OSINT is a powerful weapon against extremism
Updated: Jan 22
In a hallway in one of most iconic symbols of Western democracy, a woman lay fatally wounded on the marble floor. Just moments before her death, Ashli Babbitt was part of an angry crowd who had attacked police officers and stormed security barriers, before swarming inside the Capitol building. Most of the world viewed those events with incredulity. Not everyone, though.
To the open-source intelligence (OSINT) community, the images were met with a weary, frustrated sigh. Many analysts, from organisations including Hope Not Hate and the Institute of Strategic Dialogue, had warned of the violence to come.
On the day, they were already hard at work, identifying and cataloguing far-right militia elements within the crowd. These analysts are highly skilled digital detectives. They verify complex events and build a picture of those involved, based solely on a trail of virtual breadcrumbs left online. In the weeks and months leading-up to the rally, our analysts identified members of extremist groups openly stating that they planned to attend the event and “burn down DC”.
“The Day of the Broken Glass”, as Arnold Schwarzenegger so memorably described it, is proof that online conversations have real world consequences. Far-right narratives have power. Five people lost their lives at the Capitol. We need to learn lessons here in the UK, fast.
OSINT remains one of the best tools we have today to track far-right narratives and identify individuals and organisations responsible for violence. Governments, however, have been slow to appreciate the value of OSINT in the social media age, some dismissing it as a ‘hobby’ for tech geeks. That needs to change.
First, the UK government needs to invest in OSINT monitoring to respond to major events. It takes time to build an accurate picture of online communities. Through long-term projects, analysts learn both where to look and what to look for. In the case of the far-right in the US, expertise developed over time has identified the specific terminology, signals and insignia used by extremists.
While mainstream reporting acknowledged the influence of far-right QAnon conspiracy theories on the storming of the Capitol, early reporting failed to pick-up the less overt extremist factions present in the crowd. Our analysts were able to identify, in near real-time, the subtle hand gestures used by extremists to signify white power; apparently innocuous sweatshirt logos that indicated membership of particular militia groups; and subtle clothing worn by members of the far-right Proud Boys. The presence of these extremist elements in the Capitol becomes all the more significant as images emerged of rioters on the Senate floor carrying hand restraints; potentially signifying a failed hostage plot.
Second, the government must recognise and understand that Wednesday’s events were the result of long-term narrative trends. Niche, complex communities form around this rhetoric. Media attention is often focused on singular news events, with factcheckers and others attempting to “debunk” false stories in a piecemeal way. Yet in reality, many of those at the DC rally now subscribe to an entirely ‘alternate truth’, reinforced by an ecosystem of alternative media, public figures and social media echo-chambers and fed by conspiracies and disinformation.
This environment provides fertile ground for the violence witnessed at Wednesday’s rally. Indeed, even as these events were unfolding, members of this ecosystem were already sharing new conspiracies claiming that the crowd had been infiltrated by “the Left” and that most violent footage had been staged. Through long-term analysis, OSINT can identify these vulnerable audiences. In the case of the far-right this has often included veterans and serving and former law enforcement officers. These insights can offer a pathway to targeted solutions.
Third, there must be recognition that the impact of disinformation and conspiracies is not a problem limited to the far-right. Without action to challenge malign narratives online, there are likely to be further real-world casualties. In the UK early evidence of this has already been demonstrated during the Covid-19 pandemic, with telecommunications systems damaged by groups targeting 5G antennas which they believe cause the virus. Other say that they will refuse a vaccine, following a wave of vaccine misinformation online. OSINT can help identify and expose the networks and organisations creating these disinformation ecosystems.
As more footage emerges of the Capitol siege, analysts continue to identity the perpetrators responsible for the worst of the violence. Meanwhile, extremists have continued to post online: reorganising their communication channels in response to the shutdown of Parler: a popular platform amongst the far-right community. Further threats have already been uncovered by analysts investigating these fringe channels, finding evidence of militia appearing to plan their attendance at armed demonstrations across the United States.
To prevent the desecration of our own temples to democracy, the government should work with the OSINT community urgently now to anticipate these events. While the danger of this online discourse is now crystal clear; the work of the OSINT community offers hope for a solution.
Kim Williams is Associate Director of Programmes & Research