When a person of concern emerges, the temptation is to begin with identification. In most cases identification is neither immediately achievable nor the most useful place to start.
Start with the chronology
Every contact, dated and sourced, with the channel, the language used, and anything the individual claimed or demonstrated. The chronology is the spine of the record, and it is what makes later assessment possible.
Then the behavioural picture
- Stated grievance or motivation, in the individual's own words
- Claimed relationship with the subject, and whether it is reciprocated or fabricated
- Evidence of proximity, travel, or attendance
- Consistency of language, timing, and platform behaviour
- Changes following public events, announcements, or a lack of response
Then connections, carefully
Potential links to other accounts, incidents, or individuals should be recorded with the basis for the link and the confidence attached to it. A plausible connection recorded as an established one contaminates every subsequent judgement.
Finally, gaps
A good record states what is not known and what would change the assessment. That is what makes the next collection decision proportionate rather than speculative.
This article is general commentary on intelligence practice. It does not describe any client, engagement, or individual, and it is not advice on a specific situation.