Army CID Seeks Cloud Software for Darknet and Encrypted-Platform Investigations

The Department of the Army Criminal Investigation Division (Army CID) is conducting market research on commercial software that can help investigators identify and track threats operating across darknet sites, encrypted messaging platforms, and alternative social networks. The RFI reflects a shift in investigative posture: Army CID says it wants to move from a “reactive footing” to a “proactive model” as adversaries increasingly use decentralized, encrypted, and ephemeral online spaces. The source identifies Signal, Telegram, and Discord as examples of platforms used to organize and coordinate activity against the U.S. military. The request does not announce a contract award, state a contract value, or guarantee a future procurement.

The stated operational concern is that actors targeting Department of War (DoW) personnel, high-value assets, and critical Army infrastructure have migrated away from mainstream online spaces. Army CID’s RFI calls for an advanced, cloud-hosted commercial threat-intelligence and investigative platform that can move beyond legacy keyword-based open-source intelligence tools. Desired capabilities include behavioral analytics, machine learning, and artificial intelligence to detect potential indicators of “mobilization to violence” involving military personnel, installations, or assets. Vendors should explain how their systems identify emerging behavior and validate alerts, rather than relying solely on searches for predefined terms.

The accompanying capability matrix points to a broad set of technical requirements. Army CID is interested in natural language processing and computer vision for automated translation and symbol recognition, including interpretation of slang, vernacular, iconography, audio and visual media, and coded symbols that standard keyword filters may miss. The agency also seeks tools to correlate disparate, pseudonymous, or anonymous accounts across the surface web, deep and dark web, and alternative social platforms into unified subject profiles. Focus areas include metadata and digital-footprint analysis, as well as graphing blockchain and cryptocurrency transactions. These requirements create potential relevance for threat-intelligence providers, investigative-software vendors, AI/ML firms, and companies with experience analyzing fragmented online ecosystems.

Evidence handling and operational security are central to the market research. Army CID wants automated collection, indexing, and archiving of “volatile, transient, or user-deleted digital content,” addressing the risk that online material may disappear before investigators can preserve it. For undercover work, the envisioned tools include virtual workspaces and network-routing capabilities designed to mask investigators’ government origins and digital fingerprints. The RFI also asks vendors to describe how they handle coded or non-textual communications, track coordinated threat actors across fragmented platforms, and incorporate human analysts into threat-alert validation. Respondents should map their capabilities directly to these investigative needs and clearly describe how evidence preservation, analyst review, and protected operations work in practice.

• Customer: The Department of the Army Criminal Investigation Division, within the United States Army and United States Department of Defense.
• Request type: A request for information and market-research effort—not a stated solicitation, contract award, or commitment to purchase.
• Response deadline: Vendors’ RFI responses are due December 9, 2026.
• Hosting and core functions: Army CID seeks a commercial, cloud-hosted threat-intelligence and investigative platform with behavioral analytics, machine learning, and AI.
• Threat detection: Desired tools would flag early indicators of “mobilization to violence” against military personnel, installations, or assets.
• Language and media analysis: The capability matrix identifies natural language processing, automated translation, computer vision, and recognition of slang, iconography, audio, visual media, and coded symbols.
• Cross-platform investigations: The agency wants to correlate pseudonymous or anonymous accounts across surface web, deep/dark web, and alternative platforms; metadata, digital footprints, and blockchain or cryptocurrency transaction graphs are focus areas.
• Evidence preservation: RFI requirements include automated collection, indexing, and archiving of volatile, transient, or user-deleted digital content.
• Undercover support: Vendors should address protected virtual workspaces and network routing that can mask investigators’ government origins and digital fingerprints.
• Response guidance: Explain how the product tracks coordinated actors across fragmented ecosystems and brings human analysts into alert-validation workflows; tailor descriptions to the RFI’s specific capability areas.