CIAC CIAC Open Source Intelligence (OSINT) Methods 2 — Questions and Answers
Question 1: What is 'geofencing' as an OSINT technique in criminal investigations?
- Installing physical barriers around a crime scene
- Using location-based social media data to identify devices or accounts active in a specific geographic area during a defined time (Correct answer)
- Blocking a suspect's mobile phone signal during surveillance
- Mapping the boundaries of gang territories using GIS
Correct answer: Using location-based social media data to identify devices or accounts active in a specific geographic area during a defined time
Geofencing in OSINT leverages location data from social media and app platforms to identify what devices or accounts were present in a defined area at a specific time.
Question 2: Reverse image searching in OSINT investigations is most useful for:
- Recovering deleted images from a suspect's hard drive
- Identifying the original source of an image, finding associated profiles, or verifying whether an image has been manipulated (Correct answer)
- Converting image files to admissible evidence formats
- Generating facial recognition matches from surveillance footage
Correct answer: Identifying the original source of an image, finding associated profiles, or verifying whether an image has been manipulated
Reverse image search tools like Google Images or TinEye find where an image appears online, revealing the original source, associated identities, and whether it has been altered.
Question 3: The 'Wayback Machine' (web.archive.org) is used in OSINT to:
- Monitor live social media feeds for criminal activity
- Access archived snapshots of web pages that may have been altered or deleted (Correct answer)
- Trace the geographic origin of a domain name
- Recover encrypted communications from a suspect's device
Correct answer: Access archived snapshots of web pages that may have been altered or deleted
The Wayback Machine stores historical snapshots of websites, allowing analysts to view content that has been changed or removed, which can be critical for investigations.
Question 4: WHOIS lookup in OSINT investigations is used primarily to:
- Search public criminal records databases
- Retrieve registration information associated with a domain name, potentially identifying the owner's contact details (Correct answer)
- Monitor real-time network traffic from a suspect's device
- Access sealed court records through open-source portals
Correct answer: Retrieve registration information associated with a domain name, potentially identifying the owner's contact details
WHOIS queries the domain registration database to reveal registrant name, contact information, registration dates, and registrar details for a domain name.
Question 5: What is the key legal consideration when using OSINT in US law enforcement investigations?
- OSINT collected from social media is always inadmissible in federal court
- While OSINT is publicly available, collection methods must not violate the Fourth Amendment, platform terms of service, or applicable federal and state laws (Correct answer)
- OSINT requires a Title III court order regardless of source
- Using OSINT automatically triggers a mandatory civil rights review
Correct answer: While OSINT is publicly available, collection methods must not violate the Fourth Amendment, platform terms of service, or applicable federal and state laws
Even though OSINT uses public data, methods like undercover accounts, automated scraping, or accessing private data streams may trigger constitutional or statutory concerns that investigators must navigate carefully.
Question 6: In OSINT, 'pivoting' refers to:
- Switching investigative leads from one suspect to another
- Using a discovered piece of information as the starting point to uncover additional related intelligence across different sources (Correct answer)
- Changing collection methods after a surveillance operation is compromised
- Rotating analysts to prevent cognitive bias on long-running investigations
Correct answer: Using a discovered piece of information as the starting point to uncover additional related intelligence across different sources
Pivoting involves using one data point—such as a username, email, or phone number—to search across other platforms and databases to expand the intelligence picture.
CIAC CIAC Open Source Intelligence (OSINT) Methods 2
What is 'geofencing' as an OSINT technique in criminal investigations?