eChatter

OSINT Research: The Devil’s in the Details

For those unfamiliar with the term OSINT Research, it is explained this way by Wikipedia

Open Source Intelligence (OSINT) is the collection and analysis of information that is gathered from public, or open, sources.^[2] OSINT is primarily used in national security, law enforcement, and business intelligence functions and is of value to analysts who use non-sensitive intelligence in answering classified, unclassified, or proprietary intelligence requirements across the previous intelligence disciplines.

OSINT sources can be divided up into six different categories of information flow

Media, print newspapers, magazines, radio, and television from across and between countries.
Internet, online publications, blogs, discussion groups, citizen media (i.e. – cell phone videos, and user created content), YouTube, and other social media websites (i.e. – Facebook, Twitter, Instagram, etc.). This source also outpaces a variety of other sources due to its timeliness and ease of access.
Public Government Data, public government reports, budgets, hearings, telephone directories, press conferences, websites, and speeches. Although this source comes from an official source they are publicly accessible and may be used openly and freely.
Professional and Academic Publications, information acquired from journals, conferences, symposia, academic papers, dissertations, and theses.
Commercial Data, commercial imagery, financial and industrial assessments, and databases.
Grey literature, technical reports, preprints, patents, working papers, business documents, unpublished works, and newsletters.

OSINT Resources Reveal the Details From the Deep Web

Many times our clients want to better understand the difference between a social media scan and a deep web scan. Taking a close look at the image above explains a lot and kind of surprises most people in terms of the data on the web that is openly available.

eChatter Case Study Examples of Deep Web Details

Recently, we were trying to find out whether a POI (person of interest) was married. He had no Facebook clues other than he was in a relationship. After conducting a deep web scan we found a local newspaper article in which he was named along with “his wife”. The wife chose to keep her maiden name.
A deep scan was ordered by a client to determine what happened to a deceased person’s body. We found an association letter that was published online indicating the person was cremated and buried at sea.
A client needed to know if their POI had any business affiliations that wasn’t disclosed in a divorce settlement. After a deep scan was conducted, we located quite a few businesses tied to the POI.

Does it always work out this way? Not at all. Mainly because some people are much better at hiding this than others or because they were advised to delete everything online by advice of counsel. However, these are the kind of details OSINT research is all about. You will not find this in a Google search.

A Private Investigator’s View of Social Media Intelligence

I am pleased to share with you our first guest blog post. It is written by Larry Forletta, owner of Forletta Investigative/ Security Consulting. As a former DEA agent, Larry Forletta has established many resources in the United States and abroad.

httpss://fcisllc.com/

Social media investigations have changed the investigative landscape for private investigators.The forensics have been learned through a series of trial and error, utilizing some of the most popular social media platforms in order to gather essential evidence under the laws of collection. Those who work in this department are sometimes referred to as social media
vendors. However, not all social media forensics are the same and they certainly don’t produce the same results every time.

The effective use of social media has aided many investigations already. One investigation that comes to mind is an attempt to extort money from an individual involved with prostitution. By investigating through social media, the individual’s full identity (including name and base of
operations in the U.S.) was able to be identified. This investigative information was then provided to state authorities who were further able to identify the prostitution extortion individual.

It’s quite amazing what people continue to share on social media platforms. Despite the fact that there can be real consequences for what gets posted online, even if it might seem like fun and games, people continue to post sometimes incriminating and hard evidence that can be used against them. Americans spend more time using social media platforms than any other
internet activity, such as email. Most online evidence is compiled manually by an investigator who might screenshot or archive as needed. If something was sent or posted, perhaps even published, then it can be found and used accordingly.

Even when posts are deleted, they never really go away. Emails can be trashed, and accounts can be removed, yet the data and imprint of what has been put online may be able to be resurfaced with a little help. After all, a private investigator is only as good as their resources.

Our primary social media associate is eChatter, an online global source for social media researchers. They are spearheaded by their president, Kathy Doering, and specialize in a multitude of services including deep web searches and dark web searches. They are professional, communicative, and will get the answers that you need.

Every Picture Tells a Story

How to Use it in Your Next Investigation

More than 95 million photos are uploaded to Instagram every day,(as of November 2019). People love to look at pictures in social media and they love to share them. Most Instagram photos are uploaded in the moment of experience, right from a mobile phone. This can be very telling when conducting an investigation around a missing person, a criminal, or even someone who you are trying to serve papers to. Paying attention to the details of the photo is especially helpful. Who are they with? What is in the background? Can you tell what the weather is like?

As an added feature, Instagram stories was launched in 2016 and allows users to upload photos and short videos that will disappear in 24 hours. Yes, like the social platform, SnapChat. Timing is everything and that is where continual monitoring of a site comes in handy.

Not only can Instagram be helpful in your online research, it is also a great place to promote your business. For now, let’s dig in deeper in this overlooked platform for the investigation world.

Starting with the name one chooses when creating a profile, users are encouraged to use any combination of numbers, capital letters, lowercase letters and underscores. Usernames cannot exceed 20 characters. So, as you can see knowing your POI’s full name may not be of help unless they use it publicly in their profile. A good rule of thumb is that most people reuse their usernames. Chances are if you know one, you will uncover other platforms with the same username in your search.

There are even username generators online that help new users create an username that “gets them noticed”. Spin xo is just one of many sites.

As you can see, finding a POI’s user name can be a challenge. Once you do some digging, and you find the profile, the following searching sites can be used to make digging in easier:

As with every other social media account, marketing dollars are a high priority. In order to get that revenue, the site must show ROI., which includes how may people engage. There are many tools to use for this purpose.

Don’t forget to check Instagram!

Wait…Where Did That Social Media Post Go?

What happened to that social media post you saw yesterday during your recent online investigation? Are you kicking yourself that you did not capture that post when you saw it? It can happen and very often does. The old adage, what is here today, is gone tomorrow, is something that happens all of the time, especially in social media. It may suddenly be changed from “public” to “private” at any point. The user’s entire profile can be deleted at any time. Where will that leave you and your investigation?

Largent V. Reed

Back in 2011 this was not an issue as social media was just starting to grow. In a personal injury lawsuit, Largent v. Reed, the plaintiff claimed that a recent accident had left her with severe physical and mental pain. During the trial, defendants presented her post-accident photos posted to her Facebook profile. These photos revealed the plaintiff was clearly feeling well enough to engage in her daily activities and exercising at her gym on a regular basis.

Fast forward to 2020 and things have changed. People are more aware of what they post and use user names that are different than their real name. Let me give you a recent example. One of our clients requested a deep scan from us for a case that involved fraud. We conducted the scan and produced the report capturing the subject’s Facebook account. Scans include live URL’s as well as screen shots showcasing all publicly available data. Once given to the attorney, he had a question about one of the posts specifically. When attempting to click on the link within the profile post, he came to a dead end. We did capture a screenshot, which in most cases is sufficient for investigative purposes. However, time is critical when conducting this type of research. Looking a little more closely at one of the posts was no longer possible.

Web Preservation

Preserving digital data is something many attorneys are starting to take a serious look at and in some cases are requesting from their private investigators. Judges are getting stricter when it comes to allowing social media as evidence in court. Not all cases make it to court of course, but preserving social media may be that extra step that your clients may want you to take.

Social media posts can be altered quickly, often at the advice of opposing counsel. Be sure not to wait too long to capture the data you need and in some cases, be sure to preserve that data.

There is a Rumor Going Around…

In any work environment there is bound to be a whole bunch of dynamics around the office. Too many type A’s in the office could be quite exhausting for example. It takes skill to navigate it all with the help of a good HR department. This is however, very understandable and common to most people.

But what happens when things turn ugly at work? What if someone has it in for a person or even a group of people? Workplace conflict is a very real issue and one that should not be taken lightly. With the mental health issues we currently have in our country, employees should be trained in what to look for and have a safe place in which they can voice their concerns. In fact, many work places are taking a proactive approach by conducting workshops on this topic to teach employees what is acceptable and what isn’t.

Workplace Policy

Developing a workplace policy like the one below is helpful and can be especially important should any legal issues come up.

Under federal law and Department of Labor (DOL) policy, harassment by DOL employees of DOL employees based on race, color, religion, sex (including gender identity and pregnancy), national origin, age, disability, genetic information, sexual orientation, or parental status is prohibited. The Department of Labor does not permit harassing conduct by anyone in the workplace, including contractors.
Taken from the DOL website

Posting it in the lunch room or in a public area would be a great first step. But it does take much more effort on the part of management and prevention is key. Years ago, when a company had a problem within their organization, it pretty much stayed there. Not true anymore, thanks to social media.

Social Media’s Role

What is social media’s role in all of this? Does an employer have the right to monitor employees social media? Can it be cause for dismissal? More and more the answer is yes because it can be a red flag alert that will stop a publicity nightmare down the road.

Where there is smoke there is fire. Social media can be a red flag to other things that may be happening within a department. This was true of a Seattle Officer who showed signs of of violent tendencies on and off social media.

The Seattle Officer lost his job over a collection of social media posts. The post became public by placing a blurb about it on the Office of Police Accountability’s website. The officer included some pretty rough comments about illegal immigration, with an emphasis on endorsing violence. The department issued this statement:

“The department’s ability to fulfill its public safety duties depends on communities believing that officers will treat them equally and with dignity, regardless of their immigration status,” Best concluded. “Your comments suggest that you will not do so. They could have substantial negative consequences to the relationship between members of the Department and those that we serve and showed exceeding poor judgment.”

Additionally, the officer was suspended for escalating another incident to the point where a fellow officer feared for their safety.

As an employee, would you feel more safe knowing your employer was being proactive? When does safety in the workplace trump privacy? Please share your thoughts…