Public Records and Open-Source Intelligence Research Flashcards

A commercial data aggregator report shows a criminal conviction for the subject. What should the investigator do before reporting it?

Answer: Verify it against the original court record

Aggregator data can be outdated or mismatched, so findings should be confirmed at the primary source, the courthouse record.

In an online social media investigation, which action is generally lawful and ethical?

Answer: Viewing and preserving publicly available posts without interacting

Viewing and documenting content that is publicly available raises few legal or ethical problems, while deceptive access can violate ethics rules and law.

When capturing a web page as evidence, which practice best supports authentication later?

Answer: Capturing the page with the URL, date/time, and a hash value, and logging the capture

Recording the URL, timestamp, and a hash value along with chain-of-custody notes helps show the capture is authentic and unaltered.

A records search for "John Smith" returns several hits. What is the best way to confirm which record belongs to the subject?

Answer: Match multiple identifiers such as date of birth, address history, and middle name

Positive identification needs several matching identifiers, because a name alone is not enough to avoid false attribution.

Websites ending in .onion are accessed through which network?

Answer: Tor

The .onion domains are Tor hidden services, reachable only through the Tor network.

Why can't an investigator obtain a subject's federal income tax returns from the IRS without authorization?

Answer: Federal law (26 U.S.C. § 6103) makes return information confidential

Under 26 U.S.C. § 6103, tax returns and return information are confidential unless the taxpayer consents or a statutory exception applies.

Voter registration records in many states are:

Answer: Public, though some states limit how the data may be used, such as banning commercial use

Voter files are often publicly accessible, but many states limit access or use to election, political, or noncommercial purposes.