Category: Investigations

Analyzing Social Media Posts

Analyzing social media posts is most likely something you don’t really do on a regular basis. Unless the case calls for it, there is not always a need for it. However, when there is, so much can be uncovered!

Don’t F**k With Cats: Hunting an Internet Killer

If you are a Netflix subscriber you may have seen this documentary. It is one of the best OSINT films out there. The documentary uncovers the months it took a group of online sleuths to reveal a real life killer. During the documentary it is revealed how helpful social media posts were in finding clues to the whereabouts of this criminal. It is graphic, so be forewarned. However, the diligence of these average people is noteworthy. It takes time to really dig and even when your subject leaves clues, it can be difficlut.

One scene in particular focuses on the street lights in a city. The subject posted a photo of himself in social media on a city street. One person recognized the style of the street lights and pinpointed them correctly as being in Ontario, Canada. She was correct, however it took so long to persuade the local police to believe her story, the suspect was already on to a new location.

It is also a great example of how important it is to really look at social media posts.

Social Media Post Threats

When scrutinizing social media posts, carefully look beyond the person in the post. Is there a computer screen or tablet that you can zero in on? What about a clock in the background? Cross reference this with the date and time of the post.

Photos of a person’s home can be important as well. Recently, we conducted a deep web scan on a person who was suspected of selling drugs from her home. We searched for a post that she may have forgotten about online that showed her with the drugs. While we did not uncover anything like that, because she had deleted it all, we did uncover something else.

She was showcasing herself in a very specific Reddit group that served as a an advertisement of sorts linking to an online porn site. In this case, she did not show her face on any of the posts. She did however, take all the photos in her bedroom. We were able to link her bedroom from her public Facebook posts to the bedroom from her Reddit posts. Since this was a child custody case, this was an important find.

Reverse Image and Exif Information

Where possible, reverse image searching and checking exif data can help provide additional information when investigating uploaded images. We explained in more detail what Exif data is in a recent post titled, “Where Was This Social Media Photo Taken?”

Reverse image can be done with a Google Image search or Bing Image search. Some paid versions are Tin Eye and Social Catfish.

The Dark Side of OSINT

After the horrific attack on U.S. Congress this month, many law enforcement people turned to photos on social media and the deep web to locate people of interest and to investigate further.

An article, “The Dark Side of Open Source Intelligence” warns to be careful when using this method.

“While the use of open source intelligence has been praised by law enforcement and investigative journalists for its crime-solving efficiency, public data can be dangerous when used in haste on social media. The speed that makes OSINT so effective as an investigative tool can also make its use more susceptible to blunders and bias. From terrorist attacks to protests and mass shootings, open source intelligence has led to inaccurate vigilante-style justice and the doxxing of innocent individuals.“

Like everything else online, some is real and some is not. Cross referencing for data accuracy is critically important.

The Role Culture Plays in Social Media Research

When we think of social media research, or social media listening, culture is not something that immediately comes to mind. It is only when we begin to dig deeper and identify what our search parameters are, that we begin to understand that cultural differences will play an important role.

Recently, a client of ours asked if we had a Spanish speaking analyst because this does indeed help when conducting a search in social media or the deep web. Especially if the person speaks mostly Spanish or a combination of English and Spanish.

Facebook in particular is used by the Hispanic community as a way to stay connected to family and friends. It is also used as a way so celebrate & express diverse aspects of life.

During a recent search, our Senior Spanish Analyst uncovered a post that would lead the average person to think this individual was talking about her son. She called our person of interest her “Mijo” or “Hijo“ translated literally to mean son. Upon further investigation, our analyst knew from other data resources, that this woman was not his mother. It did indicate; however, she was a fan of his. Someone who this woman held dear. The word son in Spanish can be used as a term of endearment or for someone you feel affection for. Understanding culture plays a vital role in all investigations and this is perfect example of that.

In this example we see the literal translation. This is the case where the woman was using the word son as a form of endearment.

The Role of the Hashtag [1]

The Behaviour & Information Technology, publishes research on usability and user experience, human created interaction, human-centered and user-centered design, and human aspects of the digital world. It published an article on “Culture and social media: the relationship between cultural values and hash-tagging styles.”

In the article the authors clearly identify cultural differences in hash-tagging styles. There are characteristics of hashtags and the impact of individual cultures. Their study revealed four dimensions of hashtags.

  • Inspirational
  • Structural
  • Entertaining
  • Artistic

We discussed in a recent blog post; how important hashtags can be when you are researching a person of interest on the web. Don’t Forget the Hashtags highlighted a recent scan we conducted on a person of interest. We were asked to revisit an old case to see if there was any new information available on the subject. A senior analyst located the subject’s Mother’s Facebook profile and noticed she tagged all her photos of her daughters with a specific hashtag. Using the hashtag as a search tool through different social media platforms, our analyst discovered a different profile in which the subject was active and posted often. We wouldn’t have been able to find this profile through our normal search methods because the subject used an alias we didn’t know about.

Twitter & Latino Culture

A good reference is Twitter. Twitter, for example, has a group dedicated to empowering Latino and Latin American employees. Their account is @twitterAlas.

This is a great example. For a non-Latino person, one would need to first understand the meaning of Villancico & then as you scroll through the comments, you may need an interrupter to understand what you are reading.

“Every Latinx person has a story, each different and unique. It defines who we are, and also connects us to one another. We’re the Latinx voices at Twitter!” Tell us who you are using #IamLatinx

Twitter post: September 16, 2019

How Latinos Use Social Media

When it comes to language choice on social media, Hispanics are using both English and Spanish. According to E-consultancy, 33 percent preferred English, while 27 percent opt for Spanish; 40 percent used the two equally. But preference varied with the situation.

Because the culture is very family focused, much is shared with regard to events, celebrations, holidays and achievements.

Don’t overlook blogs and forums. Forums are a platform for expressing opinions and asking questions.

This is why we feel it is important to have a Spanish speaking analyst on our team. She has assisted in many of these cases over the years.  

[1] Pavica Sheldon, Erna Herzfeldt & Philipp A. Rauschnabel (2020) Culture and social media: the relationship between cultural values and hashtagging styles, Behaviour & Information Technology, 39:7, 758-770, DOI: 10.1080/0144929X.2019.1611923

Where Was this Social Media Photo Taken?

We get this question a lot. Can you tell me where this social media photo was taken? The short answer is probably not. Here’s why~

An easy way to explain this is to think of the chain of custody of a photo. How was the photo taken originally? Chances are, it was taken using a person’s smartphone. It could, in some cases, have been taken using a digital camera.

Digital cameras can store a lot of relevant information about a photo. It can reveal where it was taken, how it was taken & when it was taken. Digital Forensic Investigators and Examiners know exactly how to extract this data from a photo & use it to fight child exploitation and sexual abuse.

However, what many people don’t know, is that the data behind the photo can be manipulated and changed.

Geotagging a Post or Photo

It was once very popular to post a photo in social media and tag the photo by letting everyone know where you are. Remember Four Square? Many people still do this. You may see a friend who posts a photo on a beach and they tag who they are with and where they are. Those are the easy ones!

However, many people have learned the hard way not to do this. Not only does a geotag let criminals know where you are, they also let them know you aren’t home. Most people are very well aware of their privacy settings on their mobile phone and in social media.

Therefore, it is near impossible to determine where a social media photo was taken, if the geotag is set to private or is off altogether.

So what is the data behind the image? It is called EXIF data.

EXIF Data

What is EXIF data? EXIF stands for Exchangeable Image File Format. It is basically the metadata attached to every digital photo you take. It will include information such as the camera model and settings you used, the date and time you took the picture, and even details about exactly where you took the picture. Photographers can use this data to help organize their photos, perform searches, or re-create the exact manner in which a picture was taken.

** But – please note: Facebook and other social media platforms do not publicly share EXIF Data. They strip it when it is uploaded.

The FBI warns against sending photos through the internet or sharing on some social sites.

How to Get Around EXIF Data

According to the FBI’s site, here are some of their suggestions. So, keep in mind that many people do know how to do this and are doing it.

  • Turn off your phone or camera’s geo-location feature before ever taking the picture. Note: devices in airplane mode can still capture geo-location information.
  • Remove EXIF data before sharing images with people or posting them online, especially when images are captured in private homes or businesses. There are free apps that you can use to do this.
  • Use an EXIF viewer to verify that you were successful in stripping the personal data from the photos before sharing.
  • Before uploading images, use available privacy settings to limit the audience to only your close friends and family.
  • Minimize the use of apps that automatically upload and share captured images.
  • Even without EXIF data, the image may contain identifying information, such as associated persons or location histories. Screen content with the assumption that anyone can see, copy, or forward photos that you post online.

Image Tip

To find an image’s exif data, right-click the photo and select either “properties” or “information”. If the GPS coordinates appear, simply type them into Google Maps to find the location.

While this is a long shot, it is worth the effort should you find a photo online that was not shared in social media and appears to be recent.

In a recent blog post, we suggested trying Photo Investigator: The Photo Investigator is an iOS app to view all image metadata (all the possible data stored ABOUT and within each photo). You can also remove photo metadata with an in-app purchase.  The Investigator can also open the image’s GPS location in the maps app for directions; view images at full size and zoom them larger than in the Photos App.

Three Facebook Group Search Tips

Back in 2018, Mark Zuckerberg was focused on getting more people to engage on their platform. Facebook Groups became a very important tool to use to do just that. Facebook rolled out an algorithm known as “Facebook Zero,” and simply put, this is the reason why you most likely see Group content dominating your newsfeeds. (Hootsuite)

Many people who are involved in Facebook Groups are highly engaged. Once a person joins a group, there seems to be a false sense of anonymity in a way. Meaning, that no one outside of this group can see my posts. If the group is public, that is simply not the case.

It is important to remember this when you are conducting research on your person of interest.

We covered this in a previous blog. The “Must Have” to the “Nice to Have” in Social Research for OSINT featured a case study. From all appearances the POI seemed to be pretty clean cut. Someone who you would never suspect would use drugs. However, once we located a group she was active in, it revealed a different side to her.

When conducting scans, we have found some seemingly “hidden” posts in groups that were very helpful to our client’s case.

Hidden VS. Private Groups

According to Hootsuite:

Private and visible Facebook groups can be found through search, and it requires approved membership in order to see anything beyond a group description, members, and group history.

Private groups that are hidden can only be found by current members and those who have been invited to the group already (even if they aren’t members yet). Only members are able to view the group content beyond that waiting-room-styled display above.

Most business groups are most effective when set to private and visible. People can find you and you have full control of who gets to see and view group content, giving you the best of both worlds for a balance of quantity and quality while still being findable.

Hidden groups are most effective for internal team use or if you want to set up a highly-exclusive group that’s invite-only and don’t want the backlash of angry people who aren’t accepted.

Tips to Search Facebook Groups

  • Need a quick and easy way to search for groups? Start with Facebook’s Browse Groups page which is designed to help you locate a group that fits your interests.
  • Once in the Browse Group area, you can filter the search down a bit (see below).
  • If you have an idea that your POI is active in a particular group that is public, you can easily use the magnifying icon right on the page to search the group for names, keywords, dates, etc..

People who post in groups, seem to be more vocal, more honest and sometimes reveal much more than they are even aware of. It may be because they view it as being more “private” and not publicly available on their own profile page or timeline.