Beyond Keywords: Rethinking OSINT with Signal-Based Detection
On June 6th, 2025, Los Angeles experienced widespread protests following Immigration and Customs Enforcement raids across California. While many of these protests were peaceful, some escalated into full-scale riots, resulting in a state of emergency declaration, national guard and marine deployments, and numerous injuries.
As tensions rose between Los Angeles residents, the state government, and federal authorities, several critical questions emerged:
What early indicators pointed to the speed and scale of escalation?
What are the limitations of current detection methods in this context?
Had a signal-based detection approach been leveraged, what underlying themes or sentiment patterns might have emerged, and how could this have informed law enforcement or crisis response strategies?
It’s important to keep these in mind when discussing the challenges and needs of the intelligence community within technology development circles.
Intelligence organisations — particularly in the OSINT domain — are being outpaced by the rapid growth of publicly available information. The sheer volume and speed of this data make it impossible to monitor effectively through manual methods alone. Even with certain OSINT technologies in place, critical blind spots persist.
This is largely due to the limitations of Boolean logic, which relies on predefined parameters to monitor known phenomena. While effective for validating known threats and monitoring ongoing issues, this approach falls short when it comes to detecting signals.
That’s where signals-based logic offers a critical advantage.
By shifting OSINT from a reactive validation tool to a proactive, forward-looking capability, it enables the detection of emerging narratives and signals that traditional systems would miss. For organisations like law enforcement, this means improved situational awareness and a greater ability to detect, plan for, and respond to potential crises as they develop, ultimately helping to reduce risk.
The subsequent sections of this report will discuss how signal-based detection could have provided indications of several risk factors in relation to the June 2025 protests in Los Angeles.
The lead-up to the protests
Law enforcement agencies such as the Los Angeles Police Department leverage OSINT for situational awareness, tactical operations and analytical insight.
Given the department’s investment in OSINT platforms over the last few years, it can be assumed that the department would have had surface-level awareness of the impending protests leading up to June 6th. However, the sheer volume of data makes it nearly impossible to manually identify meaningful indicators. As a result, it’s unlikely that the department had a deep understanding of the sentiment and narratives that pointed to operational risks, including discourse volatility, misinformation, and overt calls for violent action.
Risk indication & situational awareness
In addition to providing law enforcement agencies with advanced warning of protests, a signals-based logic capability would have enabled law enforcement to surface emerging narratives, providing insight into the intent and sentiment of the protesters. These are crucial indicators when assessing the risk of violence.
Figure 1
Figure 2
Figure 3
This includes a multitude of posts (see figures 1, 2 and 3) that reflect calls to action framed around themes of secessionism and anti-fascism. While not true for every instance, it is worth noting that these themes are often tied to violent resistance.
Between June 1st and 21st, secessionist and anti-fascist terminology returned 22,400 and 222,000 mentions, respectively. Both terms peaked on June 10th, coinciding with the deployment of a Marine battalion to Los Angeles and an escalation in protest violence.
Tactical insights & SOCMINT enhancement
Signal-based logic also provides tactical insights that support real-time operational decision-making. For example, it can detect posts leaking police movement or positioning (see figure 4). Surfacing these posts early can help shape tactical response strategies.
Figure 4
Counter-messaging & Misinformation Detection
These protests highlight the importance of detecting misinformation as it emerges. Legacy detection methods rely on known patterns, but signal-based logic enables the surfacing of misleading or false narratives before they gain traction.
Among the most prominent misinformation incidents was a false report of an Immigration and Customs Enforcement (ICE) raid at a Los Angeles hardware store prior to the protests, which inflamed tensions and greatly exacerbated the situation. Isolated online sources further alleged the use of live rounds from law enforcement (Figure 5).
Figure 5
While the latter allegation seemingly failed to prompt a significant impact on discourse within Los Angeles, such issues serve as examples of potential accelerants that necessitate action early on. Thus, highlighting the need for a capability that is broad in its source coverage and capable of detecting signals without pre-defined keywords.
Lessons learned
The June 2025 Los Angeles protests highlight the need for a shift in data collection technology and methods. As data continues to expand at an increasing pace, keyword parameters alone are no longer sufficient. The capacity to extract intent and narrative without solely relying on such parameters is no longer a question of ‘if’ organisations should adopt such technology, but a necessity to maintain effective SOCMINT insight offerings.
KINTEL, a capability layer developed by KINSHIP Digital, enhances existing intelligence systems by bridging the gap between known and unknown phenomena. Leveraging descriptive, signal-based logic, it departs from legacy data collection methods and surfaces relevant insights without the need for predefined searches. Its access to publicly and legally available data sources transforms social media intelligence from a validation layer into a forward-leading capability.
If you would like to know more about KINTEL, don’t hesitate to reach out.