These events do not all pose the same level of threat. But treating them as "just online" can be a serious mistake.
Online harassment becomes a protective intelligence concern when digital behaviour may expose personal information, enable unwanted contact, facilitate coercion or indicate a credible risk of harm. The task is to assess the facts and the trajectory, not assume every offensive message signals physical violence.
Different behaviours, different responses
Doxxing involves publishing or sharing someone's personal information in a way that may expose them to harm. Impersonation can be used to damage trust or obtain information under false pretences. Deepfakes may be used to humiliate, intimidate, defraud or pressure a target.
Stalking may involve repeated online contact, attempts to monitor activities or behaviour that moves between digital and physical settings.
UN Women has documented the increasing use of AI-enabled deepfakes, impersonation and harassment against women and girls, including women in public life. The effects can extend beyond reputational damage to professional participation, safety and privacy.
What matters for an individual case is the specific conduct, its context and any indicators of escalation.
Questions that help establish the level of concern
What has actually occurred, and when? Has the same account or person contacted the principal repeatedly? Has private information been exposed? Is there evidence of attempts to contact family members, staff or a workplace? Have explicit threats been made? Is the claimed identity verified?
Not every question can be answered immediately. Still, a properly documented pattern is often more informative than an isolated screenshot.
Technical and investigative specialists may be needed to assess account compromise, impersonation or information exposure. Where stalking or threats may constitute criminal conduct, the relevant police authority should be involved.
Protect evidence without becoming an investigator yourself
Where safe, preserve relevant messages, account details and dates, and tell trusted people who may need to know. Avoid contacting or confronting someone whose behaviour is threatening. If there is immediate danger, contact emergency services.
Victims should not delay reporting to law enforcement while trying to assemble a complete evidence package. UK police guidance makes that clear.
A private investigation may support an appropriate protective response, but it does not replace police reporting, specialist victim support or legal advice.
The person behind the account
A digital profile is not always what it appears to be. Account names may be false, content may be manipulated and apparent online relationships may be misleading.
Attributing conduct to a real person requires care. Incorrect attribution can cause further harm and undermine an investigation. Where identification is possible and lawful, sources should be assessed and findings distinguished from speculation.
FRYA brings together relevant intelligence, investigations and protective capabilities to help principals and their representatives understand a developing concern and determine what further action may be appropriate.
An online incident can be noise, reputational abuse or an indicator of something more serious. The point of intelligence is to tell the difference.