OSINT 1 - Hooligans 0 The Future of Football Intelligence: How OSINT Can Help Tackle Football Hooliganism

Introduction

Football hooliganism should no longer be viewed as a localised phenomenon in which the terraces, railway stations, or the pubs in the streets around the stadium are the battlegrounds.

As technology continues to provide greater global reach across all areas of society, it has also helped modernise football hooliganism and streamline the disorder associated with it. Organised hooligan groups now operate as more sophisticated networks, using digital platforms to coordinate movements, recruit members, share "intelligence", evade law enforcement, and share their exploits online to a global audience.

While the FIFA World Cup 2026 provides a high-profile backdrop for these challenges, hooligans' use of technology means that even greater deployment of open-source intelligence (OSINT) tools and techniques could be a game-changer.

Traditionally, tackling hooliganism involved high visibility but reactive policing, covert infiltration and a heavy reliance on informants. However, as outlined in the Coalition of Cyber Investigators' OSINT Framework for Threats: Safeguarding Sports Integrity, protecting the integrity of major sporting events now requires a more proactive approach to identifying emerging threats by leveraging the massive volume of publicly available open-source intelligence. This can produce decision-making insights that are verified, up to date, relevant and actionable.

From Terraces to Terabytes

Today's hooligans operate in a more agile, decentralised, and internet-enabled manner, but despite the popular perception that operating online is more covert, digital footprints are usually left, creating a trail for OSINT specialists to follow.

These indicators could include, for example, posting their movements in real time via livestreams, geotagged images, and comments or updates from members of the public who are witnessing the disruption.

The future of gathering actionable hooligan-related intelligence lies in the ability of OSINT specialists being capable of identifying genuine indicators of intent among the noise created by millions of football fans across the globe – but doing so in a way that preserves the integrity of any intelligence or evidence collected, and the veracity of the process used to collect it.

As the Coalition discusses in AI in OSINT Investigations: Balancing Innovation with Evidential Integrity, maintaining evidential standards becomes increasingly important when analysing multiple indicators collected from the vast volume of publicly available information.

Tradecraft over Tools: The Need for Verification

A growing issue in modern OSINT investigations is the over-reliance on automated tools at the expense of analytical tradecraft. Imagine a police control room set up to manage public order during a high-risk local derby learning the hard way that the speed of social media can be deceptive. A single trending post claiming rival groups are gathering at a specific transport hub could trigger massive police redeployments, potentially leaving genuine targets unguarded – the cost of acting on unverified intelligence could be high.

History shows that even with access to large volumes of data, methodological failures lead to critical oversights. A recent example is the Maccabi Tel Aviv intelligence failure, which serves as a warning of what happens when OSINT is unverified but acted on, or relied upon. This reflects a core OSINT principle where even the most widely circulated digital evidence requires independent corroboration to avoid costly investigative mistakes. To turn raw data into actionable intelligence, grading and dissemination frameworks that enable decision-makers to distinguish credible threats from online hyperbole should be mandatory.

The Future is Human plus Machine

The debate surrounding the future of crowd surveillance often focuses on a choice between human expertise and technology. From a football intelligence perspective, the most effective results come from a hybrid approach, despite artificial intelligence (AI) undoubtedly being a force multiplier, capable of analysing thousands of public images for group logos, performing automated facial recognition, monitoring sentiment across multiple languages, and flagging anomalies in crowd dynamics via public webcams and CCTV.

This is important as experienced investigators recognise that technology has its limits. Hooligan groups have already learned to evade detection by automated systems through masks, face paint, or coordinated clothing choices. This is where the human "spotter" and "super recognisers" remain indispensable. Academic studies show that super recognisers possess an innate ability to remember and identify faces, often outperforming algorithms in low-resolution or crowded environments, and can provide the necessary context for AI-generated alerts. In other words, where AI provides speed, human oversight injects context and helps ensure that findings meet the evidential standards required for any potential legal action.

Black OSINT and the Intelligence Race

A significant threat often overlooked by the public is that hooligans, like many other criminal groups, are developing their own OSINT capabilities. We have already entered the era of "Black OSINT," where bad actors use open-source techniques to achieve objectives such as doxxing undercover officers, tracking the movements of rival fans, or researching potential stadium security vulnerabilities.

However, as bad actors refine their own OSINT skills, they are also more likely to be attuned to the operational security (OPSEC) measures that investigators deploy. This heightened awareness means they will increasingly deploy their own countermeasures, making them more resistant to digital infiltration.

This situation creates a double-edged sword for investigators. On the one hand, there is a goldmine of publicly available intelligence, and with the appropriate safeguards and procedures in place, it can provide high-quality, actionable intelligence. On the other hand, bad actors are becoming more OSINT-aware, making it necessary to protect the football with rigorous OPSEC measures and robust procedural safeguards. For example, any digital footprint left by an investigator could tip off a particular group that they are under observation; any degree of overreliance on an unverified intelligence report could mean that the authorities could themselves become victims of a black OSINT disinformation campaign.

Playing The Long Game: Why Intelligence must be a Team Sport

Looking forward, beyond the closing stages of the 2026 World Cup, the effectiveness of any intelligence strategy should be directly linked to the degree of international cooperation.

Hooliganism is rarely confined by national borders, particularly during major tournaments such as the FIFA World Cup, where fans from 48 nations converged.

The future of football intelligence must be defined by the seamless integration of OSINT, international Policing cooperation, and human intelligence inputs within a legally governed, multi-agency framework.

The routine grading of intelligence, the standardisation of investigative OSINT procedures, and an awareness of the sophistication of today's football hooligans are all areas where there is significant room for improvement.

Without those basic building blocks - grading, standardisation and awareness - even the best technology and the most experienced practitioners will struggle to perform consistently. In intelligence terms, that means mistakes, missed opportunities, and dodgy prosecutions; on the pitch, it might mean getting beaten at home.

---