Hello, my name is Yasmine Belghith and in this video, I'm
excited to share with you our research: Exploring the Social
Structures of Open Source Intelligence Investigations.
This work was done in collaboration with Sukrit
Venkatagiri and Dr. Kurt Luther. Investigations online have been
increasingly conducted by crowds using publicly available
information. While some are successful at uncovering crimes
and supporting crisis responses, they're also known for their
notorious failures such as vigilantism, misidentifications,
and doxings, like in the case of the Boston Bombing, or the more
recent Capitol riots. Within online investigations, we find
the field of open source intelligence. OSINT refers to
data that can be gathered from publicly and legally available
sources. OSINT experts collect, verify and analyze that data to
conduct their investigations. OSINT investigations have
successfully identified rioters at the Capitol, human rights
violations in Syria, and have more recently been a reliable
source for real-time news on the war in Ukraine. One reason for
OSINT investigators' successes may be due to the community of
practice they are a part of, with its unique approach and
underlying philosophy. OSINT investigators often come
together as a community. Due to the range of OSINT
investigations and applications and the need for individuals
with diverse domain expertise in the field, both collaborative
and competitive organizations play an important role in
building the OSINT community. These organizations conduct
real-world investigations but also simulated ones to engage
investigators and train novices. For instance, the Citizen
Evidence Lab at Amnesty International is an example of a
primarily collaborative organization where members
collaborate to conduct real-world investigations
surrounding human rights violations. On the other hand,
Hacktoria organizes competitions in the form of Capture The Flag
or CTF contests with simulated investigations. In the
organizations, we find expert OSINT investigators as
organizers, and we also find contributors who are other
expert and novice investigators assisting the organizers in
their investigations. For our study, we interviewed 14 expert
OSINT investigators from both collaborative and competitive
organizations conducting real-world and simulated
investigations to: first, provide a description of the
OSINT investigative community as a community of practice, and
surface its three key elements, a culture of transparency, the
presence of an adversarial mindset, and the collaboration
of individuals with diverse motivations and backgrounds. We
also describe social structures and dynamics within and outside
of the community and characterize social OSINT
tactics as a combination of competitive and collaborative
approaches used in structuring OSINT investigations. Finally,
we also suggest tool design recommendations to better
support OSINT, and more generally crowdsourced
investigations. Due to the time constraint, I will focus on the
second contribution. This diagram depicts the social
structures and dynamics within and outside of the OSINT
community. In our paper, we discuss social dynamics with
organizations they work within, organizations or individuals
they work with, and organizations they work for.
Because of our limited time, I will focus on the collaborative
and competitive structures within the organizations as well
as their blending into social OSINT tactics. First, we look at
primarily collaborative organizations, which are more
prevalent in real-life investigations because of how
vast the OSINT field is, as P3 shared, "the open source
community generally is super collaborative. And that's what I
love about it. And I think anything we all do in this field
should be emulating that, collaborating with different
partners, across disciplines, and covering different sectors."
These organizations are characterized by more structure
and hierarchy and less explicit rules about which tools and data
to use and how tasks are structured. They rely more
heavily on the expertise and creativity of their contributors
as P14 shared. They also emphasize transparency and
robust communication throughout their investigative process and
promote the establishment of strong bonds or friendships
between the contributors, which strengthens their resilience
through the sometimes frustrating investigative
process. Second, we look at primarily competitive
organizations. These mostly conduct simulated investigations
in the form of Capture The Flag contests or quizzes. As P11
shares, "a healthy dose of competition can help definitely
people move faster and refocus at times, because also again,
the open source investigation, you can go down so many rabbit
holes."
These organizations are characterized by less structure
and hierarchy, allowing their members to form their own
investigative teams, but more explicit rules on how to conduct
different tasks to keep a level playing field, as P6 mentions.
These organizations have gamified the investigation
process to motivate participants and increase engagement, as P8
says here, while still conveying the foundational principles of
the community. We also observe the presence of an adversarial
mindset inherent to investigations and contests in
general, which sometimes leads to a desire for recognition as P
14 shared, the contributors "naturally want to show outputs
that different teams have like stories, reports or legal
memos." Eight of the 14 organizations we studied,
however, blend either competitive or collaborative
strategies within their structures. In primarily
collaborative organizations, we see competitive strategies
introduced in the form of red teaming. As P 11 explains,
"we'll bring another open source investigator who wasn't working
on the story, and that person will go through the story with
the idea of I need to break that story, I need to find a hole in
that story, I need to find a mistake." We also see the use of
gamification. These strategies allow investigators to build
sounder investigative arguments and keep contributors engaged in
the process. On the other hand, in primarily competitive
organizations, we see collaborative strategies in the
form of team-based competitions, where team members collaborate
and share their skill sets throughout the contest. So where
do we go from here? We suggest that further blending of
collaborative and competitive strategies can be beneficial,
but has to be implemented carefully, as past research
shows that competition can sometimes inhibit collaboration.
First, in primarily competitive organizations, we can introduce
more collaborative strategies such as rewarding competitors
who exhibit collaborative behavior throughout the contest,
or designing positive goal interdependence in the contest.
This would reduce the amount of duplicated efforts by teams and
incentivize contestants to share their expertise and findings
with others. On the other hand, more competitive strategies can
benefit collaborative organizations by limiting
groupthink and inaccuracy blindness, as well as allowing
investigators to leverage encapsulation and gamification.
More generally, we suggest that establishing strong social ties
and friendships between investigators can provide
advantages beyond sense-making and creativity, strengthening
the available support systems and building resilience. Thank
you for your attention, and please reach out with any
questions, thoughts, or comments.