EMERGING TRENDS AND ISSUES ADVANCED ONLINE INVESTIGATIONS Due diligence in fraud investigations requires intense concentration, intelligence, and the right tools. This interactive session will identify and demonstrate free online resources that break through traditional search roadblocks. You will discover how to locate personal information about any person or company. Popular social networking tools such as Facebook Live, Instagram, and Twitter are covered, and the presentation goes much deeper into the vast resources available for researching personal information. CYNTHIA HETHERINGTON, CFE President Hetherington Group Cynthia Hetherington has more than 20 years of experience in research, investigations, and corporate intelligence. She is the founder of Hetherington Group, a consulting, publishing, and training firm focusing on intelligence, security, and investigations. She was the leader of Aon Consulting s Corporate Strategic Intelligence group. Hetherington was also named the 2012 James Baker Speaker of the Year for the Association of Certified Fraud Examiners. Hetherington applies her expertise in library science and information systems to provide clients with strategic insight into research and complex investigations. During her career, she has assisted a vast number of clients with Internet investigations related to employee theft and intellectual property loss. Hetherington has also applied her research skills while conducting online and database research to uncover well-hidden relations among fraudulent associates, their assets, and secrets. She has experience overseeing international investigations for Fortune 500 companies and other organizations in the Middle East, Europe, and Asia. A widely published author, Hetherington authored The Guide to Online Due Diligence Investigations (2015), Manual to Online Public Records (2008), and Business Background Investigations (2007), published by Facts on Demand Press. She is the publisher of Data2know.com: Internet & Online Intelligence Newsletter and has co-authored articles on steganography, computer forensics, Internet investigations, and other security-focused monographs. She is also recognized for providing corporate security officials, military intelligence units, and federal, state, and local agencies with training on online intelligence practices. Association of Certified Fraud Examiners, Certified Fraud Examiner, CFE, ACFE, and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of this paper may not be transmitted, republished, modified, reproduced, distributed, copied, or sold without the prior consent of the author. 2017
Contrary to today s identity theft-aware environment and the privacy advocates arguing for tighter controls of personal information, our subjects are out there sharing even more than identifiers and addresses with the entire universe. Individuals, as we have seen through social networks, are living online. As investigators, it is to our benefit to take advantage of these self-exposing persons. The following people search engines should be used to locate your subject, and from there, locate their business activity, status updates, and photos; all in the goal to assess asset status, which is a valuable offering for all investigators. Google The fastest, easiest way to find a social media profile is to Google it. Google s algorithm is based on most popular websites first, so Facebook, LinkedIn, Twitter, and Instagram rise to the Top Ten list. Search by name, then look at the offerings, and see if you can find a username (i.e., Twitter @account). Be sure to search properly. For example, the name Adam Barber would be Adam Barber with the quotes. If too many Adam Barbers appear, add Adam Barber and the town you know he connects with, such as a hometown, or the town he grew up in. The search would look like Adam Barber Morristown. Still too many. Add the asterisk to narrow down to the same paragraph: Adam Barber * Morristown. Pipl Considered the best search engine for users social network accounts, Pipl.com has been the go-to source for investigators for several years. It can be searched by full name, nickname, email address, and even phone number. Though Pipl does not find every last social network site and 2017 1
location, its coverage is very thorough. Look through each match, as if you were scanning Google results, because Pipl does not cluster the matches cohesively enough to say one match to Adam Barber captures all the matches. In fact, the best use of Pipl is to search Google for your subject first to develop their username and then search Pipl with that username, producing fast and accurate results. Yasni Yasni was developed in Germany, and is great for international profile searches, yet still tags great content in the United States as well. Yasni breaks down their results by the type of media, such as social networks, news stories, negative media, Web matches, and property. A colleague wrote recently that Yasni produced a link to the USPTO.gov site and his subject s registered patent. This patent is a considerable asset, worth a great amount that went unreported on the subject s divorce decree of known assets. Yasni can be searched by full name, nickname, email address, and even phone number. Also, check Yatedo.com for older LinkedIn profiles. Namechk To see the treasure of social media beyond what you might even consider existed, go to Namechk and search by nickname. Namechk is excellent for tracking down other social network accounts. Only searchable by nickname, any matches to your search will appear as grayed-out icons on the screen, meaning your subject might be the person behind the account. Try hetheringtongrp, for an example. You will learn more about them by their social media joins. In addition to Facebook and Instagram accounts, you could come across matches to automobile social media sites, car reconstruction, drag racing, and other vehicle-specific sites for your subject. This might open your investigation to 2017 2
include car registrations, vehicle ownership, and the buying and selling of high-value automobiles. There is no real predictability with social media behavior and how it manifests in the person who owns the account. However, the leads Namechk can discover for an investigator to follow assets, habits, and hobbies are incredible. Facebook Facebook searching is unique in that it focuses on its graph dynamic to locate information. Once you get used to this, it s amazing and very productive. Start by searching the name of your subject. The initial results will be a tabbed list (at the top) with Popular showing up first. Choose the People tab to quickly see if your contact is there. If so, go to the page and start gathering by clicking on everything you see and capturing the content. The second style of search is utilizing the Graph Feature directly, which is not complicated, but takes a few tries to see how it works best. Search by name, then specific time. Hence, if I want to find Adam Barber s postings, friends, and photos, I will add these separately to my search in this fashion: Adam Barber friends Adam Barber posts Adam Barber pictures You can use graph searching to help narrow it down by being specific such as: People named Adam Barber living in Morristown Facebook has been altering its search capability quietly, improving it for the past year. No longer is a profile unsearchable. If the subject has a profile, you will find it. The amount of content they permit you to see is based on 2017 3
their security settings, which change so often you can t possibly keep a completely anonymous, but social, Facebook account. LinkedIn LinkedIn.com is the professional social network, targeting adults who want to share and network their business experience. An amazing amount of information is posted on LinkedIn pages about job changes, education, and volunteer experience. The obvious data that jumps out includes the name, location, and work position. Also, discoverable items may include one s education, past employment, affiliations to associations, particular networking groups, and any posted recommendations. Asset searching in this environment is similar to Facebook in that you search, locate, and document your findings. Any mention of promotions, moves, or additional activity is all a potential lead to increase in salary and status. Or it could be an indication of downsizing lifestyle, such as partial retirement or taking on more volunteer work. Twitter and Live Broadcasting Currently, Livestreaming is not searchable by content. However, the usernames on sites like Meerkat, Periscope, and V are usually the same as the ones subjects use on their Twitter and Instagram accounts. Hence, find the Twitter or Instagram account, and you ll find their Live Broadcast. Find the Twitter account via Google or Pipl, and you will also have the Instagram account. Searching Twitter handles to locate mention of assets, large spending ( I just bought my tenth Coach bag! ), or similar can be done in Tweettunnel.com. Visit the site, put the username in the search box of Old Twt, and view the last 3,200 tweets they 2017 4
wrote. Or scan the Twitter account directly, but continually refresh your screen on Twitter by scrolling down. If Instagram is searched outside of Instagram, then go with Websta.me. Websta.me Log onto Websta.me site with your own Instagram account sign-in, and begin searching by username, hashtag, or keyword. Search other usernames you already developed, and you will get the user s profile on Instagram. From here, scan for photos of expensive parties, home renovations, shopping sprees, and other indicators of assets being used or moved. The uses of this work come into play for all case types; it is a matter of going to these services, gathering, and cataloging the information you find and applying analytics and some creative thinking. 2017 5