Any individual with a public profile will receive hostile communication. For some, the volume is measured in thousands of messages a month. The instinct to treat all of it as a security problem is understandable and unaffordable; the opposite instinct, to dismiss all of it as noise, is how genuine indicators are missed.
Volume is not severity
A coordinated pile-on involving ten thousand accounts may create a serious welfare and reputational problem while presenting no physical threat whatever. A single message, sent once, from an account with no following, may warrant immediate attention. Protective intelligence is concerned with indicators, not arithmetic.
Indicators that change the assessment
- Specificity: reference to a location, routine, vehicle, residence, or future appearance
- Claimed or demonstrated proximity, including attendance at an event or venue
- Non-obvious personal information the sender should not reasonably hold
- A stated intention, plan, or capability, distinct from an expression of anger
- Fixation: sustained focus over time, often with a claimed relationship or grievance
- Escalation in tone, frequency, or channel, particularly after a period of silence
- Contact extending to family members, colleagues, or household staff
The role of triage
Triage exists to make judgement possible at volume. It should be documented, applied consistently, and reviewable, so that a decision to take no further action is itself a recorded intelligence decision rather than an absence of one.
Continuity is what makes triage safe
A message triaged as low concern in March acquires different significance if similar language appears from a new account in June. That is only possible where records persist and are searchable. Without continuity, every incident is a first incident.
This article is general commentary on intelligence practice. It does not describe any client, engagement, or individual, and it is not advice on a specific situation.