On 17 October 2026, a national day of protest against the cost of living brought between 550,000 people (according to the Interior Ministry) and 800,000 (according to the organizers) onto the streets of France, in some 110 marches. In dozens of cities it ended in riots and looting. On the same day in Italy, a mobilization convened on social media by "Italia in Piazza" gathered about 11,000 people nationwide, and in Milan it degenerated into two days of street clashes and raids on shops in the city centre. A week later, on 24 October, both countries went through a second day of mobilization.
Understanding events like these while they are still unfolding is hard for anyone. Information arrives in three languages and on a dozen platforms at once, early figures are revised within hours, political narratives and disinformation travel faster than verification, and the people organizing the most consequential actions have every reason not to be seen.
We followed them with BackBox AI and its Threat Hunter profile, running an open-source intelligence investigation into what happened, who was behind it and how the situation was evolving. We used public sources only and tied every conclusion to evidence that can be checked; the results are published in an interactive dashboard.
Four questions, nothing taken for granted
The investigation started from three research questions, later extended to a fourth:
- What actually happened in Milan and Paris on 17 and 18 October?
- Is there evidence of digital or cross-border coordination between the groups active in the two cities?
- Is there evidence of related crime, such as organized theft, fencing or the resale of looted goods?
- Did foreign states (the debate named Russia, Iran and Algeria) play any part in the protests?
The working rule was written into the workspace before the first search: nothing is taken for granted, and every hypothesis is checked against independent confirmation and against alternative explanations. In a story where government figures and commentators had already hinted at hidden directors, that rule shaped the whole investigation.
How the Threat Hunter works a crisis
In BackBox AI, a profile is a configuration built for one kind of mission and given only the tools that mission needs. Here the Threat Hunter collected sources in Italian, French and English through web search, page and document retrieval, a headless browser for screenshots and Tor for the dark web, and kept everything in a persistent workspace: the tasks of each research cycle, the analysis notes, the evidence, the reports and the relationship graphs.
Three habits make the difference between a pile of links and an intelligence product.
Every source has a type and a weight. Primary sources (organizers' websites, public Telegram channels, official statements) are kept apart from press reports, aggregators and user-generated content. Two articles quoting the same agency dispatch count as one origin, not as two confirmations.
Every claim has a status and a confidence level. The investigation separates verified facts from attributed statements, analytical inferences and open hypotheses, and rates each conclusion as high, medium or low confidence. A figure announced by a minister, a number claimed by organizers and an estimate published by a newspaper are not the same kind of fact, and the record never pretends they are.
Every piece of evidence is traceable. Each entry in the evidence register carries an identifier, the URL, the publication and acquisition dates and, when the original was saved, its SHA-256 hash. Screenshots were checked one by one before being archived. The register grew from 54 entries on 21 October to more than seventy by the evening of 24 October.
The register also records what was looked for and not found. At the operator's request, the agent opened a Tor circuit and ran 21 event-related queries across three onion search engines, Ahmia, Tor66 and Torch: none returned any trace of goods looted on 17 and 18 October being offered for sale. The result is logged as a negative with explicit limits, because those indexes cover only part of the onion space. The same discipline applied to the tools themselves. On 21 October the usual search engines returned empty pages or bot challenges, so the agent fell back on news RSS feeds and marked the affected claims as "headline, outlet and date certain, content not verified" instead of quietly treating them as confirmed.
Following events as they unfold
The first full cycle ran on 21 October, four days after the riots, and was completed within the day: reconstruction of events in both cities, the coordination and crime questions, the extension on foreign interference and a consolidation pass that re-acquired the live primary sources and compared them with the archived originals.
The second cycle ran on 24 October, the day of the new mobilization, in three passes. In the morning the agent took a snapshot of the primary sources before anything happened, treated every statement about the day as a prediction rather than an observation, and wrote down in advance what to check in the afternoon. In the afternoon it re-captured three Telegram channels simultaneously, followed the live coverage of Italian and French media and recorded the outcome: in Italy, small and mostly peaceful gatherings with no systematic looting; in Paris, 110,000 marchers by the police prefecture's count, on a route imposed by the authorities.
The morning pass is where following an event differs from reconstructing it. The day before, Movimento 17 ottobre had cancelled the eight squares it had announced and switched to gatherings communicated half an hour in advance: three meeting points per city at 14:30, then a final square at 15:30. Its city chats on Telegram had been closed or deleted. In Clermont-Ferrand, a call to a large rally viewed more than a million times on X turned out to be a decoy, designed to fool the AI systems the police were presumed to use to scan social media. The agent did not read the silence that followed as reassuring. It recorded that open-source visibility on the most useful operational data, where and when, was shrinking by the deliberate choice of those being observed, and it shifted weight towards institutional sources, live reporting and the neutral aggregators that kept publishing.
The evening pass closed the day with the official figures: 410,000 demonstrators across France according to the Interior Ministry, 800,000 according to the CGT union. The official count was about a quarter lower than on 17 October, while Paris held steady at 110,000, so the decline came from the rest of the country. The Paris march kept to its imposed route, but more than 500 rioters clashed with the police as it broke up. The outcome of a gathering called for 20:00 at Place de la Concorde, which the authorities had closed in advance, was still unknown when data collection ended, and the record leaves it open rather than guessing.
The same pass brought in three facts that changed the picture. In Orléans, between 11,000 and 26,000 people marched against the congress of the Rassemblement national in a day that stayed calm; the march had drawn momentum from the shooting in Trappes the day before, which the national anti-terrorism prosecutor is investigating as a racist attack. The gilets jaunes announced that their next act, on 31 October, would be about the freedom to demonstrate rather than purchasing power. And French far-right groups, which until the afternoon had been organizing online, took to the streets: the record treats the clashes in Nice as verified, with 11 arrests reported by the prefecture, while a similar report from Toulouse rests on a single source and one from Clermont-Ferrand is unverified.
In this case the operator launched each cycle. The platform can also schedule tasks to run unattended, which suits periodic monitoring around dates that have already been announced.
What the evidence showed
As of 24 October, the investigation answered its four questions as follows.
| Question | What the evidence supports | Confidence |
|---|---|---|
| What happened | Events and key figures reconstructed in both cities | High |
| Coordination | Coordination within each country, imitation across borders, no common command observed | Medium to high |
| Related crime | Opportunistic resale verified in France, not documented in Italy, no trace on the dark web | High for France |
| Foreign interference | No public evidence of an organizational role for Russia, Iran or Algeria | Medium-high |
The coordination question deserves a closer look, because it is where the analysis proved most useful. Instead of the usual dichotomy between "contagion" and "conspiracy", the validation pass introduced a five-level scale of how tightly the movements of the two countries were coupled. Imitation of date and framing (L0) is confirmed: the Italian call explicitly referred to France and other countries, and the 24 October date was shared without any documented agreement. Shared tactical literature (L1) is reinforced: according to the Italian press, a protest handbook inspired by the Egyptian revolution of 2011 was circulating in the movement's chats, alongside an anti-arrest guide written in English. Bridge actors (L2), groups able to link the two sides, show their first signals: the Italian domestic intelligence agency told the parliamentary oversight committee that traditional antagonist milieus were trying to insert themselves. Operational coordination (L3) and a single command (L4) were not observed, a negative the agent rates at medium confidence precisely because that kind of coordination would run through the closed channels it cannot see.
On foreign interference, the evidence pointed away from much of the commentary. Russian state media and propaganda networks exploited the images of the riots, which the record treats as verified, but no public source showed any role in organizing them. The one specific accusation against Iran, a drone over the marches, was withdrawn by the French Foreign Ministry. Members of the Algerian diaspora in France had asked young people not to wave Algerian flags in the school blockades, to avoid feeding narratives that blamed the unrest on young people of immigrant origin. The dominant disinformation vector was domestic: eight widely shared false claims debunked by French fact-checkers and authorities, including an AI-generated image seen more than six million times.
On crime, the record separates what open sources can show from what they cannot. In France resale was real and documented: listings on Vinted, Leboncoin and eBay openly referring to the 17 October looting, negotiations moved to Snapchat, a reporter who completed a purchase. In Italy nothing comparable surfaced, partly because the goods taken in Milan (food, sportswear, bicycles, cash) leave fewer traces online. Organized fencing, the agent concluded, escapes keyword searches by construction, so it scheduled a new check based on the individual items on sale, fourteen and forty-five days after the events.
An analysis that corrects itself
Two episodes show why the method matters as much as the findings.
The first came from an independent validation of the conclusions of 21 October, which judged several negatives too categorical. "No cross-border command" became "no cross-border command observed with open tools four days after the events", and its confidence dropped from high to medium; "no organized fencing" became "not observable with the current method". The validation also flagged a sampling bias: the profile of the looters had been built on those who were arrested, who are by definition the least skilled.
The second concerns a public Telegram channel bearing the name of Movimento 17 ottobre, which on 21 October contained only four messages in support of law and order, in open contradiction with everything known about the movement. The agent first flagged it as an anomaly, then dated it forensically: the channel had been created on 19 October at 23:34 UTC, the four messages were published within thirty seconds, and nothing followed. On 24 October, at the suggestion of the validation, it re-read the original press coverage and found that the movement had only ever been linked to an Instagram account and a closed Telegram group: the idea that the public channel belonged to the movement had been taken for granted by the investigation itself. The register now holds both the original assumption and its correction (EV-097 on the dashboard), and the most likely explanation, a counter-messaging operation run by a third party under the movement's name, is rated at medium-high confidence.
Predictions served the same purpose. Before 24 October the agent registered five testable predictions about the second mobilization, stating in advance what each outcome would mean for the working hypotheses, so that the analysis could be proven wrong by events. By the evening they could be scored, with the same caution used to write them. The outcome expected for Italy, gatherings confined to the announced cities and no systematic looting, materialized, but the record calls the mechanism undetermined: several preventive and tactical factors were at work and cannot be separated, and the analysis deliberately does not list them, so as not to turn an assessment into operational advice. New actors did emerge, but they were far-right groups mobilized against the looters and, according to the press, the pro-Russian hacktivist group Noname057(16) backing a student mobilization in Empoli. They are not the opportunistic crowds the prediction was about, so it counts as only partly confirmed.
Resale of the loot started on the morning of 18 October, well before the expected peak at seven to fourteen days after the riots: the premise is weakened, but an early start and a later peak can coexist, and the verification window stays open until 1 November. The public Telegram channel, as expected, never moved past its four messages. The next check is already on the calendar: the marches called by the USB union for 30 October in Turin, Reggio Emilia and Rome, a natural test of whether the small gatherings of 24 October reflected a weaker organization or only a change of tactics. Every prediction, with its outcome and evidence, is on the dashboard.
The evening results were validated as well: no false positives, and a few corrections of precision, such as stating the scope of a confirmed prediction and reporting figures without adjectives. The register also documents a slip by the investigation itself: downloading a live news page a second time, the agent overwrote the afternoon copy before renaming it. The incident is logged with the lesson drawn from it: every capture carries the suffix of its cycle, and no page is downloaded again to the same path.
From the workspace to the dashboard
All of this is kept in the BackBox AI workspace: an intelligence report of seventeen sections, the evidence register, a catalogue of 73 press sources, a chronology, a link analysis, two relationship graphs and eleven archived screenshots. To make the results usable by people who will never open a workspace, the agent also produced a public dashboard, which we have redesigned and integrated into this site.
The dashboard shows the key figures for each country, a timeline from the first TikTok call on 7 September to the dates already announced for November, the network of actors and their relations, the coupling scale, the assessment of each interference claim, the prediction tracker and the full evidence index, searchable and filterable. Every figure and every statement links to the evidence behind it, and every piece of evidence lists the places in the dashboard where it is cited. The data lives in a separate JSON file in English, Italian and French: after each monitoring cycle the workspace produces a new version, and publishing it is enough to update the dashboard without touching the page.
Where open sources stop
The value of this kind of work depends on being honest about its limits, and the investigation states them explicitly.
Closed channels stay invisible, by design and increasingly by choice: the most consequential operational communication ran through private groups from the start, and became even more opaque as the movements adapted. Absence of evidence is not evidence of absence, especially a few days after the facts. Some paywalled French press could only be read through RSS metadata, and coverage of X and TikTok is partial without API access. And the product orients investigations: it is not evidence that can be used in court.
The investigation also drew lines that are not technical. The dashboard names movements, platforms and public actors, not private individuals, and it reports judicial developments with the presumption of innocence that goes with them. Only public surfaces were used: no logins, no fake accounts, no joining of private groups. When asked what options existed to reach the closed groups with more invasive techniques, the agent provided no intrusion method, explained why such methods are crimes that would also make any evidence unusable, and laid out the lawful routes available to the authorities instead: data preservation requests to the platforms, European production orders for electronic evidence, notices under the Digital Services Act and police cooperation through Europol and Eurojust.
Throughout the work, the operator kept control. The dark web sweep, the consolidation of the workspace and the dashboard itself were explicit requests, and every step is documented in the workspace.
Who this is for
The same method fits anyone who needs to understand an evolving situation from open sources and be able to defend the conclusions afterwards.
Law enforcement and public safety analysts get a picture of the situation built on lawfully collected public data, with attention to flashpoints and counter-mobilizations, and with disinformation sorted from facts before it shapes decisions. Journalists and fact-checkers get sourcing that keeps track of where each claim comes from, how much weight it deserves and when it was corrected. Corporate security and risk teams can follow the events that affect their people, sites and operations, from shop closures and curfews to travel advisories. Analysts and researchers get a reproducible record rather than a set of impressions.
What it does not do is replace investigators, editors or judgement. The agent carries most of the work of collection, verification and documentation; people decide what the findings mean and what to do with them.
If you need to follow the events that matter to your organization, get in touch.