Today’s investigators and analysts using online sources to investigate cases are often so focused on where to click, that they don’t even realize what their tools are doing in the background of their investigations. At ShadowDragon, we call this “buttonology”. Whether we are talking about cases of cyber crime or physical crime, the investigators with the strongest investigative methodology for collecting and analyzing open source intelligence (OSINT) will have the most effective outcomes.
In many cases, the users of investigative tools view them as a means to get the answers they need without ever really understanding what’s underneath – making it hard to reverse engineer how they got to certain conclusions or answer questions like, what did this process look like? How were we able to pull bits of information using OSINT? How we train investigators is not only key to maintaining integrity in an investigation, but also key in their overall success.
You know how people say, there’s more than one way to bake a cake? When it comes to OSINT, the same idea applies. Publicly available information (PAI) can be used for so many different things – ethical hacking or even due diligence, to name a few. The actual techniques will vary depending on the mission set.
Here are some fundamental best practices for investigating with OSINT that I always recommend to the investigators we train at ShadowDragon:
- Get back to the basics: Whether it’s your first day on the job, or you’re 10 years in as an investigator, we all need to instill a baseline knowledge of OSINT. Sometimes, the job of an investigator is as simple as jumping on a search engine and exploring. Ask yourself, “What can I identify? Can I find social media accounts? Has this person ever been captured in the news?” Take those smaller breadcrumbs, and then jump into the tools. While investigative tools are incredibly helpful, they’re not going to solve all of your problems – a lot of the problem-solving is up to the person behind the tools.
- Hit the books: Take advantage of training courses offered in this space, and learn from different methods and experiences of the many folks who have been in your shoes before. For example, SANS is an excellent resource (and you may even hear from our very own Director of Intelligence and Innovation Collection, NicoDekens (@Dutch_OSINTguy)! It’s crucial to fully immerse yourself in the environment as a student of the craft to familiarize yourself with different tricks-of-the-trade — our instructor-led OSINT Essentials course is a great place to start.
- Question your own thoughts and don’t give up: We’re always looking for patterns, and naturally, we tend to slip into or rely on them as investigators. Put measures in place to stop yourself and take the time to think critically about what it is you’re looking at. Try a different perspective by doing something else – get up to mow the grass or make a complicated meal step by step – while you think, and you may just get a little bit further into your investigation. There is no wrong way to get that publicly available information you’re seeking, but some ways may be more effective than others. At the end of the day, the person who gets the furthest in their investigation is the person who doesn’t give up.
Methodology. Not Buttonology.
ShadowDragon is powered by experts that have been investigating for decades, so we know that no one can replace the analyst – especially not artificial intelligence (AI) – but we can definitely make their processes easier. ShadowDragon is enabling analysts to arrive at their own conclusions with the tools, training and resources to make them successful. We are automating processes worth automating, and helping investigators never lose track of how they came to a certain conclusion.
Learn more about ShadowDragon Training today.
For additional ShadowDragon insights, such as Hunting with an Alias, visit our YouTube channel.
This blog comes from the mind of OliviaGransback, Customer Success, Support and Training Lead at ShadowDragon. Olivia is a seasoned online investigator and analyst with 12+ years of experience, including over six years as an Officer in the U.S. Army. She is accomplished in the collection, analysis, processing, and dissemination of tactical and strategic all-source intelligence, including specialization in investigative research methods, social media analysis, cyber search planning and the collection and analysis of Publicly Available Information (PAI) in support of special operations forces mission requirements. Check out our company LinkedIn post featuring Olivia to learn a fun fact about her.
