Skip to content

Intelligence Software and Social Media: Linking Web Chatter To Ground Truth

Updated: June 2022

On February 24, 2022, Russian forces invaded Ukraine, escalating a war between the two countries that has been ongoing since 2014. Intelligence software helped online investigators predict the invasion that day and have since monitored Russian movements, debunked Russian misinformation, and investigated war crimes in near real-time.


A Twitter post from Dr. Jeffrey Lewis, an OSINT expert and professor at Middlebury Institute. The screenshot is taken from Google Maps Live Traffic and shows a traffic jam at 3:15 a.m. the morning of the invasion.

How Did They Do This?

This proactive monitoring strategy is thanks to social media content, which is often the earliest source of on-the-ground information during a crisis. Social media turns bystanders into field sensors, providing photo and video records of an area of interest. It also circulates other open-source information, like satellite imagery and drone footage, that are relevant for monitoring real-world events. 

On February 24th, an open-source intelligence (OSINT) expert reportedly used live traffic data to predict the invasion early that morning. OSINT enthusiasts, investigators, and intelligence teams have analyzed social media content to monitor the war, either by searching social media sources manually or by using intelligence software to expedite the process.

Social Media’s Value for Intelligence Agencies

Public social media content, which is considered OSINT, has become a focus for intelligence agencies in recent years. As social media use becomes more widespread, it hosts an abundance of information valuable for national security use cases.

New call-to-action

In 2021, the Center for Strategic and International Studies (CSIS) Technology and Intelligence Task Force upgraded OSINT to “core” intelligence. They also called for a new intelligence agency—the Open Source Intelligence Agency—as an option to address OSINT’s growing value. The Defense Intelligence Agency has also stated that 80% of its reports come from unclassified sources.

Open-source content like social media has several benefits for intelligence agencies:

  • It provides insights unavailable from other classified forms of intelligence, like areas inaccessible to soldiers or field sensors.
  • It can target specific entities and locations or show broader trends in areas and populations of interest. This is valuable for understanding information environments.
  • Because it’s usually the earliest source of truth for breaking events, it’s valuable for early/proactive detection and speed-to-information.
  • Logistically, it’s easier to share between allies than classified information.

It also supports a variety of mission types. For example, social media can support crisis detection and response (like natural disasters and shootings), monitor and address disinformation, support counter-terrorism, generate geopolitical assessments, inform battlefield tactics, and help governments understand information environments

Infographic-SM for Intel Benefits-OPT

In the Russia-Ukraine war, social media data has been crucial for debunking Russian media manipulation and investigating war crimes, such as the use of cluster munitions in civilian areas.

Dashcam footage of what was likely a cluster munition attack near a children’s hospital in Kharkiv, Ukraine. This was geolocated and posted by a Georgia-based OSINT group called the Conflict Intelligence Team. Analysts can determine the type of weapon used and even the direction and likely source of the attack by analyzing videos and images.

What does “Social Media” Mean?

Social media is broadly understood as a collection of popular websites and apps used to facilitate social interaction online. This would include sites like:

  • Social networks (Facebook, LinkedIn)
  • Photo and video-sharing networks (Instagram, YouTube, Pinterest)
  • Interactive media networks (Snapchat, TikTok)
  • Microblogging sites (Twitter, Tumblr)

Social media and social data are actually harder to define than you might think. According to a 2017 big data research review,

“...[a] majority of related work on [big social data] is focused on the analysis of social data, giving less attention to describing what [it] actually is. This can lead to lack of consensus, inconsistency, and vague understanding of what such data could be used for.”

At Echosec Systems, we’ve observed social activity diversifying across the surface, deep, and dark web. For intelligence agencies, valuable social data is available from a variety of online spaces, including:

  • Forums and imageboards on the deep web and dark web. This content is unindexed and undiscoverable by standard search engines like Google. These sites provide user anonymity and have been associated with radicalization and violent planning. They’re also used by citizens in countries where mainstream social media may be banned, or where they fear government surveillance.  
  • Alternative social media. This includes alt-tech, messaging apps, and decentralized networks. These networks typically provide more user anonymity and relaxed content policies compared to mainstream social media.
  • Regional networks. Some social networks are unique to specific regions or linguistic groups. These can provide valuable insights for intelligence agencies focusing on a geographic area of interest.

Intelligence Software and Social Media

Intelligence agencies in the United States have been struggling with data overload since the Cold War. Now in the internet age, where OSINT is king, data overload has reached a new level. Analysts don’t lack information—they lack the resources to process and analyze it efficiently.

Data overload creates analyst fatigue and information oversight. This can cause delayed or misinformed decision-making higher up the chain of command, potentially putting people and national security interests at risk. Deciphering cultural nuances and multiple languages also add to these challenges.

Intelligence leaders need innovative solutions to address the challenges presented by a growing demand for social media data/OSINT, data abundance, and multilingual/cultural requirements. This points to the need for open-source intelligence software, which helps lighten the load and address skills gaps. 

Intelligence software helps analysts leverage social media by providing:

  • Consolidated access to a range of relevant social media sources, minimizing information gaps.
  • Translation capabilities to support multilingual data analysis.
  • Advanced features to speed up data analysis. For example, machine learning techniques can add context to results, tag high-priority items, or identify trends.
  • Highly specific search queries that reduce noise.
  • Geolocation and geo-searching capabilities to narrow in on regions of interest.

A map generated by the Echosec Systems Platform in Ukraine. The Platform allows users to search for social media content by location name or geofence.

Intelligence sources don’t need to be classified to give agencies value. Social media and other OSINT sources are now standard for intelligence teams, supporting a range of use cases—from conflict monitoring to counter-disinformation. 

While plenty of online investigators use free tools to generate intelligence, handling the scale of available social media data requires more sophisticated intelligence software. As we’ve seen in the Russia-Ukraine war, the development of these solutions will fundamentally change the way intelligence agencies obtain information and make national security decisions.

To learn more about monitoring social media with intelligence software, request a consult.