Back
Operation
Anti-Trafficking · OSINT Tooling
Active Development
Linux · Python · OSINT
2025–Present
Operation US-One is an OSINT collection and analysis program developed to support anti-human trafficking intelligence work. The program ingests publicly accessible data from the open and deep web — forums, classified advertising platforms, public indexing services, and sanctioned data redistributions — and produces structured output formatted for analytical review and, where appropriate, referral to law enforcement partners.
The program is operated by a single OSINT analyst and serves a dual role: as tooling that reduces the time cost of routine collection tasks, and as the research foundation for graduate work examining the application of open-source methods to community-level anti-trafficking analysis.
Anti-trafficking analysts face a signal-to-noise problem that manual collection cannot resolve at any useful scale. The volume of content produced daily across relevant platforms exceeds what any individual can review by hand, and those platforms shift in structure, location, and access controls on an ongoing basis. Traditional review workflows do not keep pace with the operational environment.
Commercial and institutional intelligence tooling exists, but access is substantially constrained by licensing costs and by procurement pathways that are unavailable to independent analysts and community-level organizations. Operation US-One occupies that gap: purpose-built, operator-maintained, and directly informed by the analytical requirements of the work it supports.
The program executes as a set of modular Python scripts invoked from the Linux command line. Each stage of the collection and processing pipeline is independently inspectable, adjustable, and re-runnable, supporting both scheduled execution and ad-hoc analyst tasking.
The technical stack is intentionally minimal. Dependencies are limited to well-supported, auditable libraries; GUI and framework overhead is excluded where not operationally necessary.
Operation US-One is developed and operated by a single OSINT analyst. Architecture, collection rules, and parsing routines are owned by the operator, which concentrates accountability for output quality, ethical posture, and operational risk in a single point of decision-making.
corridor-canary is an operational extension of Operation US-One that broadens the program's collection posture to include sanctioned, publicly redistributed data streams. The utility monitors the National Center for Missing & Exploited Children (NCMEC) public RSS feed and filters incoming missing-child alerts against a configurable watchlist of municipalities along the U.S. Route 1 corridor, from the Maryland/Pennsylvania border south to Key West, Florida. Matching alerts are delivered to the analyst as a single deduplicated notification via a private ntfy endpoint.
The operational value of corridor-canary is not the individual alert. It is the structured, timestamped, geolocated dataset that accumulates across the corridor over time. That dataset supports clustering analysis around specific municipalities and transit nodes, correlation against known indicators of trafficking activity — truck stops, interstate exits, transient lodging, bus terminals, and event venues — and the development of temporal baselines against which anomalous activity becomes identifiable.
When cross-referenced with additional open-source holdings, including court records, licensing databases, zoning data, and prior NGO reporting, the accumulated corridor dataset supports pattern-of-life analysis, the development of actionable tips for referral to law enforcement partners, briefings for community and agency stakeholders, and longitudinal reporting products that case-by-case awareness cannot produce. corridor-canary functions as the ingestion layer for a regional intelligence picture; analysis and dissemination remain the responsibility of the analyst.
The initial iteration of Operation US-One relied on adversarial collection against non-sanctioned targets. That approach produced useful output, but proved operationally unsustainable; access to the primary collection target was revoked within weeks of deployment, and sustained scraping of hostile platforms was assessed as a long-term architectural liability rather than a capability.
The current program direction reorients around sanctioned, publicly redistributed data streams and toward analytical methods — correlation, pattern-of-life development, and longitudinal baselining — that extract operational value from legitimate source material rather than from volume of unauthorized collection. corridor-canary is the first operational expression of this reorientation; additional extensions targeting adjacent sanctioned streams are in development.
The program also serves as the foundation for the operator's Master's capstone research in Criminal Justice and Counter-Terrorism, which examines the role of open-source methods in community-level anti-trafficking analysis.
All data processed by Operation US-One is drawn from publicly accessible sources. The program is operated exclusively in support of anti-human trafficking research and for the development of analytical products suitable for referral to law enforcement partners. Output is not distributed outside of this defined purpose.
Collection activities observe platform terms of service and applicable legal constraints; where a target's access posture changes, collection against that target ceases. The program does not store personally identifying information beyond what is required for analytical correlation, and does not retain raw collection output beyond working-analysis windows.