You Shouldn’t Post That Here

By now we have all been schooled on what we shouldn’t post publicly in social media and why. In fact, you can read all over the internet why it is not a good idea to post your COVID vaccination card. It is also not a good idea to post about vacation plans.

When it comes to insurance fraud, a claimant’s social media posts plays an important role in any investigation. When someone is trying to claim an injury when there isn’t one, they need to lock down. You would think that the fraudster would be careful when they post publicly in social media. This is not always the case. In fact, recently we performed a deep web scan on a person suspected of insurance fraud. This was a workman’s comp case. A friend of the person actually cautioned him about a post he had recently added. She came right out and told him to be careful what he was posting. He answered her post by saying, “I not. I know how this works.” The original post was deleted, so we never knew what he posted to make her say that. It was suspicious however, that he left this exchange up on his profile page. In other words, he knew he might be watched in social media.

“Checking social media accounts has become one of the first things an insurance company or adjuster will do when you file a claim,” says Frank Darras an attorney from California who specializes in law suits against insurance companies.

Source:Auto Insurance Quote

What to Look For in Social Media

When we conduct a deep web scan, we start with the data points that we know to be true on an individual. Name, address, date of birth, employer, address and email addresses. They are all critical pieces of information because each one may hold an attachment to something online about our person of interest. It is also important in authentication. We need to be certain we have the right person.

Some tips we have learned along the way that may be of help to you include the following:

  • Check for multiple profiles. You just found your person of interest’s Facebook profile and you think you are done there. Not always so. Many people have secondary profiles. They may have set them up, forgot about them or they use each one for different things. Believe it or not, you may discover them by looking through their friends list. This is especially true in Facebook.
  • Tell a Story: Across all social media platforms, it is important to check the dates of posts. When you put them altogether, they can tell a story of a person’s activity. Just by combing through this information, you may find an inconsistency in their story or claim. Perhaps they are claiming to have taken a fall at work. Yet, a social media post may show them complaining about back pain days prior. Connecting the dots doesn’t mean they are automatically guilty, but can mean that a deeper investigation is needed, just to be sure.
  • Proof of legally attained social media posts: That is where meta data comes into play. If you find something in a person’s social media profile, you are going to want to extract that post and gather the intelligence behind it. Remember, screenshots can easily be altered.

Video is the Golden Child

Instagram, TikTok, YouTube are all examples of social media known for their videos. People post videos of all kinds of things there. Searching these platforms can be very lucrative because of it. Just remember, if you do find something important there, you will want to not only obtain the meta data, but extract the actual video to keep as evidence that is admissible in court.

Keep in mind that we can extract videos and photos as well as capture the meta data from the post. Timing is everything however, and what is here today can be gone tomorrow.

Where Was this Social Media Photo Taken?

We get this question a lot. Can you tell me where this social media photo was taken? The short answer is probably not. Here’s why~

An easy way to explain this is to think of the chain of custody of a photo. How was the photo taken originally? Chances are, it was taken using a person’s smartphone. It could, in some cases, have been taken using a digital camera.

Digital cameras can store a lot of relevant information about a photo. It can reveal where it was taken, how it was taken & when it was taken. Digital Forensic Investigators and Examiners know exactly how to extract this data from a photo & use it to fight child exploitation and sexual abuse.

However, what many people don’t know, is that the data behind the photo can be manipulated and changed.

Geotagging a Post or Photo

It was once very popular to post a photo in social media and tag the photo by letting everyone know where you are. Remember Four Square? Many people still do this. You may see a friend who posts a photo on a beach and they tag who they are with and where they are. Those are the easy ones!

However, many people have learned the hard way not to do this. Not only does a geotag let criminals know where you are, they also let them know you aren’t home. Most people are very well aware of their privacy settings on their mobile phone and in social media.

Therefore, it is near impossible to determine where a social media photo was taken, if the geotag is set to private or is off altogether.

So what is the data behind the image? It is called EXIF data.

EXIF Data

What is EXIF data? EXIF stands for Exchangeable Image File Format. It is basically the metadata attached to every digital photo you take. It will include information such as the camera model and settings you used, the date and time you took the picture, and even details about exactly where you took the picture. Photographers can use this data to help organize their photos, perform searches, or re-create the exact manner in which a picture was taken.

** But – please note: Facebook and other social media platforms do not publicly share EXIF Data. They strip it when it is uploaded.

The FBI warns against sending photos through the internet or sharing on some social sites.

How to Get Around EXIF Data

According to the FBI’s site, here are some of their suggestions. So, keep in mind that many people do know how to do this and are doing it.

  • Turn off your phone or camera’s geo-location feature before ever taking the picture. Note: devices in airplane mode can still capture geo-location information.
  • Remove EXIF data before sharing images with people or posting them online, especially when images are captured in private homes or businesses. There are free apps that you can use to do this.
  • Use an EXIF viewer to verify that you were successful in stripping the personal data from the photos before sharing.
  • Before uploading images, use available privacy settings to limit the audience to only your close friends and family.
  • Minimize the use of apps that automatically upload and share captured images.
  • Even without EXIF data, the image may contain identifying information, such as associated persons or location histories. Screen content with the assumption that anyone can see, copy, or forward photos that you post online.

Image Tip

To find an image’s exif data, right-click the photo and select either “properties” or “information”. If the GPS coordinates appear, simply type them into Google Maps to find the location.

While this is a long shot, it is worth the effort should you find a photo online that was not shared in social media and appears to be recent.

In a recent blog post, we suggested trying Photo Investigator: The Photo Investigator is an iOS app to view all image metadata (all the possible data stored ABOUT and within each photo). You can also remove photo metadata with an in-app purchase.  The Investigator can also open the image’s GPS location in the maps app for directions; view images at full size and zoom them larger than in the Photos App.

Three Facebook Group Search Tips

Back in 2018, Mark Zuckerberg was focused on getting more people to engage on their platform. Facebook Groups became a very important tool to use to do just that. Facebook rolled out an algorithm known as “Facebook Zero,” and simply put, this is the reason why you most likely see Group content dominating your newsfeeds. (Hootsuite)

Many people who are involved in Facebook Groups are highly engaged. Once a person joins a group, there seems to be a false sense of anonymity in a way. Meaning, that no one outside of this group can see my posts. If the group is public, that is simply not the case.

It is important to remember this when you are conducting research on your person of interest.

We covered this in a previous blog. The “Must Have” to the “Nice to Have” in Social Research for OSINT featured a case study. From all appearances the POI seemed to be pretty clean cut. Someone who you would never suspect would use drugs. However, once we located a group she was active in, it revealed a different side to her.

When conducting scans, we have found some seemingly “hidden” posts in groups that were very helpful to our client’s case.

Hidden VS. Private Groups

According to Hootsuite:

Private and visible Facebook groups can be found through search, and it requires approved membership in order to see anything beyond a group description, members, and group history.

Private groups that are hidden can only be found by current members and those who have been invited to the group already (even if they aren’t members yet). Only members are able to view the group content beyond that waiting-room-styled display above.

Most business groups are most effective when set to private and visible. People can find you and you have full control of who gets to see and view group content, giving you the best of both worlds for a balance of quantity and quality while still being findable.

Hidden groups are most effective for internal team use or if you want to set up a highly-exclusive group that’s invite-only and don’t want the backlash of angry people who aren’t accepted.

Tips to Search Facebook Groups

  • Need a quick and easy way to search for groups? Start with Facebook’s Browse Groups page which is designed to help you locate a group that fits your interests.
  • Once in the Browse Group area, you can filter the search down a bit (see below).
  • If you have an idea that your POI is active in a particular group that is public, you can easily use the magnifying icon right on the page to search the group for names, keywords, dates, etc..

People who post in groups, seem to be more vocal, more honest and sometimes reveal much more than they are even aware of. It may be because they view it as being more “private” and not publicly available on their own profile page or timeline.