It's spooks all the way down, you can tell by their annoying insistence of referring to run-of-the-mill thinktanks with blogs with the codename-styled "OSINT." They piggyback off of the media obsession of "crowdsourcing" from a decade back, and abuse the software term "open source" to refer to these weird private groups.

The question is the same as it always was: who benefits from maintaining 12 educated full-time professionals and an office in order to claim (and publicize) that they have the most accurate view of the degree and character of protests against the Sri Lankan government? Somebody is spending a million dollars a year minimum on it; it is the opposite of the crowd/public.

Groups like this have two functions:

1) To launder false information. "Legitimate" outlets can spread information pushed by these thinktanks, but disguise it as reporting on the thinktanks themselves. If the funder of the thinktank is the state, they can then use that secondary reporting to justify the action it wants to take.

2) To launder illegitimately obtained information i.e. parallel construction. Come up with another theoretical way that some information that was actually discovered in an illegal or immoral way could have been discovered. Create fake artifacts of that discovery, and have one of these thinktanks release it. Now you can act on the information that you shouldn't have had.

I agree (as far as I understand) that the Sri Lankan government is awful, and maybe I agree with spook goals in this case, but their funders aren't doing this for moral reasons. They surely just want to get rid of these despots to put a friendlier set of decisionmakers in.