The Butterfly Bureau’s OSINT Tradecraft section is where investigative skills meet real world application. This category focuses on the tools, techniques, and methodologies used by open source intelligence researchers, journalists, digital investigators, and citizen sleuths to uncover information hidden in plain sight.
Government agencies maintain lists for legitimate administrative reasons. Some identify suspended contractors. Others flag safety concerns, regulate access to secure facilities, screen travelers, restrict licenses, or prevent people from participating in government programs. Then there are the lists nobody wants to call lists. A person may discover that she has been quietly marked as disruptive, …
Private spyware gives governments access to capabilities once associated with elite intelligence agencies. Depending on the product and method used, an operator may collect messages, contacts, photographs, location data, recordings, and other information from a targeted device. Journalists, activists, dissidents, attorneys, and human rights defenders face particular danger because compromising one phone can expose entire …
The government increasingly stores public information inside systems owned or operated by private contractors. Police evidence sits in commercial cloud platforms. Public school messages live in vendor portals. Benefit decisions are generated by private software. Transportation data, emergency records, inspection photographs, license plate searches, and agency communications may never touch a government server. Then a …
Law enforcement agencies sometimes create intelligence bulletins before demonstrations, marches, strikes, public meetings, and political actions. A legitimate bulletin may address a documented threat, planned violence, traffic control, emergency access, or credible risks to participants. The problem begins when an agency treats lawful political activity as intelligence simply because officials dislike the politics, fear criticism, …
Security clearance is not a technical certification, and a government contract is not a magic cloak of competence. Government agencies rely on private contractors to build software, maintain cloud systems, manage networks, provide technical support, and sometimes work inside facilities where sensitive or classified information is handled. That arrangement can be necessary. It can also …
A Sensitive Compartmented Information Facility, commonly called a SCIF, is an accredited space where authorized personnel may handle Sensitive Compartmented Information. It is not simply a secure conference room with thick walls, stern signage, and a basket where everyone reluctantly abandons a telephone. Planning a government SCIF requires an authorized mission, a government sponsor, qualified …
Your local police department may describe social media monitoring as nothing more than checking public posts. That sounds delightfully harmless, rather like saying a surveillance camera is merely enjoying the scenery. Modern social media monitoring can involve keyword searches, location filters, relationship mapping, automated alerts, covert accounts, image analysis, and commercial software that collects posts …
Your phone knows where you sleep, work, worship, shop, protest, receive medical care, and spend Tuesday evenings when you told everyone you were staying home. That location history can travel through mobile applications, advertising systems, software development kits, data aggregators, and commercial brokers. Government agencies have purchased access to commercially available information rather than obtaining …
Predictive policing systems promise to help police anticipate where crime might happen or who might become involved. The sales pitch usually arrives carrying words such as objective, efficient, intelligent, and data driven. Nothing says impartial justice quite like a vendor presentation with a glowing heat map. The problem is that these systems do not observe …
A criminal case may appear to begin with a traffic stop, an informant, or one officer experiencing a miraculous burst of curiosity. Sometimes that visible beginning is not the beginning. Parallel construction occurs when investigators protect an original source by creating a separate path to the same evidence. Civil liberties advocates sometimes call the abusive …