TCIB
Well-Known Member
Intelligence services will know pretty much every source for stuff and who some of the main recruiters are. Places that discuss detailed methods of operations for example how to pick a site to hit, avenues of attack, time of day, detailed up to date stuff. The services with isp help can see how many pages you viewed, what pages etc. From that you can pretty well sort the wheat from the chaff.What about looking at bomb making on the internet? Just type it in and there's pages and pages of them.
For example large irc networks like linknet, their owners may have been approached by LEA saying 'we don't give a toss about piracy chat rooms but we could really use your help if hidden chat rooms are created on your network to facilitate terrorism'. The fact that someone may go to the extent of making an ssl secured temp private chat room on irc would in it's self show a pretty high level of determination to avoid authorities, probably balanced with the risk of what they are doing.
Even as an untrained officer i could look at sets of browsing history and computer use and have a rough idea if they have been up to no good. An algorithm can do the same thing to a higher level of accuracy most likely. If the security services cross reference their online activities with real world, i would suggest they could be 90% sure they are worth investigating further if not more so.