Invitation Only

The Hunt · Bellevue

Wednesday, 20 January 2027
Bellevue, WA
Request an Invitation →See how the day runs
Who
Data holders, law enforcement and CTI practitioners
What
Invitation-only operational meeting under TLP:RED
When
Wednesday, 20 January 2027
Where
Bellevue, WA · Hosted by Salesforce
The Hunt · Bellevue

Bellevue, WA · Wednesday, 20 January 2027

A one-day, invitation-only operational meeting for the people who hold the data and the people who can act on it.

The Hunt (Hunters Underground Network Targeting) brings together about 50 practitioners from major data holders, law enforcement and the threat-intelligence community for a single working day. Hosted by Salesforce in Bellevue, The Hunt runs under TLP:RED and is free to attend.

The day opens with 15-minute briefings from data holders on what they have, how long they keep it and how law enforcement and researchers can get access. The group then splits into three threat tracks, chosen from the preferences of the people in the room, to work the gaps between the datasets and agree on who takes what forward. When you request an invitation, you'll be asked to rank the three tracks you would most like to join. This ranking sets your initial assignment, and you'll be able to move to another track during the day, if the work takes you there.

~50
Practitioners in the room
15 min
Data-holder briefings
3
Threat tracks, chosen by attendees
TLP:RED
Free to attend
How the day runs

From briefings to threat tracks to agreed next steps

01

Data-holder briefings

15-minute briefs on what each data holder has, how long they keep it and how law enforcement and researchers get access.

02

Three threat tracks

Work the gaps between the datasets and agree on who takes what forward. Move tracks if the work takes you there.

03

Networking reception

Right after the working day closes.

The ground rules

Working within the legal process

We want to be plain about what this day is and is not. The Hunt is not an attempt to shortcut legal process, and at no point will we ask any company in the room to hand over data, act outside its own policies, or go anywhere near the line at which a company assisting an investigation becomes an agent of law enforcement.

We are acutely aware of the ethical, moral and legal obligations that govern information sharing between law enforcement and the companies that hold data. We view these obligations as the respected boundary of the day, not an obstacle to it.

The purpose is for investigators and data holders to understand each other well enough that formal requests are made for the right thing, by the right route, the first time.

Cooperation within the existing framework, not a way around it.

Your part in the day

What we are asking of you

If you are a data holder or threat hunter

A 15-minute brief built on a one-page data card covering what you hold, how long it is retained, what legal process reaches each category, and who handles it.

If you are an investigator

A seat at one of the afternoon tables and a voice in choosing the threat tracks.

For everyone

The discussion stays at the level of patterns and tradecraft, not case data.

If a colleague should be at a table with you, name them in the form. Invitations are personal and non-transferable.

Invitation only

Who should request an invitation to attend

Spots are limited and allocated based on what each attendee can bring. Tell us how you would like to contribute in the form below.

Data holders

Platform, cloud, payments, telco, hosting and security teams with datasets relevant to abuse, fraud or criminal infrastructure

Law enforcement

Federal and West Coast State Law Enforcement investigators who can take cases forward, with a seat at the afternoon tables and a voice in choosing the threat tracks

Threat hunters and CTI practitioners

Based in the Pacific Northwest, actively working cases with the above

Every request is reviewed. Submissions are requests, not confirmations. You'll receive email notification of the status of your request within two weeks.

Invitation only · every request is reviewed

The Hunt · Bellevue

Fields marked with an asterisk are required. The dataset section is what we use to shape the day, so please be as specific as the TLP allows.