Investigation Online: Gathering Information to Assess Risk

Image, cropped and filtered, CC-BY-SA via lkm

Investigating another person’s identity and background can feel creepy and wrong, an ethical grey area, but it’s one of the tools we have available to us for risk assessment.

These tools and techniques are used cruelly by stalkers and harassers to do damage to us. However, gathering information is necessary to make good, informed decisions when we’re being harassed online. What we do with that information is up to us. We can approach investigation with a practical mindset and a good ethical framework as feminist activists and citizen journalists. And, we can continue to support anonymity and privacy, even if in some cases, we want to know more than is immediately obvious about someone we encounter.

As a result of your investigative work, you may be reassured that a particular nasty email sender is unlikely to show up at your house. You can use these techniques to build a picture of the threat that you or others may be facing, and make more informed decisions about how to react. ​

Basic techniques

• Gather everything you know about a person.
• Stick to legal methods of information gathering – don’t risk jail.
• Use a different browser than usual so that you aren’t logged into your online accounts. Or, delete browser history, cookies, and clear the cache.
• Use a worksheet for notes at first, or scratch paper to draw charts.
• Create a folder for investigations, and a new folder in it named after the subject.
• Save photos, avatars, screencaps, and wgets of entire websites into your folder. There are many free browser extensions that do full screengrabs, like Awesome Screenshot for Firefox, or Chrome’s Screen Capture Extension.
• Make a working file for your research. Dump every URL and piece of info into it. For each piece of info you add, give a source. Organize that file periodically to put the best information at the top. Develop a timeline.
• Make a summary file for the best information you have.
• Drive or Dropbox can be useful for collaboration with other investigators.

Image, cropped and filtered, CC-BY via tom1231

Why do this?

• If you feel a person may be dangerous or untrustworthy.
• If a person or people are harassing you online, and you want to do risk assessment. The MOSAIC Threat Assessment System is a step by step guide.
• If you are interacting with a person and suspect they may be perpetrating a hoax.
• If your judgment is that a person is dangerous to a community, you can present a body of supporting evidence if you so choose.

Information That May Be Useful to Collect

• Names: List all the names you know a person has used.
• Screen names: Handles, wiki user names, etc. These may reveal patterns.
• Social media profiles and web pages: Twitter, FB, Foursquare, Flickr, etc.
• Email addresses: List them; also, search on them.
• Domain names: Use whois. A subject’s domain names may reveal their name or location.
• IP addresses: May be able to search on them or connect activity through them. They may be in blog comment administration panels, server logs, or email headers.
• Age/DOB: Date of birth is useful; and necessary for looking up court records.
• Cities/Counties/States lived in: Find the counties the subject has lived in.
• Phone numbers: Gather current and past numbers. Do reverse lookups.
• Addresses: Places worked, schools. (Watch out for LinkedIn. If you’re logged in, the subject may see that you’ve looked at their page.)
• Mutual friends: Check Facebook, Twitter. Can you draw useful conclusions?
• Family members: For triangulating on an identity. Genealogy sites can help here. Ancestry.com is good. In some cases it can be an option to contact a family member asking them to help the subject of your investigation, in a compassionate and non-threatening way.
• Other online hangouts, mailing lists, communities
• People who this isn’t: Track and differentiate people with similar names who aren’t your subject – useful for making sure information collected pertains to the right individual.
• Court records by county, state, city: Look for the county court and jail databases. There isn’t a central place to search these.
• Sex offender registries and other criminal databases: Help determine any potential criminal history by the subject.

Search Tips

Image searches

If you have a photo, icon, or avatar, do a tineye or Google reverse image search.

Rapportive

If you have an email address, you can install this browser extension to find the other social accounts which are associated with it. Once installed, create a draft email with the address in question. Hovering over the email address will pop up the Rapportive sidebar of information.

Check references

If your subject did volunteer work at an organization across the country, contact someone at that org to ask about their experiences with the person. This can be done in a neutral manner without revealing your suspicions or fears, and is a reasonable way to approach checking a person’s references for volunteer work with your organization.

Search for name + arrest, name + harassment, name + jail, etc.

This sometimes gives quick leads to more information about abuse and/or criminal activity.

Image, cropped and filtered, CC-BY-SA via westmidlandspolice

Sex offender registries

These include the National Sex Offender Public Website and the Megan’s Law Home Page. Try others for specific state searches.

Wayback machine

Check http://archive.org to find old pages or deleted sites.

Court Records

Check court records for federal (PACER/RECAP), state, county and city courts. Build a timeline of places a person has lived and gone to school, add the counties, then check county court records for each location. Not all counties and municipalities have public online records. You may need to go to, or write to, each courthouse.

Court listings

Two places to start: Search Systems Free Public Records and the National Center for State Courts.

Domain name history

whois domain tools and history

Basic identity searches:

These can be useful, but don’t get too bogged down:

• ussearch.com
• radaris.com/
• instantcheckmate.com
• whitepages.com
• peekyou.com/
• peoplesmart.com
• intelius.com

Other Notes

Stay alert for multiple identities, sockpuppets and hoaxes.

You may want to try researching your own identity, or work with friends to see what’s out there, and reduce the amount of information that’s exposed about you from various sources.

It may be easier to collect information if you have control of your own web server. This is a great reason to host your own websites. For example, if someone is privately messaging you, give them a link to a unique image you host. Then collect the IP address of whoever clicks through.

Focus on one high-use platform like Twitter to draw a social graph, look for clues to geographic location and other information.

Image, cropped and filtered, CC-BY-SA via anitakhart

For online harassment situations, you may want to collect posts or comments to compare a horrible person’s writing style to new comments under different names.

Further reading: Free Manuals on Investigation from the Global Investigative Journalism Network. The Centre for Investigative Journalism’s Investigative Online Search from 2011 has an excellent, useful overview.

Conclusions

Once you have collected this information, you may have more information that can help you make decisions.

Are you reassured this person is not an immediate danger? If so, that’s great. Your investigation has been a success.

Do you need to take further steps? Do you want to check back on this person’s activities or criminal record in future? Or, do you want to share the results of your investigation with others?

Being able to speak with each other about the results of our investigations, and about harassment or violence we’re directly experiencing, is part of our basic human right to free speech. Though that’s true, sharing such information with each other can expose us to the risk of retaliatory lawsuits, or further harassment. Please be aware of these risks and don’t treat them lightly.

When we share information, we are building power of our own. Potential harassers may be deterred by the thought that we are both capable of and willing to turn the eye of internet surveillance back on them. We are also in a better political position as we act collectively, and as we make it clear that we share the skills to collaborate in complicated investigations.