We were recently retained by counsel representing a high-profile public figure who was being targeted through an ongoing campaign of online harassment and extortion. One profile connected to the activity appeared on a fringe personals dating site, but the name and identifying information were false and the individual claimed to be located in New Zealand.
That profile wasn’t the answer. It was the starting point.
Through targeted OSINT research, we identified matching profiles across several other dating and personals sites. The individual had been careful, but not entirely consistent. Each profile offered a slightly different collection of information—small variations in usernames, photographs, biographical details, interests, locations and other identifiers that meant little in isolation but became increasingly valuable when examined together.
We began correlating those fragments and following the connections between them. As one data point led to another, the fabricated identity started to unravel and the geographic picture narrowed considerably. What we found was that the person behind the profiles were not as careful with profiles that they did not expect to come under scrutiny. Ultimately, we were able to conclusively establish the individual’s real identity and determine that the person was not in New Zealand at all, but living in the Vancouver, British Columbia area.
Just as important was how the investigation was conducted. Rather than engaging publicly with the individual or revealing what we were learning, we quietly mapped the connections, preserved relevant online evidence as it was identified and allowed the available information to lead us from one source to the next.
The case reinforced an important principle of OSINT investigations: online anonymity can look remarkably convincing when you examine a profile in isolation. It often becomes much less convincing when you examine the surrounding information ecosystem.
People may change their names, locations and profile details from one platform to another, but maintaining a completely disconnected identity across multiple online environments is considerably more difficult. Sometimes it is the smallest inconsistency—not the most obvious piece of information—that provides the connection needed to move an investigation forward.
If you’ve dealt with online targeting, what was the hardest part to contain?
Explore the investigative services used to uncover the facts in this case:
