- I don't know what you want.
If you are looking for ransom,
I can tell you I don't have money.
- I saw that there were some posts.
She was indicating she was in Belgium.
Then suddenly she was in the Netherlands,
but the pictures didn't add up with the city she was in.
- But what I do have
are a very particular set of skills,
skills I've acquired over a very long career,
skills that make me a nightmare for people like you.
- Just running PHP beta scripts
through every single email, sending them.
Say there's a bomb at the school.
It's gonna go off at 3:30 today.
And that caused mass school evacuations in the UK.
- If you let my daughter go now, that'll be the end of it.
I will not look for you.
I will not pursue you.
But if you don't.
- This is a case of probably safety, of public safety.
We don't know where this person is.
- I will look for you.
I will find you.
(fast-paced, tense music)
- Hey, everyone.
It's David Bombal,
back with a very special group of guests
or a panel of guests.
We're gonna be talking about OSINT.
Welcome.
Technisette, let's start with you.
- Well, I'm Technisette.
You can find me on Twitter at @technisette
or on technisette.com.
My real name is Lisette.
I'm currently working in law enforcement in the Netherlands.
- Before this call started,
I was trying to like get some information out of you,
but obviously you're very shy about sharing that,
but that's fine. (laughs)
Steven.
- Hi, everyone.
Yep, my name is Steven Harris,
though I'm probably better known by my nickname,
which is NixIntel, which is where you can find me on Twitter
and my blog at nixintel.ino.
Similar to Lisette,
I have a background in law enforcement.
I spent most of my career working in cyber crime
and open source intelligence.
I teach the Open Source Intelligence course for SANS.
I'm one of the instructor candidates for that.
And I work for a company called QOMPLX
and we use open source intelligence
to help people improve their cyber security.
- And last but not least, Micah.
- Hey, David.
It's nice to be on the show with you.
I'm Micah Hoffman.
I go by the WebBreacher moniker online.
I like to say about myself that I am a collector
of amazing people in the world of OSINT,
bringing them together.
Whether it's through OSINT Curious Project,
whether it's through
My OSINT Training's training platform I run,
or whether it's through
the OSINT Games Capture the Flag OSINT platform,
I like bringing together the best of the best
and having a lot of fun with them.
My background is in psychology then in medicine,
then in IT, then in cyber, and finally into OSINT.
So I've got a pretty diverse background.
I'm on my like fifth career.
- Tell us about OSINT Curious.
What is this?
How did the three of you get together?
What is it about?
- Sure.
OSINT Curious is a US-based nonprofit.
It was created back in 2018
when myself and five other people
got together and decided to create a free place
with highly accurate and trustworthy,
open source intelligence training materials and blog posts.
We'd noticed that there was a wide variety
in the technically complete OSINT data
that was being released on the internet,
and we wanted a single place where people who come to
and they could trust the content.
I go there.
I know that it's going to be actionable information
that's solid, ad free, et cetera.
And so back in 2018,
we created the OSINT Curious Project.
Right now, we have about 13 members all around the world
that create blog posts, YouTube videos, live streams,
and 10 minute tip videos.
We also have our own Discord so that people can, again,
come together and talk as a community.
- I'll put the links below.
Please go and subscribe
to the OSINT Curious YouTube channel.
Show them some love for sharing such great content.
Go and follow everyone on their social media.
Show them that we really want
to get them back for more content.
Let's start with this question.
What is OSINT actually,
and how do I get started?
- Let's start from the very beginning
and say what OSINT stands for,
which is open source intelligence.
And it's really, really broad,
and it can mean different things in different disciplines,
but it's essentially taking information
that is publicly available,
whether you pay for it or you don't pay for it,
and analyzing, verifying,
developing that public information
into something that is useful for you,
for your client, for your company, or whatever.
That's the intelligence part of it.
So the open source is where we get the data from,
and the intelligence is the useful stuff
we can do with that information.
- Lisette, you're in law enforcement.
Is this something that
I'm assuming gets used a lot in law enforcement,
as well as in commercial enterprises, yeah?
- Definitely.
If we do a lot of OSINT stuff
within law enforcement as well.
A lot of the OSINT stuff you can do,
you can do like any other person on this planet
with an internet connection and a device,
either a phone, a tablet, or a laptop
would be able to do all of the things we are doing as well.
The only difference for me personally,
for being in law enforcement,
is that I have a lot more rules to obey to,
to make sure I'm not crossing any privacy lines or any laws.
It's quite strict for me.
- And I mean, especially 'cause you're in the EU.
I suppose there's a lot of like additional rules.
And we won't get into the politics,
but EU has all kinds of rules of things
that you can and can't do, right?
- The EU does have a lot of rules going,
but for in the Netherlands,
it's only the Dutch law I have to keep myself to.
I'm obeying that rule and that law
and making sure that everything I do is legal for me.
- Why OSINT, and how's that different
if you like to red teaming and all cyber,
just for people who don't understand
how it's different.
So why do we do OSINT?
- Open source intelligence,
or, as you probably call it in cyber,
reconnaissance or recon is literally the first step
in most of the cyber security things that people do,
whether you're doing red teaming and penetration testing
and you have to find targets.
You have to find a person or a company,
find out more about them, find out what domains they own,
what IP addresses.
Or whether you're a blue teamer researching
who's attacking your systems,
researching why people got a certain phishing email.
In digital forensics,
people use open source intelligence
when they dump somebody's phone
and they have all the user names that they need
to figure out what they're connected to on social media.
So open source intelligence for me
was that aha moment when I knew that
my cyber career was finally coming to an end
and I had found this exciting, accessible place,
like Technisette said,
where you can find almost anything online that people,
governments, and companies are sharing.
And it's in those techniques that we share,
in those tools that we use,
and ultimately, like Steven said,
in the intelligence that we develop
that truly makes OSINT an amazing
all around activity for professionals
and for hobbyists alike.
- I once heard a story, and I dunno how true it is,
that some government agencies
are really happy that Facebook exists
because it saves them a lot of the old hard work.
Is there some truth in that?
- Yeah, I think so.
I started my law enforcement career
just before Facebook sort of came into existence
and you had to do intelligence the old fashioned way,
like you had to go and speak to people and write things down
and then draw maps with pen and paper
to see who's connected to who.
And then as Facebook became more popular,
it was all there for you.
You knew who was friends with who,
and you knew where they went.
And so yeah, those sort of platforms,
Facebook in particular, but social media more generally,
has made things a lot easier.
- Do you need any special skills to do this?
Or do you have to go on special courses
or is it just something that you can pick up?
- I think anybody can do this, David.
You just need some personal characteristics
or personality traits that you can bring forth.
And Technisette, I know that you wanna say some of this.
I'll just mention one and maybe you can take it from there.
The determination that people have, the persistence,
those are incredibly important when you have this,
well, infinite amount of data on the internet.
Technisette, what were you thinking?
- You have to be curious as well.
You have to want to go on this treasure hunt
as you may wanna call it, to find that little gem
that connects all of the dots
or answers that one specific question
you really need to get an answer to.
And this is one big puzzle hunt.
I'm gathering all of my pieces of information,
putting them together to paint the whole picture for myself.
And every time it's a different puzzle,
so I rarely get bored doing this.
- But I think it's, to take that metaphor one more step,
it's a puzzle that you don't know what it's a picture of
until you've got all of those data points together,
assemble them or analyze them,
and now you can see the picture.
Would that be accurate?
- Yeah. - I agree.
- Yeah. I think that's right.
You don't need any formal skills
or training to get started necessarily.
I think to get to that end stage where you are producing
really good, high quality intelligence,
around the analysis of things,
that's the tricky, harder part.
There's no kind of magic book you can read to do that,
but that's what takes the time and the practice
to become a good OSINT practitioner, I think.
Do you guys agree with that?
- Absolutely.
I think the trainings give you that jumpstart
if you need them,
but very much like the cyber stuff
that's out there right now,
you could literally watch, I don't know,
David's channel over the past couple of years
and you could learn a huge amount about hacking and all.
There are so many videos out there
that from various OSINT conferences.
You absolutely could learn things
just by watching YouTube videos and reading blog posts.
- Especially read what the OSINT community is sharing.
'Cause I've been in this specific field
in law enforcement for over nine years.
But I know now that I've been doing this work
for far longer than the nine years,
been also doing this at my previous employer.
In that whole time, let's say 15 years,
I only have three trainings on how to do OSINT.
All of the other stuff I learned by either doing them,
but also reading what other people have experienced.
Like NixIntel writing a blog on how he delocated
a specific image on Instagram
motivates me to be more specific when I'm,
for example, looking at a picture,
to look at the lamp post or look at a electrical socket.
You need to be active in the community.
Well, you don't need to be active,
but you need to read and catch up.
And if you do that,
you can get like at a good certain level quite easy.
- Like if I was starting today, where would I start?
Would I go OSINT Curious's YouTube channel?
Or what I do first step, second step.
Have you got like any tips?
Go here, start here.
Kind of guide me.
- The OSINT community is very active on Twitter.
Search for the #OSINT.
look at all of the top tweets or all of the latest tweets
and I can guarantee you you'll be ending up
with very interesting blogs, good quality YouTube videos.
And what I personally think is great about OSINT,
you can read a blog,
which may take you like 10 to 15 minutes
and you've learned something new.
And that's what we do at OSINT Curious as well.
We try to create content that doesn't take you
like four hours to get to know a specific topic
or a specific technique.
We tend to keep it small and simple.
So we do videos of 10 minutes max to teach you a new skill.
And I think that's also quite cool doing OSINT
is that you can learn something new
in a relative short amount of time.
Be curious, click around. (David laughs)
- Give some names, like the three of you.
That would be my first three people to follow on Twitter.
Any other recommendations of accounts or people?
And then websites.
Give us specific websites.
I'll put them below.
Give us your websites,
various resources that I can start with.
- So my suggestion, David,
is start with OSINT Curious.
That's OSINTCurio.us.
That is like a one stop shop to all of us.
On our about us page, we have all of our Twitter handles.
So if you don't know who to follow on Twitter,
you've got that on our about us page.
But wait, there's more.
If you want to talk with other people
outside of just Technisette, Steve, and myself,
we've got a Discord where you can talk
to hundreds of thousands of people
all around the world that love open source intelligence.
So instead out of asking me, Micah Hoffman,
hey, how do I do this on Facebook, Instagram with a domain?
You can ask people in different parts of the world
what do they do.
And then also on the OSINT Curious Project's website,
there are links to those 10 minute tip videos,
our YouTube channel, and of course our blog posts.
- Why did you create this?
Was it just to try and help the community?
- We created it to have that voice
and to bring people together really.
We had five people and myself that got together
and we said, instead of us speaking
with separate voices about
this is good open source intelligence,
we brought it together on a single platform and decided
this is what we want to do.
And Technisette was one of those other people
that was there at the very beginning.
- You know, the problem is when you're starting,
it can seem overwhelming.
So some people like to read, some like to watch videos.
Do you have any books that you could recommend?
Any one of you?
- I'll just say from my perspective,
there are books out there about open source intelligence,
but I think the minute that they are published,
they are very much out of date.
Much like cybersecurity or many aspects of cybersecurity
that are constantly evolving and changing,
by the time you write a book about exploiting something,
it's probably a little bit old.
So in open source intelligence,
there are some books by several people.
But I think that watching social media,
whatever platform you're on, for the hashtags,
going to some of these websites and YouTube videos,
you absolutely will stay better informed
and more up to date than following some of these books.
But I don't know.
Steven? - Yeah.
There's one book I will recommend,
although you've made a really good point.
The material that's produced by the community
can go out of date quite quickly,
because techniques change very often.
So it's hard to recommend a book I read this year
or two years ago that's still relevant now.
But I will mention one called
"Hack the World with OSINT" by Chris Kubecka.
For anyone who wants to think about
offensive security, recon, it's a fantastic primer.
Some of the things that she discovers in that book,
like some the insecure systems
and vulnerability she finds,
just using open source intelligence, it's so fantastic
for anyone who wants to get into that.
- That's great.
Technisette, any recommendations from you?
- I must say I agree with Steven as well.
I like Chris's book a lot,
because it brought me more OSINT
on a perspective which is not part of my daily job,
as much as it is for other people.
I do have a copy of Michael Bazzell book as well,
the Intel Techniques book.
I do like it, but it's a very thick book
and I'm not very well-concentrated finishing big books.
But it's a very good quality book when you are in the US,
because I've noticed that a lot of the things that he wrote
are specifically for US only.
So for me in Europe,
some of the things are not as relevant
as they are to people in the States.
- When I look at like a lot of content online,
it tends to be very US-focused
or very even European focused.
But is a lot of the resources on OSINT Curious
relevant to, like, if I was living in Africa
or in the Far East?
Is it just general
stuff that can be applied all over the place,
or are there specific skills for like the US
versus other parts of the world?
- I think that a lot of things are pretty similar.
So whenever I want to do an investigation on somebody
and I tend to use Google as my first search engine to go to,
a lot of the search operators I use
can be used in multiple parts of the world.
Maybe I have to think about changing some language,
maybe translating a specific name
into Arabic or Cyrillic or whatever,
but there will always be specific websites
only locally to a specific area.
So for example, before Facebook
was the number one platform in the Netherlands
there was Hyves.nl.
I used to work there.
It looked like Facebook, had the same look and feel,
but it was focused on Dutch people only.
So if somebody from the States
would be investigating somebody from the Netherlands,
that should have been a platform they should visit
and see if they can find any information.
So there are always locally-known websites
that are quite popular
and you need to catch up on that,
either by Googling or, for example,
looking at the top visited websites of a specific country
to see if there might be any websites
in that list you're unfamiliar with,
or looking at mobile apps that are popular.
For example, in India,
they probably are not the same apps
that are popular in the UK or in Spain
and you need to get those platforms as well.
There's a lot of similarities,
but there are some country-specific
or region-specific websites and apps
you should definitely investigate
if you are in that specific region.
- So anyone up for a demo?
- Can do something.
So one of the main things that we find
in the open source intelligence investigative world
is that we have sort certain data that we start out with.
So if it's an email address
or whether it's a phone number or a domain,
we take that and then our whole job
is to find other places, mostly online,
where that data has pivot points,
where there's other data out there.
For example, I'll start out with just John@example.com.
Most people know about going to Google.
With most people, they'll get these results.
And you can see there are almost 12 million,
12 million?
12 billion (laughs) results that have come back.
So the next thing that we have to do
is obviously narrow down Google's results.
Maybe we're looking john@example.com
and we put it in quotes.
So the quotes say, John@example.com.
That string itself has to appear in the results.
And notice our results have come down to 132,000 results.
So previously Google was chopping up
the word John, example, and .com.
And now it's saying, oh,
John@example.com is in the results.
So just by adding quotes, we have some good results.
We can add other things too.
If we're looking for other words,
we can add keywords, we can remove keywords.
For example, maybe I don't want anything
with the word test in it,
so I can use dash symbol here or the hyphen
to don't give me anything with the word test in it.
I just took out another 30,000 results.
And through this iterative process of creating keywords,
searching them, using Google operators,
and then refining your results using these Google operators,
we can narrow Google and Yandex
and DuckDuckGo and other results.
But I mean, other people will tell you that
Google's only one piece of the pie.
For instance, let's just take John@example.com
and head over into the cybersecurity world
of searching for breach data.
Very common thing that we do is take an email address
and see if it's been found in any breaches.
Because if we can find that,
then what we might be able to do is identify passwords
and systems where the accounts
of this person might be found.
Have I Been Pwned?, which is a site
that you're probably familiar with, might be familiar with.
We come over here and what we do is we paste in
our John@example.com and we find, oh no!
It's in 98 breaches and 33 pastes.
Each time we're doing this,
we're recording what we're doing.
The most glamorous part about OSINT is documentation,
and I say that with a big grain of salt.
But what we're looking for is those pivot points.
Here we have John@example.com, our target email address,
and we see that it's on the 500px system.
All right, now I know that there may be
an account over there that I might want to pursue,
or an Animal Jam or something.
And each one of these bits of data has other things,
like in this breach, there's email addresses,
passwords and usernames.
Whether it's an email address
or we can start out with a site that I really like,
which Technisette and Steven will attest to,
whatsmyname.app.
Sometimes you don't start out with an email address
or you start out with an email address
of like WebBreacher@gmail.
And you're like, wait, that WebBreacher could be a username.
Well, not only do we go through our process
for email address searching,
but we also might wanna break that WebBreacher off
and then search on the whatsmyname.app site.
I'll search for something else, John Doe.
And this site takes one username,
and when you choose the category that you want to search,
it'll have your browser make over 370 requests
to find other places
where an account for that username exists.
So here on coder wall,
you can see the URLs down here.
Reddit, there's a John Doe user account.
Gab has a John Doe user account.
Over here on the right hand side
we have a nice little table that we can export to our notes
and now we have a huge number of other sites
that we need to start investigating.
And when we find those sites,
we work through our process to harvest the avatars
and the biographical information, the location data,
and we continue to move, gathering data,
analyzing it and pivoting.
- Just to add up to what Micah was saying is that
we do need to check if all of these results
are one and the same person,
because there's a very high chance
that somebody else on the world
has the same username as well.
So we need to visit all of these sites,
pivot further on to see if everything matches
and then only you can conclude, well,
John Doe indeed has over 72 other accounts
on other platforms,
which we can either connect to each other
or connect to that one person we're pivoting on.
- Have you got any examples of how this has helped
something like in a case or just in a business or something?
- Well, I had a very successful case
when I had just started out in law enforcement.
When in law enforcement,
you get a lot of extra information
about what everything else is going on
within the police force.
For example, I don't wear a uniform,
but the people who work on the streets
and who take care of all of the emergency calls,
they experience a whole different world
from the things that I do.
We have like a newsletter.
Gets sent to your email once a week,
just updating you on whatever is happening
in the region you work in.
And as I was working in Amsterdam
we got an alert from Interpol saying that this girl,
she came from Australia, she suddenly left her house.
She was only 21.
And she left a note on a table to her parents saying,
"Well, I fell in love with this Dutch guy.
He bought me a plane ticket.
I'm heading over there.
Well, see you later.
I won't be back for a while."
So the parents got very anxious
because they were afraid their daughter
might be in the hands of a human trafficker
because they've never heard of this guy
and they were also very conscious
because her mental health wasn't very stable.
And all they asked in a newsletter
was if you see this girl,
just check if she's okay, report it back to Interpol.
And I was like, hey, this is interesting.
This is a young girl.
She's 21.
She must be out there on social media.
So I was searching on Facebook, found her Facebook profile,
but it had very...
Well, the information didn't add up.
I saw that there were some posts.
She was indicating she was in Belgium.
Then suddenly she was in the Netherlands,
but the pictures didn't add up with the city she was in.
So then I found her Instagram account
and she had two photos there,
one saying, well, this is the front view of my balcony.
And this is the other view
from the backside of the apartment building.
As I was looking at that picture,
I was like, this screams that it's in The Netherlands,
because like the way the houses were built.
There was a bus line and there was a bus actually driving.
And I recognized the logos of a bus line
that goes in the Netherlands.
It must not be very hard to figure out where she is.
And by looking closely at the pictures she posted,
I was able to geolocate it back
to the apartment building she was probably staying in.
And because I'm in law enforcement,
we have a little bit extra data, more of the closed sources,
and I was able to search for the name of the person
she said she went to
to see if anyone in that apartment building
might be having the same name
and I found only one person with the same name.
So I called up the local police
because it was in another district
than where I was working in
and I was like, "Hey, have you seen this newsletter?
I think she's in this location.
Maybe you can do a welfare check."
And they were like, "Okay, well, this sounds very legit.
Let's go there and see who opens up the door."
And it was the girl.
So within less than two hours,
I was able to find her, found her.
She was indeed very much in love with the boy.
And I'm not quite sure.
I hope they are still happily ever after,
(David laughs)
but he was very shocked
that the police were at his front door
and he apologized a trillion times,
and so everything was good.
She was not in the hands of a trafficker,
but I was really happy that I was able to give relief
to parents who were on the other side of the world
and me just behind my computer,
not even ever stepping a foot in the location where she was.
So that was quite cool.
- Is that how you got interested in this,
or was that after a period of time?
You'd already been doing this for a while?
- This was in the first six months I was in law enforcement.
Just definitely lit the fire even more.
I was like, yeah, if I can do this,
I'm going stay here and do a lot of this other stuff
that I can help people with.
- What did your colleagues think about that?
I'm assuming some of the older colleagues
perhaps didn't realize the power of this?
- Absolutely.
And still a lot of people are especially afraid.
I think it's like the first time a computer
got introduced on the work floor,
people were like, "Oh no, computer!
I like my typewriter much more."
And I think there are people who still have that feeling
like, oh, I like my computer now,
but the internet is quite scary.
I do like Google, but that's about it.
So I think there will always be a generation gap
between people willing to adapt to new, modern techniques.
- But isn't this an opportunity for someone who's young?
Because I mean, a lot of people
who are young and up and coming,
I'm showing my age, but I mean,
not all of us grew up with an iPhone in our hands.
This is a great opportunity for someone who's tech savvy.
Is that right?
- Absolutely.
The world you have to navigate
to work in open source intelligence
is very familiar to you already
if you are a young person.
So you know how social media platforms work,
you know which platforms are popular, which are not.
You might understand a little bit
about the technical side of the internet.
When I think of some of my older colleagues
in law enforcement
or people of my parents' generation for example,
they wouldn't have a clue really
how to get started in this world.
But if you are a younger person now,
and you know how to, I dunno,
make a podcast or post a video on TikTok,
you are already at the beginning of being able
to understand the environment that we can work in.
And it might seem to you
that it's just something you take for granted,
but actually there are a lot of people who lack those skills
and you're at a huge advantage now
if you're a younger person wanting to get into OSINT.
- There just seems to be a lot of opportunities,
is that right?
So, I mean, there's a lot of kind of jobs available,
is that correct? - It depends.
And many of the jobs don't say, "You must know OSINT."
They use other words like recon
or they just say you have to be able to do certain skills.
The skills that open source intelligence investigators use
are used by lots and lot to people.
I had a conversation with a recruiter one time and I said,
"You look for people with certain skill sets
in certain parts of the world and so do I.
What do you do?"
And she looked left and she looked right
and she said, "Let me tell you.
I can get a lot of trouble for telling you this,
but we use Boolean queries."
I'm like, "What do you mean Boolean queries?"
She goes, "Okay, you go to Google
and then you type in penetration tester
or security engineer."
I said, "Oh, that's a Google dork.
We've been doing that for 20 years."
She goes, "No, no, no!
Boolean searches."
so a lot of people that do OSINT
don't realize they're actually doing OSINT.
And what we're seeing now with the advent
of OSINT-jobs.com and other places,
the word OSINT is now becoming more prevalent
in job titles and also job fields.
But it's also there are a lot of opportunities
for volunteer efforts to help decrease human trafficking,
to help people that are domestic violence victims.
A lot of those nonprofits use the volunteer efforts
of people that want to get into OSINT to help their victims.
- Yeah, a lot of people have the cool and sexy,
like I wanna be a hacker and I'm gonna use OSINT for that.
But that's just one small, tiny piece of the pie.
Is that right?
- Yeah, 100%.
OSINT is multi dimensional
and red teaming recon is just one part
of the OSINT landscape.
There are journalists who use OSINT,
most famously Bellingcat,
but many other journalists.
Obviously there's law enforcement,
but fraud investigators, risk analysts.
I've even seen finance, cryptocurrency firms
are now advertising for OSINT specialists
because they realized people are starting
to understand what this word means.
So, yeah, if you are looking to work in this field,
the opportunities are vast,
probably as long as I've been in this area
more than they ever have been I think.
- The field of cyber is absolutely huge
with red teaming and blue teaming
and all of the other different,
policy and compliance and all.
Same thing over in OSINT.
There are people that we know of
that are amazing at geolocating a photo.
You show 'em a photo.
They look at the fauna in there,
they look at the flora,
they look at the plants and trees,
and they're like, "Oh, this palm tree only is found
in the East Coast of the Mediterranean Sea
within this latitude and longitude."
But those people might not be great
at social media exploitation, like Technisette is good at.
Or there's people that are really good at domains and IPs,
and WhoIs and DNS that do other stuff.
Saying that you want to get into OSINT
is still just the first step into
this huge area that you can
further differentiate yourself into.
- I think the scariest thing for me
is the more I talk to you and the more I read about this,
the more I wanna take myself offline.
Can you give us like some examples?
You know, like if I wanted to be private,
do I have to go live in a cave?
- [Micah] The answer is yes.
- The answer is partially yes.
Probably everyone you know
has to live in that cage too.
The flaw of trying to hide online
lies in the hand of your friends and family,
because they will post that picture of the family reunion.
They will post that picture of you having dinner
with your friends in either your backyard or restaurant.
So even though you might be trying
to stay off of all of the platforms,
it's the people who stand close to you
who are your biggest risk probably.
- Well, it's even worse than that, right?
I mean, if we wanna get really scary
with facial recognition that's out there.
I mean, David, you're walking through the city,
just minding your own business
and there's some tourist there
that takes a selfie of themself
and you're in the background and you just happen to look.
Now whatever platform they are posting
they have a shadow profile for a person with your face.
So even if you don't have your David profile
on that platform,
they know that a person with this face
happened to be in that location on this date.
And, oh, look,
they were over here on this other date.
So there are a lot of privacy issues
that are really, really important.
The more private a person is
the less OSINT we can find online about them.
And we do have to do things like what Technisette said.
We have to pivot to their family members,
their colleagues that might be sharing their data.
But yeah, there are absolutely ways
that you can decrease your online persona
to make yourself and your family more private.
- And let's talk about that for a second.
Like Edward Snowden is a famous example,
whether people love him or hate him.
He does this thing where he says
you have to put something over your head
when you look at your computer
or you have to do things to your phone
and all kinds of crazy things.
How would I become more private,
apart from living in a cave
and having no friends and family?
(all laughing)
- That's the solution.
You just nailed it.
- Is that the answer, yeah? - Yeah.
- Divorce my wife, have no kids,
have no family, go live in a cave.
- One of the ways that people sometimes end up in OSINT
I think when they start to look at themselves.
I think you have to figure out how private you want to be.
So for some people that is just increasing
the settings on your social media profiles
so that they're not publicly viewable.
It might mean you don't have a LinkedIn profile for example.
It might mean if you register a website,
you use a privacy service so that the WhoIs is redacted.
That kind of thing.
What I would suggest to people is
know why you want to be private first of all.
'Cause I think when I've sort of mentored
or dealt with people who are new to OSINT sometimes,
they really tie themselves in knots of anxiety.
What if Tor's compromised?
And what if my VPN provider?
And do I have to have a VPN provider on Raspberry Pi?
I'll just give this as as an example of that.
I was talking to a guy probably about a year ago.
He was sort of 16, 17, starting out in OSINT
and he was good to take part in Trace Labs,
which is an open source investigators capture the flag,
basically to help find people who are missing in real life.
It's a great cause.
And he message me saying
I'm about to do my first Trace Labs.
I've got one Raspberry Pi that's running my VPN
and that's connected to another Raspberry Pi
which is connected to Tor,
and I bought this fancy new router for my home setup,
which has extra open source firmware.
Do you think that will be enough?
Like, yeah. (laughs)
Well, if we're gonna do OSINT
we are gonna have this single privacy
and we're gonna do it properly.
But you need to avoid tying yourself up in those knots
and spending lots of time and effort.
You need to think about why you want to be private first.
Do you just wanna avoid being targeted by fraudsters?
Do you just want to avoid corporations
sneaking around your data?
Or are you trying to take on the NSA?
Because there's a big spectrum of things you can do
to address those-
- Well, there's really two parts of that, right Steven?
You mentioned, and David, you were talking about,
us as potential targets
making ourselves more private online.
But then Steven actually mentioned
the operational security or OPSEC
when you're doing open source intelligence investigations,
making sure that you, me,
Micah Hoffman, Steven Harris, Technisette
don't get caught up in the investigation.
I don't know, David, if you've ever seen the Netflix show
"Don't F with Cats."
- No I haven't.
Go on.
- It's a three part series I believe
about some people that found a person that was abusing a cat
and eventually found out that this person was a murderer.
He went and killed somebody.
The challenge there was that these people
who were doing open source intelligence investigations,
they were not protecting themselves.
And through a series of events,
they created a Facebook group
to talk about this and share things.
And eventually the person that was their target
joined that Facebook group,
and it really opened each one of them up
to becoming a potential victim.
So as OSINT investigators, we do use VPNs.
We do use virtual machines, which many people know about.
And we use those things, things called sock puppet accounts,
which are real accounts on social media
that aren't in our own names to do our work.
So when we're on Facebook,
when I'm looking at things on Facebook,
I'm not searching for people
using Micah Hoffman on Facebook,
I'm using a different account
so that people can't attribute that information to me.
But it really also depends on your personal risk model.
Who are you trying to protect yourself against?
- I mean, the problem is you can get really paranoid.
I mean, Steven, we both of us live in the UK.
And I mean, I'll say this in jest,
but the UK government has got this really,
I dunno how to say it politely,
this wonderful rule where they can spy
on all your internet traffic.
So some people who are very privacy focused
might in jest say the UK is as bad as North Korea
because they wanna look at all your traffic.
Is the answer how paranoid do you want to be?
I mean, if you really want to be out of it,
don't live in London
because you'll be on every camera on the Underground,
'cause England is full of cameras.
What is a reasonable ground to be fairly private?
- My experience is, having been on the other side of that
on various law enforcement investigations,
which using CCTV is a basic investigative technique.
There are other, more secretive techniques
to do with communications and things like that.
Having been in that world,
I actually worry less on the outside
because seeing how it's not a data free-for-all.
So if MI5 or the police want to access
certain types of internet data about you,
the bar doing that is actually pretty high.
You're talking about
you have to argue your case to a judge first.
You can't just log onto the computer and say,
"Oh, I'll see which websites
David Bombal's been visiting this week."
There are lots of safeguards in place
and I actually worry less now
than I might have done before in all honesty.
Yeah, can you hide from CCTV cameras?
Yeah, come and move to the countryside.
It's great.
(both laughing)
- I'd agree with that.
Yes. - Yeah.
The reality, it's very, very difficult
and there has to be this, I think,
without going to the politics of it,
we have to be vigilant about our freedom still
but be mindful that there are things there
that do protect you to a certain degree
in terms of how this material's all processed and accessed.
Be proactive in monitoring how that changes.
- Best way that people can figure out
how to make themselves more secure online
is to figure out what's out there.
Take 15 minutes or 30 minutes, Google yourself,
Google every single one,
or use whatever search engine you want.
Search every email that you have.
Put quotes around it.
Use every nickname, pseudonym, username
that you've used, and your family members,
and see what's out there.
I can't tell you the number of times
I've done an OSINT investigation
and my client says, "Hey,
I have these three accounts on Instagram,
Twitter, and Facebook," or whatever.
And then I simply put in their phone number,
email address, or name sometimes
and it comes up with MySpace accounts
or some comment that was left
on a pornographic website using their username.
And it's embarrassing and it's simple to find.
So in order to reduce your overall online perspective,
go and find out what's out there,
make a note of it and go,
"Hey, I think I should change my name
on that website or remove some of that data."
It'll really be helpful and it's easy for anybody to do.
- So in other words, do an OSINT on yourself, yeah?
- Yeah, absolutely.
Because you also know what's right and wrong, right?
If I search for Micah Hoffman,
I'll be able to find results and go,
"Wait, this is the Micah Hoffman out in California.
That's not me."
And so I know what's out there
and then I can see, oh wait,
I didn't know that this was indexed.
One of the things that I think Technisette
can absolutely attest to
is that the social media platforms
are constantly changing what's public
and what's private in your account.
So I had an example.
One time I did a security awareness training for a company.
And I said, "I'm going to look at myself,
see what I can find on myself in 15 minutes."
Set a timer, started doing things.
And I was finding like all of my LinkedIn stuff
that I know just a month before I had secured.
And it turned out that LinkedIn did an update.
When they did the update,
they changed some settings to make my profile more private.
So my data was hanging out there on the public internet.
And the only way I found that out
was by actually doing the searches.
- My take is nothing you put on the internet is secure,
like on any social media website, should I say.
So, I mean, be prepared that someone's
gonna find it at some point, I suppose,
is sort of my paranoia way of looking at it.
But that's interesting.
So you do an OSINT on yourself
and that will do multiple things.
That'll help you secure your data
and also teach you the process.
Is that kind of the idea?
- Absolutely.
And as you start adding more and more tools,
there's a great website out there made by Bruno Mortier.
OSINTFramework.de is a site
that has a huge amount of resources with links.
So just start out doing what you know.
if you only know how to Google, Bing, Yandex, Baidu,
use a search engine, cool.
But if you are competent on a social media platform,
if you are somebody that understands some other things
about domains and other stuff,
then use some of the links that he has on that website.
Or go to Technisette's website,
type in the word phone in the search field,
and you'll get a whole bunch of blog posts, YouTube videos,
and websites that you can go to,
to search for your phone number
to see if it's out there on any of the sites.
- That's great.
Technisette, there's a big problem in tech.
There's too few women in tech.
So is this an area for women?
I'm assuming it is 'cause you're in this field.
- The funny thing is that
when I look at my fellow OSINT researchers
in law enforcements, I would say the majority is female.
But not everybody is as fond of being in the spotlight.
Like I'm publicly known,
people know my face, people know I'm Technisette.
Not everybody likes being in that kind of daylight.
So I think there are quite some women out there
which we are not familiar with or we don't know them
because they choose to stay in hiding.
The whole discussion
if there are too little women out there in tech or OSINT,
I find it very difficult because it has to do a lot
with how you grow up.
Because when I was a child, I used to play with Barbies.
But my mom was the biggest computer freak I knew,
so she was actually teaching me how to do,
like how to play a game on a floppy disc
using just the command line in Windows.
And she actually taught me a lot of the things
I still do today.
But if you don't have that person in your life,
that mom or dad or other people
who have a educational role in your life,
it can be a teacher in a school as well.
If they don't offer you the opportunity
to sniff whatever a computer can do,
I think it can be really challenging.
I think a part of why women are maybe not so big
in cybersecurity and computers, et cetera,
is maybe because people tend to think
that girls like other stuff.
So at a young age, they get a lot of other things
than a computer in front of their nose to play with.
- I mean, I don't wanna get into the politics of it,
but I think if I look at my wife and myself,
she would be a million times better
at social engineering than me
because she has this ability, uncanny ability,
to be able to sum up someone just by looking at them,
and I'll never see that.
I'll just use her as an example.
Are there certain attributes that ladies have
that would be a huge advantage in OSINT?
I mean, I think social engineering,
my wife would be a million times better
at that than I would.
- When looking at females in general,
maybe people think that there's a lower risk
that we might be dangerous.
So people tend to believe you a lot sooner
probably than, let's say, a bald guy.
(all laughing)
- That hurts. - No offense.
- No offense.
No offense.
- At least she didn't say with a beard,
'cause that's a one-two punch. - That's true. (laughs)
- You guys have to leave the conversation now.
- Yeah, pretty much.
You're absolutely right, David.
I mean, social engineering uses a lot of OSINT
to get that backstory, to get the data points
to support whatever trust type of ploy
that you're gonna do.
And women not only have great,
and as a whole have a great investigative spirit,
but they also are more believable
actually carrying off those social media
and those social engineering types of engagements.
- Even when I walk into a store and say,
"Oh, can I please use the restroom?"
There's a higher chance that they will let me go in there
than, let's say, a- - Steven.
- Let's say Steven. (laughs)
Just because you can laugh and you can like smile a little
and they will let you go.
But we're a wolf in sheep's clothes. (laughs)
- And that's a good point, Technisette.
We're talking about,
well, you mentioned being public versus being private.
A lot of people that do amazing
open source intelligence work do not seek the limelight
because of the sensitive targets that they're working with.
When you're working with organized crime
or some kind of government
that has some authoritarian types of reigns,
or maybe you're investigating hit squads
that have been sanctioned by government employees
or by some government.
You are less likely to say, "Hi, I'm Micah Hoffman
and I'm researching that country's hit squads" publicly,
because now the target's on me.
So there are a lot of people
that are not as public as we are with OSINT.
- Yeah. That's a very good point.
Technisette, what advice would you give women then
who are interested in this?
Again, is it just like follow women on Twitter?
I just want to try and broaden it.
The reason I always do this is I've got two daughters
and if I ever wanted to interest them in this tech,
how would I come convince them
that this is cool and exciting,
rather than doing something else?
- If you have a daughter
and you yourself are in the tech world in any kind of way,
or doing anything with computers or technical stuff,
just to let them experience
whatever you are doing a couple of times.
Let them help you do a small investigation,
saying you want to see whoever bought
your grandmother's house after she passed away, for example.
- That's a good one. - Just Google the address.
Show her some little tips and tricks
that might very helpful in her phase of her life.
So for example,
if she needs to Google stuff to find resources
for her study, help her saying,
"Well, there are all of these Boolean searches
or Google dorks you can use
to find the exact literature that is helpful
to continue your study with.
Or if she's going on a date,
let's Google this person together,
or I'll give you some tips
so you can Google that person yourself
just to check if he or she
is a safe person to hang out with.
- That's a good one.
I'm gonna use that on any boy that likes my daughters.
(Technisette laughs)
- Let me show you what daddy does
when he researches your boyfriends.
That's gonna be great, yeah.
- So just some simple things
that could make her life more convenient,
that might spark a little bit of a fire
on getting further into the field of OSINT,
I hope, I think.
- I think it's great.
I mean, it's like my daughter,
she's been on my YouTube videos from young
and all she wants to do is be a hacker,
and that's because she does it with me.
And I think it's exactly right.
Like your example of your mom teaching you computers.
If you share your passion with your kids,
they're gonna also be inspired hopefully
to get into this field.
- I did some work in the dark web in Tor,
and I remember when I was creating one of my talks,
my daughter was a great age
and she decided that she wanted to come in
and say, "What are you doing, dad?"
Like, well, I'm on the dark web.
You wanna learn about at the dark web?
It was the safer areas of the dark web, if those exist.
But I was showing her what was going on.
And then at later at dinner, my wife said,
"So what did you do today?" to my daughter
and she's like, "Oh, well,
I saw how to buy drugs on Tor.
And if you want a fake ID or wanna buy a US passport,
this site has it.
But if you want,"
and I was like, okay, okay, okay.
We need to dial that back a little bit.
But yeah, I mean, show them what's out there.
And I think that also has the counter effect of
if they see how easy it is for us
to find those Instagram posts and the Snaps,
then they may be less likely to share publicly.
- How do you convince your kids
not to post on TikTok and all these websites?
Show them how easy it is.
- You cannot prevent them from being online,
but I think it's very important
that you have the conversation in not a negative way.
So not saying,
"You should unpost this and that on Instagram,"
or "You shouldn't accept anybody as your friend,"
but have an open conversation.
I learned this a long time ago.
There's an organization in the Netherland
very actively involved in teaching parents
how to deal with their children and their online behavior.
And one of the things one of the speakers said,
well, just by asking your child,
have you seen anything funny on Instagram today?
Can you show me?
Just to get into that conversation,
get into a very friendly field
of just letting your child show you
what they have been up to online,
but not in a judgmental way.
So maybe you can laugh together
about a funny video of a cat they maybe saw.
And maybe you spot something
that might be harmful or dangerous,
then talk about it and say,
"Hey, did you see there's somebody commenting
and swearing a lot.
If you have any problem with this,
or if you feel offended by this, please let me know,
come to me and talk to me about this
because then we can handle things or help you further."
So I think it's very important
to have a conversation with your child
about what they're doing online,
but not in a judgmental and negative way.
- 100% agree with Lisette there.
In my line of work that I dealt with usually teenagers
who had become victims of sexual abuse online, for example,
the common theme there where things have started to go wrong
was that parents had no idea about what they're doing.
And the advice we always used to give to parents
is to be proactive in your interest
in what the kids are doing.
So a lot of parents are technophobic.
They don't know one platform for another.
They just know they're in their room
on the internet all day.
and even with youngsters who got into hacking
and fell foul-
- The 15 year old in Oxford, wasn't it?
Like recently? - Yeah.
To be honest, I was taught this statistic
when I worked in cyber crime.
I dunno how true it is but it was true in my experience
that the average age is about 37, 38.
For cyber crime, it's about 18 or 19.
For kids who are getting into hacking,
it's a perfect age where you have that curiosity,
that drive, that want to prove yourself,
to show off your friends,
but you're also not always the best
at assessing risk and consequences at that age, too.
The younger you are,
like parents, please take interest
in what your kids are up to
even if you don't understand it.
- Even if you don't understand it,
that's probably the best reason
to talk to your kids about it.
Say "Hey, you are on Instagram all the time.
Can you show me what it's like?
Would it be something for me to be onto as well?"
And then say, of course, "I'll never follow you,
or like any of your pages,
because that will be very embarrassing to you,
but show me how does this work."
- One of the things that was helpful,
I think, in my family was
my respecting of the kids
and what they want and don't want posted.
For instance, I know a lot of parents
are taking pictures of themselves and their kids
and just putting it on their social media.
And I've heard people say,
"Oh, my kids didn't want that to go online,
but I'm the dad, so I'm gonna go ahead and post it."
And what we're teaching our kids
is that they don't have a say in
what images should be or should not be online.
And so respecting that and teaching them also
that taking pictures inside of your homes can be dangerous.
One of the things that Steven's really good at
is doing image analysis
and looking at the things that are in the background.
I mean, David, I've been looking
at that mindset is everything poster.
I've been looking at all of those books and stuff,
and we do that, whether it's on Zoom
or whether it's in some live stream or some picture.
And pulling out those details
about how a family or how a person lives
can be extremely powerful in figuring out
how to do trust games,
how to social engineer them,
or how to get them into some bad relationships.
So teaching kids that
when I look at somebody else's YouTube video
and I can see, oh, look, he bought this thing.
Let's research that product.
Where did he buy it?
Or other things, it helps them think about
other people might do that to them as well.
- Yeah, so basically you're telling me
to go live in a cave, yeah?
- Pretty much.
We're back to the cave.
Yes, absolutely.
I mean, that solves so many things!
Unless your cave has wifi,
in which case that's a challenge too, but yeah.
- Is there any closing thoughts or advice
or any war stories?
I always love stories before we wrap it up.
- I have a good username story.
Probably about four or five years ago now
when I was still in law enforcement,
we were dealing with a group of teenage hackers.
I call them hackers.
Their actual hacking skills were relatively low,
but they were great at causing nuisance online.
So they learned how to SWAT people,
which is where you call in the law enforcement
and tell them there's a gun at the house
to get them into trouble.
Or they were emailing out mass bomb threats.
They got the email address of every school in the UK
via a Freedom of Information request
and just ran a PHP script through every single email,
sending them, say, there's a bomb at the school.
It's gonna go off at 3:30 today.
Blah, blah, blah, blah.
And that caused mass school evacuations in the UK.
Their capabilities were limited,
but in terms of the damage they could cause
it was quite significant.
But they loved the attention.
And rather than keep quiet,
they sought approval from their peers.
They wanted to taunt the FBI
and they wanted to taunt the police.
And so they took to Twitter
and they set up a Twitter account.
And every day they would post these messages
about what they'd been up to.
And some of them were nonsense.
Some of them, they actually
had caused some harm to people.
But their constant thing was you'll never capture us, FBI.
You'll never capture us, UK police.
You'll never capture us.
We're undoxxable and gods,
and all this kinda stuff.
So all we had to go on
when I started looking at this were usernames.
And what we figured out was that as part of,
they saw it as part of their operational security
to continuously change their usernames.
I think in their mind they thought
if I change my username all the time,
I'll be harder to find.
But what we figured out, well,
they change their usernames all the time
they can't have always thought this.
They're obviously fairly new to this.
So if we can go back far enough
to some of that other social media accounts,
we'll find what their old usernames were
and we'll work with those.
So there's a couple of things we can do with Google.
For example, we can filter Google results by time.
So if I wanted search for what David Bombal
was talking about in 2014,
I could just set up a Google filter
and just show my results in 2014.
So we did that with their usernames
and we went back only a couple years
when they were in their early teens,
when they were into Minecraft
and we had their Minecraft usernames.
And we used tools like, well,
I don't think you'd release What's My Name App
at that stage, Micah.
This is probably four or five years ago.
We used some similar tools to find
what other platforms did they use these usernames on?
And this one guy who's the leader of the group,
we took his Minecraft username
and we ran it through the platforms
and we found he had an account on Reddit.
So how do we know it was his?
Well, he was mostly talk about Minecraft
and things like that.
So we inferred from the content it's probably the same guy.
But what we found in one of the posts he's made on Reddit
was he had used what we call a PGP key
to verify that the account was his.
And for those of your viewers
who are not familiar with the PGP key,
it's basically, it's a unique string that identifies you.
It's like a signet ring.
It's like your autograph, a fingerprint.
So when I tagged my Reddit account with a PGP key,
it's definitely mine.
And so we then searched for his PGP key,
which we could link to an email address.
And we took the email address
and we did a search on the first part of that.
We took the first part of the email address,
like Micah showed before,
and eventually we found an account on Pastebin.
Pastebin, it doesn't seem as popular as it used to be.
But Pastebin is basically a site
where anyone could dump any old random text
and share it with anybody.
So it used to be used for data breaches
and things like that.
We found he had had some technical issues
with the DDoS tool that he was making.
As part of their campaign of terror,
they were doing DDoS for hire or DDoS as a ransom.
So they would knock a company's website offline
and say unless you pay so many thousand dollars,
you're not gonna get any customers.
Again, it was fairly low level stuff,
but quite disruptive for the victims.
And in one of these pastes,
we found a conversation they'd had between both of them
where they were trying to use a VPN,
but they couldn't get it to work.
They were trying to run a VPN connection
to their DDoS tool and they couldn't get it to work.
So they pasted, trying to troubleshoot it,
they pasted the log into Pastebin.
I went through this and it also had the username.
It had the home IP address
that they were trying to connect to in the logs.
It had the log of the server that they were trying to,
the IP address of the server they were trying to connect to.
So immediately we can link username to home IP,
to the DDoS tool.
And it had the Mac address
of the device that he was connecting from in there.
And again, if your viewers aren't aware,
the Mac address is the unique serial number
on the network adapter on your laptop,
and they're one of the kind.
They're unique.
They're like fingerprints.
So lo and behold, when my colleagues in the,
I think it was Herefordshire police,
when they went down to arrest him,
they went to his house and sure enough
when they seized his laptop, it was the same Mac address.
He was arrested and remained in custody
and he chose to plead guilty after that.
But that was all from a username,
from people opening their mouths on Twitter.
You'll never catch me!
You should know if you do that,
that is a red rag to a police officer. (laughs)
- Exactly.
- If you say FBI will never catch me,
well, you know what's gonna happen.
- And he was a teenager when he was arrested?
- Yeah, he was 17 or 18 at the time.
He'd be in his early twenties now.
But yeah, he went to jail
for three years on the back of that.
And his counterpart in the US went to jail
for eight years I think.
The Americans are more generous
with their sentences. (laughs)
But that started from username inquiries,
username and pivot and pivot,
and finding a key, find an email,
turn that into username, pivot again
and you find this stuff.
And there were a lot of rabbit holes along the way,
and it took several weeks to do this.
It wasn't instant.
So that's my favorite username story.
I dunno if I'll ever top it.
- Back when I was working for a company years ago,
one of the use cases for OSINT that we had
was finding missing employees.
We had a lot of employees
and sometimes one or two of them didn't show up to work,
and we'd have to call them and email them
and try to find them.
And I remember one time,
this person just didn't reply to their emails,
didn't reply to their phone.
We tried next of kin.
Nobody had any idea where this person was.
And so naturally we start thinking
this is a case of public safety.
We don't know where this person is.
We hope that they're okay.
And so what we started doing was taking those selectors,
those phone numbers, emails, usernames,
and then looking at social media.
And we didn't find anything.
We knew that they took off on a flight from one place,
and they were supposed to go see a client for work,
and they never made it.
And so after exhausting all the social media platforms,
looking at all of the other places,
we decided to branch out and widen the area
and start looking at news events that had happened.
And we took the flight number, the destination,
and this person, not even this person's name,
but just those things and we just started searching.
We found on a news site that there was a medical emergency
that had happened while the airplane
that this person was flying on
was en route to his destination.
And it said that the person, the patient, whatever
was taken immediately to this hospital
for further evaluation or emergency surgery.
It turned out he had an appendicitis attack at 35,000 feet
and the only way we knew about this and knew where he was,
was from some public events that were shared.
- I've joked multiple times now
about going and living in a cave.
But I mean, the world is so connected these days.
I suppose the advice, or what advice would be,
be careful with what you share online.
Be careful with your personal data.
Is that kind of the bottom line?
- Probably Google yourself. - Google yourself is better,
because one of the things that you'll find is that
some of the stuff out there, David,
it's not stuff that you've posted or maybe even your family,
but it's stuff that,
I don't know if you're a runner or a bicyclist
and you compete in races.
- I'm an IT guy.
I don't exercise.
- Me neither. Me neither.
I gave it up for privacy reasons.
Well, when you finish your race or whatever,
they put your name, your age, and other thing, your time,
online for other people to get.
And I don't want people to get that.
But I was doing a case one time
and I was looking and my target was a runner.
And I noticed that on every finishing race results list,
there was a woman with his same name
that finished just a second or two faster
and she was eight years old.
And I was like, well, okay, same last name,
runs every single race that he does, eight years old.
This is probably his child.
And sure enough, just by looking at those running races
which were public data, it was easy to identify that.
So using the Google technique
will help find those things too.
- Weren't the Americans in Iraq or something
and they were running and their Fitbits-
- You're about Strava.
Strava's an exercise application.
Been around for a while.
And it allows people to use their smart watches and Fitbits
to track where they go using GPS,
and then they upload that data to a website.
It's a social website
so that they can share that data and say,
"Hey, Technisette.
Look, I ran over here."
One of the biggest problems that has come to bear with that
is that many places where service people
from around the world were actually running
were on bases that may not have been
in public satellite imagery.
So in 2018 when Strava aggregated
a whole bunch of those runs, those bicycle rides,
those walks that people had generated
and they essentially updated this heat map.
And you can go to the Strava heat map now online,
and you can look at an area
and the brighter a path or road is
the more activity has happened there.
The idea there is that if a person
in a certain country or city
is in charge of maintaining trails,
they can look at the Strava map and say,
"Oh, this is very bright.
This trail is heavily used."
The problem became is when people made that map
have a dark background,
and then they moved over places where there were no roads.
and they saw very bright areas
like in the middle of the deserts
in different places in the Middle East.
They would look in those deserts and say,
"Hey, there's a very bright spot there."
And when you look at the Google satellite imagery,
there's nothing there but desert.
And yet, if you look at the Strava data,
you can see that people were absolutely running
on a very, very structured road layout.
And Strava, to their credit, once people said,
"Hey, you're revealing where our bases are,"
Strava removed some of that data.
But yeah, I gave a talk back in 2015 about that,
where people over there in the UK were making their,
well, a company over there in the UK
was making their guards use Strava
as they walked their patrols around different facilities
and then their guards would log in,
Patrol Steven and Technisette at 04:25,
and they put that out publicly.
And I looked at the Tilbury power substation over there
and you could see the exact path aggregated over time
and this heat map of where the guards were walking
and where they weren't walking as well,
and it was incredible.
- If someone wanted to do something nasty,
that would show them where to attack basically.
Is that what you're saying?
- Yeah, absolutely.
In this exact case, the guards would walk along
the west, south, and east sides
of this Tilbury power substation.
The whole northern side was never, ever walked on,
at least never walked on while the person
was logging things to Strava.
It absolutely can be used for reconnaissance and physical-
- It is however far less than it used to be,
because the functionality for other people
to see where you were,
so to actually see the tracks you were running onto,
this feature was called fly by.
So you would be able to upload a route
and to see whoever flew by the location
you were running, walking, or cycling on.
And Strava actually turned this off by default.
So if you want to share publicly
what your exercise route is,
you have to manually switch it on again.
So the amount of data that was found a couple of years back,
it's probably not the same as it is today.
For everybody who's now very anxious
watching this YouTube video,
like, oh my God, my Strava data is out there.
If you have never switched this on, this is still off.
But maybe check your Strava privacy settings
just to be sure. (laughs)
- Yeah, you're not making me any more confident,
because I'm talking to the three of you
and the more I listen to the three of you,
the more anxious I get about like, okay,
I'm gonna go live with that cave.
Hopefully I've inspired people watching
to go and Google themselves,
and also get into this field
because it's very much a growing industry, isn't it?
There's a lot of demand.
Is that right?
- Google yourself.
And if you want to show your employer
the benefit of OSINT, Google your company
and you'll find lots of security
and other skeletons in the closet
that you wouldn't find otherwise.
Yeah, Google yourself and Google your employer. (laughs)
- Well, thanks so much.
I really wanna thank the three of you
for spending so much time with me.
Hopefully I can convince you to come back
and perhaps get into more techy stuff,
like get into the weeds.
We've done a little bit about that.
But for the audience, any of you watching,
please put your questions below
that I can ask in another video,
or we can answer in the comments below.
Really wanna thank you for spending so much time with me.
Thanks.
(upbeat music)
- The more you learn about open source intelligence,
the less likely you are to publish, to post to social media.
It's just scary what's out there.
- I hope you recorded that. - Nope. I didn't.
- Well that's good.
I recorded it in Zoom,
so that's- - No!
(Technisette laughs) - I'm kidding.
If you don't want me to post that, I won't.