I accept your anecdote at face value. Therefore this gets an 'ooof' from me.
> Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. (example: ... no facebook browsing at all)
It's just one filter. Exlude this, exclude that, exclude all that is normal to find and what is left is some edge cases that might contain something interesting.
That is how I navigate linux logs when I don't know what I am searching for: grep -v x | grep -v y | grep -v z | etc
It does not mean if you don't browse Facebook you are suspect
> Criminals/targets have their own signal of data and by filtering traditional data patterns you're left with a smaller dataset of the targets you're there to find. (example: ... no facebook browsing at all)