The word escalation suggests a threshold being crossed. In practice it is a trajectory, and the individual points on it are frequently unremarkable in isolation.
What tends to change first
- Frequency increases, or becomes unusually regular
- Language moves from criticism to grievance, and from grievance to entitlement
- The subject is addressed directly rather than referenced
- Channels multiply: public, then private, then physical correspondence
- Detail becomes more specific and less public
- The individual seeks acknowledgement rather than reaction
Why single incidents mislead
One incident may be noise. A pattern can be intelligence.
A security team assessing a message in isolation has almost no information: no baseline, no chronology, and no view of whether this represents an increase or a return to a previous level. The same message read against eighteen months of record is a different piece of information entirely.
Promotion to person of interest
Designating an individual or account as a person of interest is an analytical decision with consequences: it commits resource, creates a record, and shapes future judgements. It should have criteria, an owner, and a review date. It should also be reversible; de-escalation is a legitimate finding and should be recorded as clearly as escalation.
Attribution and restraint
Similar language across two accounts is a lead. It is not an identification. Assessments should state the confidence attached to any suggested link and the information that would confirm or exclude it.
This article is general commentary on intelligence practice. It does not describe any client, engagement, or individual, and it is not advice on a specific situation.