Redacted, Not Useless: FOIA Logs as OSINT Pivots

How can redacted FOIA logs serve as OSINT pivot points?

Redacted logs still carry dates, identifiers, categories, and the subjects an agency chose to track. A EUCOM watch log released to me in 2023 shows which European political events the command logged and when, even with its assessments withheld. A DoD Inspector General log lists 3,382 closed investigations by ID, each a lead for a follow-up request.

Key Takeaways

What Can a Redacted Log Tell an OSINT Researcher?

A redacted log tells a researcher what an agency tracked, when, and under what label, even when it withholds what the agency thought. Dates, entry numbers, categories, places, and classification markings usually survive. Those fields are pivot points: each one can be searched, counted, matched to public reporting, or named in the next FOIA request.

Open-source intelligence, or OSINT, works by pivoting. A researcher starts from one identifier, such as an email address or a domain, and follows it to the accounts, servers, and records attached to it. Public-records research works the same way. A log is an index. The entries in it are identifiers. The files behind them are the records worth requesting next.

Two releases from my own Freedom of Information Act requests show the method. One is a U.S. European Command watch log that came back mostly black. The other is a Defense Department Inspector General list of closed investigations that came back nearly whole. The same reading is what the Kabul evacuation record and DIA’s Islamic Jihad files do with other redacted releases.

What Did EUCOM Release?

I asked U.S. European Command, the Stuttgart, Germany, headquarters for U.S. forces in Europe, for two records: “the EUCOM Joint Operations Center (JOC) Log from February 2022 to present,” and “the EUCOM Joint Operations Center SIGACTS Log from February 2022 to present.” A SIGACT is a significant activity, the military’s term for an event a watch floor records and tracks. The command’s FOIA office received my request on November 21, 2022, and assigned it case number 23-F-008.

The command answered on September 11, 2023. “As a result of our review, we are releasing 28 pages in part,” the letter said. It cited four exemptions:

• Exemption (b)(1), for information “properly classified” under an executive order.
• Exemption (b)(3), through 10 U.S.C. § 130c, which “protects from disclosure certain sensitive information of foreign governments,” the letter said.
• Exemption (b)(6), for personal privacy.
• Exemption (b)(7)(c), for law-enforcement records whose release could invade personal privacy.

The Initial Denial Authority, the official who made the withholding decision, was Col. Christopher Longo, whom the letter identifies as “EPOC Chief of Staff.” It was signed by Col. Luis A. Parilli, the command’s director of manpower and personnel.

Requester name, address and email redacted by OctoProbe News.

The release runs thirty pages: the two-page letter and twenty-eight pages of log. Nearly every page is dominated by black boxes stamped “(b)(1) 1.4(a), (g).” Those codes point to Executive Order 13526, section 1.4, which allows classification of military plans and operations, category (a), and of vulnerabilities or capabilities of systems and installations tied to national security, category (g).

What Survives in a SIGACT Entry?

What survives is the skeleton of the log, and every unclassified entry in full. Each row of the log has the same fields, which a researcher can read like a form:

• Title: a status (INITIAL or UPDATE), a date-time group, the tag “EUCOM SIGACT,” a subject, a place, and a classification marking.
• SIGACT ID: a four-digit entry number.
• Who and What: the actor and the event, in a few words.
• WhenBeginTime and WhenEndTime: when the event started and ended.
• Details: a short narrative, often citing the press.
• EventLocation: a city.

The date-time group is military shorthand. “23 1330Z Feb 22” means February 23, 2022, at 13:30 Zulu time, or Coordinated Universal Time.

The earliest unclassified entry in this set, SIGACT 6303, is titled “Ukraine Declared State of Emergency - Kyiv.” It was logged on the eve of Russia’s full-scale invasion. Its narrative notes that Ukraine’s Foreign Ministry told Ukrainians in Russia to “depart as soon as possible” and that “the Ministry of Defense has authorized a conscription order calling up reservists between the ages of 18-60.”

Six days later, SIGACT 6353 recorded “Ukraine President Zelensky Allows foreigners to fight in Ukrainian Armed Forces - Kyiv.” Its details field reads “NFI,” for no further information. The four rows above it are blacked out. Their classification markings, struck through but still legible, include “SECRET//REL TO FVEY,USA,” meaning releasable only to the Five Eyes allies, and “SECRET//NOFORN,” meaning no foreign nationals.

The summer of 2022 shows the log tracking European governments falling.

SIGACT 7043, logged at 08:11 Zulu on July 7, 2022, recorded “UK Prime Minister Boris Johnson Resignation - London.” Its narrative said Johnson was resigning “following the resignation of 55x Members of Parliament (MP) from cabinet and other governmental positions.” It went on to recount the scandal over Chris Pincher’s appointment as deputy chief whip and the arithmetic of a Conservative leadership change.

Italy came next. SIGACT 7064, on July 14, logged Prime Minister Mario Draghi’s first resignation attempt: “PM Draghi offered to step down after a populist coalition ally refused to support a key government bill. The nation’s president rejected the resignation.” Two entries a week later, 7083 and 7084, both timed 11:30 Zulu on July 21, logged his second. They said “Corriere della Sera reports that elections are now likely to take place in autumn 2022,” a reminder that the unclassified entries lean on the newspapers.

Editor’s note: The July 21 entries say three parties refused to back Draghi “in a confidence vote 18 Jul.” The Italian Senate vote that ended his government was held July 20, 2022, according to the Associated Press. Logs are written fast and carry errors; check each date against an outside source before relying on it.

October 24, 2022, brought two entries an hour and a half apart. SIGACT 7673, at 11:30 Zulu, recorded “Vasile Dincu Resignation - Bucharest.” Romania’s defense minister, it said, “resigned pending disagreements with Romanian President Klaus Iohannis over Ukrainian Peace Talks.” SIGACT 7672, at 14:00 Zulu, recorded “Rishi Sunak Elected Tory Leader - London.”

The last unclassified pair in this set comes from Berlin. SIGACT 8038, at 13:00 Zulu on January 16, 2023, logged “DEU DM Lambrecht Resignation - Berlin,” for German Defense Minister Christine Lambrecht. Its narrative listed the successors German media were floating, among them armed forces commissioner Eva Högl and Social Democratic Party chief Lars Klingbeil. The next day, SIGACT 8048 was logged as “UPDATE 1” under the title “DEU Appoints New DM - DM Pistorius - Berlin,” naming Boris Pistorius.

Why Is the Metadata of Attention Worth Having?

The surviving entries reveal what a combatant command chose to watch, how quickly it logged it, and how it labeled it. They reveal almost nothing about what EUCOM concluded. For a researcher, that split matters: priorities and tempo are findings in their own right, and the withheld substance can be pursued separately.

Read as data, the log says several things the letter does not:

• Priorities. Among the entries left open, EUCOM’s watch floor logged resignations and leadership changes in four NATO capitals, London, Rome, Bucharest, and Berlin, alongside the war in Ukraine. Political stability among allies was a tracked event, not background.
• Tempo. Johnson’s resignation entry is timed 08:11 Zulu, and Sunak’s election as Conservative leader is logged at 14:00 Zulu on the day it happened. The watch floor wrote these up the same day.
• Volume. The entry numbers climb from 6303 in February 2022 to 8048 in January 2023. If the numbers run in sequence, the log took in roughly 1,700 entries in those eleven months. The release does not say whether they do.
• Process. Sunak’s entry, logged later in the day, carries a lower number, 7672, than Dincu’s, 7673. Draghi’s resignation appears twice, as 7083 and 7084. Numbers track when someone opened an entry, not when the event happened, and duplicates happen.
• Sources. The open entries cite Corriere della Sera, “German media,” and “UK news outlets.” The unclassified layer of a military watch log is built largely from open sources.
• Classification mix. Even withheld rows keep their struck-through markings, from UNCLASSIFIED and CUI, for controlled unclassified information, to SECRET//NOFORN. A researcher can see where the sensitive reporting clusters without reading a word of it.

Editor’s note: The release also contains rows in a second layout, with an “EventType” column that reads “OPREP,” for operational report, on the rows examined. That fits my request for two logs, the JOC log and the SIGACT log, but the release does not label which pages come from which.

How Do You Turn a Redacted Log Into a Next Request?

You use the fields that survived as the terms of the next request. Entry numbers, date-time groups, and titles let an agency find specific records fast, and a narrow request for named entries is harder to refuse than a broad one.

1. Inventory the release. List every visible ID, date, title, place, and marking. A table like the one above is the working document.
2. Match the entries to public events. Confirm each against news reports and official statements, and note any date that does not match.
3. Request by identifier. Ask for the full entries, attachments, and updates tied to specific SIGACT numbers, such as “UPDATE 1” to 8048, rather than “all records about Germany.”
4. Challenge the withholding. The letter set a ninety-day window to appeal. Classified entries can also be sought through Mandatory Declassification Review under section 3.5 of Executive Order 13526, a separate process from FOIA.
5. Pivot sideways. Events a command logged often produced cables, briefings, or press guidance at other offices. Each can be requested from the office that wrote it.

What Did the DoD Inspector General Release?

A second request I filed, with the Defense Department’s Office of Inspector General, returned a 162-page log of closed investigations. Its header reads “Cases Closed from 01/01/2017 to 09/29/2023,” with the report run at 1 p.m. on September 29, 2023. The case types are “REGULAR INVESTIGATION, FULL INVESTIGATION, PRELIMINARY INVESTIGATION,” and the count line reads “Total: 3382.”

Each row has seven columns: UID, Case Type, Category Group, PI Open Date, PI Close Date, Case Open Date, and Case Close Date. “PI” refers to a preliminary investigation. The first two pages list Category Groups of Public Corruption, Procurement Fraud, Product Substitution, Cyber Crimes, Health Care, Counter-Proliferation, and Other. The columns carry no names, contractors, or case summaries.

On the pages examined, the log runs in order of case open date, so its first rows are its oldest cases. The very first, UID 200200055W, is a Public Corruption case opened October 16, 2001, and closed August 15, 2018, nearly seventeen years later. On the rows I checked, the first four digits of each UID match the federal fiscal year in which the case opened. Case 200200055W, opened in October 2001, falls in fiscal 2002. That pattern is my observation, not anything the log explains.

Editor’s note: The 162-page file I reviewed contains the log only. The Inspector General’s cover letter, with its case number, date, and any exemptions, is not part of that file, so this article does not cite them. Category Groups are described from the first two pages; this article does not count them across all 3,382 cases.

How Does a Case Log Become a Finding Aid?

A finding aid is an archivist’s term for a guide that tells a researcher what exists and where to look. A case log works the same way. Each row confirms that a closed investigation exists, gives it an identifier the agency itself uses, and dates it. That is enough to request the file behind it.

The pivot runs in three moves, the same as in any open-source investigation:

1. Start from the index. The log is the seed, just as a domain or a username is the seed in an online investigation.
2. Enumerate the entities. Filter the rows by Category Group, such as Procurement Fraud, Product Substitution, or Public Corruption, and by open and close dates. Each UID is an entity.
3. Pivot to the underlying records. Request the closing report or case file for specific UIDs. Closed cases matter here: FOIA’s Exemption 7(A), for records whose release could interfere with enforcement proceedings, generally fades once a case is over, though privacy exemptions for the people named will still apply.

A row is only a pointer. A closed case may have ended in charges, a settlement, an administrative action, or nothing at all, and the log does not say which. A Category Group is the agency’s label for a case, not a finding that fraud or corruption occurred. Outcomes have to come from the file, a court docket, or an official announcement.

Which Logs Should Researchers Request?

Start with the records agencies keep about their own work. They are often released with few redactions because they summarize rather than reveal.

• FOIA logs: an agency’s list of the requests it received, with dates and subjects, which shows what others are already asking for.
• Investigation and case logs: lists like the Inspector General’s, with case IDs, categories, and dates.
• Incident and watch logs: SIGACT, operational-report, and duty-officer logs like EUCOM’s, which timestamp what an operations center tracked.
• Hotline logs: records of complaints received electronically, by internet form or by phone, which show what was reported before anything was investigated.

Each is a primary source for pivoting into the investigations, reports, and files behind it.

How This Story Was Reported

Every quotation from the EUCOM release and the Inspector General log was read directly off the page images and checked against the released PDFs; none was taken from machine-extracted text. The black boxes and exemption codes in the SIGACT images are the government’s and are shown as released. The only redaction added by OctoProbe News is to my own name, address, and email on the EUCOM letter. Both FOIA requests are mine.

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio