger.

Further analysis into the recurrent URLs, email addresses and credit card information details within the discourse, led the investigators to various alt-right dark web pages. Monitoring of dark web sites and forums can provide further insights regarding specific groups activities, planned rallies and the overall organizational reach. The credit card information uncovered was flagged as that of a person of interest actively involved in fundraising activities. After surfacing the individual’s social media accounts, the investigators generated a 360° intelligence report via the ProFilerTM module. Continued monitoring and connection mapping allowed the investigators to map out fundraising networks.

Starting from a generic keyword query search and through analysis using Digital Clues’ full suite of OSINT products, the investigators were able to identify relevant alt-right Telegram channels and collect information regarding propaganda campaigns, possible alt-right targets, recruitment efforts and fundraising activities. During this investigation, Digital clues platforms analyzed more than 60K data points, surfacing dozens of new targets and their connections. All of this was done in a matter of hours, dramatically reducing the time of the investigation from days or weeks.


OSINT tools facilitate ongoing monitoring of open-source information in real time during the investigative process. As demonstrated by the case outlined above, law enforcement agencies can gather intelligence that can be further leveraged to ensure public safety, map out organizations, their targets and ultimately prevent events such as the one lived on Capitol Hill. In addition, investigators can then actively engage within the desired groups, infiltrate closed circles, identify recruitment and fundraising efforts, and recognize future calls to violence with potential named targets.