Menu Close

How risk intelligence and OSINT analysts can follow Twitter’s splintering audience

A screenshot of Mastodon at an angle. The words are difficult to read

If there was ever a moment when journalists realized that Twitter was on unstable ground, it was when Elon Musk abruptly suspended several reporters from the platform. Within minutes, many were powering up accounts on other platforms, not out of curiosity, but with the likelihood this may become their new home.

Most suspended accounts were restored two days later, but Musk’s erratic move has challenged the news media’s affinity for Twitter. Journalists have long preferred the platform for both work and personal activity. While most will stay for work, some are shifting their personal attention to other platforms.

The erosion of journalists’ attention could prove to be foreboding. Where individual journalists shift their attention, branded news accounts often follow. If those accounts gain traction, government accounts will feel compelled to create their own presence, as well. 

Unfortunately, this hasn’t been all that surprising. At a Global Security Briefing in early November, the audience was abuzz with questions about Twitter. Would analysts reliant on Twitter have to monitor new alternatives as some users announced their departure? What would happen if the site deteriorated and began to crash regularly?

For risk intelligence and OSINT analysts, Twitter isn’t merely a source of news, it’s the most widely-used tool to identify emerging threats, fact-check governments and keep tabs on global events. An over-reliance on Twitter is a risk in itself. As we wrote in a blog post after the briefing, “it’s a good time” to assess your organization’s reliance on Twitter and take stock of the larger information ecosystem. Now it’s becoming more of an urgency.

Figuring out how much attention to pay to existing and emerging platforms is part art and part science. Much of it is determined by the bandwidth your team has available. If your team was already having difficulty confirming intelligence, reliable sources splintering to different platforms makes the task much more complex.

At Factal we’re always on the hunt for emerging public data sources, and we’ve been watching Twitter’s splintering audience carefully. Here’s a breakdown:


The same night Musk banned his first batch of journalists, he also blocked links to Mastodon, the most competitive of Twitter-like platforms. As you may know by now, Mastodon is a federated social media platform with no central servers (there are currently over 7,000 instances). The first decision a new user must make is which instance to join – a confounding choice for the average user, which has limited Mastodon’s mainstream growth. 

For the analyst, the federated approach complicates matters. There’s no universal search, and many in the Mastodon community count that as a feature, not a bug. Even accounts themselves take time to discover and patch together, often requiring you to copy-paste the account URL into the search box. Fortunately, Mastodon does have RSS feeds for each user and an API for each server, and plenty of people are working on creating third-party search tools.

Regardless of the complexity, Mastodon is capturing the most Twitter refugees – including the suspended journalists themselves – and activity has surged. The morning after Musk’s journalist suspensions, Mastodon said the rate of user sign-ups tripled to 4,000 an hour. Even at that number, it will take a long time to approach Twitter’s 450 million monthly users. 

“We’re starting to see legacy media outlets and some reporters use Mastodon in the same way as Twitter — a migration that may now be accelerating with Musk’s decision to suspend the accounts of several prominent journalists under auspicious reasoning,” explained Joe Veyera, Factal editor and regional head of the Americas. “But there would have to be a significant influx of users for it to become a key source of breaking news, especially eyewitness accounts.”


Most popular in India, Russia, the United States, Indonesia and Brazil, Telegram is a privately-funded, encrypted-by-default messaging app created by the same people who created Russian social app VK. 

While it’s mostly used for private messaging, many news organizations and government officials operate public channels on Telegram. Discovery can be a bit daunting at first, and Telegram directories like this one will help. There’s also a thriving world of groups, many of them private by default. 

Leading up to Russia’s invasion of Ukraine, Telegram became the primary source of real-time information about the conflict, outpacing Twitter and other platforms. With little moderation and no algorithm dictating the feed, it’s a vital tool in Factal’s coverage of the conflict. 

“[It’s] an essential source for monitoring the post-Soviet space, from border conflict between Tajikistan and Kyrgyzstan to missile strikes near NATO territory in western Ukraine,” explained Alex Moore, Factal editor and regional head of Europe. “The wide breadth of sourcing provides a unique glimpse into events on the ground, enabling verification of events sans confirmation from local officials at quick speed.”


What if social media was also the way users paid for the news? Post attempts to be both a social platform and a method of paying breaking news journalists, analysts and creators for their work through micropayments. Post is only a few weeks old, and is being built in a live beta. It just picked up funding as it builds in the safety tools necessary for common users and news partnerships that will take advantage of its micropayments business model.

There’s a long waitlist on this hybrid of timeline and newsletter platform. Without much participation, the OSINT analyst will be unlikely to find news as it breaks. As grows, and if it meets its ambitions, it will become a place to see analysis first (as Substack and Medium did) and then breaking events later as the user base expands.

“Currently Post has a waitlist in the hundreds of thousands. The OSINT professional or risk analyst should probably sign up for an account just in case it does surge in popularity as targets news consumers and journalists specifically,” said Dave Clark, Factal marketing. 


If you thought Discord was just a gaming chat platform, think again. Over the years, it’s grown into a community of communities for just about any topic you can imagine. It’s also a thriving home for the largest OSINT chat servers: Bellingcat and Project Owl.

While a great place to keep up on crowdsourced OSINT analysis, Discord can be noisy and speculative. It’s not the home for breaking news and eyewitness reports, but rather the analysis of them. It takes time to know which users are more accurate than others, but it’s a helpful tool to discover new sources and brush up on your OSINT skills.

Old guard platforms

Some sports journalists are attempting to use the visual medium Instagram, but the highly algorithmic nature of the platform means that only Stories would be a good means to share breaking news. That will be hard to capture for analysts as Stories are only up for 24 hours. There is a chance that Meta creates a Twitter-like feature in either Facebook or Instagram, but how that is executed is still to be determined. With Meta’s broad reach it remains valuable for OSINT.

Others suggest LinkedIn, which is again a mostly algorithmic platform, and has a reputation for being a hiring website more than it is for social media. An emerging trend is to use LinkedIn in ways that are simultaneously personal and professional. That’s good for creators, and why many may head there. LinkedIn is a strong spot to locate analysis and impacts of events rather than the immediate news of the incident itself.

Conservative social apps

Parler, Gab and Truth Social all have similar issues. They are among the least moderated places on the public web and cater to populaces that feel aggrieved on more popular social platforms. Some news does break here, mostly of a political nature. Analysts should be ready to sift through more NSFW content and misinformation than on Twitter when finding actionable intelligence. 

Those unlikely to be of use for OSINT:


Hive had an explosion of popularity in creative types after Musk’s acquisition. It is heavily moderated, specifically billing itself as a safe place. Security issues took significant time to fix and resulted in a weeks-long shutdown of Hive’s servers. It looks unlikely to become a place for breaking news.


Cohost has no aspirations to become large enough to become a useful source of risk intelligence. It’s founded by a three-person company “that hates the software industry”


Founded, operated, and managed by a hacktivist named The Jester, CounterSocial is based on Mastodon and blocks entire countries from access. Breaking news is a popular topic and hashtag, but with an aggressive account removal policy and a one-person staff, it’s best used as an occasional resource.

Factal’s solution to social diversification

Since we verify events rather than just detect them, Factal’s platform and newsroom have always drawn from a broad range of real-time sources. We engineered our AI-powered technology from the ground up to analyze all kinds of sources and formats. Our team of experienced journalists are wired to seek out the news through a variety of tools and techniques. Together, we’re able to discover and triangulate information more quickly without the risk exposure of relying on a single platform. We’re constantly adding new data sources – especially in recent weeks.

As we explained to our members in November, while we hope that Twitter is resilient in the face of change, the growth of new platforms may be an improvement for the industry in the long run.

What is Factal?

Trusted by many of the world’s largest companies and nearly 300 humanitarian NGOs, Factal is a risk intelligence and collaboration platform that brings clarity to an increasingly noisy and uncertain world.

Powered by a hybrid of advanced AI and experienced journalists, Factal detects early signals, verifies critical details and assesses the potential impact at the speed of social media. From physical incidents and brand mentions to geopolitical developments, Factal offers the most trusted, real-time risk intelligence on the market.

Factal is also home to the largest security and safety collaboration network in the private sector. Members securely share information with other members in proximity to the same incident, both on and the Factal app.

Learn more at, and we’d love to hear from you.

Additional Reading:

(Updated on Dec. 17)