Showing posts with label Network Mapping. Show all posts
Showing posts with label Network Mapping. Show all posts

Thursday, December 12, 2013

Issues Investigating Savvy Social Media Users

As we discussed last week, some social media users strive to gain greater privacy with their communications online. While some users have been protecting their online communications for some time, there is currently a shift to a more private online existence happening in some demographic groups, mainly with teens and young adults. This can be seen in trends throughout Internet-based activity, whether it is a switch to private browsing using Tor, the increasing usage of mobile messaging applications, or backlashes against violations of privacy laws. These savvy social media users can prove to be a challenge for online researchers and analysts. By using privacy-centric platforms, privacy settings, and fake or obscured identities, users can problematize online research of their identities and patterns of behavior.

Privacy-centric Platforms

In many cases, it can be almost impossible to locate a subject’s information due to the sheer nature of the platform itself. Many mobile applications do not have a corresponding website, browser accessible profiles, or search-indexed content. Additionally, many of these apps do not push content to other social media platforms, which restricts outside access to hidden content. These apps often require users to be connected in order to access information. For analysts, this would require us to use the application and request a connection to the person of interest. As many investigations are done without the knowledge of the subject, this can be highly problematic and may cause the user to delete their information. When these situations arise, the most complete information can only be obtained by accessing the device itself or through the use of surreptitious techniques, such as shadow accounts and device cloning.

Privacy Settings

A major hurdle for all investigators is privacy settings. While each social media site is different, in many cases, users can leverage four types of settings to make locating their social media profiles and content more difficult. First, whether by design of the social media platforms themselves or user settings, many social media profiles are removed from search indexes. This makes broad searches more difficult to execute and requires investigators to dig deeper into each individual social media site. Second, some social media sites allow users to remove themselves from the internal search feature and from friend/connection lists unless the person searching for them is connected to them. This means you either need to establish a connection with the individual or find a static link on another location or social media site. Additionally, users can restrict access to their profiles as a whole and the content contained on it. Finally, users can also restrict how unconnected users see their content posted throughout the rest of the social media site. All of these privacy settings can increase the manual work necessary to locate relevant profiles and content.

Obscured and Fake Identities

To hide their online activities, a user may opt to either obscure their real identity or create a fake persona. Obscured identities can take many forms. Users can employ false names, nicknames, unique usernames, or misleading profile information to hide their true identity. They can also choose not to link social media profiles together and use photos which conceal their faces and are not used on any other site. Users can also opt to use fake personas online. By using a fake identity, many users can break the connection from their real identities. In addition to some of the methods used to obscure their identities, many of these users will create completely new identities that are disconnected from their real social networks. Often, they will also use a variety of other means (i.e. VPNs, proxies) to conceal their actual physical location and network connection to prevent doxing.

Making the Information Work for You

It is important to always understand the limitations of social media data and the challenges you will face during open source research. Every social media site and application has its own limitations either through design or the use of privacy settings by savvy social media users. Before you dive into your online investigations, it is important to learn as much as possible about your subject and take note of the issues you might face along the way. Each piece of data will help you find potential obscured or fake identities and better assess the corners of the Internet to explore to find your person of interest.

Wednesday, September 4, 2013

Social Media Platforms 101: LinkedIn

One of the first things people ask during PRISM training sessions is “how does that social media site help me accomplish [my goal]?” Often, we spend more time during our training sessions covering the usefulness of social media sites rather than talking about how to use the tool itself. We decided it was time to launch a little series called Social Media Platforms 101. It is designed to help our readers understand the basic construct of the platform itself, the information you can gather from different social media platforms, and how that information can be used.

As we’ve been focusing on employment issues recently, we thought it was pertinent to begin with LinkedIn.

What is LinkedIn?

LinkedIn is a professional networking site. It allows users to create profiles that showcase their current and past work experience, educational background, and skills that they may have. Users can also connect with individuals and join groups based upon their industries, interests, and affiliations. This allows LinkedIn members to network with one another to find new business and job opportunities. Currently, the main users of LinkedIn are professionals looking for new job opportunities, employers and recruiters looking to hire new talent, and managers and executives searching for new business ventures and partners.

One important thing to note about LinkedIn is that privacy settings can be very stringent. While many people leave their profiles open to attract more traffic, it can be difficult to glean information from a profile without being connected to the individual. However, you can still often access information by being connected to a user who is connected to the individual of interest.

What Can You Learn From LinkedIn?

In order to demonstrate how you can pull information off of LinkedIn, our Legal Counsel, Blake Haase, volunteered his LinkedIn profile.

 

When you look at Mr. Haase’s page, you can see a brief overview of his work experience and the number of connections he has made on LinkedIn. If you scroll down a little further you will notice he has listed out some of his job duties and a few projects he has worked on during his professional career. In addition, you will find information about the degrees he earned, his listed skills, and the groups he belongs to. Cumulatively, this page paints a basic profile of Mr. Haase’s job experience and qualifications.



In addition, if you are logged in to an account and are connected to the individual, you can access a connection chart that will show your commonalities with the person of interest.
 
How Can You Use Information Found on LinkedIn?
 
The major use of LinkedIn is obviously employment related. Whether you are an employer vetting out applicants or a firm conducting background checks on behalf of another organization, LinkedIn’s strongest usage is in constructing educational and professional profiles. This information can be used to corroborate or find inconsistencies in information provided by prospective employees on resumes and applications, and it can provide additional information about the individual’s past history that was omitted from their resume. However, it can also be used for basic investigative purposes: constructing timelines, building connections, learning interests and skills, and gaining more general insight into your person of interest.
 
Conclusion
 
Not all social media sites are created equally. Each one has its own unique set of data and serves a different set of purposes. As technology evolves, the usage of and the information found on each site will evolve along with it. It is up to us as investigators and analysts to keep abreast of these trends and provide the best services possible.

Wednesday, July 3, 2013

Case Study: Protesting the G8

The 39th Annual G8 Summit was held on June 17-18, 2013 at the Lough Erne Golf Resort in Enniskillen, Northern Ireland. Traditionally, the G8 Summit attracts protests and civil disobedience. As it was in Northern Ireland this year, we expected increased activity leading up to the Summit. In order to test our event monitoring analytics, we decided to monitor social media chatter about the G8 Summit beginning three weeks before the event and lasting throughout the end of the Summit to detect any acts of civil disobedience that may occur. For the purpose of simplicity, we will focus on a group of events that occurred on June 11, 2013.


Identifying Protest Organizers and Locations


One of the first sources of information we identified was an anti-G8 group calling themselves StopG8. Their website was a rich source of information about protests scheduled for the week leading up to the Summit. StopG8 listed key events and maintained a complete calendar of activities. One of the most important items found on the website was a map of protests aimed at the West End of London on June 11, 2013, complete with a manifesto against financial greed and corruption. This event was commonly referred to as the Carnival Against Capitalism and was tagged as #J11 on social media. The map of these demonstrations became one of the most widespread images leading up to the G8 Summit. Using this information about #J11 and associated activities, we were able to identify individuals who were attending these protests.

Identifying and Monitoring Participants

Once we identified the organizing force behind the protests and the language associated with these events, we were able to construct a network of individuals interacting with one another on social media. Network mapping allowed us to begin tracking participants and monitoring their activities throughout the duration of the protests. Using social media posts from protesters and journalists, we were able to harvest raw data from the ground. A good source of raw footage and commentary throughout #J11 was journalist Jules Mattsson.




The raw source data from Mr. Mattsson provided real-time footage of the activity occurring at #J11. Using this data, we were able to see events as they unfolded and track the movements of participants as they moved throughout London. Our analysts were then equipped with emerging intelligence to analyze the changing landscape of #J11.

Identifying Changing Circumstances

Earlier in our research, we identified information about the Convergence Centre where people could stay during the protests. This location was meant to be a safe house for individuals participating in the events leading up to the G8 Summit. However, it was raided on #J11. 


After the raid, individuals needed to find new locations to stay at for the night. StopG8 provided new contact information for protesters to use to find new lodging accommodations.


Analysis of emerging social media data allowed our analysts to stay current on the rapidly unfolding circumstances surrounding #J11. After vetting information for authenticity, our team was equipped with the information necessary to provide real-time intelligence.

Conclusion

Although there was a mountain of big data to scale regarding activities related to the G8 Summit, it was readily available for analysis. Organizers and protesters routinely harness the power of social media to communicate with one another and expand their networks and sphere of influence. Social media has the power to identify pieces of raw data which identify locations, individuals, networks, and activities important to emerging events. It is up to us as analysts to identify these rich data sources and use them as part of our investigative and intelligence solutions.

About CES PRISM Blog

My photo
The CES PRISM blog is the place where CES shares the newest developments in social media sites and tools, data analytics, eDiscovery, investigations, and intelligence. We will also share workflow tips and tricks, case studies, and the developmental progress of our open source social media research and analysis tool, PRISM. Our goal is to open a dialogue with the community which allows all of us to learn together.