Army CID looking for new commercial software tools to monitor darknet, encrypted messaging platforms
The Department of the Army Criminal Investigation Division is on the hunt for new capabilities to identify and track foes that use the darknet and encrypted digital messaging platforms such as Signal, Telegram and Discord to organize and plot against the U.S. military.
The organization aims to move from a “reactive footing” to a “proactive model” as it carries out its missions, according to an RFI released this week.
“Modern adversaries targeting DoW personnel, high-value assets, and critical Army infrastructure have migrated away from mainstream online spaces. Instead, they exploit decentralized, highly encrypted, and ephemeral digital networks to coordinate, radicalize, and plan hostile actions,” officials wrote, using an acronym to refer to the Department of War, the Trump administration’s preferred name for the Department of Defense.
To get after these types of threats, Army CID “requires an advanced, cloud-hosted commercial threat intelligence and investigative software platform that bypasses the limitations of legacy, keyword-based Open-Source Intelligence (OSINT) tools by leveraging automated behavioral analytics, machine learning, and artificial intelligence,” per the RFI.
According to a capability matrix released with the RFI, officials are interested in technologies that could automatically flag early indicators of “mobilization to violence” against military personnel, installations, or assets.
Army CID is eyeing natural language processing and computer vision capabilities for automated translation and symbol recognition. The technology would be used to sort through and “interpret” the vernacular, slang, iconography, audio and visual media, and coded symbols used by potential adversaries that standard keyword filters would miss.
Officials also want tech that could help correlate “disparate, pseudonymous, or anonymous user accounts across surface web, deep/dark web, and alternative social platforms into unified subject profiles,” according to the capability matrix, which listed metadata and digital footprint analysis and the graphing of blockchain and cryptocurrency transactions as focus areas.
To boost the obtainment and preservation of evidence, Army CID seeks tools that would enable the automated collection, indexing and archiving of “volatile, transient, or user-deleted digital content.”
For undercover work, the organization envisions investigators using virtual workspaces and network routing capabilities that mask their government origins and digital “fingerprints.”
As part of its market research effort, the Army is asking vendors for information about how their technologies would deal with coded or non-textual communications and track “coordinated threat actors” across “fragmented alt-tech, darknet, or encrypted messaging ecosystems.”
The RFI also requests explanations about how vendors’ systems would incorporate humans analysts into threat alert-validation processes; mask investigators’ device metadata, location data, and “network footprints” during active threat probes; and capture and archive “ephemeral data” as potential evidence.
Industry responses are due Dec. 9.
