An automated intelligence system that tracks, qualifies and documents the online sale of illicit cigarettes in Romania, method, channels, tools.
Pilot scope: Rothmans. Adjacent illicit tobacco surfaced along the way is included as additional signal.
Illicit tobacco is breaking records in Romania, and a growing share is now sold and promoted online: marketplaces, Facebook groups, messaging apps.
Two stages. The first casts wide and misses nothing. The second understands context, including the coded language sellers invent to fool moderation.
"Vând bomboane, 165 RON, cash on delivery, details in private"
"candy" = code for cigarettes. A sale, cash on delivery, redirect to private messaging. Case retained.
Real case · Facebook group "tigari ieftine". No keyword script would have linked "candy" to "cigarettes".
Tobacco is banned from official storefronts. Sellers migrate to classifieds, Telegram, and above all local Facebook groups, that's where we look.
All 14 channels are monitored continuously, the red dots mark where offers have already surfaced, not the limit of the search.
A flagged post is only the start. Four layers turn it into an admissible, prioritised case.
Clusters listings by phone number, handle, outbound link and image fingerprint, so one seller across five listings (or three platforms) reads as one seller, not five cases.
Vision check on the photos: missing or foreign tax stamp (banderolă), Cyrillic text, non-compliant health warning, banned menthol, "duty-free" claims.
Each case is a timestamped screenshot + SHA-256 hash + custody log, an evidence file that stands up when handed to BAT Legal or the authorities.
A weighted 0-100 score from the signals above, mapped to four levels, with hard triggers that force the top levels regardless of score.
Isolated mention, uncertain availability. Logged; monitoring continues.
Clear sale offer of a tobacco product. Into the weekly report; watched for recurrence.
Strong illicit signals or a recurring seller. Escalated to BAT AIT & Legal.
Counterfeit, youth-access or large-scale distribution. < 24h alert with full evidence pack.
Signal weights (illustrative): illicit lexicon +25 · counterfeit +22 · bulk quantity +20 · price gap +20 · brand / provenance / clear-offer / youth-access +15 each. Hard triggers → counterfeit, youth-access, or bulk + foreign origin + delivery force High/Urgent.
A defensible watch, and action-ready deliverables.
No interaction, no purchase, no solicitation. Public posts and groups we join as an ordinary member, we read, we never engage sellers.
The continuous crawl honors robots.txt; a confirmed listing is then captured as targeted, permissible evidence for the rights-holder.
Untaxed, smuggled, menthol or counterfeit sale is illegal regardless of buyer age; platform age-gates are logged as a signal, not treated as a barrier.
Sellers pseudonymised in reports; raw identifiers kept only in the secured evidence log, with bounded retention.
Screenshot + SHA-256 hash + timestamp + custody log.
We don't guess
the black market.
We document it.