Advanced Intelligence & Investigative Tradecraft

3-Day Operational Training Programme • Course Syllabus & Timetable

​

Day 1: AI in OSINT & SOCMINT Intelligence Gathering

Focus: Leveraging artificial intelligence, automated collection pipelines, and machine learning models to accelerate open-source and social media intelligence workflows while mitigating cognitive bias and operational friction.

 

Time

Session

Key Topics & Learning Objectives

09:00 – 10:15

The Modern OSINT Landscape & AI Foundations

• Machine learning vs large language models (LLMs) in open-source collection

• Automated data ingestion pipelines and API wrappers

• Establishing operational security (OPSEC) when routing queries through AI platforms

10:15 – 10:30

Morning Break

—

10:30 – 12:00

Automated SOCMINT & Network Graphing

• Scraping and parsing social media data at scale (Telegram, X, Meta, TikTok)

• Entity extraction, automated sentiment analysis, and botnet identification

• Constructing social graph models to map influencer nodes and illicit networks

12:00 – 13:00

Lunch Break

—

13:00 – 14:30

Computer Vision, Multimodal Analysis & Geolocation

• Reverse image recognition and visual artifact identification

• Automated optical character recognition (OCR) and speech-to-text in multi-language contexts

• AI-assisted chronolocation, satellite imagery processing, and terrain matching

14:30 – 14:45

Afternoon Break

—

14:45 – 16:15

Counter-AI, Synthetic Media & Verification

• Detecting deepfakes, synthetic voice generation, and generative adversarial network (GAN) imagery

• Identifying AI-generated disinformation campaigns

• Digital chain of custody and evidentiary standards for AI-filtered material

16:15 – 17:00

Practical Syndicate Exercise & Debrief

• Scenario-driven capture-the-flag (CTF): Rapid persona profiling using automated tooling

• Methodological review and daily wrap-up

 

 

Day 2: Dark Web Investigations for Law Enforcement

Focus: Technical methodologies for navigating hidden services, deanonymising threat actors, executing cryptocurrency attribution, and building court-admissible evidential packages.

 

Time

Session

Key Topics & Learning Objectives

09:00 – 10:15

Decentralised Architectures & Investigator OPSEC

• Tor onion routing mechanics, I2P, Freenet, and alternative decentralised layers

• Building isolated, non-attributable virtual research environments (VREs)

• Counter-surveillance, metadata sanitisation, and digital compartmentalisation

10:15 – 10:30

Morning Break

—

10:30 – 12:00

Marketplace Mapping, Forums & Actor Reconnaissance

• Indexers, custom dark web scrapers, and persistent monitoring techniques

• TTPs of illicit vendors across narcotics, weapons, fraud, and ransomware-as-a-service (RaaS)

• Extracting infrastructure breadcrumbs: misconfigured web servers, TLS certificates, and PGP keys

12:00 – 13:00

Lunch Break

—

13:00 – 14:30

Cryptocurrency Forensics & Asset Tracking

• Blockchain fundamentals: Bitcoin UTXO models vs Ethereum account structures

• Heuristics: change address detection, peel chains, and cluster analysis

• Tackling obfuscation: mixers, CoinJoin, privacy coins (Monero), and unlicensed off-ramps

14:30 – 14:45

Afternoon Break

—

14:45 – 16:00

Deanonymisation, Attribution & Legal Frameworks

• Correlating dark web identifiers to clearnet digital footprints

• Evidential capture, hash integrity, and courtroom-admissible disclosure rules

• Mutual Legal Assistance Treaties (MLAT) and cross-border server takedowns

16:00 – 17:00

Simulated Investigation Exercise

• Tracking a dark web vendor: infrastructure analysis to fiat off-ramp identification

• Syndicate presentation of investigative findings

 

 

Day 3: Human Intelligence (HUMINT) & Covert Human Intelligence Sources (CHIS)

Focus: Authorisation frameworks, source recruitment lifecycle, digital cover personas, operational tradecraft, and risk management when running human sources in contemporary operational environments.

 

Time

Session

Key Topics & Learning Objectives

09:00 – 10:15

Statutory Governance & Authorisation Frameworks

• Legal compliance: Regulation of Investigatory Powers Act (RIPA) / relevant statutory instruments

• The roles and distinct boundaries of the Authorising Officer, Handler, and Controller

• Necessity, proportionality, and collateral intrusion assessments

10:15 – 10:30

Morning Break

—

10:30 – 12:00

Source Lifecycle: Identification to Recruitment

• Spotting, assessing, and evaluating potential sources

• Understanding source motivations (MICE / RASP frameworks)

• Elicitation techniques, initial approach mechanics, and securing buy-in

12:00 – 13:00

Lunch Break

—

13:00 – 14:15

Handling Mechanics & Physical Tradecraft

• Briefing and debriefing protocols; cognitive interviewing techniques

• Covert communications, meeting arrangements, and counter-surveillance checks

• Documenting human intelligence: sanitising source reports and protecting identities

14:15 – 14:30

Afternoon Break

—

14:30 – 15:45

Online Covert Human Intelligence (Cyber CHIS) & Digital Cover

• Deploying digital personas, legend building, and backstopping

• Navigating end-to-end encrypted messaging apps and private chat groups

• Recognising and countering provocation, entrapment risks, and agent provocateur boundaries

15:45 – 17:00

Risk Assessment, Welfare & Course Debrief

• Dynamic risk assessments, duty of care, and source welfare management

• Handling compromised operations, source extraction, and formal termination

• Course summary, integration of Days 1–3, and final Q&A