TLP: Traffic Light Protocol

---

Trust is currency. Every investigation relies on the careful exchange of information, but not all information is meant for every audience. The Traffic Light Protocol (TLP) was created to preserve that trust, ensuring intelligence can move between investigators, organisations, and partners without compromising sources, operations, or safety.

For investigators, understanding TLP is more than knowing colours, it’s about understanding the boundaries that protect collaboration.

The Purpose of TLP

When threat intelligence is shared, it often contains sensitive details: indicators of compromise, tactics used by threat actors, or insights drawn from ongoing cases. The value of this intelligence depends on whether it can be shared safely.

The Traffic Light Protocol provides a simple but powerful framework for that, a shared language that defines how far intelligence can travel.

Each TLP colour sets clear expectations: who can see the information, and what they can do with it.

The Four TLP Classifications

TLP:RED — For the Eyes That Must See

Information marked RED is for the immediate recipients only. It must not leave the room, inbox, or conversation in which it was shared.

This level is reserved for data that, if disclosed, could cause harm to individuals, compromise investigations, or reveal sensitive operational methods.

Example: A live investigation into a ransomware operator where premature sharing could alert the target or endanger ongoing surveillance.

TLP:AMBER — Limited Circulation

AMBER information may be shared within your organisation, but no further unless there is a direct operational need.

It is used for intelligence that is sensitive but needs limited distribution — enough to enable action, not exposure.

Example: Technical indicators for a current phishing campaign that internal teams need to block, but which should not be passed to external partners.

TLP:GREEN — Community Awareness

GREEN allows sharing within your trusted community — peers, partners, or sector-specific networks — but not for public release.

It enables collaboration across organisations while maintaining controlled boundaries.

Example: An industry ISAC sharing patterns of a new attack technique so members can defend against it collectively.

TLP:WHITE — Public Release

WHITE means the information carries no risk if made public. It can be freely distributed, cited in reports, or shared in media releases.

Example: A public advisory about a widespread vulnerability after patches have been released.

Why TLP Matters to Investigators

Every investigation involves collaboration: between analysts, law enforcement, private-sector partners, and sometimes victims. Without a shared understanding of how to classify and distribute intelligence, information either spreads too far or not far enough. Both outcomes weaken investigations.

TLP gives investigators a structured way to:

• Maintain trust within intelligence networks.

• Control information flow and prevent accidental disclosure.

• Protect operational integrity while still enabling collaboration.

• Preserve evidential confidence when information is used in reports or prosecutions.

Using TLP in Practice

When marking intelligence, always choose the lowest necessary restriction, over-classification slows collaboration, while under-classification risks exposure.

A good workflow for investigators:

• Label before sending – apply the TLP colour to the subject line or document header.

• Communicate expectations clearly – state who can share the information and under what conditions.

• Respect incoming markings – never redistribute intelligence at a broader level without consent.

• Review periodically – if the sensitivity changes (e.g., arrests made, data released), update the classification.

TLP in the Real World

TLP is not just policy, it’s an operational standard recognised by law enforcement, intelligence agencies, and private-sector CERTs worldwide.

Many platforms, such as MISP or STIX/TAXII-based sharing networks, automatically integrate TLP into data tagging, ensuring shared intelligence retains its classification wherever it travels.

By respecting TLP, investigators ensure that shared intelligence remains useful, controlled, and credible,  the foundations of any successful intelligence exchange.

Every investigation walks a line between secrecy and collaboration.

TLP defines that line, allowing investigators to share what must be known without revealing what must remain hidden.

In the shadows of digital intelligence, trust is not built by what we share, but by how we share it.