How to use social media to identify a person of interest

On September 6th news broke regarding the release of Islamic States new magazine entitled Rumiyah…

While early detection is key such events also present additional opportunities to identify persons of interest (POIs) that may not have previously been known. OSINT solutions provide that ability.

In this blog post we will see how social media can be used to quickly identify POIs and other sources of intelligence such as propaganda and news repositories used by Islamic State supporters.

It should be noted that before we proceed that throughout this use case we have redacted the usernames and links for security purposes.

Our first step in this use case was to limit our timeframe to the last seven days of collection.

Figure 1

We narrowed our collection results by selecting the Activity Timeline between the 4th through to the 6th of September with the 6th of September being when news broke of the new IS threat to Australia.

Figure 2

Conducting an ad-hoc search on “Rumiyah” within our Islamic State entity narrows the data set further, this includes narrowing the number of possible supporters talking about Islamic State and Rumiyah. You can see in the Activity Timeline in the below screenshot that chatter about the topic begins at 0600 on the 6th of September.

Figure 3

The first account that is identified as being of interest has already had its account suspended.

Figure 4

Figure 5

Figure 6

Figure 7

Further searching identifies numerous other accounts of interest that are supportive of Islamic State and spreading propaganda. Another POIs profile is quickly identified.

Figure 8

Figure 9

This particular POI which has been identified is then posting links to further propaganda repositories using free ‘paste’ sites to promote the Islamic States message.

In this scenario we have seen how social media can be used as an investigation tool with regards to Islamic State supporters active in social media, identifying new leads for follow up investigation or monitoring.