Social Media Intelligence (SOCMINT) is considered to be a sub-discipline of Open Source Intelligence (OSINT). SOCMINT can be defined as the techniques, technologies, and tools that allow for the collection and analysis of information from social media platforms. SOCMINT can be harnessed by government or non-state actors, such as private intelligence agencies or marketing companies, in order to gain knowledge about specific individuals, groups, events, or any number of other targets.
While SOCMINT is generally considered to fall under the category of OSINT, there are some key differences worth noting.
In this article, we will walk you through everything you should know about social media intelligence and the best practices of conducting social media investigations.
SOCMINT vs. OSINT 🔗︎
SOCMINT is not as straightforward as OSINT because there is a belief, particularly by users and privacy advocates, that there is some expectation of privacy when using a social media platform. While OSINT investigators may not agree with this expectation, there is another aspect of SOCMINT worth considering.
OSINT investigations focus solely on information that is available publicly, but SOCMINT can also use information found on social media platforms that was intended only for a specific audience. For instance, the lines can be blurred if an investigator must join a private group or create a fake account in order to gain access to information provided by a person of interest. These situations make SOCMINT more difficult to navigate for those engaging in these investigations, and every effort should be made in order to comply with laws, regulations, and policies around intelligence gathering and investigations.
In these investigations, government investigators will likely go through the court system to gain warrants or permits to gain the information directly from the social media platform, but often, some SOCMINT techniques will have already been employed to gather the data used to support the issuing of those documents.
SOCMINT Concepts and Terms 🔗︎
There are many nuances in the field of SOCMINT, including the type of information that can be gathered and the type of platforms that can be used to gain information.
First, it is important to understand that SOCMINT includes all social media platforms, not only social networking sites. Social networking sites, like Facebook and LinkedIn, only make up one portion of the platforms that can be used to gather data. Information can be found on media-sharing sites like Instagram, forums like Reddit, image-sharing sites like Pinterest, video sharing sites like YouTube, microblogging platforms like Twitter, social gaming platforms like Xbox Live, and blogs created using platforms like WordPress.
Next, it is important to know the types of information that can be gathered from social media platforms. We can break this information down into three general categories:
Profile Information 🔗︎
Static information provided about a specific user that is observable by those who access the profile. On LinkedIn, for instance, this might include a user’s job title, current and former employers, skills, and contact information.
Interactions 🔗︎
Users on a social media platform can interact with the platform or other users in many ways. These forms of interaction include posting/commenting, replying to someone else’s content, posting pictures or videos, and liking or reacting to existing content.
Metadata 🔗︎
Information found on social media platforms is not limited to text and pictures. It can also include contextual information about said pieces of content. Metadata can include the location tagged in a post, the time that the post was made, or even the type of device used to take a picture.
Uses for SOCMINT 🔗︎
SOCMINT is commonly associated with investigations on a group or individual involved in criminal activity, but that isn’t the only scenario where it can be useful. Other types of investigations where SOCMINT could be employed include:
- Terrorism
- Organized Crime
- Human Trafficking
- Child Sexual Exploitation
- Disaster Prediction and Response
- Population Density
- Economic Analysis
- Health and Disease Monitoring
- Drug Use and Trends
- Cybercrime
While this is not an exhaustive list, it is meant to demonstrate that SOCMINT has many uses outside of those common to law enforcement. While state actors are prolific users of SOCMINT, private companies and organizations also use SOCMINT to collect information to better inform business decisions, improve marketing, ensure brand protection, and identify patterns and trends.
SOCMINT Challenges 🔗︎
Though there is a wealth of information available through social media platforms, that does not mean that the use of SOCMINT is easy or simple. There are several challenges that face investigators who employ it.
Number of Users 🔗︎
Social media platforms like Facebook and Twitter boast billions of users each month. With the sheer amount of data available, it can be difficult to find the information relevant to a particular investigation.
Identification of Users 🔗︎
Many platforms operate with the intention of keeping their users’ identities private, creating challenges for investigators. Additionally, the increased prevalence of fake accounts and bots on these platforms can make it extremely hard to figure out which data is accurate, available, and useful.
Compromising Trust 🔗︎
There have been an abundance of stories over the last few years about data leaks and user information being compromised, which can cause users to think twice before sharing information online. Additionally, as governments continue to employ SOCMINT techniques, they risk violating the privacy of their citizens, creating an unstable relationship between authorities and the people they serve and protect.
To summarize, Social Media Intelligence (SOCMINT) is a type of Open Source Intelligence (OSINT) that focuses on the collection and analysis of data from social media platforms. This information can be in the form of profile information, interactions with other users, or metadata that adds context to the shared content. SOCMINT is utilized by both government and non-state actors for a wide variety of investigations, but there are challenges that come along with these techniques and technologies. SOCMINT allows for the enhancement of investigations by using information that has been previously unavailable, but investigators must ensure that they are following laws, policies, regulations, and best practices to respect user privacy and human rights.
SixDegrees.com launched in 1997. It is often described as the first social media where users would have their real name, a list of friends, and personal information displayed on their profile. At its peak, it boasted more than 3.5 million users. Since then, other websites and apps have replaced it, and it’s estimated that billions of people use social media nowadays. This means that for any given investigation, it is likely that some data or clues can be harvested from social media.
What Can Be Found Using Social Media 🔗︎
What you can find on social media depends vastly on the individual or entity you’re looking into, and on the platform itself. Some, like LinkedIn have by design a userbase wanting to be found and desiring to use their profile to display their professional experience. Others, like Twitter, have profiles that may be less informative but may provide more context in the contents of the posts made by an account. While the information on LinkedIn tends to be more curated because it’s geared towards a professional environment, not everyone expects other people to pay attention to their tweets.
How To Find A Profile To Investigate 🔗︎
The first thing to do when investigating someone on social media is to find the account that belongs to that person. This can be done in a number of different ways, but we can identify at least 6 pivot points that will help us find social media accounts belonging to an individual:
Name 🔗︎
The name of a person is a good starting point as it will often return a Facebook, Myspace or LinkedIn account. However, it is also the first personal identifier people will avoid using or disclosing if they do not want to be found.
Email Addresses and Phone Numbers 🔗︎
These are great starting points because they’re usually only shared between accounts, and thus, individuals, that are somehow connected. So, if two accounts on different platforms share the same phone number or email address it means there is a link between them. The problem with these data points is that they usually aren’t easily searchable (Skype is a notable exception) and are not displayed on the profile of a person of interest.
Alias 🔗︎
The alias, also known as username or the pseudonym, is often reused across different social media platforms. The advantage of this data is that it is extremely easy to search: Any social media platform that has usernames allows you to search for users with a particular alias, as it is often a core concept of the platform—find people and befriend them.
The main issue with this is that aliases are only as good as they are unique: One can assume that two accounts on different platform sharing a rather specific username such as “LittleTroll15245” are likely to be operated by the same person. But even then, one would need to investigate further to corroborate the link. If the account has a more generic username like “BlueDragon”, finding an account on another platform belonging to the same individual solely based on the alias might prove difficult.
Profile Pictures 🔗︎
Profile pictures fall into the same kind of category as aliases, which means that with luck, doing a reverse image search from a picture found on a profile might just lead you to an account operated by the same person. However, it can also be that two different people thought that a determined image would look good on their profile.
Searching accounts with a picture as a departing point is also much more difficult because you have to rely on reverse image search engines, which is usually not a feature supported by social media platforms. The only advantage of profile pictures is that not everyone is aware that they can be used as a pivot point. Thus, they tend to reuse them more often than aliases.
Address and Biography 🔗︎
Addresses and biography might be the most difficult pivots to exploit. Seldom an individual will reveal their physical address on social media. Platforms that scrape online information such as Pipl are more likely to allow an investigator to pivot from that kind of information. On the other hand, biography should always be looked at carefully as some individuals link their social media accounts using their biography.
What Can Be Automated And What Do You Need To Verify 🔗︎
There are two types of information that can be found on social media:
- Information that the user wants to share
- Information that the user forgot to hide—for a lack of concern for their privacy or because they didn’t notice
For example, to establish a connection between two people: One could check if they are friends on Facebook, which falls into the first type of information. One could also check the photo they posted on their Instagram accounts and by looking at the people, the background, and the date of the posts, deduce that they both were at the same house party. This falls into the second type of information.
The main difference between the two, from our point of view, is that the first type of information can be automated and thus obtained pretty easily: Jump into ShadowDragon SocialNet and pull the list of friends of both profiles. The friends in common will appear before your eyes.
The second type of information, however, will often require an investigator to pay close attention to the sometimes extensive content displayed on a social media profile. There is not (yet) a one-click solution to this problem. This kind of information should not be pursued by default, as it is extremely time consuming.
Maltego and its SOCMINT data partners will usually focus on the first type of information.
Are You Investigating The Right Profile? 🔗︎
The first thing you should do when conducting a social media investigation is to make sure you have the right profile. There are some platforms where, using your real name, displaying information about yourself, and having an actual photo of your face as a profile picture is the norm (e.g., LinkedIn). In this scenario, it is pretty easy to identify the profile related to a person of interest by cross-referencing data we already have. This type of profile is the one you will obtain when starting your search from a name.
However, starting your search from an alias might yield other kinds of profiles where there is less information available for you to establish the difference between an account that coincidentally happens to have the same alias used by the person of interest, and an account that belongs to said person of interest.
To properly draw conclusions, you can first check information such as the location or the other social media they link in their bio (if any). If there is no such information, looking at their posts and account followings might help. Are they posting about a particular topic that you know is connected to your person of interest? Are they following an account tied to a particular location like a local police department or a small town mayor? To verify these things, you can pull the list of posts and followed accounts into your Maltego graph.
How To Access The Information On A Profile? 🔗︎
Maltego and its data partners will provide you with Transforms to pull most of the data available on a profile directly into your graph. This will save you a great deal of time as you won’t have to comb through the profile yourself which, depending on the platform, might require you to have an active account.
However, depending on the social media platform in question, the Transforms available in Maltego may not be able to retrieve all the information available on the platform. If you want to deep-dive into a profile, you ought to take a look at it in the social media platform itself, from an app or from a web browser.
It should be noted that an investigator should never use a personal account to collect information. An account reserved for research purposes should be created to do so. Websites such as this-person-does-not-exist.com can help you craft a dummy profile. Be aware that some platforms tell their user when someone has seen their profile, as in the case of LinkedIn.
In the Maltego Handbook for Social Media Investigations, we will show you 6 standard investigative workflows using Maltego and SOCMINT, pivoting from the following starting points:
Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!
Happy investigating!
1 Comment