The intelligence relevance of social media

In 2012 Omand, Bartlett and Miller introduced the term ‘social media Intelligence’ or ‘SOCMINT’, and argued that the nature of the information available in social media merits a significant place in a national intelligence framework.

SOCMINT has since received significant attention within the open source intelligence (OSINT) community with, however, generally a strong focus on collection techniques. In most OSINT courses taught, the subject social media is generally associated with identifying specific individuals and collecting as much as possible information from their social media accounts. This practice is problematic for two reasons.

First, regardless how legitimate the attention for a specific individual can be, the ethics of these practices merit a thorough discussion which, apart from some notable exceptions is not always held. Secondly, and more importantly, the predominant focus in SOCMINT on the collection of data on individuals, dilutes the actual larger relevance that exploitation of information from social media can have for intelligence purposes.

Therefore in this blogpost I explore the broader relevance of information as available in social media for intelligence. After a quick discussion of the original article by Ormand et al., five relevant purposes of information available in social media for intelligence are discussed.

The intelligence value of social media

Omand et al. introduce SOCMINT as, what they call ‘the latest member of the intelligence family’, and argue that in an age of ubiquitous social media, SOCMINT has a place in the national intelligence framework. Arguably SOCMINT is nothing more than a subset of OSINT, however I will forego the discussion here whether collecting information from social media deserves a distinct acronym.

The authors specifically distinguish three sorts of operational exploitation of SOCMINT, i.e. ‘near real time situational awareness’, ‘insight into groups’ and ‘identification of criminal intent’. They largely apply these to a public security and law enforcement perspective and emphasise five principles in relation to the legitimate use of SOCMINT. These principles show a concern of the authors on the application of SOCMINT as a surveillance tool within the state. While that concern and the call for the application of these principles is warranted, I believe that as a result of this focus the article neglects a large part of the value of social media for intelligence – i.e. non law enforcement – purposes.

Of course one can only agree with the authors that social media has become an indispensable source of information for law enforcement and intelligence. Especially compared to 2012 when their article was written, social media has even more proliferated and currently more than half the world population is using social media, basically creating a network nearly 5 billion ‘sources’ or ‘collectors’ who are constantly recording and sharing heaps of information.

If we look at that network of 5 billion collectors worldwide and the way social media platforms can be used to collect, collate and document their actions, I believe the relevance for intelligence can be summarised in (at least) the following five purposes:

  • Early warning
  • Repository of foundational data
  • Trend and sentiment identification
  • Identification of influence operations
  • Identification of (new) threat actors and their intent

The following paragraphs provide a further explanation of these purposes.

Early warning

The first, and perhaps most important why information on social media is relevant for intelligence, is that it provides early warning. Omand et al. mention ‘near real time situational awareness’ as an important feature of SOCMINT and this early warning function may be one of the most relevant features of social media for intelligence. After all, 5 billion social media users generate a multitude of the information which is disseminated through traditional media and form a network which is vastly larger than any possible HUMINT network of agents. Although HUMINT still holds its’ important position, for example because compared to recruited agents social media users cannot be directed, the sheer amount of data social media users upload almost guarantees that some relevant data is available on most subjects.

There are daily examples of social media posts which show early warning of events that the authorities rather would have kept hidden. For example, the shooting down of Ukraine International Airlines Flight 752 in Teheran was captured by local residents, put on social media and three days later the Iranian government had no choice than to admit that it was its Islamic Revolutionary Guard Corps that shot the plane down.

Another example is the nuclear-powered missile accident in the Arkhangelsk oblast (Russia) in August 2019. The authorities initially tried to cover it up, however as the clever analysis in the Arms Control Wonk Podcast reveals, too many details already were available on social media, so unlike with the 1986 Chernobyl accident, the authorities could not keep this accident hidden.

More recently social media has provided useful early warning of situations in Ukraine, including the current position of forces (which were subsequently possibly used for targeting), and and incidents such as the explosion on the Crimea bridge long before official sources brought the news.

Repository of basic data

Secondly, social media have become an astonishing repository of basic (image) data on locations, past events and situations. Thus, in addition to providing early warning of incidents, social media contains the foundational information needed to understand the normal course of events which then allows analysts to establish a base line, obtain foundational intelligence on the terrain and back-track developments that led up to events. For example, Bellingcat’s investigation of the shooting down of the MH17 relied for a large part on social media content that was available from users alongside the route of the BUK system. Often this content was posted without the user realising the (later) relevance of their images.

More recently, the vast amount of images available on social media related to the Russian aggression in Ukraine allows, for example, the analysts from Oryx to compile a very detailed overview of Russian equipment losses in Ukraine (as they do for other parties and in other conflicts as well).

Of course it does not always have to be conflict related, for example if you want to get an on the ground understanding of the rail infrastructure in Europe, various ‘cabin view’ channels exist on Youtube with footage from dozens of rail tracks. And where Google street-view is not available, such as in large parts of Germany, we can count on social media users sharing their dashcam video’s on Mapillary. The amount of images and video available from all over the world uploaded on social media, is mind boggling.

Trend and sentiment identification

The third purpose of information from social media for intelligence is that can show grass root movements, trends, and social sentiment. Omand et al. listed this in 2012 as ‘insights into groups’ although that description does not fully cover the actual value I believe. While it may be important to see inside in specific groups, the trends and sentiment across a broader population might be even more important.

Take for example the recent sentiments in Iran after the death of 22-year-old Mahsa Amini in “morality police” custody, which sentiments especially were quickly visible on TikTok. The Iranian authorities appear to understand the role of social media in the protests and are aggressively trying to lock down the internet in order to stop the communication within the country and to stop the outside world to see their human rights violations.

Meanwhile in Russia the social media posts by young men drafted in the mobilisation announced in September 2022, provides not only insight in poor state of Russian army equipment available to the draftees, but moreover into the general morale of these young men. Some of them posted videos of the situation in the barracks, while some even posted videos on deliberate breaking their own legs to avoid being mobilised. Having insight in this Human Factor seems more than a welcome factor for any military analyst to take into account.

And when on 8 October 2022 the explosion on the Crimea bridge occurred, social media showed the reaction of local residents starting to hoard fuel even though the authorities claimed there was enough fuel for the coming week. All these examples show how information from social media can contribute to an actual and timely understanding of trends and sentiment in a population.

Identification of influence operations

Yet another purpose of information from social media for intelligence, is the identification of influence operations. The best know example probably is the Russian interference in the 2016 US Presidential elections. Starting from 2014, Russia meddled on Facebook and Instagram and started gathering American followers in online groups focused on issues like religion and immigration. Around mid-2015, they began buying digital ads to spread their messages. A year later, they tapped their followers to help organize political rallies across the United States.

Another example is the use of Twitterbots to push pro-Indonesian propaganda in relation to the ongoing conflict in West Papua. And then there is the example showing that the Chinese government, and in particular the Shanghai Police, has been trying to shape public opinion via social media and has been seeking the help of private companies for such ‘opinion management’, not only for domestic use but also elsewhere in the world.

Analysis of the information available on social media could identify such influence operations and would allow to distill the intent and interests that (state) actors may have, as well as the narratives they push. The speed of social media is of great advantage to these actors, especially compared to traditional media where articles have to be ‘planted’ and one had to wait whether an article would be picked up. Nowadays stories can go viral in a matter of hours. However, simultaneously such operations also leave clear traces on social media compared to the old fashioned influence operations and thus can be easier identified, attributed and possibly countered.

Identification of (new) threat actors and their intentions

Lastly there will indeed be cases where the purpose of information from social media helps identifying those with malicious intent and understanding the goals they pursue. Such information would for example be relevant in relation to terrorists, who want their voice to be heard and social media is nowadays the prime channel to reach an audience. Therefore they have to reveal themselves at which point they could be identified.

Likewise, intelligence operators will have to create social media profiles as part of their ‘legend’ or cover story. As the case of GRU operator named Sergey Vladimirovich Cherkasov a.k.a Victor Muller who tried to infiltrate the International Criminal Court in The Hague, shows, these profiles can be a great source to identify specific individuals and the methods they used.


The above examples show that whereas in practice the focus in SOCMINT often lies on the collection of personal data on individuals, the actual value of SOCMINT for intelligence purposes is much broader and largely lies in the raw material it provides for foundational and current intelligence.

Obviously, as always careful source validation is required which may be especially difficult because of the anonymity that users can have on social media platforms. Then again, source and information verification is important for any type of information collected, regardless of the collection discipline. And with 6 billion social media users constantly recoding their daily life, denial and deception strategies become increasingly hard to maintain.



Omand, D., J. Bartlett and C. Miller (2012) ‘Introducing Social Media Intelligence (SOCMINT)’, Intelligence and National Security Vol. 27(6): pp. 801–823.