To an online investigator, social media is a goldmine. As companies such as Google, Meta and Microsoft encourage users to share more to grow and improve social media platforms, billions of people worldwide willingly accept and surrender their personal information. Highly revealing details are posted every minute on platforms such as Facebook, Twitter, Instagram, LinkedIn and TikTok as users seek to share with their friends and family. If a user shares frequently, within a few minutes an investigator can be provided with unparalleled insight into an individual’s life without using any intrusive methods – relying only on information that is willingly submitted.
Social media intelligence, or SOCMINT, is the information that an analyst collects and analyses from social media to aide an investigation. Most users of social media are adept at collecting information from someone’s profile to learn more about them, from noticing a new acquaintance has mutual friends with someone, to identifying a colleague who attended the same university. To everyday users of social media, this information is valuable to inform social interactions, while to an investigator it can be useful intelligence to build a subject’s profile.
SOCMINT can help create a thorough network analysis of an individual or group; gaining an understanding into their lifestyle habits, social circle and opinions. Social media accounts can also provide key bio data, such as date and place of birth, educational background and career history. LinkedIn is a great example of this, which can often corroborate a person’s location and whole career and educational history by details willingly submitted by the individual themselves – an easy start point for an investigator.
Pictures and videos are great visuals for people to show their friends and family what they are up to, where they have travelled and what restaurant they love. However, to an online investigator, these images and videos can be captured and analysed to identify a person’s current location, a place they frequent or a restaurant they regularly visit. These crucial bits of data can provide analysts, or adversaries, an important insight into habits, routines and locations of not only the subject, but their family and social circle. Geo-tagging images is often used by people when uploading images or stories to their profile which provides real time intelligence – placing them at a specific location and allows analysts to bypass certain technical tools to identify the town, city or country the picture or video was taken.
The challenges of SOCMINT
The proliferation of the internet has caused the quantity and availability of open-source data to skyrocket, making collection an often considerable task. If a subject has the same name as thousands of other users, an investigator faces the challenge of painfully sifting through irrelevant profiles, or if the user is a prolific poster, the investigator is faced with copious amounts of data to triage in order to identify any relevant information.
Amidst the billions of social media accounts across the globe many are alias accounts which individuals can create to prevent investigators from finding them. This can range from people using their middle name or nickname, initials or maiden name, or creating a whole new identity. On these profiles there is often minimal information, with no corroborating data such as date or place of birth, educational institution or nationality. Some go as far as putting false information to further obfuscate positive identification.
Whilst it is a positive development that social media platforms such as Meta and Twitter are becoming increasingly aware about the importance of a user’s privacy and security, the subsequent increase in obfuscated data is (although not the be all and end all) a challenge for investigators to verify and corroborate intelligence collected. The constant creation of new social media platforms also means that investigators have to continue learning new ways to retrieve information relevant to the investigation and keep up-to-date with new, upcoming apps.
But while OSINT investigative tools have developed to help researchers tackle this challenge, what does an investigator do if there is no data publicly available online about an individual? Read part II to gain an insight into some of the mechanisms analysts and investigators can use to identify information on social media.