Writing

OSINT, aka know thy enemy.

By Brandon Eckert

From the archive: originally published in January 2017. The social-platform search examples describe features available at the time.

Illustration accompanying the OSINT article

OSINT stands for open source intelligence: intelligence gathered from publicly available information. Law enforcement, government agencies, attorneys, journalists, and security researchers use it to research individuals and organizations.

Before we get into an example, consider how much of our lives we share online. When something hurts, we search for it. When we want opinions, we post on social media. When the car acts up, we ask an automotive forum. Along the way, we share names, phone numbers, email addresses, locations, and interests.

As I mentioned in my passwords article, we are creatures of habit. We reuse handles across websites, giving researchers a way to connect otherwise separate profiles. Search engines, archives, and other crawlers can make those connections easier to find.

Following the connections

Here is a simple example using Facebook’s search features as they existed when I wrote this article. A full name, phone number, or email address was not always necessary to narrow a search. A first name, general location, and a few interests could be enough.

Suppose I know someone’s first name, that they live in Pittsburgh, and that they like beer and The Walking Dead. Searching the first name alone returns too many results. Combining it with the location and interests narrows the search to two matches in this example.

One profile lists a home address and an online handle. That gives me a full name, an address, and a lead to other profiles. Searching Instagram for the handle turns up another account. Searching Google for the name and handle reveals more websites associated with that identity.

With a full name and location, I find a possible phone number through another public source. Searching Facebook for that number returns the same profile, providing another point of corroboration.

In this historical example, searching public WHOIS records for the phone number also reveals a domain registration, an email address, and matching contact details. Each connection gives me something else to check; a matching name alone would not establish that two records belong to the same person.

What I started with:

  • First name
  • General location
  • Personal interests

What I found:

  • Full name
  • Address
  • Online handle
  • Instagram account and other social profiles
  • Other website profiles
  • Phone number
  • Email address
  • Where they work

The example uses information already available online. It does not require breaking into an account or persuading someone to disclose private information.

Other sources of OSINT

  • Image metadata. Photos may contain EXIF data such as location, camera model, and capture time. Editing software may also leave identifying metadata. What remains available depends on how the image was created, edited, and shared.
  • Google Maps. Public maps and imagery can add geographic context.
  • Search engines. More specific search queries can uncover material that broad searches miss.
  • Newspaper websites. Reporting and archives can connect people, places, and events.
  • State and city public records. Available records vary by jurisdiction.
  • Social media. Profiles, posts, and public interactions can provide additional leads.
  • Web archives and caches. Making a profile private later does not necessarily remove earlier public copies.

Automating the research

Following all of these leads manually takes time. When I wrote this post, I was building a framework called OSINTive to automate many of these tasks using APIs and code. Yes, it also included a sweet ’90s ASCII-art detective banner. The later OSINTive project article describes that work in more detail.

← All writing