Army CID seeks darknet threat-intelligence software

By Tom Whitfield

Vendors must submit responses to Army CID’s commercial threat-software RFI by Dec. 9. The Army Criminal Investigation Division issued the request this week for a cloud-hosted platform to identify and track adversaries across darknet and encrypted messaging platforms.

The RFI remains market research, not a software award. It names no price, selected vendor or deployment schedule, while setting a demanding scope for vendors.

A proactive posture replaces reactive monitoring

Army CID says it wants to move from a reactive footing to a proactive model as it conducts missions. Officials wrote: “Modern adversaries targeting DoW personnel, high-value assets, and critical Army infrastructure have migrated away from mainstream online spaces.” DoW is the Trump administration’s preferred name for the Department of Defense.

They say adversaries now exploit decentralized, highly encrypted and ephemeral networks to coordinate, radicalize and plan hostile actions. The target includes foes who organize against the U.S. military through darknet services and encrypted platforms such as Signal, Telegram and Discord. Watching mainstream online channels no longer supplies a complete picture.

Army CID “requires an advanced, cloud-hosted commercial threat intelligence and investigative software platform” that goes beyond legacy, keyword-based Open-Source Intelligence (OSINT) tools. The RFI specifies automated behavioral analytics, machine learning and artificial intelligence. Keyword search alone will not carry procurement.

What the platform must detect and connect

The accompanying capability matrix defines the operating requirements. Automatic warning comes first: vendors should show how their systems would flag early indicators of “mobilization to violence” against military personnel, installations or assets.

The matrix also seeks:

• Natural language processing and computer vision for automated translation and symbol recognition. The platform would sort and interpret vernacular, slang, iconography, audio, visual media and coded symbols that standard keyword filters miss.
• Correlation of disparate, pseudonymous or anonymous accounts across the surface web, deep and dark web, and alternative social platforms into unified subject profiles.
• Metadata and digital-footprint analysis, plus graphing of blockchain and cryptocurrency transactions.
• Automated collection, indexing and archiving of volatile, transient or user-deleted digital content for evidence acquisition and preservation.

Together, those functions connect account discovery to evidence handling. The request asks for an integrated method, not merely a feature list: automated analytics, human review and evidence preservation must fit within one commercial platform. That is a demanding specification for vendors.

Evidence collection and undercover routing

Army CID also wants the platform to secure material before it disappears. The collection function targets volatile, transient and user-deleted content, with indexing and archiving intended to improve evidence acquisition and preservation. Automated collection addresses a basic investigative problem: some digital evidence has a short shelf life.

For undercover work, investigators would use virtual workspaces and network-routing capabilities that mask their government origins and digital fingerprints. The request puts operational concealment and evidence durability on the same shopping list. That pairing covers both operational security and evidence retention.

What does this change for commercial vendors?

The RFI asks vendors to explain how their systems handle coded or non-textual communications and track “coordinated threat actors” across “fragmented alt-tech, darknet, or encrypted messaging ecosystems.” It also asks how systems would place human analysts into threat-alert validation. Vendors must describe masking of device metadata, location data and network footprints during active probes, and capture and archiving of ephemeral data as potential evidence.

For vendors, the practical task is to show one commercial platform joining account correlation, automated analytics, evidence collection and investigator protection. The brief is broad; Dec. 9 is not. Each response must explain how those controls work together, rather than merely list them.