Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Chapter 8. Facebook

Abstract

Facebook is a social networking site and jockeys for position with Google as the most used Web site in the world. They report 1.4 billion monthly users, which constitute over half of the worldwide population of Internet users (currently estimated at 2.4 billion). Facebook is a place where people come to share links, play games with friends, post photos and videos, share their location, and find trending news. Its usefulness goes far beyond the ability to post a simple update or maintain a profile. This chapter presents an overview of the different types of information people share on the site and how to find those people.

Keywords

Social media

Social networks

Facebook

In my own work, I was approached by a woman who wanted help finding someone online. Her niece, “Carol,” had lived several states away in the Midwest. Carol had died a few years earlier in a highway accident. She had had a rocky relationship with her husband, “Mike,” and they had been separated at the time of her death. Carol was cremated, and after the funeral, Mike was given possession of a family heirloom that had been given to Carol when she left home. It had little monetary value but a lot of sentimental value for the family. My client’s sister, Carol’s mother, had requested the heirloom be returned, and Mike had offered to hand it over for a price. Carol’s mother balked at the idea of paying for this kind of transfer, so Mike left town and brought Carol’s heirloom with him.

Not having the family heirloom had become an emotional hardship for Carol’s mother. My client saw this and decided to make a deal with Mike on her own to get the object back. The only problem was that my client did not have any information about how to reach Mike. No email address, no phone, and no idea exactly where he was living.

We started by searching Carol’s Facebook profile. It was still active several years after her death, but she had deleted all of her connections with Mike when they had separated shortly before her death. This ruled out finding him through a known associate. Furthermore, Mike had a common last name, so there were thousands of people on Facebook who had his name. It was impractical to search for them all. A search using an old email address for him also turned up nothing.

Finally, we turned to Facebook’s graph search. This allows you to search for a name and then use filters to narrow down the search results. We searched for Mike using his full name and then filtered the search to only people living near the medium-sized city where he had last lived. This returned only four people. We ruled out one by the picture (a man shown with his wife and three children who was clearly not our Mike), one was excluded because he attended a high school in a different state than where our Mike was from, and one was excluded because he graduated from a university that we knew Mike had not attended.

This left one option, but it was not necessarily the Mike we were looking for. Our Mike might have used a fake name or location or simply not have been on Facebook at all. Examining the profile, however, showed conclusively that this was our target Mike. He listed Carol’s father on his profile page as “father-in-law” and mentioned Carol in several posts.

Using a fake Facebook account created just for this purpose, my client sent a friend request to Mike. After he approved it, she reached out to him with a Facebook message and offered to make arrangements with him to transfer the heirloom. Mike responded within a few hours and named a price. My client agreed, and within a few days, she flew to the Midwest airport closest to Mike, met him at a prearranged time, and made the exchange.

Carol’s heirloom is now home with her mother, all as a result of a Facebook investigation that allowed my client to reach out to her husband.

Facebook Overview

Facebook is a social networking site and jockeys for position with Google as the most used website in the world. They report 1.4 billion monthly users, which constitute over half the worldwide population of internet users (currently estimated at ≈ 2.4 billion).

Reflecting back on the categories of sites listed earlier in the book, Facebook can fairly be called the social networking site, since there is a heavy emphasis on creating connections with friends. The information users post is shared with their friends, and when users log in, they see a list of posts that their friends have made. However, Facebook is not just a social networking site; in many ways, it can be considered a one-stop destination for everything a person might want online.

We will discuss the different types of available data in detail below, but Facebook is a place where people come to share links, play games with friends, post photos and videos, share their location, and find trending news. Its usefulness goes far beyond the ability to post a simple update or maintain a profile.

Basic Facebook Activities

Users can do many things on Facebook, but this chapter will focus on a core set of activities.

Adding Friends

Having social connections is a prerequisite for any social network. It’s therefore no surprise that one of the main features of Facebook is the ability to create lists of friends. When a user finds someone on Facebook they want to be friends with, they can send a friend request. If the recipient of the request approves it, the two users become friends. The main result of this is that each person will be able to see updates that the other has created. We discussed how this information is displayed later on in this chapter.

Status Updates

The main way that users share information with their friends is through a status update. Updates are usually text but may also contain links, photos, videos, and location information. Users can also “call out” friends by name in their updates.

Figure 8.1 shows the basic interface for creating a status update. This appears on the top of most pages that users see on Facebook. They can type their update into the box and add other data if they choose. Note that in Figure 8.1, the location icon at the bottom left of the window says “Washington.” This is Facebook automatically including the users’ location with the update. To the right of that is a camera icon that gives the user the option to choose a photo to include with the update.

FIGURE 8.1 A basic status update in the making. Note the row of icons along the bottom. The location icon indicates the status is taking place in Washington. To its right is a photo icon, allowing the option to include a picture with this update.

Another important icon to note in Figure 8.1 is just to the left of the “Post” button in the bottom right. This has a globe with the word “Public” next to it. That indicates the privacy level of the post. This post is visible to anyone online. The small triangle to the right allows the user to select different privacy levels from a pull-down menu. They can choose to make the post visible to their friends only, to themselves only (making it practically invisible), or to a custom-defined group of people.

Likes, Comments, and Shares

Users can also interact with status update made by others. Figure 8.2 shows a post made by the grocery chain Whole Foods Market. At the bottom of this post in a gray box under the image are the options “Like,” “Comment,” and “Share.”

FIGURE 8.2 An update by the grocery chain Whole Foods Market with options to like, comments, and share the post.

Liking something on Facebook is one of the most common ways users interact. It indicates exactly what the name suggests; the user clicks “Like” when they like a post.

User can also comment. In Figure 8.2, you can see the user has started typing a comment: “Yum!” The comment feature is a way that people can have a discussion about a link, photo, or other updates.

The option to share is the way people can repost something so that their friends can see it.

Liking “Pages”

Liking on Facebook isn’t only available for posts. A user can also like a “page.”

These pages are maintained by companies, celebrities, and other public entities. Figure 8.3 shows the top of the page for Whole Foods Market. You can see a “Like” button in the lower right. Clicking that is similar to creating a friend relationship on Facebook. If the user likes the page, he or she will see this brand’s updates posted on his or her newsfeed page.

FIGURE 8.3 The page for Whole Foods Market is shown here. The option to “like” the page is made available through the button in the lower right.

Third-Party Integration

Facebook has even extended the ability to like and share content to other websites. Figure 8.4 shows a screen from the retailer REI website. REI is unaffiliated with Facebook, but they have integrated a Facebook icon (visible at the top right of the page). When a user clicks this, it allows them to automatically share a link to the current page with their friends on Facebook.

FIGURE 8.4 The REI website includes a link to share product info on Facebook. This is done by clicking the Facebook icon above the product name (on the right of the page).

Tens of thousands of websites have this capability integrated. This has made it very easy for people to share interesting information on Facebook even when they are using other websites.

Components of the Facebook Site

Facebook is broken down into two major sections: the News Feed and the Timeline.

The News Feed

The first is for all the News Feed. This is the first page people see when they come on to the Facebook website. It’s a collection of all the status updates and activity announcements that their friends have made as well as updates from brands or celebrities whose pages the user has liked. (Facebook also mixes ads in with this content to make money.)

The News Feed can be sorted in reverse chronological order, so the user sees his or her friends’ most recent posts first. By default, though, Facebook tries to highlight the post they think are most relevant to the user. Facebook does not explain exactly how they determine relevance, but it combines how recent post is, how many likes and comments have been received from people, and other factors that are in a constant state of change.

Figure 8.5 shows the News Feed for our example user Malcom. If you were to scroll down, you would see more posts from his friends and the pages he has liked.

FIGURE 8.5 The News Feed of, for example, user Malcom.

The News Feed aggregates posts from all of a user’s friends.

The Timeline

All the posts a user has made are contained in that user’s Timeline. To access a user’s Timeline, click on their name anywhere within Facebook. Clicking on the name brings you to their Timeline by default. Figure 8.6 shows the top of example user Malcom’s Timeline.

FIGURE 8.6 Our example user Malcom’s Timeline on Facebook.

In addition to the user’s updates, all other personal data about a user is aggregated and accessible to users from the Timeline. In Figure 8.6, you can see “About,” “Photos,” “Friends,” and “More” in the navigation bar beside Malcom’s profile picture, toward the top of the page. Rather than explore all of these items here, we’ll cover each in more depth later in the chapter, when discussing how to obtain information about people.

Facebook Demographics

Because Facebook is so popular (1.4 billion users), it can be hard to distinguish their demographics from the demographics of the population at large. Close to 70% of the US internet-using population has Facebook profiles; similar numbers are seen in Europe. Penetration is higher in many countries abroad. Over 70% of India’s online population is on Facebook, and penetration is close to 90% in Indonesia, Turkey, and the Philippines.

Facebook users tend to be a bit overrepresented in the middle-age bracket, and the male-to-female ratio is slightly skewed toward female when compared to the overall population. Rates of adoption tend to be a bit higher among educated, wealthier adults; but there is a good chance of finding any adult on Facebook, regardless of his or her demographic characteristics.

Finding People

When you want to find a person on Facebook, there are a number of interesting ways to find them.

By Name

The most straightforward way to find someone is to search by name. The search bar at the top of the Facebook window can be used for all the searches discussed in this chapter. When you type in someone’s name, you get a preview list of the results, as shown inFigure 8.7.

FIGURE 8.7 A search for someone named “Alice Smith.”

If the person you are searching for does not appear in this list, you can also try to search for them through Google. This requires an advanced search technique. You can limit the search results to a Facebook by including site:facebook in the query. To search for Alice Smith’s Facebook page on Google, the search would be as follows:

site:facebook.com "Alice Smith".

This will return only public pages on Facebook that contain the name “Alice Smith” and results for profiles with that name will be prioritized.

By Email Address

If this still doesn’t get you to the person you are looking for, you can also search by email address. Depending on a user’s settings, this may bring up their profile page even when the name does not.

It is possible that both of these techniques fail. There are privacy settings in Facebook that allow people to prevent themselves from being found in the search. Fortunately, for the investigator, there are a number of other strategies although this may not be so fortunate for unaware users.

By Known Associations

One technique is to look for someone through their associates. If you know who your target’s friends are, try to find those friends by name or email address. From there, you can navigate to the associate’s friend page. Your target may be listed there. (More details on the “Friends” page are in the next section.)

By Likes

Another option is to find the target through their likes. When someone likes a page on Facebook, they usually appear on the list of people who have liked the page.

Using Graph Search

Facebook has recently added new support for this kind of search through a tool they call graph search. These searches can be entered into the same search bar at the top of the page that you would use to search for someone by name. However, the searches can be more complex.

For example, you can enter the search “People who like Georgetown University.” This brings up a list of everyone who has liked that page and some additional information about those people. Figure 8.8 shows a result page with the identities of the people blurred out to protect their privacy.

FIGURE 8.8 Results of the graph search for people who like Georgetown University. Note the information on the right that shows over 1000 people like this. A list of attributes for filtering also appears there.

You can filter the results by someone’s gender, employer, etc., in your search. Using these filters can help narrow down the number of results dramatically.

For example, if you started with the search above and then added filters to select only men who graduated from Georgetown (in addition to liking it) in the class of 2000, there are only two people in the results, shown in Figure 8.9. Note that the query in the search bar updated is updated to “Male graduates of Georgetown University in 2000 who like Georgetown University.”

FIGURE 8.9 A filtered graph search for men who like Georgetown University and who went to school there, graduating in 2000. Unlike the many results in Figure 8.8, these results have only two people.

Obtaining Data

Once you have found your target, you can begin looking for information on their Facebook page. Facebook does not inform a user when someone has looked at their profile, posts, photos, and so on. Thus, a user will not know that you have browsed what they’ve posted. The only way for a user to know that you had looked at their page is if you comment, like, or otherwise send a message indicating you were there.

User Timelines

Users’ Timelines have collections of the status updates they have made. Figure 8.6 shows Malcom’s Timeline.

Each status update has the text a user has entered, but there is more information embedded in it. If you click the date or time listed on a status update, it will bring up only that post in the browser.

Figure 8.10 shows one of Malcom’s updates that has been opened in this fashion. Next to his name, it says “at Elephant & Castle.” This is location information indicating exactly where the user was when he posted this update. Location data is discussed more below.

FIGURE 8.10 A post with all the associated information.

Under Malcom’s name is the exact date and time of the update, along with the city where it was posted. The globe icon to the right of this indicates that the privacy setting for this post makes it available to the general public. Different icons will appear based on the privacy setting the user has applied. Privacy levels are discussed in depth later in this chapter.

Personal Profile

Users maintain extensive personal profiles, which are relatively static and contain background and demographic data. Once you have found a person, you will be taken to their Timeline, which mostly contains their status updates. The majority of profiles’ attributes are on the user’s “About” page. You can access this by clicking “About” in the navigation bar next to the user’s profile picture at the top of the page (see Figure 8.11).

FIGURE 8.11 The “About” page for Malcom. It includes information like work and education, family, places Malcom has lived, background information, and photos.

This section is where you will find background information, including users’ employment and education history, personal traits, their relationship status, lists of relatives, organizations they belong to, and things (books, music, movies, sports teams, ideas, and celebrities) they like. Figure 8.11 shows example user Malcom’s About page.

At the bottom of the first large section, titled “About,” there is a link that says “See more.” Clicking this will bring up more extensive personal information, including contact information if the user has made it available.

Readers are encouraged to visit Malcom’s “About” page to see all the information available there.

Social Connections

Each user also has a “Friends” page with a list of his or her friends. This is accessible on another tab toward the top of a user’s page. Figure 8.12 shows Malcom’s friend list.

FIGURE 8.12 The “Friends” page for the example user Malcom.

From this page, you can click on a friend’s name to visit their Timeline and find more information about them.

Note that someone’s friends can be valuable sources of information as well. For example, Forbes magazine describes how Facebook friends can share damaging evidence during divorce cases:

Married couples often have dozens of mutual friends and connections. If the marriage breaks up, obviously some of these people will be more loyal to one spouse than the other. I’ve had more than one client report a steady stream of information about her estranged husband’s financial activities, as relayed by mutual friends who were still following his Facebook updates. So, even if he’s blocked you from seeing his posts directly, your mutual friends can still tell you all about the ski trip he took to Switzerland with his girlfriend a week after claiming he couldn’t afford to pay spousal support.

—Jeff Landers, Forbes.com¹

Activities

Users may post updates about their activities in their status updates that are visible on their Timeline. But for some events, there is a more formal log. In the same row of options with the Timeline, About, and Friends pages, there is an option that says “More ” Clicking this opens a menu that lists additional information about the user. This menu is highlighted in Figure 8.13.

FIGURE 8.13 The “More” menu on a user’s Facebook page.

Most options on the More menu are simply sections of the “About” page, but there is some additional information. One such option is “Events.” Clicking that will bring up a list of events the user has attended. These “events” are created by other Facebook users and allow people to RSVP (or choose not to). The events might be parties, sporting events, concerts, special events that businesses put on, or pretty much anything else.

Figure 8.14 shows two upcoming events that Malcom is planning to attend. The events screen was accessed by clicking on the “Events” button. Past events will also be listed on this page.

FIGURE 8.14 The events page from Malcom’s profile. This includes two upcoming events he is planning to attend.

Location Information

There are a few ways to find out where a target has been. Using the events page mentioned above is one option. It shows when people have been to an event, and patterns in those events may reveal a club, bar, or sports venue that the target visits frequently.

Status updates may also contain location information. Not every update will have a location, but users can choose to include that. If a location is included, it usually appears with “- at «location name»” at the end of the status update. Figure 8.15 shows a status update from Malcom that includes the location “Elephant & Castle,” a bar in Washington, DC. The status update automatically gets a map that shows the location when the user lists one. You can click on the place name or the map to see more precise information about the location.

FIGURE 8.15 A status update with a location “Elephant & Castle.”

In the “More” menu shown in Figure 8.13, there is also an option called “Places.” This has map pins for every place users list in their status updates and all the places they have worked, lived, or attended school. Figure 8.16 shows Malcom’s Places page zoomed in on Washington, DC.

FIGURE 8.16 The map from Malcom’s Places page showing places he has mentioned in his status updates or listed in his profile.

Clicking on a pin in this map will show all the status updates or profile information associated with that location.

Privacy Levels and Access

There are three major levels of privacy on Facebook. Information can be public, which means it is visible to anyone online, even without a Facebook account. This is indicated with a small globe icon next to the post. You can see this icon in all the figures in this chapter that show a post by Malcom.

Users can restrict their information to be visible to their friends only. This requires someone to have a friendship that the user has approved. They can also limit access to be visible to no one or to a customized list of people.

All the different types of information described above—including status updates, likes, and personal information—can be shared at different privacy levels. A user may make one status update public and restrict another to be visible only to friends. Thus, if you are looking at a person’s profile without a friend relationship with that person, you are not necessarily seeing all the information they have posted; you can see what is public, but not content restricted to a smaller audience.

Exact numbers on how openly people share are hard to come by and change quickly. A 2012 study suggested 28% of US Facebook users were sharing most of their posts with an audience bigger than just their friends. This means there is a decent chance you will be able to find some information about a person on Facebook, even if you are not friends with them.

Obviously, becoming friends opens up a much wider set of information. In most cases, you will have access to the vast majority of a target’s content if your target has accepted your account as a friend.

Example: Malcom Conroy-Smith

Malcom’s Facebook account is located here:

https://www.facebook.com/malcom.conroysmith

Browsing through his profile reveals many interesting things. He has posted background information, including where he grew up, where he went to school, and his job history. His contact information is also available.

But beyond the information he has explicitly shared, you can learn many things about his habits. Under the “Places” tab, you can see that Malcom posts a message almost every Friday evening from Elephant & Castle, a bar just a block from the International Monetary Fund where he works. That makes it a good place to look for him on Friday evenings. It’s also somewhere you might find other people who know him.

He also posts photos of his dog Barley and talks about taking her to the dog park. While no dog park is listed in Malcom’s Places, it is reasonable to make a first guess that the dog park is near Malcom’s house. Other places indicate that he goes grocery shopping (at Whole Foods Market Georgetown), to the CVS pharmacy, and to get his dry cleaning in the Georgetown neighborhood of Washington, DC.

A Google search for “dog park georgetown washington dc” pulls up several pages for Montrose Park, a leash-free park very close to Malcom’s residence. This would be another good location to look for people who know him or to spot Malcom himself.

Case Studies

Because of Facebook’s popularity, there are many cases where it has been used in investigations. We will look at the results of both criminal and civil investigations that leveraged Facebook.

Criminal Cases

Arrests that come from Facebook usually happen because the target was unable to keep his or her mouth shut about their crimes. Sometimes, posts are picked up and spread widely across social media that brings them to the attention of authorities. These cases are interesting; but in this chapter, as with this book as a whole, I focus on investigations of specific targets where information turned up online.

The beating of an 11-year-old. In April 2014, police arrested three people in Flint, Michigan, after they posted a video of themselves beating an 11-year-old boy with a belt as punishment.² The video went viral and was eventually brought to the attention of police.

Colleen Cudney, a 22-year-old Michigan woman, was on probation for a drunk driving conviction.³ Part of the conditions of her release was that she will not drink.

On St. Patrick’s Day of 2014, she went out and drank anyway. The following day, she had to take a breathalyzer test, which she passed. She was so pleased that she decided to post about it on Facebook: “Buzz killer for me, I had to breathalyze [sic] this morning and I drank yesterday but I passed thank god lol my dumba@@.”

A local police officer saw the post and alerted her probation officer, ultimately leading to her arrest for violating her probation.

Jeremy Thompson, an Indiana man, was arrested for illegal manufacture and sale of liquor.⁴ After receiving a tip about the man, officers began monitoring his Facebook account. The target then posted a photo of himself with an illegal still on Facebook (Figure 8.17). Investigators found other photos of him illegally making and selling moonshine. Ultimately, this provided cause for a search warrant. He was arrested and charged with five misdemeanors.

FIGURE 8.17 Lesson: Don’t post photos of yourself with illegal stills on Facebook. This man was arrested as a direct result of posting this picture. Photo provided by Indiana State Excise Police.

Danny Gough. On the other side of the world, criminals have used Facebook to obtain information about subjects as well. One of the more dramatic cases is that of Danny Gough. Following a feud that took place in the summer of 2010, authorities alleged that three men plotted a revenge killing. Gough had left town on vacation, but his alleged killers tracked his movements on Facebook and determined when he would be returning home. Gough was confronted outside his home by three masked men who brutally killed him. The alleged perpetrators were shown to have accessed Gough’s Facebook page just hours before the crime.⁵

Civil Cases

There are countless cases of people being sued, fired, or otherwise punished because of the things they posted on Facebook. These are not necessarily the case of targeted investigation of an individual, but rather the case where information was posted on Facebook. The posting was then brought to the attention of people who used it to make their argument. One of the most recent and dramatic stories comes from Florida.

Patrick Snay, a school administrator, had sued the school he worked for. The two parties settled and the school agreed to pay Snay $80,000. As part of the settlement, he signed a confidentiality clause, agreeing not to reveal any details of the settlement to anyone besides his attorneys and his spouse.

However, Snay told his teenage daughter about the settlement. She went on Facebook and posted the following status update:

Mama and Papa Snay won the case against Gulliver…Gulliver is now officially paying for my vacation to Europe this summer. SUCK IT.

The school found the post and used it as grounds to refuse to pay the settlement. Snay appealed and lost—making his daughter’s status update a very costly Facebook post.⁶

Conclusion

Facebook, as the most popular social networking site in the world, is the most likely place to find a target. There is a wide range of information, from personal history, to social connections, to location. Within their posts, people often reveal a lot about their preferences and patterns of activity.

Facebook users do have a lot of control over the privacy of their information, and they often allow only friends to see it. However, a lot of people make their posts more public, which means an investigator may be able to access them without having an account that the target has friended. Because of the vast amount of accessible data, Facebook is widely used in investigations of all types.