Once you have a known event, then you can use the information that you know about that to start asking more questions.
Proximity is an obvious one, who was near or in contact with the alleged terrorist in the hours, days, weeks beforehand. Were there recurrences of close proximity amongst those individuals previously not considered persons of interest.
This methodology is precisely the same as how fraud and money laundering risk is mitigated. Once you work back from a KE (known event) to build up the pattern of related activities you can use this as a signature on observed future behaviour to try and identify future activity that you'd like to investigate more closely or act on.
It's more like you'd have a map with a line that shows where the terrorist has been, you can overlay on that map everywhere every other whatsapp user has been and pull out any that spend a significant amount of time with the known terrorist. Then you know exactly who they associate with and can interrogate their profiles directly to see if they are viable suspects.
Once you have a known event, then you can use the information that you know about that to start asking more questions.
Proximity is an obvious one, who was near or in contact with the alleged terrorist in the hours, days, weeks beforehand. Were there recurrences of close proximity amongst those individuals previously not considered persons of interest.
This methodology is precisely the same as how fraud and money laundering risk is mitigated. Once you work back from a KE (known event) to build up the pattern of related activities you can use this as a signature on observed future behaviour to try and identify future activity that you'd like to investigate more closely or act on.