Protective intelligence · OSINT · Event risk
From public information to informed protective decisions
I use public-source information, behavioural indicators and business context to understand how emerging issues can affect people, organisations, operations, and assets.
356
public-source items
0
credible direct threats
Synthetic case study: snapshot
356
Public-source items
104
Accounts in the synthetic dataset
11
Calls to interrupt presentations
0
Credible direct threats
The case examines how general public criticism can develop into organised activity around a specific event, while recognising that although activism heightens security risks, it is not necessarily a physical threat.
Cause does not equal threat.
Behaviour changes the risk picture.
Escalation flow: behaviour changes the risk
- 1. Broad criticism: Companies and relationships criticised
- 2. Event targeting: Speakers, sessions and venue named
- 3. Calls to interrupt: Explicit disruption intent (MLCOA)
- 4. Harm indicators: Weapons, injury intent, access to restricted areas (MDCOA)
Case Study
From activism to event disruption
✦ DisclaimerThis is a work of fiction. Names, characters, businesses, places, events and incidents in the synthetic scenario are products of the author's imagination or used in a fictitious manner. Any resemblance to actual persons, living or dead, or actual events is coincidental. Real-world incidents are referenced separately for professional context only.
From online mobilisation to live-event interruption, business impact and protective decision-making.
The Crestwell Leadership Forum is a fictional two-day UK tech industry event with 2,400 attendees, livestreamed keynotes and 18 senior corporate speakers.
Two unrelated fictional activist networks, People Against Tech and AI (PATAi) and Animals Have Rights (AHR), begin focusing on the event.
One campaign criticises a cloud-services sponsor over alleged links connected to the Gaza-Israel conflict. A separate animal-rights campaign focuses on another company over an alleged supplier relationship with a regulated research-animal business.
There is no evidence that the two networks are coordinating.
The intelligence problem is not whether people are allowed to criticise the companies. The question is whether public activity is changing in ways that could affect event continuity, executive exposure, business reputation or physical safety.
Real-world context
Why this matters now
Corporate presentations, shareholder meetings and high-profile events can become stages for issue-motivated activism. A disruption that lasts only minutes inside the room will likely reach a much larger audience through livestreams, social media and news coverage.
Reuters · 5 April 2025
Microsoft AI CEO's remarks interrupted by pro-Palestinian protester
A senior Microsoft presentation was interrupted by a protester raising concerns about the company's relationship with Israel and the use of its technology. Microsoft disputed claims that its technology had been used to harm people in Gaza.
Source (opens in a new tab)Associated Press · 22 May 2025
Microsoft fires employee who interrupted CEO's speech to protest AI tech for Israeli military
An employee interrupted a senior Microsoft presentation in May 2025 while raising concerns about the company's technology and its relationship with Israel. The allegations are attributed to the protesters.
Source (opens in a new tab)PA / The Independent · 7 May 2026
Barclays shareholder meeting targeted by Palestine and climate activists
Barclays' May 2026 AGM was repeatedly disrupted by Palestine and climate activists challenging the bank over its relationships and financing.
Source (opens in a new tab)UK Parliament, Hansard · 28 April 2025
Westminster Hall debate on dogs and other animals in scientific and regulatory procedures
A parliamentary debate described a demonstration of several hundred people outside the MBR Acres beagle-breeding facility.
Source (opens in a new tab)The task is to understand behaviour, intent, access, target exposure and likely consequences, then recommend a proportionate response.
Intelligence products
Same intelligence. Different decision context.
Flash Alert
For immediate operational awareness.
Answers three questions:
What happened? Why does it matter now? What should happen in the next two hours?
Protective Intelligence Brief
For operational and protective decision-makers.
A structured assessment covering:
BLUF, additional relevant detail, assessment, most likely course of action, most dangerous course of action and advisory.
Executive Brief
For senior leadership.
Condenses the same intelligence into:
Bottom line, business implications and decision points.
The value lies in understanding what different decision-makers need from the same intelligence and presenting it accordingly.
How I approach analysis
From signal to decision
- 01
Define
What does the organisation actually need to know?
- 02
Collect
Gather relevant public-source, event and business information.
- 03
Connect
Identify changes, relationships, patterns and gaps.
- 04
Test
Consider alternative explanations rather than immediately accepting the most alarming one.
- 05
Assess
Separate likelihood, consequence, uncertainty and escalation indicators.
- 06
Brief
Explain what happened, why it matters and what should happen next.
Focus
What this portfolio demonstrates
- Protective intelligence and event risk analysis
- OSINT collection framing and source validation
- Behavioural assessment separating criticism from risk-changing behaviour
- Structured analysis, confidence statements, MLCOA and MDCOA
- Business impact analysis across security, communications, HR and legal
- Operational and executive intelligence writing