Introduction to the Responsible Use of Social Media Monitoring and SOCMINT Tools
4 likes10,780 views
The document provides an overview of social media monitoring and SOCMINT tools, including definitions of the deep web, dark web, open source intelligence (OSINT), and social media intelligence (SOCMINT). It discusses the importance of metadata, operational security steps for investigations, and various useful tools for enhancing online investigations. Additionally, it emphasizes the need for organizations to establish protocols approved by legal counsel due to the evolving nature of social media and the potential legal implications of data access.
Introduction to the Responsible Use of Social Media Monitoring and SOCMINT Tools
- 1. Introduction to the Responsible Use of Social Media Monitoring and SOCMINT Tools December, 2018
- 3. Dark Web Refers specifically to a collection of websites that exist on an encrypted network and cannot be found by using traditional search engines or visited by using traditional browsers. Almost all sites on the so- called Dark Web hide their identity using the Tor encryption tool. Deep Web All of the web pages, or websites that have not been crawled by a search engine, are hidden behind paywalls or require a username and password to access. The opposite term is “surface web”. Dark Social A term used by marketers to describe website referrals that are difficult to track. Dark social traffic doesn't seem to have a specific source, which creates a challenge for companies that are trying to monitor website referrals and social media activity.
- 4. Open Source Intelligence (OSINT) Data collected from publicly available sources to be used in an intelligence context. In the intelligence community, the term "open" refers to overt, publicly available sources. Social Media Intelligence (SOCMINT) A subset of OSINT that gathers information exclusively from social media sites. It is typically analyzed from two layers – one, the original published content and two, the associated metadata.
- 5. Metadata • Metadata is data about data. It’s information that's used to describe the data that's contained in something like a web page, document, or file. A simple example of metadata for a document is author, file size, and the date created. • Metadata comes in several types and is used for a variety of broad purposes that can be roughly categorized as business, technical, or operational. • Descriptive metadata properties include title, subject, genre, author and creation date, for example. • Rights metadata might include copyright status, rights holder or license terms. • Technical metadata properties include file types, size, creation date and time, and type of compression. Technical metadata is often used for digital object management and interoperability. • Preservation metadata is used in navigation. Example preservation metadata properties include an item's place in a hierarchy or sequence. • Markup Languages include metadata used for navigation and interoperability. Properties might include heading, name, date, list, and paragraph. • It is used everywhere, by every industry, in multiple ways • Metadata availability on social media depends on each platform (e.g. hashtags on Twitter are a public form of metadata). Metadata referring to the time/location of a photo or video is usually stripped upon upload.
- 6. Investigations are being performed with public access to social data (SOCMINT) as opposed to private access (i.e. special access granted by a warrant). It is understood that what your organization can/cannot do as a government organization is very different from what is theoretically possible. It is understood that your organization should create a stand-alone protocol approved by proper legal counsel before using any of the tools in an official investigative capacity. It is understood that the state of social media is constantly moving - what is/isn't possible changes on a daily basis. Any provided information may soon be out of date and need to be regularly updated.
- 7. Situational Awareness Developing an overview of an unknown situation or event to focus future analysis Ongoing Monitoring Daily tracking of account activity and relevant keywords within a topic area Social Network Analysis Acquire an understanding of the social dynamics for large-scale data to tell you who and how users are relating Priority Information Requests Ask a pointed question to support an important decision Investigations Acquire additional information on a person or organization Engagement Analyze information around a communications goal or objective to provide engagement and content suggestions Performance Assess performance effectiveness and progress based on defined metrics measured against targets = focus of this session
- 8. 2.5quintillion (18 zeros) new data bytes produced daily 90% of the world’s data has been produced in the last two years alone Twitter still tends to be the most useful public data source for SOCMINT
- 10. Basic operational security steps during an investigation • Encrypt your connection • Ideally use a browser dedicated to investigations • Keep your operating system and browsers updated • Ensure that you are using incognito or stealth mode, especially if you are not using the TOR browser • Use anonymous search engines • Use a dedicated password keeper • Ensure your passwords are complex • Run a virus and spyware scanner frequently • Scan URLs you are unsure of • Track your steps during an investigation
- 11. Tool Categories 1.) Security 2.) Advanced Googling 3.) Verifying Legitimacy 4.) Social Search 5.) Network Visualization 6.) Other
- 12. 1 - SECURITY
- 13. 1Password.com Purpose: Provides a place for users to store various passwords,software licenses, and other sensitive information in a virtual vault that is locked with a PBKDF2- guarded master password. Alternatives: • Zoho Vault • Dashlane • LastPass • LogMeOnce • Password Boss
- 14. howsecureismypass word.net Purpose: A great way to see how easy it would be for someone to crack your password.
- 15. duckduck.go Purpose: Searching quickly without being tracked
- 16. TOR Browser Purpose: Useful when anonymity is of paramount importance. In the case of RoP it can be used to access a TOR compliant version of Facebook (facebookcorewwwi.onion)
- 17. Hunchly.com (Chrome Extension) Purpose: Runs in the background during your investigation to capture each page as you go.
- 19. goo.gl/4XfNU8 Purpose: Become faster at finding what you are looking for.
- 20. google.ca/advanced _search Purpose: For people that don’t have time to memorize search operators
- 21. google→search tools→date→custom range Purpose: To effectively search through historical Google data. Great for finding content that no longer appears in the top results.
- 23. tineye.com Purpose: To find all the places that a particular image appears online including the original source (even if it was modified)
- 24. exifdata.com Purpose: Viewing image metadata on the go
- 25. fotoforensics.com Purpose: To determine if there were any modifications to an image
- 26. emailsherlock.com pipl.com Purpose: To help determine the identity of the email owner through scanning other places the email has been used online. Also great for discovering fraudulent emails.
- 27. virustotal.com Purpose: Analyze suspicious files and URLs to detect types of malware, automatically share them with the security community.
- 28. snopes.com Purpose: To help prevent the spread of disinformation. Always use this before sharing a breaking story that is hard to believe.
- 30. inteltechniques.com Purpose: To search through FB,TW, LI and find people by name, job, location, age, gender, their friends, the groups they are members of etc. Also great for managing your own digital footprint. *Use findmyfbid.com to find an ID number
- 31. goo.gl/x4RPbK (Chrome Plugin) Purpose: To search through FB,TW, LI and find people by name, job, location, age, gender, their friends, the groups they are members of etc. Also great for managing your own digital footprint.
- 32. tweetdeck.com Purpose: To quickly filter content based on media type, engagement level, geo- location, etc. in real-time
- 33. hootsuite.com Purpose: To locate tweets in a specific area
- 34. twitonomy.com Purpose: To verify accounts and better understand how they interact and who they influence.
- 35. trendsmap.com Purpose: To identify real-time trends anywhere in the world on any language supported by Twitter right down to city level
- 37. Social network analysis (SNA) is a strategy for investigating social structures through the use of network and graph theories. It characterizes networked structures in terms of nodes (individual actors, people, pages or things within the network) and edges (relationships or interactions) that connect them. A sociogram is the visual representation of these nodes and their relationships (edges) to one another. The colour represents community affiliation and the size of each node represents importance of place in the network. Reading a Twitter Account Sociogram Reading a Facebook Page-Like Network Sociogram Node (circle) Each node is a Twitter account. Each node is a Facebook page. Edge (line) Each edge is a connection between accounts that interacted at least once with one another via a tweet. Thicker edges mean more tweets/interactions between those accounts. Each edge is a page like. Pages in Facebook can like other pages. There is no change in edge thickness on these sociograms since pages can only like another page once. Colour Accounts that have something in common are generally clustered together and have the same colour due to their interactions. Accounts that have something in common are generally clustered together and have the same colour due to their interactions. Size Larger accounts tend to have more incoming tweets from a greater number of important accounts. The number of followers that an account has does not influence this number. Larger accounts tend to be liked by a greater number of important pages. The number of individuals who follow a page does not influence this number.
- 38. Konigsberg Bridge Problem (1736) First Grade Class (Grant - 1952) Facebook Sociogram (2012) Jefferson High School Sexual Relationship Study (Stovel, Moody, Bearman, 2005)
- 39. socioviz.net Purpose: To quickly identify the key influencers and communities within a topic area + to identify key hashtag sub-topics *Free version analyzes 500 of the latest tweets. If you make a donation it allows 5000 TIP:You can export to GEPHI
- 40. analytics.mentionmapp.com Purpose: To quickly identify the general topics being discussed around a central user or hashtag + to explore their surrounding networks
- 41. gephi.org Purpose: This is the leading visualization and exploration software for all kinds of graphs and networks. Best of all it’s open source (FREE)
- 42. 6 - OTHER
- 43. analytics.moz.com/p ro/link-explorer/ Purpose: Determine what other web domains are linking to the web property in question
- 44. who.is Purpose: Determine who has registered a particular domain. Useful for finding hidden contact info.
- 45. http://archive.org/web/ Purpose: Finding old and/or deleted web properties
- 46. trends.google.com/tr ends/explore Purpose: To determine how and when people search for a specific topic TIP:You can export to Excel + add exclusion terms
- 47. The slides for this presentation will be made available for download.
- 49. Mike Kujawski Mobile: 613.899.1348 E-mail: mikekujawski@cepsm.ca Website: cepsm.ca LinkedIn: “Mike Kujawski” Twitter: @mikekujawski Skype: mikekujawski Blog: mikekujawski.ca