INTELLIGENCE NOTE

Subject: Indicators of Potential Information-Gathering Within a Social Circle
Classification: TRAINING / ANALYTICAL USE ONLY
Date: 31 August 2026

1. Situation

Individuals within a social network may, intentionally or unintentionally, collect and relay information concerning another person’s activities, relationships, movements, or personal circumstances.

The presence of a single indicator does not establish hostile intelligence activity. Assessment should be based on patterns, corroboration, access, opportunity, and alternative explanations.

2. Indicators

The following observations may warrant attention:

• Unexpected knowledge: An individual possesses specific information that was previously communicated only within a restricted conversation.
• Information propagation: Private information repeatedly moves through the social network faster or farther than would normally be expected.
• Indirect elicitation: Individuals repeatedly obtain information through apparently casual questions or by asking different people similar questions.
• Third-party collection: Mutual acquaintances are repeatedly questioned about an individual’s whereabouts, relationships, plans, or activities.
• Digital monitoring indicators: Unusual attention to social-media activity, repeated requests for screenshots, suspicious accounts, or unexplained access to shared digital information.
• Patterned presence: The same individual repeatedly appears at locations or events associated with the subject without an obvious independent reason.
• Boundary testing: Attempts are made to discover increasingly sensitive information after the subject has deliberately limited disclosure.
• Cross-checking: Information obtained from separate members of the social circle appears to be compared or reconciled.

3. Analytical Assessment

Indicators should be evaluated against four questions:

Access — Could the individual reasonably have obtained the information?

Opportunity — Was there a realistic occasion through which the information could have been acquired?

Pattern — Has similar behavior occurred repeatedly?

Alternative explanation — Could ordinary social communication, coincidence, public information, or mutual acquaintances explain the observation?

A credible assessment normally requires multiple independent observations, rather than reliance on intuition or a single unusual event.

4. Warning Indicators

Concern should increase when several of the following occur simultaneously:

1. Sensitive information repeatedly reaches an individual without an apparent legitimate source.
2. Multiple people report being questioned about the same subject.
3. The individual demonstrates knowledge of information that was not publicly available.
4. Attempts are made to obtain private messages, screenshots, passwords, or account access.
5. The behavior continues after reasonable privacy boundaries have been established.
6. Monitoring behavior is accompanied by threats, intimidation, impersonation, harassment, or unauthorized account access.

5. Recommended Defensive Measures

Personnel should:

• Minimize unnecessary disclosure of sensitive personal information.
• Review account privacy settings and active login sessions.
• Use strong, unique passwords and multi-factor authentication.
• Avoid distributing sensitive information through large group chats.
• Verify unexpected requests for private information.
• Record objective incidents, including dates and observable facts.
• Avoid confrontation or accusations without corroborating evidence.
• Escalate credible threats, unauthorized access, stalking, or harassment through appropriate security or legal channels.

6. Intelligence Judgment

Social-network information leakage is often attributable to ordinary interpersonal communication rather than deliberate intelligence collection. Accordingly, behavioral patterns should be distinguished from conclusions about intent.

The appropriate analytical posture is:

Observe → document → corroborate → assess alternative explanations → take proportionate defensive action.

No single behavior should be treated as proof that an individual is acting as an intelligence collector or is deliberately spying.