Executive Protection on Social Media

With the plethora of information shared on social media, the importance of security is on the rise. For individuals in powerful roles, executives (CEOs and COOs), and celebrities, most of this has to do with the security of personal data. Can hackers get into personal accounts? What will they do with the information they find?

Let’s dive deeper into executive protection (EP) in corporate and high net worth contexts. What can you do to protect your client’s reputation as well as their personal safety? Executive protection teams must be able to handle many different moving parts at once – reputation risk, physical security, and cybersecurity.

Of course, the easiest route is to just stay off social media. But that’s like telling a child not to lick the spoon when baking cake! EP pros need to know how to embrace social media, not reject it. Below are some strategies that can help best protect your clients. 

1) Social media is part of our world. Know how to navigate it.

According to recent research by the University of Massachusetts, Dartmouth, all but three Fortune 500 companies are active on social media with corporate accounts:

  • 98% use LinkedIn
  • 88% use Twitter
  • 85% use Facebook
  • 75% use YouTube
  • 53% use Instagram
  • 42% maintain blogs
  • 31% use Pinterest
  • 10% use Snapchat

Keeping track of what your principal is up to on social media helps EP pros in several ways. It helps you understand what’s going on in his or her life and what’s important to him or her. Being aware of contexts that are meaningful to your client is a good idea no matter what business you’re in – including the business of executive protection.

Also, observing what the principal is doing on social media – and what others are doing on social media regarding your principal – helps you improve your protective practices. You need to follow and understand what everyone else can follow and understand about the principal simply by taking a look at their smartphones. You need to monitor what others monitor. Then you can add your protective perspective so you’re looking for things that can impact the principal’s wellbeing, including time and place predictability.

2) Disable Geo-enabled Social Media Posts

Enabling the public to know your executive’s location opens up an entirely different world of risks, including oversharing information to those who don’t need it. Geo-enabled social media postings through location-based services (LBS) create physical risk, leaving the executive with little to no privacy.

The best way to combat this risk is to remove it completely – turn off the geo-enabled feature for both your executives and their family members.

Social media posts can also increase time and place predictability. A simple Facebook or Instagram post can broadcast your location quickly and accurately. Maybe the principal just wants to say “Hey, check out this cool picture that shows you what I’m up to and who I’m with.” Although it seems harmless, the principal’s time and place predictability helps the bad guys. They conduct surveillance prior to any bad deed: the ability to predict when a victim will be where helps them plan an attack – and increases their chances of getting away with it.

Protective teams can combat this by using surveillance detection and mixing up routes so the principal is not commuting via the same streets at the same time every day. Keep access to principal itineraries to the absolute minimum.

3) Monitor for Executive Account Imposters

There’s always a risk of imposters on any social platform. Fake accounts are used as part of social engineering and spear-phishing attacks to target customers and other key employees.

Make sure you have a verified account or page. That way, if anyone sees a page that is posting as the executive, but knows that that’s not the official page, they tend to be less believing of the content coming from “unverified” pages. Next, you should have a monitoring system with triggers in place that understands the difference between authorized and unauthorized social media accounts quickly, so take-downs can occur quickly.

3) Don’t Reuse Passwords
It sounds simple enough but passwords are the main portal of entry to any account – whether it be social, personal, or financial. Once a hacker has been able to bypass and figure out an executive’s password the risk factor increases exponentially. Have different passwords for each social account – that way even if one account is compromised, the others not mean an immediate compromise

4) Everyone’s a Journalist

EP professionals need to understand the implications of anyone being able to take a picture (of the principal, of the principal’s family or colleagues, and the EP team) and then posting it to social media where millions, can see it in seconds.

Let’s say your principal is in a restaurant having a meal with a colleague or their family.  It is quite likely that someone in that restaurant will post a picture on social media, maybe even the restaurant owner trying to announce that a prominent person likes their food. No matter what the instance, it could mean that a crowd of people shows up before dinner is done. And that definitely means your principal’s privacy is in jeopardy. Of course, there is no way to prevent all photos or postings…but EP professionals must consider this type of exposure as part of the overall risk environment.

While these tips can certainly help you reduce the threat posed by social media, it’s inevitable that some information about your organization and its employees will be available to criminals through social media. This is why, no matter what else you do, security training for employees is an essential component of any cybersecurity strategy.

How to Protect your Company’s
 Online Reputation

Customers are talking about your brand. Through avenues such as social media, online review sites, blog comments, and community forums, your brand has made an impression…and it’s up to you whether that impression is a positive or negative one.

Because of the plethora of social media choices in play, it can be very difficult to monitor the conversations and truly know what’s being said about your brand every minute of the day. Because of this, more companies are investing in online reputation management (ORM).

ORM is the act of monitoring and engaging in activities to understand and improve the overall public impression a company has online. In other words, it’s public relations for the internet. 

It’s best to stay abreast of what’s being said about your brand, otherwise you will be playing a game of clean up. When it comes to your business’s online reputation, the “fix it later” approach can result in disaster. Hersh Davis-Nitzberg, founder and CEO of crisis management firm Reputation Control Inc., says that entrepreneurs need to be proactive about managing their online reputation before irreversible damage is done. Here are four steps he recommends you take to protect and improve your business.

1) Be Present…Especially where your Customers are

The number one danger to ORM is when companies are not present where their customers are interacting. Social media is only one avenue where your customers are talking about you online. Your customers are not only tweeting or posting on Instagram about you, but they are also gaining support praising or pummeling you on community forums, or the comment section of review sites. 

Unfortunately, on most of these forums, the customer inquiries, concerns, or complaints go unseen and unanswered by a representative of the business. Instead, the forums become support groups for customers as other users share similar questions or poor experiences that they have encountered with in your brand. You definitely do not want this to become a free-for-all bashing your brand.

2) Responding to Negative Content

In most cases, online forums, communities, or review sites allow companies to respond to feedback. When your company or brand receives negative feedback, ideally you should respond as an affirmation. Try not to become defensive or downplay the customer’s experience. The first step is to apologize for the experience and take the conversation offline.

Many review sites and service communities rank high on search engine optimization (SEO). If a company is mentioned negatively on these sites, the best plan of action is to give a short response recognizing the issue, apologizing, then taking the conversation offline. Invite the user to send a direct message or an email. If a company chooses to go back and forth with a consumer, each time the page re-publishes with additional content about the company, search engines will push the content. In turn, the ranking of this negative review can improve.

3) Pushing Positive Content

A key aspect of managing a brand’s online reputation is to create positive content that will rank well in search engine result pages. By constantly pushing out new, credible content you can increase awareness online and build up your brand’s reputation. Quality content could include customer testimonials, related articles, product reviews, press releases, or banner ads on relevant pages that link to your company website.

4) It’s Easier to Build a Good Reputation than Fix a Bad One

Hersh Davis-Nitzberg explains, “It’s easy to ignore your online reputation when everything is going well. But when a crisis strikes, suddenly the information about you on the internet can determine how the media, clients, and even your personal relationships will react. Be on top of your digital footprint before a crisis happens. If you lack an online presence or have a negative reputation, a crisis situation can become a top story. But, if you have established an authentic, positive, and robust reputation, the same event can be a blip on the radar. If something happens, take a step back and look at the big picture. There may not necessarily be a quick fix, but with a solid strategy, you can repair your brand. The biggest mistake you can make in a crisis is to respond without thinking. Quick reactions can turn a minor crisis into a disaster.”

The Government Turns to Social Media for Social Security Fraud

Playing outside with your grandchildren, casting a fishing line or running a marathon can seem like harmless, healthy fun. But physical activity could lead to denial of Social Security disability benefits if your activity shows up on Facebook or Instagram. Is it fair for the government to go through your social media? On the other hand, is it fair for you to apply for benefits if you can do these activities?

These are all questions the Social Security Administration is weighing, as Acting Social Security Commissioner Nancy A. Berryhill has told Congress in written explanations over the last week. Facebook and other social media feeds are already being reviewed if agency investigators suspect someone is fraudulently collecting benefits and they are looking for corroboration, the agency said in the documents it gave to lawmakers. But now the agency is “evaluating how social media could be used by disability adjudicators in assessing the consistency and supportability of evidence in a claimant’s case file,” Berryhill said in the submission to Congress.

The idea has drawn praise as well as criticism — praise because more attention to people’s social media could cut down on fraud, some say. Fraud and abuse do exist in the program, and it should be weeded out to protect taxpayers and legitimate claimants. 

The Pros

Mark Hinkle, acting press officer for the SSA, notes that the agency uses data analytics and predictive modeling to detect fraud, and has created new groups dedicated to detection and prevention. Asked to comment on plans for expanded use of social media to detect fraud, he confirmed that SSA investigative units already use social media, and that the agency has “studied strategies of other agencies and private entities to determine how social media might be used to evaluate disability applications.”

The Social Security Administration said that in December, 8.5 million people of all ages received a total of $10.5 billion in disability benefits, with an average monthly sum of $1,234. It said 68 percent of the private-sector workforce has no long-term disability insurance.

The risk of disability rises with age, and people are twice as likely to collect disability benefits at age 50 as at age 40 — and twice as likely at age 60 compared to age 50, according to the Center on Budget and Policy Priorities, a liberal Washington think tank.

“Social media can provide valuable evidence to support or deny individuals’ disability claims,” Rachel Greszler, a research fellow at the Heritage Foundation, a conservative Washington think tank, wrote last year. “For example, a disability claimant may say that she is unable to leave her home, while her social media pictures show her out and about regularly.”

In one case, a 57-year-old Louisiana man pleaded guilty last month to theft of government funds. He had received $2,177 a month in benefits — a total of $242,000 — while employed by companies that did demolition work and job site cleaning. He also operated heavy construction equipment. He told federal investigators that the companies had been registered in the names of family members, rather than his own name, “so y’all wouldn’t find out about it,” according to court records.

In its latest financial report, Social Security estimated that it made $3.4 billion in overpayments to disability insurance beneficiaries in 2017, in part because of their failure to report work activities. The program has been “riddled with problems, including fraud and abuse,” said Greszler. When people who can work collect benefits, she said, “it drains the system for those who truly cannot work and support themselves.”

The Cons

Advocates for people with disabilities say the use of social media in this way would be dangerous because photos posted there do not always provide reliable evidence of a person’s current condition. Someone may not want to upload a picture or video that shares how he or she deals with a disability on a daily basis.

Social media reviews could also delay the time it takes for applicants who are already out of work to be approved. “This proposal starts with the discriminatory assumption that people with disabilities do nothing socially in the community, or have lives, so that anything the person does on social media can be classified as some form of fraud,” said Eric Buehlmann, deputy executive director of public policy at the National Disability Rights Network, a nonprofit membership advocacy group. He told AARP that methods to detect fraud already exist. If the Social Security Administration “is interested in rooting out fraud,” Beuhlmann said, “spying on people’s social media accounts is not the way to do it.”

“It may be difficult to tell when a photograph was taken,” said Lisa D. Ekman, a lawyer who is the chairwoman of the Consortium for Citizens with Disabilities, a coalition of advocacy groups. “Just because someone posted a photograph of them golfing or going fishing in February of 2019 does not mean that the activity occurred in 2019.”

Program statistics do not support the allegation that SSDI is riddled with fraud and abuse. In the government’s fiscal-year 2018, the SSA’s Office of the Inspector General (OIG) reported about $98 million in recoveries, fines, settlements/judgments, and restitution as a result of Social Security fraud investigations. The OIG states that most the recovered funds were from recipients of SSDI and Supplemental Security Income (SSI), a means-tested welfare program for low-income seniors, blind and disabled people.

That sounds like big money. But in fiscal 2018, the SSA paid out $197 billion to beneficiaries of SSDI and SSI. And keep in mind that the recovered $98 million was for benefits paid out over several years, not just in 2018. SSA data shows that the rate of overpayments for all its programs was well under 1% of benefit payouts in each of the last three fiscal years – and not all improper payments are fraud.

More often, overpayments occur due to administrative delays at the SSA in making adjustments to benefit amounts due to errors and paperwork snafus. A federal government list of programs at highest risk for making improper payments compiled by the Office of Management and Budget does not even mention Social Security.

Greszler has readily acknowledged that fraud rates are low. “Outright fraud is actually a pretty small component of the program’s problems,” she said. “Most people perceive fraud as a big issue but what they might consider fraud – people receiving benefits when they have the ability to work – is often just abuse of the system by taking advantage of certain rules and structures that allow people who can perform some work to nevertheless receive benefits.”

What constitutes abuse of the rules? An example, she said, would be claiming SSDI and receiving unemployment benefits at the same time, or claiming based on the argument that a disability prevents a worker from performing certain types of jobs, Greszler and other SSDI critics often point to the rise of SSDI applications and award grants coincident with the rise of unemployment during the Great Recession as evidence of abuse.

Open Source Network Tools for Investigations 

What is Open Source Intelligence (OSINT)?

Open Source Intelligence (OSINT) is defined as data and information that is collected legally from open and publicly available resources. Obtaining the information doesn’t require any type of secretive method and is retrieved in a manner that is legal and meets copyright requirements.

 The Internet has all the information readily available for anyone to access. Collection of information using these tools are referred to as open source intelligence. Information can be in various forms like audio, video, image, text, file etc. A few of the data categories available on the internet include:

  1. Social media websites like Twitter, Facebook, Instagram, etc.
  2. Public facing web servers: Websites that hold information about various users and organizations.
  3. Mass media (e.g. newspapers, TV, radio, magazines and websites)
  4. Code repositories: Software and code repositories like Codechef, Github hold a lot of information but we only see what we are searching for.
  5. Public records databases
  6. Government reports, documents and websites
  7. Maps and commercial imagery
  8. Photos and videos
  9. The dark web

Who Engages in Open Source Intelligence gathering and analysis?

Anyone who knows how to use the tools and techniques to access the information is said to have used the process. However, the majority is used formally by the United States intelligence community, the military, law enforcement, IT security professionals, private businesses and private investigators.

Gathering the information manually can eat up a lot of time, but now there are tools that can help collect the data from hundreds of sites in minutes, easing this phase. Let’s say, for example, you want to identify whether a username is present and if so, on which/all social media websites. One way is to log in to all the social media websites (and there are more than you know!) and test the username. Another way is to use an open source tool that is connected to various websites and check the usernames presence on all the websites at once. This is done just in seconds using OSINT.

List of Open Source Intelligence Tools

The tools and techniques used in Open Source Intelligence searching go much further than a simple Google search. Following is a list of helpful, time-saving open source intelligence tools. Note: most are free, although some have advanced features available for a fee.

Email Breach Lookup – Have I Been Pawned

This site allows you to find out if a particular email address was affected by one of the many data breaches that have occurred over the years

Fact Checking Websites – Hoaxy, Media Bugs, PolitiFact, SciCheck, Snopes, Verification Junkie

Hacking and Threat Assessment – Norse

OSINT Image Search – Current Location, Image Identification Project, TinEye

Public Records (Property) – Melissa Data Property Viewer, Emporis Building Search

Sites like Zillow, Trulia, Realtor.com, etc. are always useful and should be a part of your investigative toolbox. But the two mentioned above provide various twists on property records searching and are definitely worth checking out.

OSINT Search EnginesGoogle Correlate, Google Search Operator Guide, Million Short, Shodan, TalkWalkerAlerts

OSINT Social Media Search ToolsFacebook Search Tools, TweetBeaver

OSINT Tool WebsitesIntelTechniques

SoftwareHunchly, Maltego, SearchCode

Surveillance CamerasEarth Cam, Insecam

Username CheckCheckUserNames, Knowem.com, Namech_k

Virus ScannerVirusTotal

Website Analysis – BuiltWith.com

The main benefit of OSINT is how the technology can help us in our day to day tasks. With all that information freely available multiple actors can accomplish various tasks. A security professional can use the information for data protection, security testing, incident handling, threat detection, etc. A threat actor, on the other hand, can gain information to perform phishing attacks, targeted information gathering, DDOS attacks and much more. The key is to select the right tools and techniques. Since this is all free, users can make their decision regarding how best to access the information they need.

Craigs List Fraud & Scams

Unless you’ve been hiding under a rock you have heard of Craigslist.

Craigslist is a great resource for selling things, finding apartments and jobs, locating services and meeting people. Most of the time transactions go smoothly and both seller and buyer are satisfied with the Craigslist experience.

But lately more and more people are being scammed on Craigslist losing money and, in worst case scenarios, putting themselves in danger.

To help keep yourself safe from scams, Craigslist advises that any business dealings be done with people in your own local area. Don’t do business with folks who live far away. Also look for listings with poor grammar and misspelled words. Beware of anyone offering more than what you asked for. Why would someone do that? Especially since Craigslist is known as the place to go for good deals.

Below are some of the most common Craigslist scams and how can you avoid them.

1) Nigerian or Foreign Country Scams

If you receive an email with very specific criteria…it’s more than likely a scam. Most will offer more than your selling price if you accept their check or money order. And if the buyer or seller tries to pay you with a money order or wire transfer — take that as a big, waving red flag. 

Scammers over the years have developed pretty sophisticated-looking fake packing slips or even money orders claiming to be from trusted institutions like Western Union. Often, these scams are part of a Nigerian 419 scam, and could entice you to send the buyer your goods before the fake check or money order clears. To avoid getting duped, don’t accept money orders on Craigslist and, if you must use a check, make sure it clears before sending what was bought.

2) Fake or Cancelled Tickets

Ticket scams are among the more common scams on Craigslist. My husband was actually a victim of this. Savvy scammers have been able to make fake tickets that look real to big events like concerts or sports games. According to WiseBread.com, some scammers have even replicated holograms and watermarks on tickets for concerts or events — and these tickets are either fake or already cancelled – setting you up for a big disappointment. To avoid the headache, only go through reputable sites like Ticketmaster or the actual venue.

3) Non-Local Ads

In general, whenever an ad is not local, it’s generally not a good idea to pursue it. If someone posts a non-local ad they usually won’t be able to meet up with you and will often require transferring money through some online platform (which is a red flag!).

While there are certainly some precautions that should be taken when actually meeting and conducting a transaction in person (such as meeting in a public place or bringing a friend with you), some people that are unable to meet in person (or refuse to) could be scammers on the site. 

4) Fake Craigslist Site

Yes, you can accidentally land on a fake Craigslist site. Scammers often use similar domain names in hopes of snagging internet searches from the real Craigslist site and convincing users to trust the fake ones. Some of these sites look very realistic and could cost you a lot of money. Rule of thumb: if any Craigslist site does not have the address http://www.craigslist.org, it’s fake. 

5) Scam Email from PayPal

Some scammers may use PayPal (or the promise of PayPal) to send or receive money on Craigslist. PayPal actually warns people to be wary of ads that want to use the site for transactions because many of them may never follow through or send you a fake PayPal email confirmation of a payment. Warning signs include emails that don’t address you by your full name or a statement that money is being held until you perform some action (like sending money through another wire service or using links to tracking orders).

6) Lured to a Mugging

This is a really nasty scam, and we could all fall for it quite easily. It’s also known as “robbery by appointment.” As a Craigslist seller, you will know that cash reigns supreme. You don’t want to deal with bounced checks. Craigslist scammers will place an ad for something like a car, high-end electronics, or another product of significant value. So you arrange to meet the seller (with a large amount of cash), and that’s when you’ll be jumped and the money taken from you. This “lure” scenario has happened many times over the years, which is why Craigslist advises you to meet in a safe, secure location, go with a friend (or two), and if in doubt, back out.

If you happen to see something on Craigslist that looks fishy, send an email to abuse@craigslist.org and give them as much detail as you can about the listing. Make sure you include URL (or 8 digit post ID number) in your email. If you’re selling something and you think a con artist has expressed interest, forward it to abuse@craigslist.org. Be smart, be aware and if in doubt ask your friends or someone with internet savvy what they think if something just doesn’t seem right. If it sounds too good to be true, it usuall