The situation
On a Friday evening, the security team of a global consumer brand escalated a series of messages sent to its chief executive through social platforms and the company's customer channels. Over three weeks, the tone had moved from anger about a product recall to references to the executive's children, their school and the family's weekend residence.
Every message came from a newly created account that was abandoned after one or two posts. The security team could block accounts, but they could not see who was behind them, how dangerous that person was or whether the threats were getting closer to action.
The question
Who is sending these messages? Does the sender have the intent and the capability to act on them, and how soon? And what does law enforcement need in order to intervene?
What we did
Our protective intelligence lead, two analysts and an image analyst worked the case around the clock through the weekend, with a red-team reviewer on call.
1. Assessed the threat first
Identification takes time. Safety decisions cannot wait for it. Within four hours we delivered an initial assessment using our structured protective intelligence framework. The messages showed several recognized warning behaviors: a shift from grievance to fixation on the executive personally, growing knowledge of the family's routine and specific references to locations. We recommended immediate protective measures for the family that night, and the client put them in place.
2. Linked the accounts
We preserved and hashed every message and profile. Fourteen accounts shared the same unusual phrase, the same punctuation habits and, on nine of them, the same avatar image: cropped, mirrored or recolored differently each time. Perceptual hashing, which matches images that have been altered, confirmed that all nine avatars came from a single original photograph.
3. Found where the image came from
The uncropped original turned up through reverse image searching on a hobby forum for vintage motorcycle restoration, where it had been one member's profile picture for seven years. That member's posts used the same distinctive phrase found in the threats, and two of the throwaway usernames followed the same naming pattern as the forum handle.
4. Moved from a handle to a name
The forum member had shared hundreds of photographs of restoration projects. One showed a motorcycle on a driveway with a distinctive shopfront across the road, which our image analyst geolocated to a single street in a small town. The same photographs appeared in a public sales listing for a motorcycle part, which gave a first name, and in the published results of a regional club event, which listed the motorcycle with its owner's full name. A recent forum post complained about the recalled product by name.
5. Assessed capability
The town was less than two hours' drive from the family's weekend residence. Older posts referred to lawful firearm ownership. Recent posts described the loss of a job and growing anger at the company. There was no public evidence of a specific plan or of travel toward the residence.
6. Reviewed, then delivered
Even under time pressure, the attribution went through red-team review before delivery. The reviewer tested whether the forum member's image could have been taken and reused by someone else. The shared phrase, the username pattern and the recall grievance made that implausible.
| When | Milestone |
|---|---|
| Friday 19:30 | Tasking from the client's security team; preservation begins |
| Friday 23:30 | Initial threat assessment and protective recommendations delivered |
| Saturday 14:00 | Fourteen accounts linked; original avatar traced to the hobby forum |
| Sunday 04:30 | Identification complete; red-team review begins |
| Sunday 07:30 | Identification and capability assessment delivered to the client |
| Monday 08:30 | Referral package delivered to police through the client |
What we found
- High confidence: all 14 accounts were operated by one individual.
- High confidence: the identity of that individual.
- Likely: the individual had the means to travel to the weekend residence. We found no evidence of a specific plan.
The red-team review took three of the 36 hours, and it was not negotiable. A wrong name in a threat case can put an innocent person in front of police. Every attribution we deliver passes review, whatever the deadline.
The outcome
The client's security team passed our referral package to police on Monday morning. It contained the preserved messages with their hashes, the chain of reasoning from accounts to identity, and the capability assessment.
- Police interviewed the individual the same week and arrested him for making threats.
- A court granted a protective order covering the executive and the family.
- We monitored for 90 days afterward and detected no further contact.
- In parallel, we reduced the family's exposure by identifying and requesting removal of their personal details from people-search and data broker sites.
What made the difference
Anonymity fails through reuse. The sender changed accounts every time, but kept the same photograph, the same phrase and the same naming habit, and those threads led back to a seven-year history under a stable identity. Assessing the threat before identifying the sender meant the family was protected from the first night, not the third day.