SOCMINT on Twitter (X): What Social Media Intelligence Is, and a Worked Method

SOCMINT stands for social media intelligence: the systematic collection and analysis of what people publish on social platforms, in order to answer a question someone has to act on. The emphasis is on the question and the analysis. A pile of posts is data; a statement such as "the conversation about this agency is driven by sixty accounts, mostly replies, peaking two hours before the agency's own posting peak, with low confidence on who those accounts represent" is intelligence. Everything on this page serves that transformation.

The term has a traceable origin. In April 2012 the London think tank Demos published #Intelligence, written by Sir David Omand (a former director of GCHQ), Jamie Bartlett and Carl Miller. Its executive summary says that "social media intelligence, which we term SOCMINT, could contribute decisively to public safety: identifying criminal activity; giving early warning of disorder and threats to the public; or building situational awareness in rapidly changing situations." The paper describes itself as "the first effort to examine the ethical, legal and operational challenges involved in using social media for intelligence and insight purposes", and argues that SOCMINT "must be based on a publicly argued, legal footing". We verified these quotes against the PDF on demos.co.uk this session.

The paper's lasting contribution is not the acronym but two structural ideas. The first is a set of six principles for any state use of SOCMINT, reproduced here because they transfer almost unchanged to a corporate or research setting.

The second idea is the two-route split. The paper recommends "a clear distinction between open source non-intrusive SOCMINT and intrusive or surveillance SOCMINT": route one, "open source non-intrusive SOCMINT, which can be conducted on a similar basis to non-state actors, such as universities and commercial companies", and route two, "the exercise of state-specific powers of access intended to result in the identification of individuals and access to private information". Everything on this page is route one. The moment a task requires identifying a person, reading private messages or gaining access the platform does not give an ordinary user, it has become route two, and in that world the question is no longer which endpoint to call but whether you have the authority at all.

The intelligence disciplines are named by source, not by subject. That is why the comparison below is about where the material comes from and what you had to do to get it, not about what the material is used for.

SOCMINT is therefore a subset of OSINT narrowed by source, and the distinction matters for two reasons. Volume: an OSINT desk reads dozens of documents; a SOCMINT exercise classifies thousands of posts, so the method is statistical and the output is an aggregate. Boundary: SOCMINT lives next to two things it must not become. Sending a message to an account to get an answer is HUMINT and carries its own rules (and on X it means acting as an account, with the platform's limits on that account). Reading messages the sender did not publish is interception. The open route touches neither.

A practical consequence: the fields a SOCMINT analyst relies on are the ones every logged-out visitor can see, just read by machine. On X that is the post (text, createdAt, lang, isReply, inReplyToUsername, quoted_tweet, retweeted_tweet, entities, extendedEntities, the engagement counts), and the public profile embedded in each post as author (userName, followers, following, createdAt, isBlueVerified, isAutomated, statusesCount). Our Twitter OSINT page maps those fields to investigative questions one by one; this page assumes that map and uses it.

The cycle is the classic intelligence cycle with social-platform specifics at each stage. Run it in order; skipping the first stage is how a collection turns into a fishing expedition.

Question. Write the question as a sentence someone will act on, with a time window and a unit of analysis. "Who drives the public conversation about this organization on X, when does it happen relative to the organization's own posting, and how much of it is a small core?" is a SOCMINT question. "Monitor the organization" is not. The question fixes the sample size: a posting-hour pattern needs a few hundred posts; a share-of-replies estimate at a few points' precision needs about five hundred; a claim about a trend over months needs a window, not a snapshot.

Sources. Decide which public surfaces answer the question and write down which you will not touch. For the worked example: the organization's own public timeline and the public posts that mention it. Not touched: direct messages, protected accounts, anything that requires being logged in as someone, and the identities of the private individuals behind the mentions.

Collection. Map each source to an endpoint, estimate the request count and the cost before the first call, and write the protocol down. On twitterapi.io the three collection calls used here are /twitter/user/mentions (public posts mentioning an account, 20 a page, newest first, with sinceTime and untilTime in Unix seconds for a window), /twitter/user/last_tweets (an account's own timeline, 20 a page, newest first, reposts included) and /twitter/tweet/advanced_search (any X search operator, queryType=Latest or Top), each paginated with has_next_page and next_cursor. Tweet endpoints bill 15 credits per post returned, which is $0.15 per 1,000 posts, with a 15-credit minimum per request; no X developer account or log-in is needed for reads.

Processing. De-duplicate by id (cursors overlap at page boundaries), parse createdAt (the format is %a %b %d %H:%M:%S %z %Y, always UTC), classify each post (repost if retweeted_tweet is present, else reply if isReply, else quote if quoted_tweet, else original), flag links, media and hashtags from entities and extendedEntities, and bucket every author by followers and account age rather than keeping the handle. Processing is where privacy is engineered in: the de-identified row that leaves this stage has no id, no text, no handle.

Analysis. Compute the aggregates the question asked for, and only those: hour-of-day histograms for both sets, type shares, concentration (what share of posts the repeat accounts write), bucket shares for the account population. Then compare them against something: the organization's own pattern, a second organization, a previous window. A number with no comparison is a description, not a finding.

Reporting. State the finding, the sample, the window, the confidence and, explicitly, what the sample cannot show. Report aggregates. If an individual account must be named for an operational reason, that is a route-two decision with its own authority, not a byproduct of the analysis. Decide how long the raw material is kept and delete it on schedule; GDPR's storage limitation principle applies even to public posts. The report then sets the next question, which is why the diagram above is a loop.

Three rules cover most route-one work on X, and all three are checkable against primary sources rather than vendor glossaries.

Rule 1: collect only what a logged-out visitor could see. Public posts, public profiles, public follow lists and public engagement counts are in scope. Direct messages are not: they are private communications and reading them without being a party is interception, not intelligence. Protected accounts are not: their posts are visible only to approved followers, and gaining that approval under a pretext is a HUMINT act with a deception problem. Access controls are the platform's statement of what is public; the open route respects them rather than working around them. On twitterapi.io, reads need an API key and no X account, which keeps the collection on the public surface by construction.

Rule 2: public is not the same as free of data-protection law. Under the EU General Data Protection Regulation, a public post that identifies a person is still personal data. Article 5(1)(b) requires that data be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes", and Article 5(1)(c) that it be "adequate, relevant and limited to what is necessary". A private organization typically relies on Article 6(1)(f), processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party", which requires a documented balancing test. Article 14 requires telling people whose data you obtained indirectly, unless doing so "proves to be impossible or would involve a disproportionate effort", which is the usual basis for aggregate research, and is one more reason to keep outputs aggregate. Article 9(2)(e) lifts the special-category ban only where "the data subject has manifestly made the personal data public", a narrower test than "it was on X". (Quotes from the regulation text on eur-lex.europa.eu, verified this session.)

Rule 3: for public authorities, systematic monitoring of a person is surveillance even on open sources. This is the Demos paper's own caveat: directed surveillance of open-source material is a route-two activity that requires authorization, if at a low level. In the UK the governing framework is Part II of the Regulation of Investigatory Powers Act 2000 for directed surveillance, with the Investigatory Powers Act 2016 covering interception and communications data (legislation.gov.uk/ukpga/2016/25). The Home Office's Covert Surveillance and Property Interference code of practice (2018) addresses online covert activity directly: it notes that individuals who post information on social media networks are less likely to hold a reasonable expectation of privacy in relation to that information, while treating repeated viewing of a particular person's open-source material as something that may amount to directed surveillance and require authorization. The practical reading for everyone else: a one-off aggregate study of a public conversation is research; returning daily to watch one named person is surveillance, and the law treats it as such regardless of the privacy setting.

What this looks like as a checklist on X.

X's own developer and platform terms add a contractual layer on top of the statutory one; our Twitter OSINT page covers that layer, and it does not change any row above.

The question. Who drives the public conversation about a space agency on X, when does it happen relative to the agency's own posting, what kind of posts are they, and how concentrated is it in a few accounts? Unit of analysis: the post, with the account as a secondary unit for the concentration and bucket measures. Window: the most recent 500 mentions and the most recent 500 organization posts at collection time.

The sources. Two public surfaces: posts that mention @NASA (an organization account, so it can be named) and @NASA's own timeline. We did not collect profiles separately; the public author object embedded in each mention post carries the fields needed for bucketing, which kept the request count at 50 and meant no profile endpoint was called at all.

The collection plan, costed before the first call. 25 pages of /twitter/user/mentions at 20 posts a page is 500 posts and 7,500 credits; 25 pages of /twitter/user/last_tweets is the same again. Total: 50 requests, 1,000 posts, 15,000 credits, $0.15. At the official X API's pay-per-usage rate card (docs.x.com/x-api/getting-started/pricing, $0.005 per post read) the identical 1,000 reads are $5.00. The script below does the collection and then the processing and analysis steps; it is the complete study minus the charts. Raw mention pages were written to a temporary directory and not kept, because their authors are private individuals; the organization's own pages are kept compressed with the study.

Keyword triage, the step we did not need here. When the subject is a topic rather than an account, the same plan starts with /twitter/tweet/advanced_search (for example "artemis" lang:en -filter:replies since_time:1760000000, queryType=Latest) to find which accounts carry the topic, then moves to mentions or last_tweets for the accounts that matter. Search returns the same post shape, so the processing code does not change.

Processing produced two clean sets. 500 organization posts spanning 190.2 days (2.63 a day): 259 original posts (51.8%), 234 reposts (46.8%) and 7 quotes (1.4%); 41.6% carried media and 43.8% a link. 500 mention posts spanning just 30.1 hours (16.6 an hour), which is the first finding in itself: the public writes about this organization roughly six times faster than it posts, and a 500-post sample of mentions is a day and a quarter, not a season. Any claim about mention patterns below is a claim about that day and a quarter.

The hour-of-day comparison. Both histograms are in UTC. The organization is a working-day poster: 91.2% of its posts fall between 12:00 and 23:59 UTC, its three busiest hours are 18:00, 21:00 and 16:00 UTC, and the six hours from 03:00 to 08:59 UTC hold 1.6% of its posts. The public is flatter: 73.4% of mentions fall in the same 12-hour span, the busiest hours are 16:00, 14:00 and 17:00 UTC, and the overnight six hours hold 8.4%. Only one hour, 16:00 UTC, is in both top threes. The mention peak sits two hours before the organization's own peak, which is consistent with mentions following the morning news cycle and the previous day's posts rather than the organization's afternoon output, though a 30-hour window cannot prove that; it would take several weeks of windows and a lag correlation to say so with confidence.

What this stage is for. In a real engagement the hour comparison answers an operational question: when should a communications team be watching, and when does a surge in mentions mean something has happened rather than that it is 16:00 UTC? The baseline is the thing of value. A posting-hour baseline costs about $0.08 per 500 posts to establish and the same to refresh, which is why it is the first SOCMINT product worth building.

Type of mention. Of the 500 mention posts, 353 (70.6%) were replies, 95 (19.0%) original posts and 52 (10.4%) quotes; the mentions endpoint returned no reposts, so the repost share is unmeasured here. Only 10.0% of all mentions were replies to @NASA itself (inReplyToUsername); the other 60 points of reply share were people replying to one another in threads where the organization's handle was carried along. That is the normal shape of a conversation around a large organization: most of it is not addressed to the organization.

Content flags and languages. 14.6% of mentions carried a link, 18.0% media and 9.4% at least one hashtag. 68.4% were tagged English and 15.2% Spanish; 4.2% had the qme tag, which X uses for posts with media and no text. The hashtags that appeared three or more times were #venusretrograde (14), #nasa (7), #spacex (5), #stem (3) and #moon (3). The leading tag has nothing to do with the agency; it is a recurring astrology meme that tags space accounts, and it is a good illustration of why a hashtag count is a processing output rather than a finding until an analyst has looked at what the tag is.

Engagement. The median mention had 0 likes, 0 replies and 17 views; 73.0% had no likes at all. The median organization post had about 3,222 likes, 145 replies and 735,000 views. The two populations are not comparable on engagement, which is the point: a mention's existence is the signal, not its reach.

Concentration, the number that answers the question. The 500 mentions came from 303 distinct accounts. 60 of them (19.8%) mentioned the organization more than once in the window and between them wrote 257 posts, 51.4% of all mentions. The single most active account wrote 46, and the five most active together wrote 20.4%. Half of the public conversation about this organization in this window was a core of sixty accounts, and a tenth of it was five. We do not list them; the SOCMINT finding is the shape of the distribution, and anyone with an operational need to know who they are has a route-two decision to make and document.

Reading the buckets. The median mentioning account has 373 followers and is 4.5 years old; two thirds have fewer than 1,000 followers, and 5.6% have 10,000 or more. 29.7% carry the Premium checkmark, which on X is a paid subscription signal and not an identity check, so it says something about willingness to pay and nothing about whether the account is an organization. No field in the public profile says "organization"; the honest statement is that the mentioning population is overwhelmingly small, mostly established accounts, with a visible paid-subscriber minority and almost no accounts carrying X's automation label. Account-age and follower buckets are reach proxies, and the account-age distribution is the input for the account-age checks on our tools pages when a specific account must be assessed for a legitimate reason.

A SOCMINT program is a recurring cost, so price per post read is the number to carry. twitterapi.io prices tweet endpoints (search, mentions, timelines, replies, quotes, tweets by ID) at 15 credits per post returned, $0.15 per 1,000 posts, with a 15-credit minimum per request; profiles are 18 credits each ($0.18 per 1,000) and follower or following lists 1 to 3 credits per user returned depending on page size. $1 is 100,000 credits and purchased credits do not expire. The official X API's pay-per-usage rate card is $0.005 per post read, $0.010 per user read and $0.010 per follower or following read, capped at 3 million post reads per monthly billing cycle with Enterprise above that; new accounts get $20 in credits on a first saved card and a match of the first auto-recharge up to $50.

The ratio is about 33x per 1,000 posts ($5.00 against $0.15), and for the follower graph it is larger, because X prices each follower record at a cent. Rate limits on twitterapi.io are 0.2 requests a second before a first payment, 20 after it, 50 on the Scale plan and 500 on Business, which for a study like this one is a time constraint rather than a cost one: the whole collection here was 50 requests. Monthly plans with bonus credits are on the pricing page; new accounts that pass the automatic bot check get up to $1 of free credits (at most 100,000 credits, no card, one per person or network, expiring after 31 days), which covers this exercise about six times over.

Question: for one public organization on X, when does the public mention it by hour of day compared with when it posts; what share of mentions are replies, quotes or original posts; what share carry links, media or hashtags; which hashtags recur; and how concentrated are mentions in a small set of accounts, with the account population described only in buckets.

Accounts and query: /twitter/user/mentions with userName=NASA, 25 pages (public posts mentioning the organization, newest first), and /twitter/user/last_tweets with userName=NASA, 25 pages (the organization's own timeline, reposts included, replies excluded by default). No profile, follower or search endpoint was called; author fields come from the public author object embedded in each mention post.

Window and sample: the 500 most recent mentions at collection time (30.1 hours) and the 500 most recent organization posts (190.2 days), collected in 2026 through a rate-limited client. 50 requests, 1,000 posts, 15,000 credits, $0.15. Posts were de-duplicated by id; times are UTC from createdAt; a post is a repost if retweeted_tweet is present, else a reply if isReply, else a quote if quoted_tweet is present, else original; hashtags appearing fewer than three times were dropped.

What the sample cannot show: the mention set covers a day and a quarter, so its hour-of-day pattern is one weekday's pattern and may not match a weekend or a launch day; the organization set covers six months and averages over events. The mentions endpoint returned no reposts, so repost share is unmeasured. Follower and account-age buckets are reach and tenure proxies; nothing in the public profile identifies an account as an organization, and the Premium checkmark is a subscription signal. The two-hour lead of the mention peak over the organization's peak is an observation from one window, not an established lag.

Privacy: aggregates only. @NASA is a public organization account and is named; the authors of mention posts are private individuals and are never listed, ranked, quoted or linked. Raw mention pages were kept in a temporary directory and not committed; the organization's own pages are kept gzip-compressed with the study, together with the protocol, the analysis script, the results file and a de-identified sample (hour, type, flags, follower bucket, age bucket, counts; no id, URL, text, author ID or handle).