Developing PRISM: V2 is Here

For the past few weeks, the PRISM team has been diligently working to test the new version of PRISM. We are proud to announce that, after months of development, we have finally released PRISM V2. As we discussed in an earlier post, Version 1 was originally developed for internal users. In order to test our features and gain valuable feedback from external users, we launched a Pilot Program with select law enforcement agencies across the US. They found bugs, identified workflow issues, gave valuable critiques, and made feature wish lists, which allowed us to greatly approve upon PRISM in V2. Here are some of the big changes to the tool.

Faster Workflow

As analysts and investigators, we need to be able to more efficiently work throughout a project. Previously, it was cumbersome to search for usernames, scrape data, and build out user profiles. Our analysts and Pilot Program users identified ways to expedite these processes. PRISM now has additional buttons to add profiles, add usernames, edit projects, and upload documents directly from the workbench. This allows users to spend less time clicking between areas of the tool and more time reviewing content.

Improved Exporting & Authentication

Before, PRISM only exported data into Microsoft Word formatted Rich Text (.rtf), Microsoft Excel XML format spreadsheet (.xlsx), and Comma-separated Value Plain Text (.csv) formats. As many of our users have additional needs, we expanded this selection to include Microsoft Access database (.accdb) and Adobe Portable Document Format (.pdf) files. All of these files include the MD5 hash values associated with each individual result for authentication purposes.

In addition, users can now download individual search results and native files to their computer in .pdf and Flash Video (.flv) formats. When these files are downloaded, a record of each download is created in an uneditable system log. This log can then be exported into .pdf format and will include information such as the hash value for the content downloaded and which specific result it came from. We added this feature to assist law enforcement agencies with evidence gathering and authentication.

Topic Monitoring

Previously, PRISM was designed as a case management system for individual profiles and groups of individuals. Over the course of testing, we discovered that both our analysts and Pilot Program users desired the ability to search in real-time across social media sites to find information about topics pertinent to their projects. In response, we built a topic monitor. Users now have the ability to search real-time content originating from Facebook, Google Plus, Instagram, Reddit, Twitter, and YouTube. All of these results can be highlighted to showcase important words, filtered down by word exclusion, and saved both within PRISM and locally on the user’s device.

Subscribing to PRISM

Now that PRISM V2 is released, subscriptions are available to all organizations. To learn more about PRISM or to get a demonstration, contact Blake Haase at blake.haase@cesnb.com.

Building a Better Tool Chest: Browser Apps & Extensions

As an organization aiming to use the best tools possible, many of our analysts rely on the power of Google Chrome. Chrome is developer friendly and has a wide variety of free apps and extensions available for use in the Chrome Web Store, which allows us to increase performance even on the browser level. In order to increase efficiency, we rely heavily on tools to block ads, quickly screen images, and capture screenshots. Here are three tools that can help increase the performance of your workflow during online investigations.

Adblock Plus

A screenshot of a Google search with ads blocked via Adblock Plus

One of the major things we have to worry about in the Internet advertising era is the browser slowdown that occurs from ads. Adblock Plus is one of the best adblockers out there. It blocks ads on sites such as Google, Facebook, and YouTube. Instead of wasting time sitting through videos and waiting for pages to load, you can quickly and easily navigate the Internet using Adblock. It is important to note that in order to block all ads, you have to set your options in Adblock Plus by unchecking the box for “Allow some non-intrusive advertising.” (Not a Chrome user? Adblock Plus is available for a variety of browsers.)

Hover Zoom

A screenshot of a Google Image search while using Hover Zoom

Hover Zoom is one of our favorites because of its ability to save time. Traditionally, whenever photos appear on websites, you have to click into them to see a larger version of the photo. Hover Zoom skips this step in the workflow process. Once you hover over the photo with your cursor, a larger view of the image will appear. This tool is perfect for going through large batches of images on photo and social media sites. (Currently, Hover Zoom is only available for Google Chrome.)

Lightshot

  

A screenshot of PRISM being captured by Lightshot

We used to be ardent Awesome Screenshot users, but lately it has only worked sporadically. Recently, we discovered Lightshot as a viable alternative. Lightshot is user friendly and has great features built in for photo editing and exporting, as well as searching for similar images on Google. So far, it is proving to be the best alternative to our old standby. (Lightshot is available for a variety of operating systems and browsers.)

Conclusion

This list is in no way inclusive of all of the tools that can save you time during online research. In the past, we wrote about the Chrome extension Image Tools and its ability to assist with image searching and examining exif data. There are a variety of other extensions for Chrome that can assist you with first-language translation, secure browsing, cache clearing, rss reading, and more. Add-ons are not exclusive to Chrome. You can often find similar tools on Firefox and Internet Explorer. No matter which browser you use, you can help ensure you are working efficiently just by building out a better browser.

Tips & Tricks: Three Simple Ways to Keep Up With Social Media Trends

A few weeks ago, we wrote about maximizing your training experience. Part of that discussion covered the need for individuals to look for free sources of information. When you are looking to expand or narrow the scope of your open source Internet-based intelligence and investigations solutions, there are three main open sources you can use to help you make those decisions: social media content, blogs and news sources, and research.

Social Media Content

As social media content has become an integral part of online research, it becomes increasingly important to stay abreast of social media trends. One quick way to identify new sources of information is to look in content feeds. Many social media sites and applications connect with one another to push and pull data. As an example, we can use a Twitter feed. On Twitter, many people push Facebook, Foursquare, Instagram, Tumblr, and Vine posts into their Twitter feeds. By watching these sources of information, you can easily identify new social media sites to incorporate into your investigations.

Blogs and News Sources

Often, blog and news-based content are some of the first places to see emerging trends in social media use. The best way to organize the influx of data is to be selective about the sources you use and to use an RSS reader like Feedly. Feedly allows users to subscribe to any written source with an RSS feed and to organize these sources into categories. When building out your reader, adding investigation, intelligence, and technology sources are greatly beneficial to keeping abreast of emerging trends. This information will not only help you identify new sources of information, it will also help you understand which types of individuals are using the technology and how they are using it.

Research

Similar to blogs and news sites, many research entities discuss the changes in the social media landscape. A major issue is that most research is scholarly in nature and costs money to access. However, there are two free research sources that provide excellent data: Pew Research Center and Nielsen. Both organizations study changes in technology usage and social media trends and release reports on a routine basis. You can even add their RSS feeds to your RSS reader. By keeping up with their findings, you can stay on pace with changes in society at large.

In the dynamic social media environment, investigators and analysts cannot afford to fall behind. By using these three sources, you can easily cultivate basic knowledge of the changing social media landscape. This allows you to update your practices, improve research and analysis, and add value for clients.

Building Your Tool Chest: Facebook's Graph Search

Building Your Tool Chest is a series devoted to the review and analysis of tools that assist with social media and open source research and analytics. 

For the past few months, a few of us at CES have been beta testing Facebook’s Graph Search feature. On July 8, 2013, Facebook announced the feature will soon be available to all Facebook users who have selected US English as their language. In order to prepare for the new search features, it is important to understand that Graph Search works quite differently than the current Facebook search feature.

Flexible Queries

Graph Search allows users to create flexible, complex queries for information. Instead of the current system in which users have to search for a term and then sort the data, users can now string together the relevant pieces of information to narrow search results. For instance, if you wanted to locate a jewelry store in Saint Augustine, Florida, you would simply type “Jewelry Stores in Saint Augustine, Florida.” The returned results only include jewelry stores which are located in Saint Augustine. The ease of using Graph Search allows us researchers to perform queries at a faster rate because we no longer have to take the extra step to run filters, and we can make more complicated searches than ever before. (See the Facebook Graph Search Cheat Sheet below.) However, not all search terms are easy to work with, and search results can be misleading.

Data Issues

Just because Graph Search says it returned all relevant search results, it does not necessarily mean all relevant results were accessible and/or properly categorized. There are a few major issues with search results in Facebook. First and foremost, users can choose to opt out of search results; this would exclude these users from the results even if they meet the criteria. Second, many users have privacy settings that prevent the system from returning their information in search results. Third, Facebook users do not necessarily complete their profile nor input their data in a uniform way. For instance, one person our St. Augustine office technically lived in New York, New York, but she identified her location on Facebook as her neighborhood, Harlem, New York, which would excluded her from New York, New York results. Finally, not all data fields or types of information are currently searchable, including posts. If the data you are searching for is embedded in posts, you will miss that information in your search.

Conclusion

Facebook’s Graph Search is a great tool. In the office, many of us used to complain about the difficulty we had searching for information inside of Facebook. Aside from the missing post search feature, the site has become much easier to use for locating information. Although Graph Search has some issues and requires users to learn the language before they can effectively search the system, it is ultimately a step forward for searching inside of Facebook.

In order to help you use Graph Search, we created a quick Graph Search Cheat Sheet.

Building Your Tool Chest: Image Tools

Building Your Tool Chest is a series devoted to the review and analysis of tools that assist with social media and open source research and analytics. 

The world of social media and online content is becoming increasingly visual. Photos and videos are becoming the primary vehicle used by many to communicate their thoughts and ideas with others. Gone are the walls of text once prevalent in the era of Geocities. Today, online content generally focuses on conveying messages with little text in a manner designed to impact users in a big way.

This trend is exemplified by Facebook’s recent announcement it was transitioning to a more visual news feed. The change was reportedly prompted by the growing popularity of other social media sites such as Instagram, Pinterest, and Tumblr. Additionally, Google recently added a carousel design to its search returns which show photos related to search terms. These changes to a more visual culture has made the analysis of images during social media research much more important.

Analysts must be able to draw conclusions from the content of the photos themselves. More importantly, analysts must equip their toolkit with applications that visualize the metadata behind photos and give users the ability to search for images across the Internet. There are a variety of individual services that perform these functions such as TinEye and metapicz. However, there is a Google Chrome application which combines a variety of these image analysis tools into a single, simple interface: Image Tools.

Image Tools combines applications that extract exchangeable image file format (exif) data and provide reverse image search services together in a single right-click interface. With this application, analysts can gain insight into the data behind photos and determine if they are used elsewhere. The two main features of the tool are exif viewers and reverse image searches.

Exif Viewers

Exif data is a structured data set embedded into most digital images by the device that captured it. Certain tools can extract latent information from images for further analysis. To detail this concept, we will examine the exif data behind our Project Manager’s stylish sunglasses:

 Using Jeffrey’s Exif Viewer, you can visualize an abundance of information. You now know the photo was taken on an iPhone 3G running out of date software on June 19, 2013 at 12:56PM at a specific location. This information is vital when building timelines and placing people at certain locations. The exif tools featured in Image Tools also allow users to see a map of the area where the photo was taken. These latent details give analysts greater insight into the subject of their investigation.

 However, there are limits exif data. This data is best extracted from images downloaded from the Internet and email attachments. When an image has been uploaded to a site like Facebook or Imgur, the rich exif metadata is generally removed from the photo. Ultimately, the ability to extract this data depends on the website hosting the image and whether users or the site have scrubbed the metadata from the photo.

Reverse Image Searches

Reverse image searches are valuable when you are attempting to identify online accounts maintained by a single individual or the original source of an image. The toolset available in Image Tools allows you to right click on an image and search for sites where that image was used before. This saves a great deal of effort when trying to build out an individual’s online footprint.

To show how this works, we will use a reverse image search to identify accounts belonging to a member of the Syrian Electronic Army. Once you identify one account maintained by the person of interest, you can right click on their profile image and perform a reverse image search. The search for the image below returned thirteen results.

From the results, you can to identify YouTube and LinkedIn accounts. Image Tools gives you a jump-start on building out this individual’s digital footprint by helping you identify additional accounts within minutes. From there, you can continue to build out this individual’s network based upon the other data found on these profiles.

Without facial recognition capabilities, the average profile photo does not fare so well in a reverse image search. This method works best when the individual’s avatar is somewhat unique. However, you should always run a reverse image search because there may be relevant results. Using these searches can be valuable time savers when trying to identify where avatars may have been used elsewhere.

Conclusion

The two sets of features detailed above show how analysts can exploit the growing image-centric nature of online content when conducting their research. Image Tools is a great all-in-one app for viewing exif data and searching through disparate data sources to locate images. Every analyst’s toolkit should have a similar tool to investigate the data behind digital images. Thanks to exif data and reverse image searches, you can go beyond what it is in a photo by examining what is behind it as well.

Building Your Tool Chest: The New Google Maps

Building Your Tool Chest is a series devoted to the review and analysis of tools that assist with social media and open source research and analytics. 

In May, Google revealed the new Google Maps interface. Currently, it is in its testing phase, and no firm release data has been set. A few of us in our St. Augustine office started using it and instantly noticed graphical improvements to the system. There are some fantastic new visualization features, including tilt view and additional photo streams. However, some ease of use issues may make this version more cumbersome for research. We used Flagler College as a comparison point for differences between the new and current Google Maps.

Viewing Locations is a Snap

Now that the giant sidebar is gone, it’s simply easier to view the map. The integration of the photo carousel allows you to quickly view the physical appearance of the location of interest. The compass and tilt view are great for changing the perspective of the map to fit your needs. The tilted and rotated screenshot above features Flagler College in the lower-center of the map while looking east towards Anastasia Island and the Atlantic Ocean. Although the 3D graphics do not always properly render, it can give you a good perspective if you’re trying to learn the lay of the land.

Getting Location Data is More Difficult

 

In the current version of Google Maps, a static bubble pops out of the pin when you click on a location of interest. It has a clearly defined place to click for “more info,” which takes you to the location’s Google Plus page. However, in the new Google Maps, it is not that simple. The information appears in the upper left hand corner of the page in a collapsing drop down. In order to see this information, you have to keep your cursor over it. In addition, the clearly defined “more info” link is missing; instead, the user must click on the reviews to be taken to Google Plus.

Location Mapping in Earth View is a Bit Wonky

As recently mentioned in Slate, Google’s idea to plot locations on maps based upon users’ preferences and history could prove to be problematic, especially for researchers. Personalized data can exclude items which may not seem relevant to our personal interests even though we may need a complete data set for area mapping and analytics.

In map view, both the new and current Google Maps show comparable sized data sets and matching data points. However, when we move into Earth view in the new version and satellite view in the current version, we begin to see differences in data. The current satellite view provides more data points on the map, while the new Earth view shows only selective locations. It is hard to tell if this is a symptom of personalized data or a glitch in Earth view.

Conclusion

Without knowing all of the changes Google will make to the new maps system before it is released, it is hard to know how many of these functionality issues may impact our work in the future. Additionally, it is difficult to predict future changes in Google Maps based upon changes in the business environment, as social companies are constantly outmaneuvering one another through acquisition and development. Google’s recent acquisition of Waze could further impact direction and travel features added to new Google Maps, which is why we did not include those features in our discussion. Between the acquisition and feedback being provided to Google during the testing phase, we could see many changes to new Google Maps before it is finalized.

Although we will not know the full impact of the changes to Google Maps until it is released, accessing tools during the testing phase keeps us ahead of the curve by anticipating how changes in technology may impact our future research practices. By providing feedback during the preview process, it allows us to shape the development of these tools for easier and expanded use by analysts. If you’re interested in testing out the new Google Maps, click here for an invite and more information about the tool.