Over the past few months there have been a number of publicised changes to the availability of open source intelligence including Facebook logic amendments and other social media platform search toolswhich have been adapting their visibility.
Researchers and OSINT (Open Source Intelligence) handlers have also faced the closure of free services such as the well-respected Mike Bazzells’ Intel Techniques Search Tools pages. This is due to DDOS (Distributed Denial of Service) attacks and misuse, which in turn has limited tools that are reliant on similar URL searches.
Leading members of the OSINT community recently met in Holland. Under the guidance of Henk Van Ess, a consultant and author of books on data journalism and web search, they discussed the need to adapt and develop new tools and methodology to search open source content, demonstrating that the human element remains an important key aspect of investigations.
More than ever the changes demonstrate the necessity for the researcher to adapt and utilise the most important and effective tools we have in our anti-fraud armoury. Personal knowledge, instinct and experience to locate and then capture visible content in all formats, from written to visual imagery and video content to assist in repudiating fraudulent claims is paramount in any investigation.
Finding & tracking unusual usernames used by a subject on social media platforms, coupled with thorough examination of interactions between individuals and the content of images, can help provide valuable evidence. There remains huge volumes of assistive intelligence available on the internet, it is just that now more than before, it is having the skill, time and patience to find this detail.
Whilst AI and machine learning are in many cases of some benefit in uncovering patterns; insights and predictions, the volume of data needed to find these trends can offer logistical and compliance issues. An individual researcher is able to be more selective in their search parameters and validate the sourced data to an individual or company.
Recently, as part of one of our investigations, we identified information to contradict a substantive loss claim made by a claimant solely from reviews which have been placed on travel sites. We were also able to source valuable witnesses after an event from examining local social gossip sites and references made to the incident on these pages.
It is common for us to find contradictory evidence and images on posts by third parties. The posts often contain information within the images posted proving dates and locations, allowing our team to dispute claims made, and potentially confirm that certain pieces of evidence have been falsified in support of claims.
In the past, the “curtain twitcher” on the street was the person to speak to directly when you needed intelligence and local knowledge. Today however, in the modern age, keyword and directed area specific searches are used to deliver valuable results.
Intelligence is all about thinking outside the box; if a person has an accident on a bicycle, do they for example, ride in a local club or competitively? Even if they don’t post about their activities and achievements, others might do.
Just because you can’t find a social presence in a common name it doesn’t then mean a presence is not “out there”. In many cases this information can be found by expanding a search to encompass family, friends, work colleagues, former school friends and employees etc.
Often a fraudster will learn from experience and use a variant of their name or a nickname to avoid detection. Understanding this possibility and then finding and searching by possible variants is also an important part of the search process.
We are often asked where we start an investigation, what specific pages to look at and what to think of when you are searching for information.
The best answer to this is that there is no set start point or finish line! Every investigation is different and has to be tailored to the client requirements, having a set start and finish limits the lines of query and searches should always be tailored, dynamic and change as needed.
Intelligence is and will remain an adaptive and essential part of the counter fraud process in all its forms. It is imperative that the Analysts and Researchers, like the fraudsters, never stand still.