Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Chapter 17. Forums and question and answer sites

Abstract

Forums, at their heart, allow people to post topics and for others to reply. Discussions are usually grouped together by topic. A spin-off of the Internet forum is the question and answer site. People certainly post questions and look for answers within forums. However, there are sites dedicated to question asking and answering, usually with less support for sustained discussions and more support for highlighting the best answer. This chapter presents an overview of the different types of information people share on these sites and how to find those people.

Keywords

Social media

Social networks

Forums

Q&A

Question answering

Yahoo ­answers

Long before Facebook, Twitter, or even “old” social networking sites (like Myspace and Friendster), there were internet forums. In fact, Usenet, one of the first manifestations of this, came about in 1979—over a decade before the World Wide Web was invented.

Description of Forum- and Q&A-Style Sites

Forums, at their heart, allow people to post topics and for others to reply. Discussions are usually grouped together by topic. A spin-off of the internet forum is the question and answer site. People certainly post questions and look for answers within forums. However, there are sites dedicated to question asking and answering, usually with less support for sustained discussions and more support for highlighting the best answer.

There are thousands of these sites. While some are general purpose, many are dedicated to a particular topic. Communities can (and often do) form within these forums. The result is that, if you can locate a target on one of these sites, the content of his or her posts and interactions can provide great insight into them, including their interests and personality.

The basic premise of forums is that someone starts a discussion thread, with a question, image, link, etc., and others reply. Figure 17.1 shows an example discussion about cooking for dogs taken from the forum section of dogster.com. Each post is shown in its own box, with a picture, name, and other info to the left. The posts also have a date and time when they were posted. This type of configuration is commonly seen across most forums.

FIGURE 17.1 An example discussion from the Dogster forums.

Question and answer sites have a similar structure. Figure 17.2 shows a question and answers from the popular site Yahoo! Answers.

FIGURE 17.2 A question and answers shown on the Yahoo! Answers site.

Users can also maintain profiles on the site. These may be simple, like a list of posts they have made, or only a name and date they joined. They can also be long and detailed, similar to a Facebook profile, with pictures, personal information, likes and dislikes, and more.

As an example of more extensive profiles available on these sites, consider Ask.fm, a question-answer site dedicated specifically to asking people questions about themselves. A person's profile contains their answers to all the questions people have asked them.Figure 17.3 shows Malcom's Ask.fm profile.

FIGURE 17.3 Malcom's profile on Ask.fm, which includes his answers to all the questions people have asked him about himself.

Major Forums and Question and Answer Sites

As mentioned above, there are thousands of internet forums. Some are public and easy to find and others are quite private, known only to their members. Some are free and open to join and others are restricted to approved or invited members only.

The ten most popular forums¹ in Table 17.1 show the diversity in number and topic. Also, note that even the largest of these forums is much smaller than any of the social networking websites we have looked at.

Table 17.1

The Ten Most Popular Online Forums

Question and answer sites tend to have more general topical focus (though it could be argued that they are just forums with a question and answer topic). Ask.fm is among the most popular of these, with 125 million registered users. The site trends young, with most users in their teens or early twenties.

Yahoo! Answers is also very popular. The exact number of users is hard to define, since anyone with a Yahoo! account for any reason has a Yahoo! Answers account by default. However, Quantcast² estimates it has about half the number of visits each month thatAsk.fm receives.

For investigation purposes, it is certainly worth looking for people on some of these large sites, particularly the question and answer ones. However, a more effective strategy is often to find forums that focus on specific interests of your target and then look for the target there.

Finding People

Because there are so many forums and question and answer sites, there are a number of strategies to use when looking for people. We will look at two major categories of search:

• A wide search, when you don't know what sites a target might participate in

• A narrow search, within specific forums

Wide Searches

When you don't know where you might find a target, Google searches may be your first best bet. If you have a known username for the target, simply searching for that username and the word “forum” will often turn up results. Since most forums have the word “forum” somewhere on the page, including the word in the search will narrow down results. This Google search is particularly effective when the user has a distinctive username; one that is a common word is less likely to be effective.

As an example, a search for “malcomcsmith forum” turns up a few false results and links to posts Malcom has made on goldenretrieverforum.com (Figure 17.4).

FIGURE 17.4 Searching for malcomcsmith forum on Google returns a link to Malcom's page (and links to his posts) on the Golden Retriever Forum.

You may find accounts for a user on multiple forums this way. That alone can be an interesting insight into a target's life. You can potentially learn where they live, what their hobbies are, and what issues matter to them.

Note that not all forums are included in Google's search results, so you may not find all the forums a user participates in this way.

Narrow Searches

Google can also be useful for finding forums dedicated to particular topics that may interest a target. Searching for the term “forum” with any given topic is likely to turn up at least one forum result. Then, you can search for a user within that forum.

Question and answer sites have mixed search capabilities. Yahoo! Answers has basically no functionality to search for a user. A Google search restricted to the answers.yahoo.com domain may help you find a user. However, Yahoo! Answers does not have usernames—user profiles are shown with a name only (e.g., “Bob”), and they are usually first names. This makes it difficult to get a unique search result for a person. However, if the user has a unique name they might use on the site, a Google search like the following may work:

site:answers.yahoo.com “Malcom Conroy-Smith”

Ask.fm, on the other hand, has a search feature that lets you search by first and/or last name, username, or email address, or if you connect through a Facebook or Twitter account, you can search for anyone in your friend or follower list. Figure 17.5 shows theAsk.fm search interface. You can get to it by clicking the “Search” link at the top right.

FIGURE 17.5 The Ask.fm search interface.

Forums run on many different platforms. Most websites do not implement the forum component of their sites from scratch; they usually install existing forum software on their servers. The two most popular forum software packages are vBulletin and phpBB. You do not need to know about these to conduct an investigation, but their popularity means that knowing how to search and interact with each can be useful when working with many different forums online.

If you encounter a forum that uses either of these packages to run their forums, they may have the following search features. However, server operators can adjust the code and turn off some features. Also, some sites may require you to be registered and logged in before search options become available. Thus, consider these guidelines for the search capabilities that may be present.

vBulletin

vBulletin includes an advanced search option that lets you search for users through a variety of attributes. You can search by email, the username they use on the service and sometimes their username on other services (like Skype or Yahoo!), location, and even in the “biography” text a user has written about himself or herself. You can even search by IP address, the unique numerical address (e.g., 192.168.0.1) that identifies each computer on the internet. Figure 17.6 shows the advanced user search options as described in the vBulletin manual.

FIGURE 17.6 The advanced search option on vBulletin-powered forums.

Again, not all sites will make all these options available.

phpBB

phpBB also has an advanced search option to find users. It too includes search by username on the site and on other services, as well as search by email and IP address. Figure 17.7 shows the phpBB advanced search that may be available on some forums running this software.

FIGURE 17.7 The phpBB advanced user search interface.

General Search Tactics

In addition to these advanced user searches, the social searches described for many other social media sites can also be effective in forums. If you can locate a friend of the target, you may be able to look at that person's “friends” list on the forum and identify the target in that list. In general, you can see a list of friends for any person on the forum, though this may be restricted unless you are logged in as a forum user. Searching these lists may turn up the target.

An important note: As described above repeatedly, many forums restrict your ability to search and view information if you are not a logged in user. While registration is usually quick and relatively anonymous, many forums show users a list of people who have visited their profile pages. Thus, your browsing through profiles will not necessarily be anonymous.

Obtaining Data

Each forum and question and answer site is likely to have different information available about users, but they follow a similar structure in providing it.

First, you can get to a person's profile either through search (discussed above) or by clicking on their name next to a post they have made. Figure 17.8 shows an example post by Malcom. His username and picture are above the post. Clicking his username would take you to his profile page.

FIGURE 17.8 A post by Malcom on a forum. Clicking his username above the post would take you to his profile page.

Other sites may have the username and photo off to the left or right of the main post text.

Profiles are likely to contain some personal information, like name, location, and the date the person joined the site. They often have additional data specific to the topic of the site. For example, the popular forum at Bodybuilding.com has options to include information about bodybuilding goals, body fat percentage, photos, weight history, and supplements being used. Each forum may have its own personalized profile information. Profiles often have a list of posts a user has made.

The posts themselves are great sources of insight, though it requires more work to get that insight than simply reading attributes from a profile. The posts will let you see how the target interacts online and may also contain text about his interests, movements, and activities.

Case Studies

Investigators have used postings from forums and question and answer sites in a number of ways.

Case Study 1

One case is that of Adel Daoud, an 18-year-old man arrested as part of an FBI sting in Chicago.³ FBI agents provided him with a fake bomb and arrested him after he tried to detonate it outside a Chicago bar. He came to their attention through his posts on Yahoo! Answers. These allegedly included talk of violent jihad, and, according to The Chicago Sun Times,⁴ he posted “Hmm. WELL on a personal scale i hate Shiites, Christians, Atheists and then Jews.”

He also is alleged to have had a private chat in which he said he wanted to be a martyr and that he wanted to make a bomb. The posts he made online, especially the public posts on Yahoo! Answers, were a core part of the evidence brought forward so far in his legal proceedings.

Case Study 2

In a gruesome case, a 16-year-old Japanese girl was arrested after posting on the popular Japanese forum 2channel about murdering her 15-year-old friend and classmate.⁵

The Japan Times reports that she started a thread titled “I have ended up killing” that included the message, “Oh no, blood keeps pouring out even though I have wiped it away many times.”⁶

She also allegedly uploaded photographs of the dismembered body of her friend. Her posts went up late on a Saturday night and prompted a police investigation. The girl was arrested hours later and charged with murder on Sunday.

Case Study 3

Not to be outdone, a British man was arrested after befriending a 14-year-old girl on a fetish-oriented internet forum and plotting to kill and eat her as part of a cannibalism fetish. He had posted on the board that he already had consumed “a woman aged 39 and a 5-year-old.”⁷

Case Study 4

Internet forums also helped catch a man who, in 2009, threatened to kill the then-President-elect Barak Obama.⁸ The man, Steven Joseph Christopher, had previously threatened to assassinate President George W. Bush.

In January 2009, he posted several times on an alien- and UFO-oriented internet forum at alien-earth.org about his plots. Below is the text of three such posts released by the Department of Justice, who removed some of the racial slurs.

ok we have 6 days until my Presidential Assasination.

Yes, I have decided I will assassinate Barack Obama. It's really nothing personal about the man. He speaks well, has a loving although controlling wife and two cute daughters. But I know it's for the country's own good that I do this. And I'm not racist either, my family is a little, but isn't all Italian and european families? I mean how many times have you heard the word (racial slur) in the comforts of your home? I have a lot, and it really bothered me and I would confront them about it. No, it's not because I'm racist that I will kill Barack, it's because I can no longer allow the Jewish parasites to bully their way into making the American people submit to their evil ways. How many of you Obama supporters are now disappointed after some of his arm-twisted Jewish appointee decisions??? Make's you think he's not really in charge (which he isn't). No it's the same old, same old filthy (expletive) (racial slur) who are poisoning America, who have murdered thousands of innocent lives on 9-11-01, and are thinking that they are going to get away with it again.

Barack, I view more as a sacrificial lamb, but the sacrifice MUST take place. He had good intentions, but like the Steve Taylor song goes, “a politician next door, swore, he'd set the Washington arena on fire, thinks he'll gladiate them, but they're gonna make him a liar.”

So, I'm stuck here in Mississippi, and I'll need bus fare or some way of getting to Washington. I don't own a gun, so maybe someone can give me one. And I'll need a leak in the secret service to get a close up shot, somewhere close to the podium, since I've never fired a gun, so I need to get an easy shot off. Wattdysay fellas? Any help?You all know we can't live with the jewscum anylonger, dont cha? You got a better solution? I'm all ears.

Stevie

RE: ok we have 6 days until my Presidential Assasination.

Why is your heart so wicked?

I can get away with actually murdering Barack Obama OR just threatening to do it.

hth

To those who still think I'm a nobody, who antagonize me, who seek for my capture and arrest……

I wll have you found, arrested and executed, if you push me too far.

Christopher made the threats on January 11, 15, and 16. Secret Service agents read the posts and used them to track down the man's IP address, which they used to determine the place he was staying. He was arrested on January 16, the same day as his last threat. He was eventually convicted and sentenced to three years in federal prison.⁹

Conclusions

While any individual online forum or question and answer site is smaller than most social networking websites, they can be excellent sources of insight when investigating a target. There are forums for just about every imaginable interest online, and active participants may have thousands of postings. Profile information can also be extensive, but the text of the posts themselves is the most valuable data. It not only may describe crimes or plots but also may give a detailed picture of a person's beliefs, interests, movements, and the way they interact with others.

Not only may Google searches help find evidence of a target posting on a forum, but also it may be productive to first identify forums where a target might post and then search for them there. Policies vary from forum to forum, but some will require you to have an account and be logged in before you can search or access posts and profile data. Furthermore, users may be able to see when you have visited their profile if you are logged in while browsing.