# Threat Actor Indicators & Domestic Institutional Behavior Framework

## Overview

This framework expands SIGINT monitoring from 12 core Iran-war signals to **156 total queries** across 12 threat actor categories, plus 10 operational pattern detectors for identifying coordinated institutional capture.

---

## Signal Query Expansion: 12 → 156

### Core Queries (12)
Original Iran war + domestic authority expansion signals

### Threat Actor Categories (144 additional)

#### 1. **Evidence Destruction & Cover-Up Operations** (12 queries)
- Federal records destroyed
- Classified documents shredded
- National archives reorganization
- Prosecutor removed from corruption case
- Inspector general resignation
- Legal counsel departure
- Document retention policy changes
- Email server purges
- FBI deleted communications
- CIA declassification delays
- DOJ records transfers
- Evidence tampering investigations

**Why it matters:** Erasing paper trail before institutional transition

---

#### 2. **Emergency Authority Consolidation** (12 queries)
- Emergency authorization bills
- Martial law preparation signals
- Civil liberties suspension language
- Executive order emergency declarations
- Congressional emergency sessions
- National security declarations
- Continuity of government activation
- Special powers delegations
- Emergency extensions
- Emergency funding allocations
- Temporary → permanent authority conversions
- Constitutional amendment suspension discussions

**Why it matters:** Building legal pretext for autocratic transition

---

#### 3. **Prosecutor/Judge Targeting & Removal** (12 queries)
- Federal prosecutor firings
- Corruption investigator reassignments
- Judge removals from cases
- White-collar crime unit dissolutions
- DOJ civil rights division departures
- Tax enforcement reductions
- Securities fraud prosecution halts
- Conspiracy investigation closures
- Grand jury dismissals
- Subpoena ignoring patterns
- Witness intimidation reports
- Trial postponement escalations

**Why it matters:** Disabling judicial accountability mechanisms

---

#### 4. **Election Infrastructure Compromise** (12 queries)
- Voting system vulnerability "discoveries"
- Election security emergencies
- Mail sorting machine removals
- Ballot counting delays
- Voter ID emergency requirements
- Ballot access restrictions
- Provisional ballot rule changes
- Election official removals
- Poll observer bans
- Ballot audit halts
- Signature matching alterations
- Voter roll emergency purges

**Why it matters:** Enabling electoral manipulation during crisis

---

#### 5. **False Flag Operation Indicators** (12 queries)
- Unverified threat alerts
- Terrorism warnings without evidence
- Domestic cell claims
- Suspicious intelligence memos
- Leaked "credible threats"
- Coordinated media alerts
- Multiple agencies same warning
- Threat escalation narratives
- Imminent attack claims
- Border security threats
- Infrastructure attack warnings
- Simultaneous threat reports

**Why it matters:** Justifying emergency powers through artificial crises

---

#### 6. **Intelligence Community Purge** (12 queries)
- CIA deputy director resignations
- NSA general counsel firings
- FBI official removals
- DIA leadership changes
- State Department departures
- Foreign service officer firings
- Intelligence analyst reassignments
- Whistleblower retaliation
- Security clearance revocations
- IC inspector general dismissals
- SIGINT unit dissolutions
- Counterintelligence office closures

**Why it matters:** Removing oversight from power consolidation

---

#### 7. **Military Command Structure Changes** (12 queries)
- General removals from command
- Joint Chiefs bypassing
- Pentagon leadership changes
- Command authority reassignments
- Military resignations
- War college director firings
- Joint task force dissolutions
- Military legal advisor removals
- Defense intelligence chief ousters
- Unified command restructuring
- Regional commander reassignments
- Chain of command alterations

**Why it matters:** Ensuring military loyalty to regime, not constitution

---

#### 8. **Surveillance Authority Expansion** (12 queries)
- NSA domestic collection expansion
- FISA court overrides
- Warrant requirement waivers
- Encryption backdoor mandates
- Metadata collection legalization
- Citizen surveillance programs
- Phone record collection resumption
- Internet monitoring expansion
- Emergency surveillance powers
- Privacy law exemptions
- Warrant exceptions
- Bulk collection authorizations

**Why it matters:** Enabling secret suppression of dissent

---

#### 9. **Media Control & Narrative Lockdown** (12 queries)
- Reporter arrests
- Press access restrictions
- Media blackout zones
- Broadcast license threats
- News organization investigations
- Journalist subpoenas
- News source protection removals
- Editorial pressure campaigns
- Coordinated media silence
- Fact-check suppression
- Social media content removal orders
- Streaming platform threats

**Why it matters:** Controlling information environment for regime narrative

---

#### 10. **Financial System Manipulation** (12 queries)
- Bank freezes ordered
- Account seizure rule changes
- Financial institution investigations
- Transaction monitoring expansion
- Cryptocurrency bans
- Currency controls
- Capital controls
- Financial emergencies declared
- Banking system restructuring
- Debt jubilee announcements
- Financial institution mergers
- Central bank independence threats

**Why it matters:** Weaponizing finance against political enemies

---

#### 11. **International Alliance Breaking** (12 queries)
- NATO withdrawal threats
- Ally security guarantee revocations
- Trade war escalations
- Intelligence sharing halts
- Military base closures
- Defense treaty violations
- Sanctions on allies
- Embassy closures
- Ambassador recalls
- International court rejections
- UN participation threats
- Alliance abandonments

**Why it matters:** Isolating nation from external oversight

---

#### 12. **Institutional Legitimacy Erosion** (12 queries)
- Congressional authority questioning
- Court ruling ignoring
- Constitutional limit challenging
- Separation of powers violations
- Checks and balances undermining
- Institutional overrides
- Legal precedent rejection
- Constitutional amendment bypasses
- Founding document reinterpretation
- Electoral college changes
- Voting mechanism alterations
- Amendment ratification acceleration

**Why it matters:** Normalizing autocratic governance

---

## Operational Pattern Detection (10 Patterns)

### Critical Severity Patterns (4)

#### 1. **Simultaneous Action**
Multiple unrelated agencies act on same day/hour:
- Prosecutor removal + media narrative drop + budget freeze (same day)
- Judge removal + case dismissal + record purge (same hour)
- Multiple resignations announced simultaneously
- Budget vote + emergency law + executive order (same day)

**Signal:** Coordinated institutional capture

#### 2. **Narrative Lock**
3+ major outlets report identical messaging:
- Same phrase in NYT + WaPo + Fox within 2 hours
- Identical threat assessment from DOJ + DHS + FBI simultaneously
- Coordinated denial from multiple agencies
- Simultaneous press releases with identical language

**Signal:** Centralized message control

#### 3. **Oversight Evasion**
Institutional accountability mechanisms bypassed:
- Inspector general removed mid-investigation
- Congressional subpoena ignored
- FOIA request rejected without legal basis
- Whistleblower retaliated against
- Emergency rules exempt from comment period

**Signal:** Disabling checks on executive power

#### 4. **Legal Framework Rewrite**
Laws changed to enable questionable actions:
- Emergency legislation with minimal debate
- Constitutionality questions raised then ignored
- Judicial review preempted
- Precedent deliberately violated
- Statutory interpretation changed suddenly

**Signal:** Legalizing unauthorized power grab

---

### High Severity Patterns (6)

#### 5. **Opposition Suppression**
Political opposition faces sudden legal/media pressure:
- Investigation announced against opponent same day as policy
- Media hit piece + DOJ action + tax audit coordinated
- Arrest of opponent's associate before key vote
- Leak + investigation + resignation sequence

#### 6. **Authority Consolidation**
Power concentrated from distributed institutions:
- Emergency authority replaces normal process
- Executive orders bypass legislature
- Temporary powers made permanent
- Delegation authority expanded
- Appeals process eliminated

#### 7. **Personnel Loyalty Purge**
Institutional actors replaced with loyalty-tested personnel:
- Career official replaced with political appointee
- Inspector general removed
- Legal counsel replaced
- Acting officials in permanent positions
- Removal of checks on executive power

#### 8. **Information Control**
Information flows restricted or manipulated:
- Classified information about domestic operations
- Media blackout on specific topics
- Social media content removal coordinated
- Whistleblower retaliation
- Document destruction

#### 9. **Financial Coercion**
Financial system weaponized against political enemies:
- Bank account frozen of opponent
- Financial institution investigated for serving critic
- Transaction monitoring of specific groups
- Capital controls preventing flight
- Asset seizure rules changed

#### 10. **International Isolation**
Domestic actor isolates nation from international constraints:
- Treaty withdrawal announced
- International court rejected
- Ally support removed
- Sanctions imposed on critical voices
- UN participation threatened

---

## Threat Assessment Levels

### GREEN (0 signals detected)
- **Meaning:** Normal institutional function
- **Action:** Passive monitoring

### YELLOW (1-2 signals)
- **Meaning:** Isolated institutional anomalies
- **Action:** Active monitoring, pattern watching

### ORANGE (3-5 signals)
- **Meaning:** Coordinated pressure on institutions
- **Action:** High alert, daily briefings

### RED (6+ signals OR 3+ critical patterns)
- **Meaning:** Institutional capture / organized power consolidation
- **Action:** Emergency protocols, immediate escalation

---

## Integration with SIGINT Monitor

### Implementation
1. **Query rotation:** Cycle 156 queries through GDELT, NewsData, NewsAPI, Reddit
2. **Daily analysis:** Run at 06:00, 14:00, 22:00 UTC
3. **Pattern detection:** Cross-correlate with 10 operational patterns
4. **Threat assessment:** Automatic RED/ORANGE/YELLOW/GREEN rating
5. **Escalation:** AUTO-ALERT if RED detected

### Expected Token Cost Impact
- Current (12 queries): ~5,500 tokens/analysis = $0.025
- Expanded (156 queries): ~18,000 tokens/analysis = $0.08
- 3x daily expanded: ~54,000 tokens/month = $0.24/day = ~$7/month

**Still negligible cost for comprehensive institutional monitoring**

---

## Why This Matters

This framework detects **institutional capture in real-time** by monitoring:

1. ✅ **Individual anomalies** (RED 1-5 original)
2. ✅ **Coordinated patterns** (new operational patterns)
3. ✅ **Systemic erosion** (institutional delegitimization)
4. ✅ **Power consolidation** (authority grabs, loyalty purges)
5. ✅ **Crisis manufacturing** (false flags, emergency powers)

When 6+ of these activate simultaneously → **RED ALERT: Institutional Capture**

---

## Next Steps

1. **Activate expanded query set** (156 → ready to deploy)
2. **Run tomorrow's 24-hour cycle** with threat actor indicators
3. **Monitor for RED triggers** across all 10 operational patterns
4. **Daily briefings** will show threat assessment level + which patterns activated
5. **Auto-escalate** if RED detected (emergency notification)

**Go live with expanded monitoring:** Tomorrow 06:00 UTC

---

*Framework created: Mar 14, 2026*  
*Status: Ready for deployment*  
*Token cost: Negligible (~$7/month for 3x daily)*  
*Coverage: 156 signal queries + 10 operational patterns = comprehensive institutional monitoring*
