The Signal, Issue #001

Three things mattered in OSINT this week. Craig Silverman quietly reframed what most practitioners are paying for in the situation-monitoring dashboard category. A free satellite tracking tool closed a five-figure price gap on commercial space intelligence, though the coverage has it wrong. And an RTÉ Clarity investigation made a claim about Irish information operations with implications well beyond Ireland.

Welcome to The Signal. Starting here, starting now.

Craig Silverman evaluated 38 situation-monitoring dashboards for Indicator this week. The finding sits behind the Indicator paywall and is worth the subscription. The short version: the general-purpose tools in this category draw from the same four open sources (ACLED for conflict, GDELT for media monitoring, OpenSky for aviation, AIS feeds via MarineTraffic or VesselFinder for maritime) and layer AI summarisation on top.

This is the most useful thing published in OSINT this month, and it is not about tools. It is about spending. If you are paying a subscription for a general-purpose monitoring dashboard, the underlying intelligence is free and queryable directly. You are paying for interface, alerting, and convenience. That is a defensible purchase. It is also a purchase most teams have not made consciously.

Silverman also flags a small number of niche tools, built by practitioners with genuine subject matter expertise, as worth paying for. Three criteria separate them from the commoditised layer: single-domain focus, a named practitioner whose methodology is documented, and a data source the free four do not cover. Apply those criteria to anything new before it enters your stack.

SkyOSINT launched this week with eight satellite anomaly detection algorithms running in the browser, free, no login. Commercial alternatives from Slingshot Aerospace and COMSPOC sit in enterprise pricing tiers that newsrooms rarely access. The price framing is the story most coverage will lead on, and it is the less important half of the story.

SkyOSINT is a verification tool, not a discovery tool. The platform pulls from the public Space-Track TLE catalogue and CelesTrak, which lag actual orbital events by a variable window determined by ground-station visibility, object observability, and 18th Space Defense Squadron processing time. Median TLE epoch age is around 12 hours. That lag is the point. Commercial vendors retain the proprietary optical and RF sensor layer, real-time feeds, and the analyst support that contextualises raw detections. What has changed is that newsrooms investigating Russian or Chinese space behaviour can now corroborate manoeuvre claims from specialist tracking sources independently, rather than taking any single source on single-source authority.

That is a meaningful change. It is not a replacement for commercial intelligence or for specialist human observers, and the coverage framing it as either will age badly.

RTÉ Clarity published a five-incident analysis this week: church fires in Donegal, Dublin, and Westmeath, and attacks on mosques in Galway and Limerick, all between 2025 and 2026. In every case, an attribution narrative (usually blaming migrants, occasionally framed as anti-Christian coordination) circulated online within hours of the incident and before garda findings. In every case where findings were later published, the original narrative was wrong or unsupported. Corrections reached a fraction of the original audience.

The pattern is real and it is not Irish. Treat this as a template preview for comparable jurisdictions, France, Germany, and the Netherlands in particular, rather than as an Irish-specific case study. The operational point is one RTÉ makes almost at the end and is worth foregrounding: the window between incident and official statement is not a lag to wait out. It is the information cycle. Newsrooms waiting for verification before publishing are structurally slower than the amplification layer, and that gap is not closing.

The RTÉ analysis establishes the template with consistency across five incidents and overlapping amplification across named accounts. The coordination question sits on top of that foundation: is the amplification directed from a single actor, is it a coordinated network responding to shared cues, or is it aligned accounts acting independently on the same template? Three lines of work would move the question from suggestive to established.

Account-level network analysis on the amplifying accounts across all five incidents, looking for posting-pattern overlap, shared infrastructure, or coordinated timing outside the incident windows. Financial and operational links between the accounts or the entities behind them. And platform-level data on whether the amplification spikes trace to common origin points or propagate from genuinely distinct starting nodes. Until that work is in the record, the template is the call and coordination is the open question.

LST-001, the neutral language cheatsheet

The work continues.

Derek