NDIT Public Records and Open-Source Intelligence Research 5 — Questions and Answers
Question 1: A commercial data aggregator report shows a criminal conviction for the subject. What should the investigator do before reporting it?
- Report it as-is since aggregators are reliable
- Verify it against the original court record (Correct answer)
- Ignore it because aggregator data is inadmissible
- Confirm it by calling the subject's employer
Correct answer: Verify it against the original court record
Aggregator data can be outdated or mismatched, so findings should be confirmed at the primary source, the courthouse record.
Question 2: In an online social media investigation, which action is generally lawful and ethical?
- Sending a friend request under a fake identity to a represented party
- Hacking a private account to view posts
- Viewing and preserving publicly available posts without interacting (Correct answer)
- Impersonating the subject's relative to gain access
Correct answer: Viewing and preserving publicly available posts without interacting
Viewing and documenting content that is publicly available raises few legal or ethical problems, while deceptive access can violate ethics rules and law.
Question 3: When capturing a web page as evidence, which practice best supports authentication later?
- Copying the text into a word processor
- Taking a screenshot with no date or URL
- Capturing the page with the URL, date/time, and a hash value, and logging the capture (Correct answer)
- Asking the subject to email the page
Correct answer: Capturing the page with the URL, date/time, and a hash value, and logging the capture
Recording the URL, timestamp, and a hash value along with chain-of-custody notes helps show the capture is authentic and unaltered.
Question 4: A records search for "John Smith" returns several hits. What is the best way to confirm which record belongs to the subject?
- Choose the most recent record
- Match multiple identifiers such as date of birth, address history, and middle name (Correct answer)
- Pick the record in the subject's home state
- Use the first search result
Correct answer: Match multiple identifiers such as date of birth, address history, and middle name
Positive identification needs several matching identifiers, because a name alone is not enough to avoid false attribution.
Question 5: Websites ending in .onion are accessed through which network?
- Tor (Correct answer)
- VPN only
- Standard DNS
- Usenet
Correct answer: Tor
The .onion domains are Tor hidden services, reachable only through the Tor network.
Question 6: Why can't an investigator obtain a subject's federal income tax returns from the IRS without authorization?
- They are destroyed after one year
- Federal law (26 U.S.C. § 6103) makes return information confidential (Correct answer)
- They are only available through FOIA
- They are filed with the state, not the IRS
Correct answer: Federal law (26 U.S.C. § 6103) makes return information confidential
Under 26 U.S.C. § 6103, tax returns and return information are confidential unless the taxpayer consents or a statutory exception applies.
Question 7: Voter registration records in many states are:
- Completely confidential in every state
- Public, though some states limit how the data may be used, such as banning commercial use (Correct answer)
- Available only to federal agencies
- Held exclusively by the U.S. Census Bureau
Correct answer: Public, though some states limit how the data may be used, such as banning commercial use
Voter files are often publicly accessible, but many states limit access or use to election, political, or noncommercial purposes.
