VSI GLOBAL // ENTERPRISE ARCHITECTURE

OSINT-006-continuous-subject-monitoring-collection

11 min read

[SUBJECT] - Collection Map

OSINT-006 Continuous Subject Monitoring - collection workspace. Central topic = the monitored subject (person). Branches = watch criteria and data-point categories for the ongoing monitoring subscription. Drop each collected or newly-observed value as a child node; expand it with source, date observed, and what tripwire (if any) it triggered. Paste raw tool output into the node’s Notes. → feeds deliverable OSINT-006. Requires a seeded baseline: ingest OSINT-001-standard-subject-dossier before standing up lanes.

00 · Collection Plan - PIRs & EEIs

The standing intelligence requirements and essential elements of information (EEI) this service must keep current. Tick when satisfied for the reporting cycle; re-open each cycle. Maps to §1 Watch Criteria/Tripwires, §4 Escalation & Notification Triggers, and the ongoing gaps register.

PIR-1 - Is the subject’s identity anchor and selector set still current?

  • EEI: active phone number(s) confirmed in current cycle
  • EEI: active email address(es) confirmed in current cycle
  • EEI: active username/handle set confirmed across key platforms
  • EEI: current residential or operating address verified

PIR-2 - Has any new adverse/legal/regulatory item emerged since last cycle?

  • EEI: new court filings, arrests, charges, convictions identified
  • EEI: sanctions/PEP/watchlist status unchanged or change detected
  • EEI: new adverse media or damaging publications identified
  • EEI: regulatory / licensing action observed

PIR-3 - Has the subject’s digital footprint changed materially?

  • EEI: new or deleted social media accounts detected
  • EEI: new breach/paste/credential exposure observed
  • EEI: new domain registrations or web infrastructure observed
  • EEI: dark-web mention or leaked PII observed

PIR-4 - Have the subject’s network and associations changed?

  • EEI: new corporate filings / directorships / UBO appearances
  • EEI: new associates or co-signatories surfaced in public records
  • EEI: existing associations discontinued or altered (corporate resignations, etc.)

PIR-5 - Has the subject’s pattern of life deviated from the established baseline?

  • EEI: new geographic location or relocation signal observed
  • EEI: anomalous activity cadence (sharp increase/silence on monitored platforms)
  • EEI: travel indicator (visa applications, flight references, border-zone check-in) detected

PIR-6 - Are all active collection lanes healthy and within SLA?

  • EEI: each §2 source lane returned data within its scheduled cadence
  • EEI: no source lane degradation or access failure outstanding
  • EEI: previous-cycle gaps/RFIs resolved or carried forward

Collection gaps / RFIs (running)

  • [open item from current cycle] → route to [product / analyst / external request]
  • [open item]

00b · Monitoring Cadence & Triggers

OSINT-006 is a retained continuous service. This branch governs the watch schedule, refresh cadence per lane, alert thresholds, and escalation path. → feeds §1 Watch Criteria/Tripwires, §2 Collection Cadence & Sources, §3 Reporting Cadence, §4 Escalation & Notification Triggers, §5 Service Levels (SLA).

Active watch items (per §1 of deliverable)

Seed one block per §1 watch-item row. Clone per item.

  • [watch item - e.g. new criminal filing against subject]
    • Observable indicator:
    • Tripwire threshold:
    • Likelihood (1–5):
    • Impact (1–5):
    • L×I score:
    • Severity tier: [Critical 21–25 / High 16–20 / Elevated 11–15 / Moderate-Low 1–10]
    • Escalation route (→ §4 tier):
    • Status this cycle: [Open / Fired / Clear]
    • Notes / tool output:
  • [watch item 2]

Collection-lane refresh cadence

Map each §2 source lane to its scheduled check frequency and last-run timestamp.

  • [lane - e.g. court-record monitors]
    • Cadence: [continuous / hourly / daily / weekly]
    • Last run:
    • Next scheduled:
    • Source grade (Admiralty):
    • Status: [Healthy / Degraded / Offline]
  • [lane 2]

Alert thresholds & escalation path

  • Critical (L×I 21–25): notify within - method:
  • High (L×I 16–20): notify within - method:
  • Elevated (L×I 11–15): notify within - method:
  • Moderate / Low (L×I 1–10): include in next routine product - method:
  • False-positive protocol:

Routine reporting schedule

  • Routine periodic summary: cadence - next due - recipient
  • Tripwire alert: on-event, per §4 - last fired
  • Service-health / SLA report: cadence - next due

Cycle review log

  • [cycle - e.g. 2026-W25]
    • Tripwires fired:
    • Gaps carried forward:
    • Watch-list changes:
    • Notes:

01 · Identity & Biographic (Baseline Anchor)

Baseline identity established by OSINT-001 ingest; monitor for changes. Any selector change or new alias is itself a tripwire. → feeds §1 Watch Criteria (identity-change tripwire), §2 Collection Cadence, Annex A Source Register.

Names

  • Full legal name (baseline):
  • AKA / aliases (baseline):
  • NEW alias detected this cycle:
    • Source / URL:
    • Date observed:
    • Confidence: [H/M/L]

Birth & nationality

  • DOB / YOB (baseline):
  • Nationality / citizenship(s) (baseline):
  • Change detected:

Physical description / imagery (change detection)

  • Baseline photo reference:
  • New photo detected:
    • Source / URL:
    • Date:

02 · Contact & Selectors

The pivot core for ongoing monitoring. Baseline selectors from OSINT-001; monitor for additions, changes, or retirements. A new selector is itself an alert. Clone the sub-block per value. → feeds §1 Watch Criteria (selector change tripwire), §2 Collection Cadence & Sources.

Phone numbers

→ alert on new number; re-check carrier/app linkage each cycle.

  • [number - e.g. +1 555-0142]
    • Type / carrier: [mobile / landline / VoIP]
    • Status: [Active / Inactive / New this cycle]
    • Linked accounts / apps:
    • Where found (source + URL):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Last verified:
    • Notes / tool output: ← truecaller, caller-ID lookups
  • [number 2]

Email addresses

→ alert on new address; re-run breach/paste check each cycle.

  • [email]
    • Status: [Active / Inactive / New this cycle]
    • Linked accounts (acct discovery):
    • New breach / paste appearance this cycle:
    • Where found (source + URL):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Last verified:
    • Notes / tool output: ← holehe, h8mail, hunter.io
  • [email 2]

Usernames / handles

→ alert on new handle or abandoned account; re-run each cycle.

  • [handle - e.g. csmith200]
    • Platforms / where found (URL):
    • Status: [Active / Dormant / New this cycle / Deleted this cycle]
    • Linked email(s):
    • Linked phone(s):
    • Other accounts reusing it:
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Last verified:
    • Notes / tool output: ← idcrawl, sherlock, whatsmyname
  • [handle 2]

03 · Addresses & Locations

Monitor for relocation or new operating address. A change is a PIR-5 tripwire. → feeds §1 Watch Criteria (location-change tripwire), §2 Collection Cadence & Sources.

Current address (baseline)

  • [address]
    • Dates associated:
    • Basis / source:
    • Confidence: [H/M/L]

New address detected this cycle

  • [address]
    • Date first observed:
    • Source / URL:
    • Confidence: [H/M/L]
    • Tripwire fired: [Y/N - tier]

Other associated / frequented locations

  • [location - work / travel hub / contact point]
    • Type:
    • Basis:
    • Change from baseline: [Y/N]

04 · Digital Footprint

Monitor for new/deleted accounts, new web properties, new breach exposures. Every new or deleted account is a potential tripwire event. Clone per platform / asset. → feeds §1 Watch Criteria, §2 Collection Cadence (social/web lane), PIR-3.

Social media accounts

Clone per platform. Re-check activity status each cycle.

  • [platform - Facebook / X / Instagram / LinkedIn / TikTok / Telegram / other]
    • Handle / URL:
    • Status: [Active / Dormant / New this cycle / Deleted this cycle]
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Last activity observed:
    • Notable content / change this cycle:
    • Notes:

Websites / domains

→ monitor via whois/crt.sh/cert transparency for new registrations.

  • [domain]
    • Registrant / WHOIS:
    • Hosting / IP:
    • Status: [Active / Parked / New this cycle]
    • Notes / tool output: ← whois, crt.sh, viewdns.info
  • [domain 2]

Forums / communities / niche platforms

  • [site + handle]
    • Status: [Active / Dormant / New]
    • Last observed:

Breach / paste / data-broker exposure

Re-run each cycle; compare to baseline.

  • [indicator - email / username / phone]
    • Source / paste site:
    • Date observed:
    • New since baseline: [Y/N]
    • Significance / data exposed:
    • Notes / tool output: ← haveibeenpwned, dehashed, h8mail, intelx

05 · Network & Associations

Monitor for new associations, dissolved relationships, or new co-signatories. Each new high-risk associate is a potential escalation trigger. → feeds §1 Watch Criteria (network-change tripwire), PIR-4, §6 Review & Renewal.

Family & household

  • [name]
    • Relationship:
    • Basis / source:
    • Change from baseline: [Y/N]
    • Confidence: [H/M/L]

Business / professional associates

Clone per associate.

  • [name]
    • Relationship:
    • Basis / source:
    • New this cycle: [Y/N]
    • Risk indicator (sanctions / adverse):

Social / other associates

  • [name]
    • Relationship:
    • New this cycle: [Y/N]

06 · Employment, Education & Affiliations

Monitor for role changes, new corporate appointments, or loss of professional licences. A new directorship or resignation is a PIR-4 EEI. → feeds §1 Watch Criteria (affiliation-change tripwire), PIR-4.

Employment

  • [employer]
    • Role / title:
    • Dates:
    • Status: [Current / Changed this cycle / Ended this cycle]
    • Source:

Corporate appointments / directorships

→ monitor via OpenCorporates, national registries, Companies House, etc.

  • [entity]
    • Role (director / officer / UBO):
    • Jurisdiction / registry:
    • Appointment date:
    • Status: [Active / Resigned this cycle / New this cycle]
    • Notes / tool output: ← OpenCorporates, national business registries
  • [entity 2]

Licenses / memberships / professional bodies

  • [body / credential]
    • Status: [Current / Suspended / Revoked this cycle]
    • Source:

07 · Financial & Lifestyle Indicators

OSINT-visible only - indicators, not forensic trace. Monitor for new property, vehicles, or financial-stress signals. → feeds §1 Watch Criteria (financial-change tripwire), PIR-2.

Real property

→ check recorder / cadastral records each cycle.

  • [property]
    • Basis / record:
    • Status: [Baseline / New acquisition / Disposed this cycle]
    • Confidence: [H/M/L]

Corporate / business interests

  • [entity]
    • Role / stake:
    • Registry source:
    • Status: [Baseline / New / Exited this cycle]

Vehicles

  • [vehicle]
    • Make / model / plate:
    • Status: [Baseline / New / Disposed]

Financial-stress / adverse indicators

→ check court/UCC/lien databases each cycle.

  • [lien / judgment / bankruptcy / CCJ (public)]:
    • Jurisdiction:
    • Date:
    • New this cycle: [Y/N]

Observable lifestyle changes

  • [indicator - travel, social posts, new asset visible]:
    • Source:
    • Date:

08 · Legal & Derogatory

Core monitoring domain - any new charge, conviction, sanctions hit, or adverse media fires an alert. Distinguish charged vs. convicted vs. alleged; date and grade each. → feeds §1 Watch Criteria (legal/adverse-event tripwire), §4 Escalation, PIR-2.

Criminal / court records

→ monitor via PACER, state courts, international databases each cycle.

  • [matter]
    • Jurisdiction / case #:
    • Status / disposition:
    • New this cycle: [Y/N - tripwire tier if fired]
    • Source grade:

Civil litigation

  • [case]
    • Role (plaintiff / defendant):
    • Status / summary:
    • New this cycle: [Y/N]

Regulatory / professional actions

    • Body:
    • Action type:
    • Date:
    • New this cycle: [Y/N]

Sanctions / PEP / watchlist screening

→ re-screen each cycle against all applicable lists.

  • OFAC SDN / Consolidated: [Clear / Hit / Near-match]
  • EU / UK / UN sanctions:
  • PEP databases:
  • INTERPOL / national wanted lists:
  • Last screened:
  • Change from last cycle: [Y/N - specify]

Adverse media

→ run media monitoring searches each cycle.

  • [outlet + date]
    • Substance:
    • New this cycle: [Y/N]
    • Tripwire tier (if applicable):
    • Reliability (A–F) / Credibility (1–6):
    • Notes / tool output: ← Google Alerts, media search, Factiva/Nexis lane if available

09 · Media & Imagery

Monitor for new photos, videos, or media appearances. New imagery may update pattern-of-life or reveal location/association changes. → feeds §2 Collection Cadence (media lane), PIR-3, PIR-5.

Photos of subject

  • [image ref]
    • Source / URL:
    • Date observed:
    • Metadata (EXIF):
    • New since baseline: [Y/N]
    • Reverse-image check run: [Y/N]

Avatar / profile picture

  • [image]
    • Platform:
    • Changed since last cycle: [Y/N]
    • Reverse-image locations used:

Video / audio appearances

  • [file / URL]
    • Source / date:
    • New this cycle: [Y/N]
    • Notes:

10 · Pattern of Life

Ongoing pattern-of-life layer. Compare each cycle against the OSINT-001 baseline; flag deviations as PIR-5 tripwires. Open-source only - no covert or physical surveillance. → feeds §1 Watch Criteria (PoL deviation tripwire), §3 Reporting Cadence, PIR-5.

Routine & temporal patterns (baseline)

  • [observed baseline cadence - e.g. posts Mon-Fri 08:00–18:00 UTC]:

Deviation detected this cycle

  • [departure from pattern]
    • Date observed:
    • Source:
    • Tripwire fired: [Y/N - tier]
    • Significance:

Geographic footprint

  • [habitual location]:
    • Confirmed this cycle: [Y/N]

Travel & mobility indicators

→ monitor check-ins, EXIF geotag, flight/visa references.

  • [observed travel signal]
    • Source / URL:
    • Date:
    • Destination / route:
    • Confidence: [H/M/L]

Anomalies / escalations

  • [anomaly description]:
    • Date:
    • Escalation tier triggered:

99 · Collection Admin

Working register - not a deliverable section, but the audit trail behind the service. → feeds Annex A Source & Watch-List Register, Annex B Onboarding/Offboarding Checklist, §5 SLA.

Source register

Every material datum traceable to a graded source. Grade per NATO Admiralty (A–F × 1–6).

  • [S-1 - source / lane]
    • Type: [Primary / Secondary / Tertiary]
    • Reliability (A–F) / Credibility (1–6):
    • Cadence / last accessed:
    • Lane health: [Healthy / Degraded / Offline]
    • Notes:

Evidence archive

  • [screenshot / capture ref + hash + URL + timestamp]:

SLA compliance log

  • [metric - e.g. alert delivery time, critical tier]
    • Target:
    • Achieved this cycle:
    • Miss / credit triggered: [Y/N]

Onboarding / offboarding checklist status

  • Authority / consent captured and on file
  • Baseline (OSINT-001) ingested and watch list seeded
  • Collection lanes stood up and verified
  • Tripwires configured and tested
  • Data retention / destruction schedule documented
  • Offboarding terms documented

Open gaps / verification pending (carry-forward)

  • [item outstanding - source, date opened, routing]
  • [item]

Watch-list change log

  • [date] - [watch item added / retired / threshold adjusted] - authorized by:

Graph View