The Triad Framework: Triangulating Public Signals for OSINT

The Triad Framework is a way to compare public social, geospatial, and technical evidence against one clearly defined claim. Its value comes from finding agreements, contradictions, and source dependencies. Three categories of evidence do not automatically produce certainty, and three websites repeating one statement do not create three independent sources.

This guide explains how to use SOCMINT, GEOINT, and technical public records together without turning weak correlations into allegations. It includes a worked event-verification example, a source-lineage table, related tools, and a checklist for deciding what the combined evidence actually supports.

Expanded November 5, 2026 with AI assistance and linked source review. The Triad Framework is this publication’s organizing aid, not an independently validated confidence formula. This revision corrects the earlier claims that three categories approach certainty and that multi-vector confirmation automatically becomes fact.

What the three evidence categories contribute

SOCMINT, or social-media intelligence, examines relevant publicly available communications and relationships. In a verification task, it might show what an organization announced, which account published a photograph, or how a claim spread. A public interaction alone does not prove a private relationship, agreement, or intent.

GEOINT, or geospatial intelligence, examines location and spatial context. Landmarks, terrain, public maps, and dated imagery can help test where a scene was captured or whether visible infrastructure fits a proposed period. Location consistency does not independently establish the event described in a caption.

Technical public-source evidence can include domain registration data, public certificate records, and documented website history. Here it is used as a convenient category rather than a claim that every web record is TECHINT under every professional definition. A domain relationship can help direct research without establishing legal ownership or operational control.

Keep the three categories as lenses. Some questions only need one of them. Other questions need a fourth source, such as a court decision or an official corporate filing. Forcing every investigation into exactly three boxes can hide the evidence that actually matters.

Choose one claim and identify its components

Start with a sentence that could be supported or contradicted. “This organization held a public workshop at this venue on this date” contains at least four components: the organization, the activity, the location, and the time. Each may need different evidence.

Break the sentence into a claim table. What would support the organization’s involvement? What could establish the venue? What could constrain the date? Which parts depend only on the publisher’s own statement?

A useful result might confirm the venue while leaving the date unresolved. Another might confirm that the organization advertised an event but not that it occurred. Keeping the components separate allows an informative partial answer without implying confirmation of the whole story.

Define the purpose and scope before collecting. A reader checking whether an advertised workshop took place does not need a map of attendees’ private addresses or unrelated social connections. Collect the evidence that answers the question.

Independence is about origin, not appearance

Suppose an organizer posts a photograph, its website embeds that post, and a venue directory republishes the website description. The records look different and may appear in separate tools, but their key claim can still originate with the organizer.

Map the lineage. Record whether each item is an original observation, an official record, a copy, a quotation, or a summary. If the lineage is unknown, mark it unknown. Do not assume independence because two addresses have different domains.

A source can also be independent for one component and dependent for another. A venue may independently confirm that a room was booked while repeating the organizer’s description of the event’s purpose. Those statements have different evidentiary roles.

Evidence item	Underlying origin	What it can add
Organizer’s announcement	The organizer.	Evidence that the event was advertised.
News item quoting the announcement	The same announcement for the quoted claim.	Evidence of circulation, not independent attendance.
Venue’s own dated event record	The venue, if independently maintained.	A separate record of venue scheduling or activity, within its stated scope.
Map comparison of the photograph	The image and reference imagery.	A test of visible location features.
Public domain record	The registration service or certificate ecosystem.	Technical context about the web presence, with limited relevance to the event itself.

Use social evidence without inferring hidden motives

Save the exact post address, account identifier, visible publication time, text, and relevant media. Record whether you inspected the original post or only a screenshot. A screenshot may omit replies, edits, or the surrounding context needed to understand it.

Compare account identity with the claim. A name, logo, or badge can be a useful clue, but it is not a substitute for establishing the account’s relationship to the organization. For a consequential action, use the independent verification methods described in the defensive identity-verification guide.

A like, follow, mention, or shared photograph can have several explanations. Do not convert it into a claim of employment, ownership, coordination, or ideological agreement without stronger evidence. Record the observable relationship at the level the source supports.

For the workshop example, a participant’s public post can be relevant to whether someone reported attending. It does not automatically verify every statement about the organizer, the agenda, or the number of people present.

Use spatial evidence to test the scene

Look for distinctive arrangements of features: a doorway beside a staircase, a roofline behind a road curve, or a visible landmark in a consistent direction. A combination is more useful than a generic wall or an easily copied sign.

Compare the proposed viewpoint with reference material. Ask whether the camera could plausibly see those features in that arrangement. Preserve contradictory details as well as matches. A candidate should not survive merely because one attractive feature fits.

Record the reference imagery’s date and limitations. A current map can differ from an older image because the site changed. A composite view may combine different acquisitions. The GEOINT and chronolocation guide explains those timing and measurement issues in more detail.

Shadow compatibility can help test a proposed time window when the assumptions are defensible. It does not automatically establish an exact date. Keep the measurement uncertainty and the possibility of repeated solar conditions visible in the assessment.

Use technical evidence within its actual scope

Certificate Transparency documentation explains how public logs make certificate issuance visible. Such records can help identify domains associated with a certificate and place technical events in a timeline. They are not a register of beneficial ownership.

Shared hosting, a common service provider, or similar website code can have routine explanations. A managed platform can serve many unrelated customers. A certificate or infrastructure similarity should generate a question rather than settle who controls an organization.

ICANN’s RDAP guidance identifies the modern registration-data service for generic top-level domains. Check the exact field and date you are using. A domain registration event is different from the founding date of a business or the first date a site published content.

In the workshop example, a public technical record may support when a relevant domain existed. It usually adds little to whether the workshop actually happened. Mark that limited relevance instead of counting the technical category as an automatic confidence boost.

Build a comparison matrix that welcomes contradictions

Use one row per evidence item and separate columns for each component of the claim. Mark support, contradiction, or no meaningful bearing. Add a short explanation rather than relying on colored cells alone.

For example, an image matching the venue supports location but may say nothing about the date. A post timestamp establishes publication timing, not necessarily capture timing. A venue record can support a scheduled booking without proving attendance.

Include alternative explanations. The event could have been advertised but cancelled. The image could show an earlier workshop. The named organization could have rented the room while another group ran the session. Decide what evidence would distinguish these possibilities.

The CIA’s Tradecraft Primer is a useful reference for structured consideration of assumptions and competing explanations. Apply that discipline to the matrix without suggesting that a particular layout has a validated error rate.

Check identity and time before combining records

Give each entity a stable identifier in your working notes. Preserve the original name as printed, the normalized name used for searching, the jurisdiction where relevant, and the reason two records are treated as referring to the same thing. Keep ambiguous matches separate until another identifier resolves them.

Align the period described by each source. A photograph from one year, a domain record from another, and a current organization page may all be genuine while describing different states of the world. Record both the event date and the retrieval date, and distinguish an explicit source date from an analyst’s estimate.

Apply the same care to relationships. A person listed as an officer in a historical filing should not be shown as a current officer unless current evidence supports that status. A website hosted at a shared address today should not be linked to a past event merely because the infrastructure now overlaps.

This identity-and-time check often resolves an apparent conflict without requiring more tools. It can also reveal that the collected records do not answer the same question and should not be combined into one confidence judgment.

Worked example: checking a public workshop claim

A fictional organization posts an announcement saying it held a workshop at Harbour Hall on a particular Saturday. The post includes a room photograph and links to the organization’s website. A reader wants to know whether the post supports the claimed event.

The investigator preserves the announcement and website page. A local news item repeats the announcement, so the investigator records it as the same source lineage. It is useful for tracking circulation but not independent proof that the event occurred.

A comparison with the venue’s published room photographs finds a distinctive staircase and window arrangement consistent with the image. This supports the proposed location. It does not resolve when the photograph was taken.

The venue’s independently maintained calendar shows a booking on the claimed date. The investigator records precisely what the calendar says: it may show scheduling rather than confirmation that the activity took place. If a dated venue follow-up or another independently sourced observation is available, that can add a different kind of support.

A domain lookup shows that the organizer’s website existed before the announcement. This is consistent with its web history but does not establish the event. The final assessment does not become “certain” simply because social, spatial, and technical categories are represented.

A useful conclusion is: “The image is consistent with Harbour Hall, and the venue calendar supports a booking on the claimed date. The organizer publicly reported holding the workshop. The available records do not independently establish attendance or the exact capture time of the photograph.”

Related tools for evidence comparison

QGIS can help organize candidate locations and reference layers. Record coordinate systems and source dates so the map remains interpretable. A precise marker is a representation of your assessment, not evidence of accuracy by itself.

Gephi can visualize networks of records and relationships. Define what each edge means before drawing it. A line representing “quoted the same announcement” should not look indistinguishable from a line representing “owns shares in.”

Zotero’s related-items feature can connect source records within a library. Use notes to explain why items are linked and whether they share an origin. The software relation itself does not express evidentiary independence.

For a small task, a spreadsheet with source IDs, dates, claim components, and lineage is often enough. Choose a graph or GIS tool when it helps answer the question, rather than adding one merely to make the report appear technical.

Reporting confidence without a magic source count

Explain which components are supported and where the evidence is limited. ODNI’s Analytic Standards provide a reference for distinguishing information, assumptions, judgments, and uncertainty. Their existence does not validate a three-source formula.

Do not report a numerical probability unless you have a defensible method and explain it. Readers usually benefit more from knowing that the location match is strong, the date relies on one publisher, and the technical clue has little bearing on the event.

State what would change the assessment. An earlier copy of the same photograph might undermine the date claim. A corrected venue record might change the booking interpretation. A source retracting a statement should trigger review rather than be ignored because the other two categories still look consistent.

Frequently asked questions

Do I always need all three categories?

No. Use the categories that can answer the question. An authoritative record may resolve a narrow registration question without geolocation, while an event claim may require evidence outside the triad.

Are three independent sources enough to establish a fact?

There is no universal threshold. Independence, relevance, source quality, contradictions, and the consequence of error matter. Three weak sources can repeat a mistake, and one well-scoped primary record can establish a specific administrative fact.

What if the categories disagree?

Inspect dates, identity matches, source dependencies, and alternative explanations. Report unresolved disagreement when it remains. A contradiction can be the most informative result in the investigation.

Sources and next steps

The primary references and official tool documentation are linked beside the relevant descriptions. The framework, fictional workshop, and comparison matrix are editorial teaching material. For the broader distinction between collection and analysis, read Information vs. Intelligence.

Explore the OSINT Research Hub, Research and Publications, and Start Here guide. For your next claim, map where each source’s information originated before deciding how much agreement the evidence really provides.