Forensic SOCMINT: Network Graph Analysis and Profiling

SOCMINT network analysis examines recorded public interactions to understand a defined communication pattern. A graph can show which accounts mentioned one another, shared a link, or appeared in a collected conversation. It does not reveal private relationships, intent, identity, or physical location merely because the visualization looks persuasive.

This guide explains how to build and interpret a defensible social-media graph, with clear edge definitions, source records, basic metrics, temporal checks, and a worked example. It focuses on public-interest research and organizational communication rather than personal targeting.

Expanded November 5, 2026 with AI assistance and primary-documentation review. The earlier article disclosed Gemini assistance. Examples are fictional. This revision removes the claims that posting patterns identify sleep cycles or location and that network topology reveals absolute structural truth.

Define the research question before collecting accounts

A useful question is specific: “Which public organizations amplified this consultation announcement during the first week?” This identifies the topic, period, and type of relationship that matters. “Profile everyone discussing the topic” creates an unnecessarily broad and potentially misleading task.

Record the platform, time window, inclusion rules, source access, and intended use. Decide whether your unit is an account, a post, a link, an organization, or some combination. Those choices change what a graph means.

Collect only the public information needed for the question, through permitted methods. Do not bypass access restrictions, impersonate a trusted contact, or treat a public profile as authorization to investigate unrelated personal details.

A public-interest report may only need aggregate patterns or organizational accounts. Consider whether individual identifiers need to appear at all. The graph should serve the question, not expand the exposure of people who happened to enter the dataset.

Choose nodes and edges explicitly

A node represents a defined object. An edge represents a defined relationship or event. For example, an edge from Account A to Account B might mean “A publicly replied to B” during the study period. It should not silently mean “A supports B” or “A works with B.”

Choose whether the graph is directed. A reply or mention has a source and a target; collapsing it into an undirected connection discards that distinction. If you use an undirected projection for a particular analysis, explain the transformation.

Choose what a weight represents. It might count distinct posts, repeated interactions, or another documented quantity. Several copies of one event should not accidentally become a stronger relationship because the collection process duplicated them.

Observed relation	Useful label	Unsupported shortcut
A mentions B in a public post.	Mentioned during the defined period.	A endorses B.
A and B share the same URL.	Shared the same recorded link.	A and B have the same operator.
A replies to B.	Replied to the identified post or account.	A has a private relationship with B.
Two accounts publish similar text.	Text similarity under a stated comparison method.	The accounts are deceptive bots.

Maintain different edge types separately when they answer different questions. A single generic “connection” can hide important distinctions between reply, quotation, criticism, and repetition.

Keep a source-backed interaction table

Before drawing the network, create a table containing the source account ID, target ID where relevant, event type, post identifier, source URL, timestamp, retrieval time, and collection method. Retain the relevant text or permitted source record.

Use stable platform identifiers where available. Display names and handles can change, and similar names can belong to different accounts. Preserve the original observed name while keeping identity-resolution decisions explicit.

Do not merge accounts across platforms merely because they share a username or photograph. Treat the proposed identity link as a separate claim with supporting evidence and uncertainty. Some analyses can remain account-level without resolving a natural person.

Record unavailable fields as missing. An absent client label or account-creation date should not be inferred from a pattern in the visible posts. A reproducible dataset includes its gaps.

Understand the collection boundary and missing data

A graph usually represents the data you obtained, not the complete social system. Search ranking, deleted posts, private accounts, API limits, sampling, language choices, and the time window can affect which interactions appear.

Distinguish a complete collection of a defined export from complete platform coverage. You may have processed every row in the provided file while still missing much of the underlying discussion. Describe both levels accurately.

Keep a collection log with queries, dates, pagination, errors, and relevant access limits. A failed request is not evidence that no activity occurred. Repeated downloads can also create duplicates that distort counts.

When comparing periods, check that the collection rules stayed comparable. A larger graph after a new keyword was added may reflect a changed method rather than a growing campaign.

Interpret centrality as a property of the constructed graph

NetworkX’s degree-centrality documentation describes a connection-based metric and its normalization. In a simple interaction graph, a high value identifies a node connected to many others under your chosen edge definition. It does not automatically identify a leader or influential person.

Consider direction and repeated events. Many incoming mentions can reflect praise, criticism, automated notifications, or a public-service account answering questions. The number requires context.

Betweenness centrality measures a node’s role on shortest paths in the graph. A high value can highlight a bridge in that constructed representation. It does not prove that information actually traveled along those paths or that the account coordinates other accounts.

Other metrics, including eigenvector-based measures, depend on their own definitions and assumptions. Consult the official centrality reference and explain why the selected metric fits the question. Do not turn a software ranking into a label of culpability, expertise, or hidden authority.

Clusters and layout are exploratory aids

A community-detection result groups nodes according to a method and its parameters. The resulting group may reflect a topic, language, collection boundary, or ordinary audience structure. It is not automatically an organized faction.

Inspect the underlying posts and relationship definitions before interpreting a cluster. Compare alternative explanations. A public announcement shared by several local organizations can produce a dense group without any deceptive coordination.

A force-directed layout is a visual arrangement, not a geographical map. Nearby dots need not represent nearby people. Layout changes can move clusters around without changing the underlying interaction records.

Use a legend describing node type, edge type, size, color, and the analysis period. Mark unresolved identities or relationships clearly. A graph should make its assumptions easier to inspect, not hide them behind a polished image.

Use posting times without inferring private routines

Normalize timestamps only when the source timezone is known, and preserve the original representation. Distinguish publication time, retrieval time, and any claimed event time. Those dates can describe different things.

Posting schedules do not reliably establish a person’s sleep cycle, home timezone, or physical location. Accounts may use scheduling software, multiple operators, travel, or delayed publication. A pattern can support a question about the account’s observed output without identifying a person’s routine.

Changes in vocabulary or posting frequency also have several explanations. A new campaign, editor, topic, or platform feature can change behavior. Do not diagnose account takeover or automation solely from an unexplained shift.

Use time analysis to compare observed events within the defined research scope. For example, it can show whether recorded shares followed an official announcement or whether a burst aligns with a public event. Keep the conclusion at that level unless stronger evidence is available.

Similar content can reveal a pattern without proving deception

Compare exact duplicates separately from approximate text matches. Record the normalization rules, similarity method, threshold, and treatment of quoted material. A threshold chosen after inspecting the desired result can exaggerate a pattern.

Repeated language can come from a press release, campaign toolkit, news headline, common slogan, or platform sharing feature. Distinguish shared source material from evidence of a common operator.

Timing and content similarity can justify closer review, but they do not establish intent or authenticity by themselves. Search for the original publication and document how the material circulated. The Triad Framework guide explains why source lineage matters when several records appear to agree.

If the evidence remains ambiguous, use a descriptive label such as “accounts sharing similar text in this window.” Avoid a stronger “inauthentic network” label unless the additional evidence supports it.

Worked example: a public consultation announcement

A fictional research team studies how an official consultation notice spread among public organizations. It defines a seven-day window and collects permitted public posts containing the notice’s exact URL and selected direct references.

The team creates account nodes and directed sharing or mention edges. It records the source post behind every edge and removes duplicate collection rows. It keeps quotations and replies separate from simple shares.

The graph shows the official account as a prominent node and a local newsroom connecting two discussion groups. Inspection reveals that the newsroom published a summary that both groups shared. That supports a limited description of its role in the observed distribution.

Several organizations post similar wording shortly after the notice. The team finds a public communication toolkit containing that text. It records the common source rather than presenting the similarity as evidence of covert coordination.

The final report says which organizations and links were prominent in the collected dataset, how the collection was bounded, and what could have been missed. It does not infer private alliances, natural-person identities, or a complete map of public opinion.

Related tools and a first reproducible analysis

Gephi’s official quickstart explains importing network data, inspecting tables, and exploring a visualization. Review the node and edge counts after import and check that identifiers, direction, and weights match your source table.

NetworkX supports scripted graph analysis. Record the library version, graph type, preprocessing, and metric settings. If an algorithm uses randomness or approximation, retain the relevant settings and describe their effect on comparison.

OpenRefine can help review inconsistent labels and candidate record matches. Keep proposed identity matches separate from confirmed ones, and avoid overwriting the original values.

A spreadsheet may be sufficient for a small investigation. Begin with a few fictional or appropriately licensed records, inspect every edge, and compare the graph with the table. The goal is to understand the model before applying it to a consequential research question.

Report counts with the right denominator

Separate the number of posts, accounts, interactions, and distinct links. A small number of highly active accounts can generate many posts. Reporting only the post count can make a narrow conversation look like broad participation.

For example, a fictional dataset might contain 100 posts from 20 accounts, with one account responsible for 40 posts. Those figures describe the collected activity. They do not establish that 40 percent of the relevant public agrees with the account or that the remaining population was reached by the message.

State how quoted posts, repeated shares, deleted material, and accounts without interactions were handled. An account with no recorded edge can be absent from a visualization even when it appears in the source collection. Keep the inclusion rule visible.

When presenting a proportion, name its denominator: “12 of the 20 collected accounts shared the notice” is a bounded observation. “Most local organizations supported the consultation” requires a defined population and evidence of support, neither of which follows from that count.

Keep a versioned record of corrections. If an account was merged incorrectly or a source post changes the interpretation of an edge, update the table and the published conclusion together. A visually unchanged graph can still need a substantive correction to the meaning of its connections.

Quality checks before reporting

Sample edges back to their source posts. Check duplicate removal, stable identifiers, date conversion, missing fields, and the distinction between quotation and endorsement. These checks often matter more than adding another metric.

Try a reasonable alternative time window or collection rule. If the main pattern disappears, report that sensitivity. A result that depends heavily on one arbitrary boundary should not be presented as a stable property of the wider network.

Have another reviewer inspect the strongest claim directly from the underlying records. Ask them to propose an ordinary alternative explanation and identify which evidence would distinguish it. Preserve disagreements in the analysis notes.

Include an as-of date and a method summary with the final visualization. State what the graph represents, what it omits, and why the result matters to the reader’s question.

Frequently asked questions

Does high centrality identify the leader of a group?

No. It identifies a mathematical property under the chosen graph definition. Leadership requires evidence beyond that metric.

Can matching posting times prove two accounts share an operator?

No. Scheduling, public events, common source material, and other explanations can produce similar timing. Treat it as a pattern to investigate.

What does “forensic” add to SOCMINT?

It should mean careful provenance, reproducible handling, and precise reporting—not a promise that every inference is legally established. Keep the source record behind each material claim.

Sources and further learning

Official tool documentation is linked beside the mathematical and software descriptions. The consultation example and workflow are editorial teaching material. The Information vs. Intelligence guide explains how to connect observations to a decision without hiding uncertainty.

Explore the OSINT Research Hub, Free Research Library, and Start Here guide. A useful social-network analysis explains its edges and limits as clearly as its visual patterns.