Why you should give unconventional OSINT techniques another go
Unconventional ways to verify people and locations.
There is a mountain of ways to verify information online. Some are part of our regular checklists we go through while others are less obvious to us and come in to play much later into our investigations. Finding information directly from the public is very rewarding for me, these somehow top all other publicly available information online because they come straight from the horse’s mouth. These are comments available online or easily accessible to anyone with a free account. Nowadays, it is very hard to be very careful with what you write online, even if you post anonymously, we might still find a date, a time frame, a location or a problem you have. That said, there are many things we have to do in our daily lives that require some transparency to our privacy walls but when it comes to choosing between necessity or privacy, sometimes the former comes first.
What are some of the unexpected resources out there and what can they give us? This could be an additional verification tool that can help push research forward or identify some recent locations. Nothing on here is technically new but the way we can approach these websites I believe it is.
Being a great resident
Fixmystreet is a website available to everyone in the United Kingdom for street problem reporting purposes. They take the responsibility to forward all reports received to the respective boroughs. That also means posts can be found online in 2 different places, on the main fixmystreet page and the main council’s reporting page, plus Google is indexing all of these.
Each city, borough, county in the United Kingdom has their own website and indication of where to report faulty street lights, damaged bus stops, illegal graffiti or even abandoned vehicles. Each and every one of those are found on an interactive map online where residents publicly report issues in their neighbourhood. While the majority of the posts are sent anonymously, most of them have a lot of information available that can help us.
There is something you would need to have in order to use this unconventional back up research technique. That is a location, an address or an idea of where the person might live.
Maps can show open, closed and fixed reports. Some maps are almost all public while other council maps are very private and will only tell you that an issue was reported and nothing else. A lot of the reports are accompanied by a photo, a photo showing what the problem is, and that is a good way of gathering dated pictures of a certain location.
Posts would normally have a title, a message, how it was submitted (for example, via mobile or desktop), a date and time stamp, sometimes a picture and sometimes a real name. While the majority of posts are anonymous the majority of pictures do not have sensitive information blurred.
Posts can either be directly posted as the person who is reporting it (left), as anonymous but name left in the message body (middle) or as anonymous with no name in the body message but the person is visibly seen in the picture (right). Due to these inconsistencies, I am unsure if residents are reminded properly that these are all public and easily accessible by everyone else. Is definitely something to think about and more importantly to be aware of.
This doesn’t just place someone in a city and in a neighbourhood but it also shows how close they are to be from their own home. These sort of pictures and reports will usually get done when on foot and so most people would have to be in close proximity to the problem they are reporting.
Ways of approaching these websites
If you know a city or an approximate location, search these on fixmystreet. Check the neighbourhood and see if there are reports of any sort in that area, simply by selecting ‘all’ on everything. All cases (open, closed and fixed), choose reports about ‘everything’ (this covers a lot of city damages or even Santander bikes abandonments) and sort by ‘newest’ (and it updates instantly if there is a new report) or by ‘oldest’ (it usually goes back a few years, depending on the city). Specified reports will cut down the amount of messages posted and so could be easier to find more information.
I have seen many pictures in areas I would not see through maps, public footpaths in a quiet neighbourhood giving us that extra bit of detail we need. Another website that does exactly that, is Geograph.org. They try to cover every part of every region in the United Kingdom and others with a photograph. Another resource to pair this article up with.
Graffiti and street art
Graffiti is a great way of confirming a location online and so is street art. A great blog that I have learnt a great deal from and focuses on these in more detail is ‘Leveraging Street Art in OSINT Investigations’. Graffiti and street art leave a stamp on a location and this can be used for further tracing. Every artist has its unique way of painting and a unique signature that most want to be publicly known by so they will definitely not shy away from consistency. Same street art can place an artist in one specific area or a range of locations in a given neighbourhood. These artists also help individualise a location at a specific time, leaving a unique but temporary signature that can help identify a location quicker now and later. As most residents provide a picture along with their message, that picture can visibly show the detail of the graffiti, exact location of the graffiti, time of day is usually seen to be the time of the post or within a few hours away and any other surroundings that can enrich the investigation.
There is a category specially for this called: ‘Graffiti and flyposting’ or just ‘Graffiti’. These are all reported by local residents and it offers great insight into what a piece of graffiti is where and at what time. Some reports take a few days to get fixed (for example, graffiti to be cleaned up, removed) but this can also take a few months so is always good to check all reports available.
Neighbourhood Wars
Photos on these websites are not just important for verifying reports and getting a very recent idea of what the neighbourhood looks like at this time but also what else is in the picture. Most if not all pictures are focused on the issue on hand but if there is a person or a licence plate around those are usually not blurred beforehand by the resident or by the website itself. In some cases sensitive documents are scanned and attached to the report (below).
I have also seen many other residents in pictures where they are not part of the issue at all, they just happened to be there. For example, a report on illegal advertising at a bus stop caught on camera another resident waiting for a bus (left). A street parking report captured a neighbour’s car and licence plate in their picture (middle) and a picture of rubbish left on the side of the road was deliberate in showing a full name and a home address (right). These can soon create havoc between neighbours and other residents, especially if there is already tension between them.
Finding out someone’s residence from their picture
Unfortunately, some pictures are either intrusive to other people and other people’s privacy or intrusive to the owner’s privacy. Some pictures are taken from home and so giving away their home address and their own identity.
The example below is just one of many I came across online. This is a London resident reporting a bus parking issue. From the website itself we get an exact location of where the report is coming from, a date and time stamp, a message with more information and a picture. Checking back and forth the reports in their ‘illegal parking’ category and ‘street parking’ category I find other posts few days apart that appear to be from the same building for the same issue. I put all the pictures together to find the exact flat or flats these pictures are coming from.
I performed brief analysis on these pictures to try and identify the exact flat these are taken from.
The classical architecture seen in the main picture below is not on any levels above 1 (excluding) in the nearby flats. The views they are getting from the windows match with the outdoor surroundings, the elevated view of the buses and street, the trees and the building across the road.
Right window (yellow) is the first of the posts. The first post at 09:06 in the morning shows the buses outside their residency. The subtle edge of the balcony is seen on the right of the owners’ picture, the edge directly surrounding the window is designed in a way that identifies the level and part of the building this is from. Couple of minutes later (middle, red), they post another picture from the balcony window, looking to the left of the road. In the owner’s picture we can see the balcony pole on the left side, signifying this is from the balcony on level 2. The shape and size of the bottom of the pole is similar to the ones from the middle balcony I mentioned.
And the last of the pictures is from 19th August from another window flat (left, black). The difference between this picture and the others is that the surroundings of the window is different. The classical architectural design is not directly present around the windows, but slightly a far. The position of the tree outside is lining up with the edge of our building, the flats in the middle in our picture are pushed forward slightly and the building’s edge is the one seen in the owner’s picture. We now have the flats reporting this issue and potentially the residents living there.
Very often, residents are faced with 2 options, either to publicly report a safety issue online or to not report anything at all. Local residents using such services are instantly faced with some type of backlash. Depending on the issue at hand, will neighbours figure out who is posting the complaint? Will they damage each other’s property (as seen in some messages online) or are other wrongdoers going to take advantage of this issue and commit a crime? These are risks we are taking by having these messages public. From a lot of the messages that I have researched, a lot of residents are potentially not aware their posts are this easily accessible online ( some even use bad language to talk about another neighbour). These services are committed to help regardless of our names or the detail in our pictures but it still presents a risk, a risk some know how to take advantage of.
The website is very transparent about their privacy policy and have backed up their decision to have all reports public by saying ‘others can quickly see what has already been reported, so it prevents the council from having to deal with duplicates. It also creates a snapshot for local communities, so it’s easy to see what the common problems are in a given area, and how quickly they get fixed. Other local residents can browse, read and comment on problems — and perhaps even offer a solution.’ Until something goes wrong, which from a privacy point of view I believe more needs to be done to protect everyone’s privacy while still providing a great service.
This is very clearly not made more available to the residents as the amount of sensitive information seen on this website is immense. That said, this is a long road to complete privacy, in a way that Google also indexes these reports and the individual council also publishes these on their own website so this might be a long road but it has to start somewhere.
