Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)
Chapter 25. An Example Investigation
Abstract
Many of the investigation stories in Social Media Investigation are relatively simple: A target uses one social media site, and an invsestigator collects information through that site. With large sites like Facebook and Twitter, there is often a good chance a target will have an account, so this is a good strategy. But some investigations are deeper and require more thorough methods. In this chapter, we examine one such case. This is a step-by-step description of an actual investigation that I was asked to do. I am anonymizing the identity of the target for her protection, as she has not been arrested or charged with any crime. This story is intended to demonstrate the investigative process, including all the dead ends that led to the final insights.
Keywords
Social media
Social networks
Investigation
Many of the investigation stories in this book are relatively simple: A target uses one social media site, and an investigator collects information through that site. With large sites like Facebook and Twitter, there is often a good chance a target will have an account, so this is a good strategy.
But some investigations are deeper and require more thorough methods. In this chapter, we will examine one such case. This is a step-by-step description of an actual investigation that I was asked to do. I am anonymizing the identity of the target for her protection, as she has not been arrested or charged with any crime. This story is intended to demonstrate the investigative process, including all the dead ends that led to the final insights.
The Target
The target of this investigation, whom I will call “June Collins,” is a woman who has an unhealthy interest (perhaps obsession) for a classic rock band. Her interest was especially focused around one band member in particular, whom I will call “Dan.”
June maintains Facebook tribute pages to Dan. She travels around the country to see Dan's band and always has pictures taken with them. She also sends Dan emails and gifts. But it was when she showed Dan pictures she had taken of his house—a few hundred miles from where she lives—that she was brought to my attention. Dan was concerned that June's interest had escalated to a level where she might be dangerous.
The Background
Initial Information
The initial information I had for June included some screenshots of discussions she participated in, from her Facebook tribute page to Dan. In the discussions, she would occasionally post angry rants about other women who had an interest in Dan, especially if they posted a comment she disapproved of. She actively banned people from viewing the fan page (and her profile page).
Her true name was very common, so simply searching for her on the web was not likely to return good results. She also appeared to have several fake accounts that she used to post. The language used in the rants from these fake accounts was very similar to the language in June's own posts. Also, June's profile picture was a photo of her and Dan together, while the fake accounts' profile photos were beach scenes; no actual person was shown. While this is not evidence of anything by itself, it might suggest that someone did not have a personal profile photo to upload.
The Investigation
Facebook, Part I: Finding an “In”
I began by visiting the Facebook fan page for Dan. Since the fan page was public, I found a few posts by June. These linked back to her Facebook profile page. She had her privacy settings turned on quite high, so I could not find any information about her from her page. In fact, I could not even send her a friend request, since we did not have any friends in common. (This is a Facebook setting people can choose to protect themselves from “spam” friend requests.)
I decided to start by sending friend requests to active members of the fan page. I assumed that some of them would be friends with June, which thus allows me to send her a friend request. I became a fan of Dan's page myself and sent the friend requests. I did not include any messages with these requests; there was no deception. I simply befriended people who actively posted in the community, particularly people who had liked or commented on things June had posted.
Within an hour, one member had accepted my friend request. He was friends with June, so I could now send June a friend request. This would show up as a request from someone who had a friend in common with her.
Other Social Networks, Part I
While I waited for her to respond to my request, I began searching for her in a number of different ways on the web.
I started with her Facebook username, which was something like June.collins.4121. However, this did not turn up anything outside of Facebook. I also saved a copy of her Facebook profile picture and did a Google image search for matching pictures, in case she had used it on other profiles. However, that returned no results either. I searched for forums or forum posts centered around Dan's career, hoping to find posts by June. No luck.
I went to both Twitter and Pinterest and searched for her by name. Since I had a photo of her from Facebook, I hoped I would be able to identify her visually in a profile picture. This did not turn up any accounts that I could identify. I also searched on Pinterest for boards dedicated to Dan, thinking she might have maintained one of these, but there were not any. I even looked at photos of Dan posted on Pinterest, but there were not too many. I was able to check out each one and confirm that, as far as I could tell, it had not been posted by June.
On LinkedIn, there were over 350 people with June's name. I went through the list by hand, looking for people in her known home state of North Carolina. I found one woman who did not have a profile photo. She was a fourth grade teacher. I then searched for her and the name of her school. This Google search eventually leads to a Facebook page for her church that, in turn, linked to her Facebook profile. It was not the June I was looking for. I went through a few more dead ends before hitting page 8 of the search results, where I found a profile with her photo on it. It was the same person in the Facebook photo.
Unfortunately, this page did not provide much more information. She listed no places of employment, and her connections were not visible. All that showed were interests in freelance writing and photography. Using a nonpersonal account, I sent her a LinkedIn connection request.
Other Social Networks, Part II: First Success
However, since she had a different profile photo on LinkedIn than she had on Facebook, I did another Google image search for photos. This time, I looked for those that matched her LinkedIn picture.
I was rewarded with four hits, all on the internet forum “Find A Grave.” This site is dedicated to locating grave sites of celebrities and people's ancestors. The first hit was for June's profile page on this forum. It included a rambling and somewhat patronizing message, instructing people on what was “respectful and appropriate,” which was very much in line with her tone on Facebook.
The site provided a list of her ancestors and links to many pages she created and maintained, which described the graves of her relatives. The comments on her profile page also indicated that she has asked several people to transfer control to her for pages that they had created for graves of her relatives.
This was actually an important insight, even though it did not have anything to do with Dan. The fact that she used a condescending, demanding tone in her posts and that she overreached her bounds in a need to control things on this grave-oriented website indicated that her behavior was typical of her personality and not restricted to her interest in Dan (Figure 25.1).
FIGURE 25.1 An example page from Find A Grave, a site where users maintain pages about people and their grave sites.
June did have a username on Find A Grave that was not simply her name. Unfortunately, this name was also extremely common—something many different people would use across sites. Still, I tried searching for the username along with Dan's name and his band's name on Google, but there were no promising results.
Facebook, Part II: Fake Accounts and Friends
Back on Facebook, I looked for a couple of the fake accounts that Dan suspected June of maintaining. One had disappeared, but one was still active. Using the screen grabs, I was able to match photos from the deleted account with photos on the active fake account. Both used the same beach scene on their profile pages. Again, while this is not necessarily evidence of anything, it suggested a possible connection between the two pages. I checked to see if the active fake account was friends with June, but I could not see a connection there (possibly because there was none or possibly because of June's privacy settings).
By this point, June had logged on and accepted my friend request. Now, I could see all her posts, photos, and profile information. Browsing through her photos and status updates, it became clear that she was obviously a serious fan of Dan and his band, but she also mentioned other bands. She also mentioned her interest in tracking down the grave sites of famous actors and her family members, echoing what I found on the Find A Grave forum.
Facebook, Part III: Findings
About half her posts detailed her trips to see Dan's band or other bands perform. She talked about breaking down in her car when she heard one band member was retiring. The other half of her posts were both melancholy and somewhat self-righteous. Examples include
• “How frustrating it is when you're the only person who can see how evil and sneaky someone is and everyone else is blind to it,”
• “Sometimes it's better to be alone nobody can hurt you,” and
• “A successful woman is one who can build a firm foundation with the bricks others have thrown at her.”
Her profile included links to her Twitter and YouTube pages. Her YouTube channel was dedicated to a totally different artist, featuring tributes to him and videos of him performing.
Her Twitter handle included Dan's last name in it, but her tweets were protected. I sent a follow request to her from the Twitter account that matched the Facebook account she had already approved. To gain her trust through mutual interests, I tweeted a link to a video from Dan's band, so she would see it if she checked out my profile.
Other Social Networks, Part III
As I waited to see if she would respond, I used her Twitter handle as a username in another Google search. This username was more unique. It turned up June's Pinterest account (with her real name attached to that Twitter handle). The account had only one photo posted, and it was of a band in the same genre of Dan's band (but not Dan's band itself).
It also turned up a single post on the weight loss site MyFitnessPal, which did not have anything to do with Dan.
At this point, I had a pretty clear picture of June's activities. She had not replied to my requests to connect on LinkedIn or Twitter, but I felt like the other sources had provided enough background to draw my conclusions.
Investigation Results
After reviewing all the information available about June on Facebook, Twitter, YouTube, LinkedIn, and the forum site Find A Grave, I was able to draw a few conclusions about June.
First, she ties a lot of her identity into her fandom for bands in general and Dan's band in particular. She is definitely a big fan of Dan himself as well. She follows the band around the country and posts about them frequently on a number of platforms. However, Dan (and his band) is not her only focus; she talks about other bands and maintains fan pages for them, too.
She is also a lonely person who does not seem to be happy with her life. She does not have a career, and her posts suggest she is divorced and unhappy being single. She gets angry with people for perceived small slights and responds with long, angry rants and often completely cuts these people out of her social media life. Many of her posts are preemptively defensive, warning people about the potential consequences if they get in her way. Yet, she has no power to actually do anything to anyone who “crosses” her, except to block them.
Taken together, it seems that June's few interests form the core of her personal identity. Her confidence is low, and she holds on to these interests with fierce intensity. At the same time, it seems that she has never done anything to anyone who hurt her except to complain about it or hide from them.
In addition, she had interests beyond Dan and did not post anything especially creepy about him. Her enthusiasm seemed unhealthy, but not dangerous. Thus, as a result of the investigation, I reported back to Dan that nothing on social media indicated he had to worry about June.
Conclusion
This investigative process is typical of what I do when I'm looking for information about someone online. It shows the different types of social media to look at, the various and repeated Google searches for profile photos and usernames that can turn up previously undiscovered accounts, and techniques for gaining access to information restricted to a person's online friends.
Not all the techniques will be right for every investigation. In particular, you may have rules that prohibit you from friending people from fake accounts. However, most of what I did here required no interaction with the target. It is also important to recognize that many searches I did failed to find any useful information. That is typical of these searches—though usually, as in this case, you will eventually turn up information on someone who is active online.