What Happens Online Doesn't Stay Online…
Why OSINT Belongs in Every School Safety Conversation
Let me start with something that might be uncomfortable to hear: in the vast majority of targeted school violence cases, the warning signs were already out there. They were in a post on Reddit. A message in a gaming server. A comment on a forum most adults have never visited. Visible to anyone who knew where to look and how to read what they were seeing.
That gap between "the warning signs existed" and "someone found them in time" is exactly where Open-Source Intelligence (OSINT) does its most important work.
What Exactly Is OSINT?
OSINT is the disciplined collection and analysis of information that's lawfully and publicly available. For example, it is public social media posts, open forums, news articles, public records. It is not hacking. It's not accessing private accounts or reading private messages. When it's done right, it's entirely lawful, ethical, and proportionate.
The Research Backs This Up
In 2021, the U.S. Secret Service reviewed 67 disrupted school attack plots and published those findings in a report titled “Averting Targeted School Violence.” Their finding was striking: every single plot was stopped because someone noticed something and reported it. Read that again. The warning signs were there first.
Researchers call this "leakage." This is defined as the intentional or unintentional disclosure of violent thoughts, grievances, or plans before an act of targeted violence. It shows up as a threat, a post praising a prior attacker, or a pattern of comments, in context, that paint a concerning picture. And it is appearing online more and more where it can be identified and assessed before anything happens.
The key word there is "in context." Young people sometimes make impulsive or dramatic statements online. Context is everything. Which is exactly why this work needs to be done by trained professionals, not well-meaning staff who've been handed a social media task.
Where the Threats Actually Live
Here's something that surprises a lot of administrators: the concerning content rarely shows up on a student's main Instagram account. It tends to surface on Reddit (where pseudonyms encourage candid posting), Discord (widely used by students for gaming and social groups), Twitch, gaming profiles, and public Telegram channels. Platforms that most school staff don't monitor and wouldn't know how to navigate effectively even if they tried.
A Few Questions Worth Asking
If you're not sure where your school stands, start here:
• Does your school have a written procedure for evaluating online threats?
• Is there a confidential reporting channel students, staff, and parents can actually use without fear?
• Who verifies the authenticity of screenshots before disciplinary action is taken?
• When did you last audit what a stranger can learn about your school from public sources alone?
If any of those answers are vague or if the honest answer is "we don't really have a process for that” now is the time to address it.
This Work Has to Be Done Right
We want to be straightforward: well-intentioned amateurs doing OSINT in school settings can cause real harm. An untrained staff member poking around a student's online presence could tip off the subject, compromise evidence, or miss critical context entirely. The stakes are too high for informal, ad-hoc responses.
OSINT that will be acted upon for a safeguarding decision, a disciplinary proceeding, or a law enforcement referral, needs to be conducted by professionals who understand digital evidence standards, legal boundaries, and proper documentation.
Our firm specializes in digital forensics and school investigations. We work with administrators and school counsel to conduct lawful, well-documented OSINT investigations, preserve digital evidence to proper evidentiary standards, and identify your school's own public digital exposure before someone else does. If you'd like to talk through how this applies to your district, we'd welcome the conversation.