VSI GLOBAL // ENTERPRISE ARCHITECTURE

OSINT-004-subject-threat-assessment-collection

12 min read

[SUBJECT FULL NAME] - Collection Map

OSINT-004 Subject Threat Assessment - collection workspace. Central topic = the subject posing a potential threat. Branches = data-point categories for threat assessment. Drop each collected value as a child node; expand it with where it was found and behavioral significance. Paste raw tool output and communications into the node’s Notes. → feeds deliverable OSINT-004. IMMINENT DANGER: If collection surfaces evidence of imminent risk, stop and escalate to law enforcement immediately.

00 · Collection Plan - PIRs & EEIs

The questions this threat assessment must answer + essential elements of information (EEI) for each. Tick as satisfied. → drives §3 Key Judgments, §4 Threat Intelligence Requirements (PIRs), §11 Threat Classification & Level Determination, §16 Collection Gaps & RFIs.

PIR-1 - Intent: Does the subject have intent to harm the protectee?

  • EEI: explicit or implicit statements of intent to harm (communications, social media, third-party reporting)
  • EEI: ideation evidence - violence framed as a solution to grievance
  • EEI: instrumental vs. expressive tone across all communications
  • EEI: last-resort / desperation language (“no other option”, time-imperative framing)

PIR-2 - Capability: Does the subject have the means to carry out an attack?

  • EEI: weapons access or acquisition (purchase, possession, online browsing/searches)
  • EEI: relevant skills / training (military, law-enforcement, tactical, MMA)
  • EEI: financial capacity to enable movement or acquisition
  • EEI: physical capacity (mobility, fitness indicators)

PIR-3 - Access & Opportunity: Can the subject reach the protectee?

  • EEI: physical proximity of subject’s known locations to protectee’s locations
  • EEI: subject’s knowledge of protectee routines, addresses, workplaces, schedules
  • EEI: prior physical approach attempts, surveillance indicators, reconnaissance
  • EEI: upcoming exposure windows (known events, predictable protectee locations)

PIR-4 - Pathway Progression: How far along the pathway to violence is the subject?

  • EEI: furthest confirmed pathway stage (grievance → ideation → research/planning → preparation → breach → attack)
  • EEI: velocity of progression (days/weeks between stages)
  • EEI: evidence of stage-skipping or acceleration
  • EEI: TRAP-18 proximal warning behaviors present (clustered or isolated)

PIR-5 - Stabilizers & Inhibitors: What is braking potential escalation?

  • EEI: active employment, family ties, social anchors
  • EEI: ongoing legal jeopardy that creates disincentive
  • EEI: known supervision (probation, mental health, security program)
  • EEI: prior de-escalation events / history of stepping back from the edge

PIR-6 - Hunter vs. Howler: Is the subject instrumentally targeting or expressively venting?

  • EEI: communications tone - goal-directed (hunter) vs. emotional/public (howler)
  • EEI: pattern of seeking attention vs. avoiding detection
  • EEI: audience for threats - private to protectee or broadcast to third parties
  • EEI: history of following through on stated threats vs. repeated non-action

Collection gaps / RFIs (running)

  • [open item] → route to [product / PIR]
  • [open item]

00b · Monitoring Cadence & Triggers

OSINT-004 is a one-time engagement. However, §17 of the deliverable mandates reassessment triggers and hands off to OSINT-006 Continuous Subject Monitoring if the case is retained. Capture the trigger conditions here so collection can be re-opened and scoped instantly. → feeds §13 Escalation Indicators & Tripwires, §17 Reassessment Triggers & Cadence.

Tripwire watch items (collection re-open triggers)

  • Subject acquires or is observed with a weapon
  • Subject physically approaches protectee location or known route
  • New threatening communication received
  • Subject’s employment or housing status changes abruptly (destabilizer event)
  • Subject enters mental-health crisis (observable, non-clinical indicators)
  • Any law-enforcement contact / arrest since as-of date
  • Third party reports escalating subject behavior (leakage to a new person)

Refresh cadence (if monitoring handoff to OSINT-006 is authorized)

  • Active case (High/Imminent): hours / days between sweeps
  • Managed case (Moderate): days between sweeps
  • Passive case (Low): weeks between sweeps

Alert thresholds & escalation path

  • Threshold for immediate LE referral: [Imminent / High + new tripwire]
  • Alert owner:
  • Escalation path:

01 · Identity & Biographic

Who the subject is, verified vs. claimed. Establish unique identity before threat attribution. → feeds §5 Subject–Target Nexus (establishes who the subject is), §12 Verified Findings Summary.

Names

  • Full legal name:
  • Middle name / initial:
  • Maiden / former name:
  • AKA / aliases:
  • Transliterations / native script:

Birth & nationality

  • DOB / YOB:
  • Place of birth:
  • Nationality / citizenship(s):
  • Government / national ID (partial/redacted):

Physical description

  • Description:
  • Distinguishing features (tattoos, marks, scars):
  • Languages spoken:

Subject–Protectee relationship (overview)

  • Relationship type: [Former employee / intimate partner / litigant / stranger-fixated / ideological adversary / other]
  • Relationship origin:
  • Duration of relationship / contact:

02 · Contact & Selectors

The pivot core for attribution and communications tracing. Each value is its own node - expand it with where it appears and what links to it. Critical for identifying all communications channels the subject used toward the protectee. Clone the sub-block per value. → feeds §5 Subject–Target Nexus (contact/communication history), §6 Behavioral Warning Indicators.

Phone numbers

→ feeds §5 contact/communication history, §8 Capability Access & Opportunity (proximity indicators).

  • [number - e.g. +1 555-0142]
    • Type / carrier: [mobile / landline / VoIP / burner]
    • Linked accounts / apps:
    • Used to contact protectee? [Y/N/Unknown]
    • Where found (source + URL):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Notes / tool output: ← (truecaller, caller-ID, carrier lookup)
  • [number 2]

Email addresses

→ feeds §5 contact/communication history, §6 Behavioral Warning Indicators (leakage, direct threat communications).

  • [email]
    • Linked accounts (account discovery):
    • Breach / paste appearances:
    • Used to contact protectee? [Y/N/Unknown]
    • Tone of communications sent: [Threatening / Neutral / Expressive]
    • Where found (source + URL):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Notes / tool output: ← (holehe, h8mail, hunter.io)
  • [email 2]

Usernames / handles

→ feeds §5 contact/communication history, §6 Behavioral Warning Indicators (fixation, leakage, energy burst).

  • [handle - e.g. jdoe_angry99]
    • Platforms / where found (URL):
    • Linked email(s):
    • Linked phone(s):
    • Other accounts reusing it:
    • Content relevant to protectee / grievance? [Y/N - summary]:
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Notes / tool output: ← (idcrawl, sherlock, whatsmyname)
  • [handle 2]

03 · Addresses & Locations

Establishes subject’s physical proximity to protectee - core to §8 Capability, Access & Opportunity. Determines whether access exists regardless of intent. → feeds §8 Capability Access & Opportunity, §5 Subject–Target Nexus.

Current address

  • [address]
    • Distance from protectee’s known location(s):
    • Dates associated:
    • Basis / source:
    • Confidence: [H/M/L]

Previous addresses

  • [address]
    • Dates:
    • Proximity to protectee (then):
    • Source:

Other associated locations (work, frequented, observed)

  • [location]
    • Type: [work / frequented / observed transit / travel hub]
    • Proximity to protectee routes/locations:
    • Basis:

Surveillance / reconnaissance indicators

  • [location where subject was observed near protectee / protectee’s location]
    • Date / frequency:
    • Basis / source:
    • Pathway relevance: [Probing / Reconnaissance / Coincidental]

04 · Digital Footprint

Maps the subject’s online presence for warning behaviors, grievance escalation, leakage, fixation, and energy burst. Content is evidence of behavioral warning indicators. → feeds §6 Behavioral Warning Indicators, §9 Intent Motivation & Grievance, §14 Analysis of Competing Hypotheses.

Social media accounts

Clone per platform. Flag any content referencing the protectee, grievance, weapons, violence ideation.

  • [platform - Facebook / X / Instagram / LinkedIn / TikTok / Telegram / other]
    • Handle / URL:
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Status: [Active / Dormant]
    • Protectee-referenced content? [Y/N - date range]:
    • Warning-behavior indicators observed: [Fixation / Leakage / Identification / Energy Burst / Direct Threat / None]
    • Notes (content / tone / escalation arc):

Websites / domains

  • [domain]
    • Registrant / WHOIS:
    • Hosting / IP:
    • Grievance / threat-relevant content:
    • Notes: ← (whois, crt.sh)

Forums / communities / dark web

  • [site + handle]:
    • Content relevance to threat:
    • Date range active:

Breach / paste / data-broker exposure

  • [indicator]
    • Source:
    • Date observed:
    • Significance to threat assessment:

05 · Network & Associations

Identifies who the subject may have leaked to (warning behavior: leakage), potential co-actors, and who may be able to influence or stabilize the subject. → feeds §6 Behavioral Warning Indicators (leakage), §10 Risk & Protective Factors (stabilizers), §17 Threat Management (intervention leverage).

Family & household

Family members can be both stabilizers (leverage for intervention) and sources of leakage.

  • [name]
    • Relationship:
    • Stabilizer or destabilizer? [S/D/Unknown]
    • Has subject leaked intent to this person? [Y/N/Unknown]
    • Basis / source:
    • Confidence: [H/M/L]

Business / professional associates

  • [name]
    • Relationship:
    • Contact with subject since triggering event:
    • Basis:

Online / ideological community ties

Especially relevant for ideologically motivated subjects; community may reinforce or validate grievance.

  • [community / group]
    • Subject’s role / activity level:
    • Community stance toward protectee or grievance type:
    • Basis:

Known enablers / influencers (persons escalating subject’s grievance)

  • [name]
    • Role in subject’s escalation:
    • Basis:

06 · Employment, Education & Affiliations

Employment status is a key stabilizer/destabilizer dynamic factor. Recent job loss is a common precipitating event. Skills and training (military, weapons, security) feed §8 Capability. → feeds §8 Capability Access & Opportunity, §10 Risk & Protective Factors.

Employment

  • [employer]
    • Role / title:
    • Dates:
    • Status at time of assessment: [Employed / Terminated / Resigned / Unknown]
    • Subject’s reported view of departure:
    • Verified / claimed:

Education

  • [institution]
    • Credential / dates:
    • Relevant training (tactical, technical, weapons):
    • Verified / claimed:

Military / law-enforcement / security service

Critical for capability assessment - training, weapons proficiency, tactical knowledge.

  • Branch / agency / role:
    • Dates:
    • Discharge type / circumstances:
    • Weapons qualifications:
    • Basis / source:

Licenses / memberships / certifications

  • [license / membership]
    • Type: [Firearms / Security / Professional / Other]
    • Current / lapsed:

07 · Financial & Lifestyle Indicators

Financial stress is a common destabilizer. Observable lifestyle indicators can also surface capability (weapons purchases) and pathway behaviors (stockpiling, resource mobilization). → feeds §8 Capability Access & Opportunity, §10 Risk & Protective Factors (destabilizers).

Real property

  • [property]
    • Basis / record:
    • Confidence: [H/M/L]

Corporate / business interests

  • [entity]
    • Role / stake:
    • Registry source: ← (OpenCorporates, state registries)

Financial-stress / adverse indicators

  • [lien / judgment / bankruptcy / foreclosure (public)]:
    • Date:
    • Source:
    • Destabilizer relevance:
  • [indicator - e.g. public social post, forum activity, firearms-store sighting]
    • Date:
    • Source:
    • Capability relevance:

Observable lifestyle changes (OSINT-visible)

  • [indicator - e.g. social media posts indicating isolation, travel, new associates]
    • Date:
    • Dynamic factor type: [Destabilizer / Stabilizer / Neutral]

08 · Legal & Derogatory

Prior violence, restraining orders, and threatening-behavior charges are the strongest static risk factors. Prior TROs, no-contact orders, or trespass bans against THIS protectee are directly material. → feeds §10 Risk & Protective Factors (static factors), §11 Threat Classification & Level Determination, §5 Subject–Target Nexus (prior protective/legal actions).

Criminal / court records

  • [matter]
    • Jurisdiction / case #:
    • Charges - violence-related: [Y/N - specify]:
    • Status / disposition:
    • Source grade:

Prior targeted / threatening behavior toward this protectee or others

  • [incident]
    • Target (this protectee or prior target):
    • Nature: [Communication / Physical approach / Assault / Stalking / Other]
    • Date:
    • Outcome / disposition:
    • Source grade:

Civil litigation

  • [case]
    • Role (plaintiff/defendant):
    • Parties involved:
    • Status / summary:
    • Grievance relevance:

Restraining orders / no-contact / trespass bans

  • [order]
    • Issuing jurisdiction:
    • Protected party(ies):
    • Current status: [Active / Expired / Violated]:
    • Source:

Regulatory / professional actions

Sanctions / watchlist screening

  • OFAC SDN / Consolidated: [Clear / Hit / Near-match]
  • EU / UK / UN sanctions:
  • Terrorist / violent-extremist databases (publicly available):

Adverse media

  • [outlet + date]
    • Substance:
    • Reliability (A–F) / Credibility (1–6):

09 · Communications Index

All communications from the subject to or about the protectee, graded and characterized for behavioral warning indicators. Communications are primary evidence. Every item should be preserved with chain of custody. → feeds §6 Behavioral Warning Indicators (direct threat, leakage, fixation), §5 Subject–Target Nexus (contact history), Appendix B Communications Index.

Direct communications to protectee

Clone per communication. Characterize tone and behavioral indicator.

  • [communication ref - e.g. Email 2024-11-03]
    • Channel: [Email / Letter / Phone / Text / Social DM / In-person / Other]
    • Date / time:
    • Content summary:
    • Tone: [Threatening / Intimidating / Expressive / Neutral / Conciliatory]
    • Warning behavior coded: [Direct threat / Leakage / Last resort / None / Other]
    • Evidence preserved (hash + location):
    • Source grade:
  • [communication ref 2]

Third-party reports of subject statements (leakage)

Clone per report.

  • [leakage report ref]
    • Reporting party:
    • Content summary:
    • Date of statement / date reported:
    • Corroborated? [Y/N]:
    • Source grade:

Subject’s public posts / open-source statements relevant to grievance or threat

  • [post ref - platform + date]
    • Content summary:
    • Warning behavior coded: [Fixation / Identification / Energy burst / Last resort / None]
    • URL / archived URL:

10 · Pattern of Life

OSINT-observable routine and behavioral patterns. Changes in pattern (energy burst, anomalous activity, sudden isolation) are key behavioral warning indicators. → feeds §6 Behavioral Warning Indicators (energy burst, pathway behaviors), §7 Pathway-to-Violence Assessment (preparation/breach stages), §8 Capability Access & Opportunity.

Routine & temporal patterns

  • [observed cadence - e.g. commute times, regular locations, online posting schedule]:

Geographic footprint

  • [habitual location]:
    • Proximity to protectee:

Travel & mobility

  • [observed travel - destinations, frequency, mode]:
    • Dates:
    • Relevance to protectee location:

Energy burst / anomalous behavioral changes (key warning signal)

Sudden increase in activity, contact attempts, research, or preparation behaviors.

  • [anomaly observed]
    • Date / timeframe:
    • Nature:
    • Pathway stage implication:
    • Source:

Weapons / tactical interest indicators (behavioral)

  • [observed indicator - social post, purchase, club membership, range attendance]
    • Date:
    • Source:

99 · Collection Admin

Working register - not a deliverable section, but the audit trail behind it. → feeds §18 Sources & Methodology, Appendix D Source Index, Appendix E Evidence Archive.

Source register

Every material datum traceable to a graded source (Admiralty A–F / 1–6).

  • [S-1 - source]
    • Type: [Record / Communication / Collateral / OSINT / Law enforcement / Court]
    • Reliability (A–F) / Credibility (1–6):
    • Date accessed:

Evidence archive

Chain-of-custody log for all preserved communications and records.

  • [screenshot / capture ref + hash + URL + timestamp]:

Behavioral timeline (working chronology)

Running log for Appendix A Behavioral Timeline. Date-stamp every behavioral data point.

  • [YYYY-MM-DD - event / communication / behavior observed]:
    • Source:
    • Pathway stage:

Open gaps / verification pending

  • [item submitted, not yet returned - route to PIR]:

Tripwires observed during collection (log immediately)

  • [tripwire event + date + source + action taken]

Graph View