Litigation Archives

Social Media & Behavior Analysis

Photo: medium.com

One of the most fascinating aspects of social media for me has always been the psychological angle or behavioral science to it all. Behavioral science is a field that analyses human behavior. It focuses on observing, describing, explaining, predicting, and modifying behavior through systematic observation and manipulation of environmental variables. This can be applied to social media in various ways. Marketers have been doing it for years~ profiling users of social media to better advertise their products or services. In fact, social media can even be used to better understand population dietary behaviors. The review identified 34 studies involving social media analysis (SMA). They took a deep dive on alcohol consumption, dieting and eating away from home behaviors. Twitter was predominant with data sets in tens of millions.

This is nothing new for OSINT researchers, Investigative Journalists, Law Enforcement, and Private Investigators. We have learned just how much you can discover through various platforms from finding a missing child to uncovering financial fraud and everything in between.

We like to start off by examining the age of the person and which platforms they are more likely to be on.

Demographics of Platforms: AGE

The recent data from Pew Research may suggest we should pay closer attention to certain social media platforms based on age. YouTube and Facebook still remain the top two most used platforms across all demographics. This data is a good place to start and may help to uncover different usernames that can later be used to identify other platforms.

Understanding User Behavior

Behavior analysis can be used to study how individuals interact with social media platforms. Researchers can observe and analyze user behavior patterns, such as the frequency of posting, types of content shared, and interactions with others (e.g., likes, comments, shares). How much influence does the user have? Which friends or followers seem to interact with the user the most? In what capacity?

Clues in a Post

Location: Posts may contain information about a person’s location, such as check-ins or geotags, which can be used to verify alibis or track movements.
Relationships: Posts may reveal a person’s relationships with others, such as friends, family, or acquaintances, which can be used to identify potential suspects or witnesses.
Activities: Posts may provide information about a person’s activities, such as hobbies, interests, or daily routines, which can be used to establish patterns of behavior or gather evidence of illegal activities.
Emotions: Posts may reveal a person’s emotions, such as anger, sadness, or happiness, which can be used to assess their mental state and motivations.
Communications: Posts may contain messages, comments, or other communications with others, which can be used to identify potential witnesses or suspects, and to gather evidence of criminal activities.

Body Language

Technically, body language refers to the nonverbal signals that we convey through our physical movements and gestures, which are typically seen in person. However, in social media videos, you can still convey nonverbal cues through your facial expressions, tone of voice, and posture.

For example, facial expressions can show enthusiasm or sadness, change the tone of your voice will convey different emotions, and gestures may be used to emphasize certain points. Voice inflections can be a sign of stress or anxiety.

Studying a social media post’s background can be very telling as well. For example, a cluttered or messy background may communicate disorganization or lack of attention to detail, while a professional or clean background may communicate professionalism and attention to detail.

Social media posts can provide valuable clues in an investigation, as they can reveal a person’s thoughts, emotions, activities, and connections with others.

There are and will continue to be a wide range of reasons to pay close attention to social media for an investigation of any kind.

Cultural Intelligence & Social Media

In the world of OSINT and Social Media, Cultural Intelligence is the understanding of the role culture plays in your subject’s day to day life. It can play a part in their interests, hobbies, word choices, religion, work, etc.. For instance, social media posts might include specialized language that becomes understandable only when we possess sufficient knowledge about the culture, enabling us to recognize distinctive word choices, iconology, or symbols.

A few years back we wrote, “The Role Culture Plays in Social Media Research” which provided some real life examples of how different cultures use language. During a recent search, our Senior Spanish Analyst uncovered a post that would lead the average person to think this individual was talking about her son. She called our person of interest her “Mijo” or “Hijo“ translated literally to mean son. Upon further investigation, our analyst knew from other data resources, that this woman was not his mother. It did indicate; however, she was a fan of his. Someone whom this woman held dear. The word son in Spanish can be used as a term of endearment or for someone you feel affection for.

Self-Promotion vs. Humility:

In some Western cultures, self-promotion is common, and individuals may openly share their achievements and successes on social media.
In certain Asian cultures, humility is valued more, and individuals may be more reserved in showcasing personal accomplishments to avoid appearing boastful.

Use of Emoticons and Emoji:

Different cultures may interpret emoticons and emojis differently. For example, a smiley face may convey happiness in one culture but could be perceived as insincere or sarcastic in another.

**LEaF Translations

Hashtag Usage:

The use of hashtags varies across cultures. While some cultures may embrace and create trending hashtags for various causes, others may not use them as frequently or may have different conventions for their use.

Personal vs. Professional Branding:

Cultural norms influence the balance between personal and professional content. In some cultures, people may seamlessly integrate personal and professional aspects of their lives on social media, while others maintain a clear distinction.

Frequency and Timing of Posts:

Cultural expectations regarding the frequency and timing of social media posts can differ. Some cultures may value regular updates, while others may prefer more selective and thoughtful sharing.

Response to Conflict:

Cultural norms play a role in how individuals respond to conflicts or disagreements on social media. Some cultures may prioritize maintaining harmony and avoid public confrontations, while others may engage in more direct debates.

Privacy Settings and Sharing:

Attitudes towards privacy impact how individuals configure their privacy settings. Some cultures may be more comfortable with public profiles, while others prefer stricter privacy controls.

Visual Content Preferences:

Cultural aesthetics influence the types of visual content shared. For instance, certain cultures may appreciate minimalist and clean designs, while others may prefer more vibrant and intricate visuals.

Community Building:

Cultural values shape the formation and participation in online communities. Some cultures may place a strong emphasis on building supportive and inclusive communities, while others may focus more on individual expression.

Language and Multilingualism:

Multilingualism is common on social media, and cultural context affects language use. Some cultures may use a mix of languages in their posts, reflecting the diversity within their community.

These examples highlight the diverse ways in which cultural differences manifest on social media platforms, influencing user behavior, content creation, and interaction styles. This is helpful when investigating a person of interest which may lead to critical information regarding your case.

Conducting Online Corporate Research

Conducting an online investigation on a corporation involves gathering information about the company from a variety of online resources. It is used for many purposes; some of which include, gaining insights to its operations, financial health, reputation and more.
A PI investigating a corporation typically follows a systematic approach to gather information, uncover potential wrongdoing, and provide valuable insights to their clients. This includes collecting publicly available information about the corporation. Researching its history, key personnel, financial records, public statements, news articles, etc…
There are several different reasons why a corporation might hire an Investigator to conduct online research. Some of the most common are listed below.

Due Diligence: Investigations on corporations for potential investors, partners, or clients. This might involve verifying financial information, assessing the company’s reputation, investigating key executives, and uncovering any hidden risks.
Intellectual Property Theft: Looking into cases of intellectual property theft or industrial espionage. PIs can gather evidence to identify culprits and prevent further theft.
Competitive Intelligence: Assisting companies by gathering online information about their competitors, including market strategies, product developments, and potential vulnerabilities.
Corporate Security Assessments: PIs might be hired to assess a corporation’s security protocols, vulnerabilities, and potential threats, helping the company improve its security measures.
Insurance Fraud: Private investigators can assist insurance companies in investigating potential fraudulent claims made by corporations, such as property damage or liability claims.
Litigation Support: Private investigators can provide evidence and information that supports legal cases involving corporations, such as in cases of contract disputes, intellectual property infringement, or wrongful termination.

Online Resources to Use

We use several online resources, but the few mentioned below are worth mentioning. Like any other deep web dive, each site potentially offers breadcrumbs that can be used in your investigation.

Open Corporates (https://opencorporates.com ) Collects and aggregates data from various public sources, such as company registers, government records, and other official documents. The platform then organizes and presents this data in a standardized format, making it easier to search and analyze. Users can access information about a company’s legal status, ownership, financial history, and more.
Ripoffreport (https: ripoffreport.com) is a consumer complaint website that allows individuals to post complaints and reviews about businesses, products, and services.

Glass Door (https://www.glassdoor.com) This site is a job and recruiting website that allows employees and former employees to anonymously review companies and their management, provide salary information, and share insights about the interview process.

LittleSis (https://littlesis.org/) This site is used for tracking and researching the connections and relationships among powerful individuals, organizations, and corporations in the United States. It allows users to create and access profiles of influential people, companies, politicians, and non-profit organizations. These profiles include information on their affiliations, board memberships, political contributions, financial interests, and other relevant data.

Crunchbase (https://crunchbase.com) is a platform that provides information about companies and startups, including their funding, key personnel, products or services, and other relevant business details.

Corporate Case Study

We were hired recently to conduct several deep web scans on companies and their C-Suite executives. The Investigator worked with a client who was about to do some major business with three businesses and wanted to know everything about them before jumping into a business relationship. When completed, one could get an excellent picture of the overall reputation of the companies. The group of companies were business to consumer, so there were a lot of online reviews from various sites from Amazon to Yelp. Social media played a significant role. Newspaper articles published online were included as well as company generated press releases. As you can imagine, it was a large report.

Don’t forget About the Employees

The next step in our corporate case study was to identify online profiles and information on key executives in each organization. Why was this important? By conducting this research, it revealed how the employees felt about working for the company. It also ruled out any social media violations in the workplace. Our research included looking for any of the following areas of interest.

Sharing Confidential Information: Posting sensitive company information, trade secrets, financial data, or proprietary information on social media platforms without authorization.

Harassment and Bullying: Using social media to target, harass, or bully colleagues, supervisors, or other individuals within or outside the organization.

Discriminatory Remarks: Making discriminatory comments, including those related to race, gender, religion, sexual orientation, disability, or other protected characteristics, which can create a hostile work environment.

Defamation and Libel: Making false or damaging statements about the company, coworkers, or management that could harm their reputation or result in legal consequences.

Negative Publicity: Sharing negative opinions, complaints, or criticism about the company, products, or services, which could potentially harm the company’s image or business relationships.

It always amazes me what people will post online. Even in the age of increased privacy awareness, people get carried away sometimes with the personal information they post online. It may have been posted years ago but can come back to haunt them in an investigation.

Chain of Custody & Digital Evidence

Digital evidence has become more and more relevant for most civil and criminal investigations. Developing your OSINT skills is ongoing and understanding where it is all headed is just as important. It is an ever changing area, with new social media platforms sprouting up all the time.

When conducting online research on a person of interest for your investigation, it is important to develop a solid strategy. Once you begin gathering information, a clear chain of custody must be obtained with anything you find online. Additionally, authentication of social media posts or profiles are becoming more and more important to a case.

“We need all videos extracted and the subject’s social media profile captured and preserved.”
Recent client request

We are getting more and more requests like this every week. When a suspect or person of interest gets legal council, they may be advised to delete all their social media. That is why time is so important and it is becoming more important to start with online investigations before you do anything else. Many attorneys and PI’s have learned the hard way that what is here today, may be gone tomorrow. Understanding the differences in digital evidence can set your Private Investigation firm apart from the others.

The purpose of this blog post it to explain some of the differences in the capture of online evidence.

Screenshot Digital Evidence

Most of the time your OSINT discovery process is centered around a specific strategy and focus. The gathering of online information, its chain of custody, and your final report can and should contain screenshots and corresponding URLS. However, what if the Instagram post or video is just the digital evidence you were looking for? What if you know your attorney client is going to need this in the deposition, civil or even criminal case? It is times like this where a screenshot is not enough. Taking that extra step can be very valuable.

Social Media posts may not only be deleted or turned off, but they can also be edited. The post you see today may not be the same post you saw during your online investigation. Unless you have preserved the original post, you may not be ale to prove what was originally said.

For social media and web page evidence to be valid and accepted according to the Federal Rules of Evidence:

Original source code of the social media message, blog or webpage must be collected

Metadata must be collected

Digital signatures and timestamps must be placed on the data to provide evidence of data integrity & authenticity

Data should be prepared in EDRM-XML for easy processing & analysis in eDiscovery systems

Preserving the Digital Evidence

*Establishing a valid chain of custody means being able to show where the evidence has been, who has handled, and its condition at all times, in order to establish that there has been no alteration or tampering of the evidence prior to the time it is presented to the court. With respect to web pages and social media accounts, then, this means that the party propounding the evidence must establish:

When the record was originally produced;
That the record is an accurate recording of the webpage in question;
That the record was not subject to alteration from the time it was collected until the time it is presented in court.

Using the correct tool instantly generates a forensic report using a forensic SHA256 hash, and HTML source code. It means that your online preservations contain key identifying Metadata such as the timestamp, the URL, the IP address, the date, and the time of capture, using a certified Stratum-1 atomic clock in compliance with the eSign Act.

As a result, you can capture the evidence you need at the moment you need it, with the assurance that when you do, you are collecting evidence which contains the necessary hallmarks of authenticity that courts are increasingly seeking.

(*Web Preserver), This is the software we use at eChatter when we need to preserve digital evidence for our clients.

Web Scrapping

Can a website be scrapped or archived? Yes and It may surprise you to know just how often it is used. Web archiving tends to concentrate more on the look and feel of a website or profile. The Wayback Machine (a.k.a. archive.org), is designed for web archiving. They explain their company this way, “The Internet Archive, a 501(c)(3) non-profit, is building a digital library of Internet sites and other cultural artifacts in digital form.” It is like an online library of websites. ( As an aside, it is also a great way to check if a person of interest worked for a certain business years ago, as they may have been featured on the website).

Web scrapping is more focused on textual data. The most crucial step for initiating a web scraping project is to select a tool to fit your research needs. There a tons of them out there to choose from. It is important to remember that the collection of data, while publicly available, is still a collection produced by others. Depending on the case, be aware of the potential privacy and security implications and proceed with caution.

Web scrapping can be used for price monitoring, lead generation, marketing and research. The complexity of many websites makes it difficult to scrape data unless you know code. Software applications make this task easy for anyone and is not dependent on skills.

Example of a Preserved Post

The post below is a great example of what is captured during the preservation of a post. The key components are the URL, Timestamp (when the post was discovered), Hash, and Signature.

An entire profile of a person of interest can be over 100 pages and is captured in PDF report format.

By: Kathy Doering.

Kathy is President of eChatter, and is McAfee certified in OSINT and is a certified Social Media Intelligence Analyst (SMIA). Kathy also serves as president of The Global Social Media Research Association.

A Picture is Worth A Thousand Words

“A picture is worth a thousand words” is an English language adage meaning that complex and sometimes multiple ideas can be conveyed by a single still image, which conveys its meaning or essence more effectively than a mere verbal description. (Wikipedia)

I couldn’t help but think about how pictures in social media are worth a thousand words, especially when it comes to investigations. We wrote a blog back in February, 2020, about how important photos are in Instagram for an investigation. However, since COVID-19 hit, with people working form home more than ever before, the opportunities to capture an important photo have increased significantly. Look for the details!

This week, Joe Biden announced his running mate and released a photo of himself on Zoom with Kamala Harris. Did you happen to catch it? It is a great example of the importance of paying attention to what is in the background of a photo.

What Biden’s Photo Reveals

The media mocked him for several things that were picked up in the photo. It appears that he may have had a script or notes of some kind. There was a third person on the call by way of the cell phone. A cartoon was on his desk in the background and that drew attention as well. According to the Business Insider, The comic is a simple two-frame piece from Dik Browne’s “Hägar the Horrible,” a 1970s-era comic strip of a charming viking from the Middle Ages, according to comics subscription website Comics Kingdom. “Hägar the Horrible” has appeared in numerous advertisements and pop-culture references, in addition to nearly 2,000 newspapers.

In Biden’s comic, Hägar appears stranded in the sea as his ship burns in the background during fierce storm. The viking bellows out to the sky, “Why me?!,” to which the clouds responds with, “Why not?”

Biden said he kept the cartoon on his desk for decades and that it humbled him in times of need, according to PBS.

Geofencing Photos

Let’s take our photo investigation one step further. Imagine creating a virtual fence around an area of the world using software. Once set up, this software can then run for a predetermined amount of time. This can be used for monitoring of infrastructure, crisis management, or executive protection. Once it is captured, it remains available within the platform, even if the user takes it down.

Pictures like this really are worth a thousand words! They bring huge value to any investigation.