Monitoring the local news media's radio channels (usually 450-451/455-456 MHz) and sometimes at the high end of VHF near the federal and rail frequencies, would be a good starting point. although many larger outlets are migrating to cell or other technologically advanced solutions. Aeronautical VHF, as
@trentbob mentioned, can also be productive. Here in LA, 123.025 is one I watch, but know sometimes the airspace above large protests will end up being restricted (aka "91-91").
It's worth mentioning that the tech savvy protestors of today use cell phones and texting plus any number of messaging apps. The same for "the man".
That said, there's a log of Baofeng (and other CCR) radios out there, but as we frequently see here on RR, not a lot of radio savvy end users. It would probably be prudent to program the common test frequencies loaded in the CCr's from the factory.
While some municipalities encrypt their LE and fire radio traffic, local government channels/talk groups remain in the clear so there's a chance of picking up peripheral radio traffic from the folks driving the big trucks.
It all comes down to having a working knowledge of the local radio spectrum and being frequency agile enough to take advantage of all opportunities.