Twitter Archives

Social Media Updates That May Affect OSINT

By now most of us in the OSINT field have gotten used to social media updates. Remember Facebook Graph (RIP)? I remember when we would use it and think about what would happen if they took it away. Then, one day, it was eliminated. We were horrified, and wondered how we would live without it. We all have lived without it of course, and we are probably better for it. It has forced us all to think more about the “how to” rather than relying on any one software platform, app, or tool.

What’s Around the Corner?

Well the big tech giants are at it again. Let’s start with one that I think will be a game changer. Twitter is working on new controls on who can @mention you on the platform. Last August they put the control back in the user’s hand. The latest in the news of social media updates.

As outined by Twitter:

“Here’s how it works. Before you Tweet, choose who can reply with three options: 1) everyone (standard Twitter, and the default setting), 2) only people you follow, or 3) only people you mention. Tweets with the latter two settings will be labeled and the reply icon will be grayed out for people who can’t reply. People who can’t reply will still be able to view, Retweet, Retweet with Comment, share, and like these Tweets.”

This can be quite limiting in OSINT work if the user realizes they have this option. The key phrase is that “everyone” is the standard Twitter default setting. To me, it kind of negates the entire reason for being on the platform. To so many users, this is a platform to not only shout out your opinions, but to also get noticed for those opinions!

Social Media Update #1: Newest Twitter Update

The platform is working on a few different variations for mention controls, starting with this prototype for ‘unmentioning’ yourself from a tweet chain. So basically, you can formally excuse yourself from this tweet chain conversation. Your Twitter Handle would be unlinked but the thread would still be seen. This is similar to what you see in Facebook when someone has deleted their profile, but they user name is still tagged in a live user’s profile.

In addition, Twitter’s also looking to add a new notification for when you’re mentioned by somebody who you don’t follow. This is going to be a huge game changer for all those Social Media Influencers and marketers out there. Tagging can be a great way to get in front of the right brand or person to get noticed.

Social Media Update #2: Facebook Tests Pubic Comments in Stories

As you can see in this example, posted by @ohitsmerenz (and shared by Matt Navarra), Facebook appears to be testing a new option which would display Stories replies on the Story frame itself, adding a whole new way to engage with Stories content. It would be a new way for people to engage with stories. Will it be discoverable during online searches? That remains to be seen. It is also in the very early stages, so we shall see.

Tip: Remember if you view someone’s stories you will be identified. Something to remember when searching online.

Check back and we will be sure to watch for updates on this!

The “Must Have” to the “Nice to Have” in Social Research for OSINT

In the world of online research, social research, OSINT, etc., information falls into two main social research categories. In one group you have the “Must Have” and the other is the “Nice to Have”. Let me explain.

Let’s take a look at this from the viewpoint of information collected on a person of interest.

Must Have: Facebook

Facebook intelligence is still in the “Must Have” category. In part this is due to the fact that there is still so much to discover there, if you know how and where to dig. That is the challenge!

Groups: Sometimes people will showcase their groups and sometimes this information is kept private. If it is kept private, there are search techniques that can be used, but it is not easy. Sometimes this information is readily available on a person’s profile page. When it is, and the group is public, I would suggest taking some time to do a manual search.

What Can You Find?

When people post in Groups, I really think that most have a mindset that it is undiscoverable information. Meaning, it is safe within the constraints of the group. That may give a false sense of freedom to speak their mind or to post something that they wouldn’t want the majority of their friends to know. When viewing a person’s page, public posts may give an impression of being squeaky clean but posts in a group setting can reveal the opposite.

Recently, we conducted a scan on a person who from their two facebook profiles, looked to be pretty clean cut. After digging further, we came up with a series of posts that showed a very different side to the individual.

Facebook Post — Post of a person of interest in a Group

In case you are unfamiliar with the term, “wake and bake” it can be described as getting up in the morning and partaking of the drug of choice, without leaving the comforts of one’s bed. (urban dictionary).

Enough to toss that squeaky clean image right out the door!

Twitter:

If you are having trouble finding information online, one suggestion is to turn to Twitter. Is the person currently employed? By whom? What about past jobs? It may be worth it to scan the company’s Twitter pages because many mid to large size companies will post events, fundraisers, blogs, videos, etc. which have employees present.

We recently found several photos of an individual from their company’s Twitter page.

Nice to Have

There is quite a lot of information that can be filed under the “Nice to Have” social research category. When conducting a deep web scan for example, we may find out that the person had some past problems with the law. From simple traffic violations to bankruptcies and everything in the middle. This may date back 10 or more years.

While it may not be important to the case, it is something that is part of the person’s past. Voter registration, financial contributions to a particular political party, volunteer work, newspaper articles, digital records of all kinds, and so on. All of this additional information can help to give you a good picture of the character of the person.

UCC filing — Person had a possible DEA Controlled Substance License that expired in 2015

A piece of information like the one above can be useful in many ways. Perhaps you know the person to be a Veterinarian or he was one in the past. This piece of information can serve as another data point that confirms his profession. It may list an address or name of a business that you didn’t have before.

It can help you to eliminate false positives in your research as well. Without the help or assistance of multiple software platforms, you can easily get two people confused who share the same name.

Social Media Regulation & Section 230

Will Social Media sites ever be regulated? Should there be a social media regulation policy? You can’t stop people from giving their opinions. That is called free speech. Social Media is the place where we all take part in free speech. What is up for debate is whether or not expressing your opinions on those sites falls under our First Amendment rights or not.

This week it comes front and center once again because of a Tweet from President Trump that Twitter added warnings to. Trump did not break any Twitter rules, however the social media site added its own opinion on the subject. It is no secret on how liberals feel about Trump’s Tweets. They despise them. I am certain that even some of Trump’s followers cringe at many of his Tweets. The problem here, in my opinion, is not the subject matter but the way in which Twitter did it. Should the owner of a social media platform be able to censor an opinion of anyone? And where does it stop?

What did Twitter Do?

Twitter said that the tweet about mail in voting fraud fell into a gray area of misleading content that the company deems as being important to call out. The platform rolled out its new fact-checking approach on May 11, around misinformation about COVID-19 which can be very dangerous. There is a lot of false statements made on all social media platforms and I think when it comes to public health this is very important. I am glad they have this safeguard in place.

However, did Twitter go too far this time? What does the law say? When this is talked about, Section 230 is always brought up. But is it out of date?

What is Section 230?

Section 230 was actually is part of federal legislation that was created 20 years ago. It has a total of 26 words. A recent Forbes article explains it this way:

They are the “26 words that created the Internet,” says Jeff Kossett, a cybersecurity law professor at the U.S Naval Academy and one of the foremost experts on Section 230.

Most fundamentally, Section 230 provides immunity to social media companies like Facebook and Twitter against being sued over the content on their site. This allows them to operate and flourish without needing to moderate content.

“Section 230 set the legal framework for the internet that we know today that relies heavily on user content rather than content that companies create. Without Section 230, companies would not be willing to take so many risks,” Kosset says.

Has social media gotten too big to regulate? Should it even be considered? What about censorship in the media? How does one ever really fact check these days when so many news outlets have their own agendas?

What do you think?

Think Your Data Is Private Because You’re Not on Social Media? Think Again.

Just because you’re not on Facebook or Twitter doesn’t mean your data is safe from social media or their clever algorithms. In two different studies, researchers found evidence that your privacy is no longer in your hands, even if you abstain from social media.

The studies, conducted at the University of Vermont and the University of Adelaide, found that they could predict a person’s posts on social media with 95% accuracy, even if they never had an account to begin with. The scientists got all the information they needed from a person’s friends, using posts from fewer than 10 contacts to build a mirror image of a person not even on the social network.

The study, published Monday in the journal Nature Human Behavior, looked at more than 30 million public posts on Twitter (excluding retweets) from a total of 13,905 English-language users (attempting to eliminate bots and non-personal accounts) to populate their model. By using data provided by just 8 or 9 of a user’s contacts, the researchers were able to show that the tweets of friends allowed them to predict quite a bit about the original user. The original user’s Tweets allowed them to predict future tweets with an accuracy rate of roughly 64% and the user’s contacts gave them enough data to predict behavior with an accuracy rate of 61%. So, go ahead and delete your account, but information about you is still going to be generated (and pretty accurately) if you have a close relationship with at least 8 people who use the platform.

This analysis showed that “information within the Twitter messages from 8 or 9 of a person’s contacts make it possible to predict that person’s later tweets as accurately as if they were looking directly at that person’s own Twitter feed.”

“You alone don’t control your privacy on social media platforms,” University of Vermont professor Jim Bagrow said in a statement. “Your friends have a say too.” And even when you delete your social media accounts, if your friends are still there, tech giants are able to build profiles on you. This is already a concern that privacy advocates have about Facebook, called “shadow profiles.”

Now, there is a mathematical upper limit on how much predictive information a social network can hold. They can’t know everything about you, but they can know some things.

So why is this information important? Businesses who want to sell you things or government agencies who want information about you can use this information to their benefit. Companies or agencies may not be able to find out your darkest secrets, but they can figure out things like your political or religious affiliation and products you might be interested in. The same things platforms like Facebook and Twitter know (and sell) about their users.

The researchers went on to acknowledge that their research “raises profound questions about the fundamental nature of privacy—and how, in a highly networked society, a person’s choices and identity are embedded in that network.”

“There’s no place to hide in a social network,” said
co-author Lewis Mitchell.

Professor James Bagrow, also an author of the paper, confirmed: You alone don’t control your privacy on social media platforms. Your friends have a say too.

In April, Facebook CEO Mark Zuckerberg told lawmakers that the social network collected data on nonusers for “security purposes.” That includes people’s contact list when they use Facebook’s mobile app, which the company uses to suggest friend recommendations, it explained.

In response to the study, a Facebook spokeswoman said the company doesn’t build profiles on nonusers, even if it’s collecting data on them. “If you aren’t a Facebook user, we can’t identify you based on this information, or use it to learn who you are,” the company said in a statement.

The study shows there’s only so much you can control in terms of your own privacy and security online. As careful as you are online, the study suggests that you’re only as private as your friends have been.