Countless demonstrations and acts of civil unrest around the world have been organized through social media and mobile apps. While new media platforms represent a great avenue to organize these events, criminal groups, outliers, and foreign powers regularly infiltrated civic groups’ events to push their own agendas. Therefore, it is of essence, that law enforcement agencies monitor such groups and events to collect OSINT which will protect citizens rights to protests, limit foreign power intervention, aid preserve public order and ultimately preserve lives.


Following a rise in public transportation prices in a country in Latin America, citizens took to the streets to voice their grievances against economic hardships and the continued rise of unemployment in the country.  As protests became more frequent, violent, and spread to a national level, the government and law enforcement expressed concern of foreign powers manipulation and its possible consequence on protestors safety. In efforts to better prepare ahead of upcoming demonstrations and effectively maintain public order, the investigators began by employing ProFoundTM platform’s wide search capabilities to surface possible public communication channels being used by protest organizers on the surface, deep and dark web.

The results indicated that although social media played a vital role in spreading the word, detailed information regarding upcoming events and mass demonstrations were taking place via Telegram channels. Using the platform’s collection and analysis capabilities, the investigators easily sifted through all the content disseminated through those channels since their establishment and pinpointed accounts within the groups encouraging violent behavior. Using the username information, a one-click intelligence report was generated via ProFilerTM for each person of interest and brought to light potential foreign interference in organizing the civil unrest.

Further analysis of the content collected from the Telegram channels led investigators to uncover the locations and time for imminent protests being organized in the capital. Geo-fencing capabilities were deployed around the geographic areas mentioned by protestors, using ProFoundTM, allowing the investigators to monitor in real-time and advise authorities on the ground of any changes. Real-time monitoring of chatter coming from each location allowed law enforcement to distribute their resources, accordingly, protecting the protestors right to protest while containing sporadic outlier groups attempting to capitalize on the protests to wreak havoc. In parallel, a keyword-based dictionary containing terms threatening to law enforcement officers, agencies and public order was uploaded to the platform. The implementation of the dictionary facilitated investigators ability to analysis threats made against law enforcement, report hot spots of interests, and ultimately increase real-time preparedness.

Starting from a broad search and through analysis using Digital Clues’ full suite of OSINT products, the investigators were able to identify relevant Telegram channels and collect information regarding possible threats and protests. During this investigation, Digital clues platforms analyzed more than 20K data points, surfacing new targets and their connections. All of this was done in a matter of hours, dramatically reducing the time of the investigation from days or weeks.


Communication between analysts and law enforcement on the ground is crucial to public safety. By using OSINT tools and real-time monitor capabilities found in Digital Clues suite of products, analysts can inform officers in the line of duty of potential danger to protestors and law enforcement as well as planned breaches in security, in turn ensuring a more efficient use of resources and potentially saving lives. Moreover, one-click intelligence reports can aid in the processing of large groups of individuals, checking for inconsistencies and flagging potential people of interests for further investigation.