AIP 510 · Practitioners
Threat Intelligence for Child Safety
Learn the intelligence cycle in plain words, grade sources, follow ethical open-source rules, read trend data skeptically, and write a sourced one-page threat brief.
What you will be able to do
- Explain the intelligence cycle and turn a vague worry into a specific question.
- Grade sources and express confidence in clear, consistent language.
- Follow ethical research rules that never put a child, a victim or an investigation at risk.
- Read a trend figure skeptically and say what it does and does not show.
- Write a bottom-line-first threat brief that a parent or principal can use.
1 Module 1 of 5 · 30 min
The intelligence cycle in plain words
- Describe the four steps: question, collect, assess, report.
- Turn a worry into a question that can be answered.
- Explain why the cycle is repeated and why the question comes first.
Intelligence is information that has been checked and put to use for a decision. The method is simple. Ask a question, collect what is publicly available, judge it, then report in a way that supports a decision. Then ask again.
| Step | Plain meaning | Example |
|---|---|---|
| Question | What decision does this help? What exactly do we need to know? | “Which scams should middle school parents in our district hear about this term?” |
| Collect | Gather public, lawful sources | Public reports from NCMEC and the FTC; school incident themes shared by the staff with no names |
| Assess | Check the sources, weigh what they show, state confidence | Two independent sources agree. Confidence: moderate |
| Report | Bottom line first, with sources and unknowns | A one-page brief to the principal and parent group |
- Tied to a decision someone will make.
- Narrow enough to answer.
- Free of an assumed answer.
- Answerable from public information.
- “What are all the dangers online?”
- “Prove that this app is unsafe.”
- “Who is behind this account?”
The question comes first
People who start by collecting drown in material and find what they already believed. Write the question and the decision it supports before you search.
A parent group asks, “Is there some new online trap targeting our kids?” They want a one-page summary by Friday.
Rewrite their worry as a question you can work on.
Show the debrief
Ask what decision the group faces: for example, what to tell parents at the next meeting. A workable question is, “What are the most commonly reported online threats to teens, according to public sources published in the last year, and what is the one action parents can take for each?” It is narrow, tied to a decision, and answerable from public information.
Knowledge check
2 Module 2 of 5 · 35 min
Source grading and confidence language
- Grade a source for reliability and a claim for credibility, separately.
- Use consistent confidence terms.
- Mark what is fact, what is judgment, and what is unknown.
A reliable source can be wrong, and an unreliable source can be right. Grade the source (how dependable it has been, how close it is to the facts) and the claim (whether other independent information supports it) separately.
| Question | What you look for |
|---|---|
| Who is it from? | Official data holder, researcher, news outlet, anonymous poster |
| How do they know? | Direct counting, second-hand, repeated rumor |
| What is their interest? | Sales, fundraising, politics, none |
| Is it independent? | Do two sources share the same origin? |
| Is it current? | Date of data versus date of article |
| Confidence | Use it when |
|---|---|
| High | Multiple independent, reliable sources agree and nothing important conflicts |
| Moderate | Credible sources support it, but there are gaps or limited independence |
| Low | Thin, single-source, old or contradictory information |
| Unknown | You cannot judge. Say so |
- What is known (sourced fact).
- What you judge (labelled with confidence).
- What you do not know.
Two sources from one origin are one source
If five websites quote the same press release, you have one source. Look for independence before you raise confidence.
Related
A post with thousands of shares says a popular game has been “taken over by traffickers.” It links to three articles, all of which cite the same unnamed local source.
How reliable is the claim, and what do you write in your notes?
Show the debrief
Treat the three articles as one source with an anonymous origin. The claim has low confidence. Note what you can confirm (the game exists and children use it) and what you cannot. Look for reports from official sources such as NCMEC or the platform. Record that the claim is unverified and do not repeat it as fact. If an adult reports a real concern, direct them to report to the platform and the CyberTipline.
Knowledge check
3 Module 3 of 5 · 40 min
Ethical open-source research rules
- State the rules that keep open-source research ethical and safe.
- Recognize when to stop and report rather than investigate.
- Explain why you never look for, store or view illegal imagery.
Open-source research uses public information. In child safety, the work is about patterns, such as what scams are circulating, not about finding or exposing individuals. These rules protect children, victims, investigations and you.
- Use only public, lawfully accessible sources. Do not log in under false pretenses or bypass access limits.
- Do not engage, message, befriend or deceive anyone, and never pose as a child.
- Never investigate, identify, follow or expose a suspected offender yourself. Report instead.
- Never search for, open, download, store or share sexual images of minors. If you see a link or file that may be one, stop, do not open it, and report it.
- Do not collect personal details about minors. Study patterns, not people.
- Record what you looked at and when, so someone can check your work.
- Know your limits and escalate to people with authority to act.
- Don’t confront or contact a person you suspect.
- Don’t publish a name, photo or address of a suspect or a child.
- Don’t use research tools to locate or watch an individual.
- Don’t keep screenshots of illegal material ‘for evidence’.
| If you find… | Do this |
|---|---|
| A public post that looks like a child being targeted | Do not engage. Report to the platform and the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678) |
| A possible sexual image of a minor | Stop. Do not open or save. Report it to the CyberTipline and note only the location of the link |
| A person who may be in immediate danger | Call 911 |
| A possible trafficking situation | Contact the National Human Trafficking Hotline at 1-888-373-7888 or text 233733, or call 911 if urgent |
| A scam pattern with no named victim | Record the pattern and sources, and include it in your brief |
While researching a scam trend, you notice a public profile with many teen followers that sends them private messages offering money for photos. A colleague suggests you pose as a teen to “catch” the person and gather proof.
What do you do?
Show the debrief
Do not engage or pose as a child. That can compromise a law enforcement case, break platform rules, and harm real children. Record the public username and URLs without interacting, then report to the platform and the NCMEC CyberTipline. Do not contact the person or publish the account. If any image or link appears to depict a child, do not open or save it. Let investigators with authority take over.
Knowledge check
4 Module 4 of 5 · 35 min
Reading trend data skeptically
- Explain why counts of reports are not counts of victims or of crimes.
- Check denominators, time periods and changes in method.
- Describe a trend honestly, including what it does not show.
Numbers feel solid, but they depend on what was counted and who was counting. A rise in reports can mean more crime, more awareness, better detection, an easier reporting form, or one large batch from a single company.
| Check | Why it matters |
|---|---|
| What is being counted? | A report, an incident, a victim and a suspect are different things |
| Who is reporting? | Platforms, the public and police report differently, and policies change |
| What is the base rate? | A large percentage change on a small number can still be small |
| What is the denominator? | Per what population, over what period? |
| Did the method change? | New definitions or tools can create a jump that is not real |
| What is missing? | Many cases are never reported, so counts are a floor, not a total |
- State exactly what was counted and by whom.
- Give the time period and compare like with like.
- Say what the data cannot tell us.
- Prefer ranges and plain words to false precision.
Reports are not victims
A report to a tip line is a signal that someone thought something was wrong. One child can appear in many reports, and many children never appear in any report.
A headline says reports of one category of online harm rose several hundred percent in a year. A school board member wants to “declare an emergency.”
What questions do you ask before anyone repeats the figure?
Show the debrief
Find the original source and ask: what exactly was counted, from what base number, did a company or the tip line change how it reports, and is this a rise in reports or in harm? A big percent on a small base, or a change in detection, can create a dramatic headline. Advise saying, “Reports rose sharply, and here is what that may and may not mean,” and focus the board on actions parents and staff can take regardless of the exact number.
Knowledge check
5 Module 5 of 5 · 40 min
Writing a bottom-line-first threat brief
- Structure a one-page brief: bottom line, evidence, assessment, unknowns, actions.
- Write for a decision-maker who has two minutes.
- Cite every figure and label confidence.
A brief exists so someone can decide what to do. Put the bottom line first, show the evidence, state your confidence and the unknowns, then say what to do. If a reader stops after the first paragraph, they should still know the key point.
| Section | What goes in it | Length |
|---|---|---|
| Bottom line | The main judgment and why it matters, in plain words | 2–3 sentences |
| What the public data shows | Sourced figures with dates and exactly what was counted | A short table |
| Assessment and confidence | Your judgments, each with a confidence level and reason | 3–5 lines |
| What we do not know | Gaps in data, time and place | 2–4 bullets |
| What to do about it | Specific steps for the reader, including where to report | 3–5 steps |
| Sources | Links and the date you read them | Complete |
- Use plain words and short sentences.
- Date every source and your brief.
- Name hotlines from /get-help.
- Say who the brief is for and what decision it supports.
- Don’t use alarming language or vague claims like “skyrocketing.”
- Don’t include any names, photos or details of individual children.
- Don’t cite a figure you cannot trace.
- Don’t overstate confidence.
A bottom-line opener
“Bottom line: This scam is widely reported, targets teens on gaming and social apps, and is stoppable when a child tells an adult early. We assess this with moderate confidence. Public data cannot tell us the local scale.”
The principal has two minutes before a staff meeting and asks, “Should we worry about this scam our counselors keep hearing about?”
Draft the first three sentences of your brief.
Show the debrief
A strong opening gives the answer and the confidence: for example, “Yes, a brief staff reminder is warranted. Public reports describe this scam as common among teens and quick to unfold, and we assess that with moderate confidence. We lack local numbers, so we recommend a short staff briefing, a note to parents, and the sextortion response steps on file.” Details and sources follow in the brief.
Knowledge check
★ Capstone
A sourced one-page threat brief
The capstone is how you show you can do the work, not just answer questions. It produces something real that you keep.
- Write a question and the decision your brief supports, for a named audience such as parents, staff or a board.
- Collect at least three public sources and grade each for reliability, noting any shared origin.
- Write a one-page brief with bottom line, a sourced evidence table, assessment with confidence levels, unknowns, and actions including where to report.
- Add a short method note listing what you looked at, when, and the ethical rules you followed.
How it is reviewed
- The bottom line is in the first paragraph and is plain and useful.
- Every figure is cited with a date and a description of what was counted.
- Confidence levels are consistent and explained.
- The brief says what is unknown and avoids false precision.
- No individual, child or suspect is identified or described, and no illegal material is referenced beyond the location needed for a report.
- Actions are specific and point to hotlines listed on /get-help.
Pass every module check at 80% or better, finish the capstone, then follow the steps on the credentials page to request your certificate.
Counts toward
Companion playbooks
- Is this real? Grading what you read and who told you
- Threat brief: financial sextortion of minors
- Preserving evidence: a guide for families
- The grooming chain: what adults can notice, and where to break it
AIP Academy courses are awareness and skills training. They are not legal, medical or clinical advice, and an AIP certificate is not a license, state or professional accreditation, CLE credit, or a promise of employment. In an emergency call 911.
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.