Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password

Digital Forensics

JAN
14
0

When OSINT is turned into the Baseball Bat of Internet Mob Justice

Posted by Brett Shavers
in  Digital Forensics

We are of a curious mind, we the forensic examiners, private investigators, OSINT professionals, and journalists. Our work is for the public good, and we are skilled in the effective wielding of the most powerful weapon on the planet: INFORMATION!

We are experts in searching for it. Experts in interpreting it. Experts in sharing it. Experts in creating it. Sometimes, we are completely inept, or even malicious in handling it and totally screw up.

Ethics matter

Ethical behavior not only keeps your reputation solid but also keeps you from being sued or jailed. The cancel culture falls into a category of ethics, where if an infosec professional engages in canceling a person on the Internet, they are (in my opinion), the epitome of being unethical by wrongfully turning legitimate OSINT into the Baseball Bat of Internet Mob Justice. Ethics matter. The truth matters.

A recent example. Welcome to 2021.

Refer to the story for details (https://patch.com/illinois/chicago/trolls-wrongly-accused-retired-firefighter-capitol-riot-murder). In brief, an unidentified person (Figure 1) suspected of murder was misidentified (Figure 2). The identification was based on a posted image of the actual suspect in which OSINT was most certainly used to find a similar image online. The OSINT worked to find a similar image, but the verification of the match by the finder failed as did the action taken afterward. Rather than forward to law enforcement to verify, an Internet mob piled on an innocent person.

 

 

Could it get any worse? Sure. Once you blindly jump feet first into a rabbit hole, everything you come across that you believe to be true will become collateral damage. Even in this example, the innocent son of an innocent victim gets drawn into the wrong accusations. This may not seem to be a big deal, but the careers and reputations can be permanently damaged. Friendships, family, promotions, and even careers can be lost on a false allegation! It is so so easy to prove yourself correct if you are hellbound to do so, even when everything that you find is false but perceived in a way to support your belief.

An older example. Back to 1996

An older example from 1996 is the Richard Jewell case. Refer to the story for more details https://en.wikipedia.org/wiki/Richard_Jewell. Again, this was another misidentification, and Internet pile up that resulted in an innocent person’s life is forever turned upside down. This one was so bad that a movie was made out of the story. There are plenty of other misidentifications that you can find online or unluckily be involved in. Misidentification is not new. Law enforcement has had its fair share of accusing and arresting the wrong people for the same reason that Internet mobs have made: failure to verify and corroborate.

Did I somehow forget that I dated Nicole Brown Simpson?

Part of my incredible year of 2020 was getting a phone call from a reporter. I get calls from reporters on occasion, but this one was totally different. The reporter asked if I wanted to give him a statement before he printed an article about me having an affair with Nicole Brown Simpson in 1993.

First off, this didn’t happen. My shock was how could I be accused of something that I didn’t do by a nationally recognized reporter? Second, I immediately had visions of being splashed across the Internet of having an affair with OJ Simpson’s wife! My wife would not be pleased….

The details on this story, as told to me by the National Enquirer reporter was that he was holding photos of me arm-in-arm with Nicole Simpson in Cancun or Cabo San Lucus (I forgot which he said) in 1993. I told him that he has the wrong “Brett Shavers” but his response was that his ‘database’ was correct. I suggested that he not print the story because it is false, but if he did print it, to let me know because I’ll see what crazy mileage I can get out of it, mostly to write a blog post about it.

Then it got a little weirder. I told the reporter that I was in my first year of patrol in a police department during that time and I probably wrote a ticket or made an arrest on the alleged date of the photo, didn’t take any vacation that year, and married (my wife would certainly know if I flew off to Mexico without her and our kids!).

The reporter’s first reaction: “So you’re telling me that law enforcement was involved in her murder?!?”

So now you have a reporter who accused the wrong person and immediately created a conspiracy that law enforcement was involved in a murder and ready to write a story about that.

All I said was that he needed to check his sources and verify and that if he printed the story, I’d prove it false and go from there. By mere coincidence, I had a dated photo of me from a local newspaper from that time frame. I emailed it to the reporter and I think the reporter accepted that I looked much different from the person in the photo that he had. The more I think about it, that probably means that the guy with Nicole Simpson was better looking than me....

The point of this story is that anyone can be falsely accused by anyone for anything, and once the Internet dogs of war have been released, irreparable damage will occur. On top of that, this reporter was so dead set that I was the Brett Shavers that dated Nicole Brown Simpson, that he immediately jumped to a conclusion that since I was in law enforcement at the time, that law enforcement must be involved in her murder!  I do credit the National Enquirer for actually double-checking and finding out that they had the wrong person. Of course, if they printed their photo, my photo (backed by a local newspaper) would prove it to be false. Still...don't do this!

Unleashing the Internet dogs of war!

One thing about mob rule is the lack of personal, moral, and legal responsibility. It is quite easy to create a passionate stir, lead a group of people to the edge, incite emotion, and nudge the group over the edge into an all-out attack while at the very same time, avoid responsibility for causing it, especially if done anonymously. This is not ethical.  The Baseball Bat of Internet Mob Justice does not stop. It does not think. It grows and beats the victim until nothing of substance is left.

The anonymous and double-anonymous complaints

Here is something that happens commonly on the Internet:  “I will not name this person, but they are (name a group that this person belongs to) and they did (name the social norm violation).”

This type of accusation demonizes an entire group of people for committing some violation of a social norm, and now everyone in that group is now suspect. Any person speaking up in that group will then call attention to themselves and be misidentified as the violator. Additionally, it doesn’t solve any problem and most importantly, the claim cannot be verified or disproven.

This is not justice in any sense of the word. Quite the opposite and worse when the complaint is anonymous. Even if the offender is identified but the complainant is anonymous, the offender has no way to face their accuser. Yes, I know the Internet is not a court of law, but as we all know, the court of social media is sometimes harsher than any court of law ever could be.

How does any of this apply to us?

The Digital Forensics/Incident Response field is primarily investigative in nature and as such (1) be aware of your personal biases and beliefs, and (2) take measures to keep your personal biases in check. It is far too simple to let an internal bias affect your judgment, which affects your investigative/analysis plan, and ultimately affects your conclusions.

Society does not need a law enforcement officer who has a bias against any specific or general group of people, as that bias will negatively affect the community at large and wrongfully targeted individuals.

Society also does not need unethical people who work in ethical fields to wrongly accuse others because of internal biases, beliefs, or false conclusions to what they believe to be true. Any one of us can go down rabbit holes of “investigating” someone or some event and lead ourselves down the wrong path because of preconceived beliefs, failure to verify information, and a determined mindset to prove ourselves right rather than find the truth.

Professionalism in this field requires us to be professionals to be trusted and have our word to be trusted. That doesn’t mean a stiff personality, lack of humor, no personal opinions, or being impassionate. But it does mean being fair and impartial, and also maintaining the appearance of being fair and impartial.

Best investigative method to prevent this from happening to you

Follow the evidence. Disprove that which is false. Prove that which is true. Confirm, verify, corroborate.

In my law enforcement career, I have seen a few examples where investigators did not do this. In one example, a search warrant was served on an innocent family’s home. The warrant was served by SWAT (I was not on the team at that time), but SWAT was innocent. They only served the warrant as written by the case investigator and signed by the judge. The investigator failed at the most basic task of verifying an address. The address on paper wasn't even close to the physical address. I’ve seen this almost happen in another warrant service, but fortunately, I was aware of the real address and stopped the warrant from being served while the team was AT THE FRONT DOOR! Again, this was an instance of not verifying information.

In every instance (there are more!), verification was not done. Investigators had a belief and followed only the evidence that supported their belief. When an investigator does that, every single time they will prove their beliefs to be right, when factually, they were wrong. This never ends well.

All of us are prone to making mistakes with assumptions. Unfortunately, there is not much accountability when this happens with Internet allegations. Reporters may falsely accuse someone, ruin the person’s life, and the only accountability is publishing a correction article. On the Internet, people delete their posts and walk away without care that the Internet remembers forever.

On the Internet, accusations can be made, even anonymously, spread through the Internet like a virus, and even if proven to be false, no accountability to the accuser when destroying someone’s life. We need to be better than that, and if any of us falter, others should take the care to gently remind to take a step back, breathe, and verify before releasing the dogs of war online.

**side note**

I was "OSINTing" the reporter while on the phone and verified his name, number, email, and other information.

 

 

2
  15556 Hits
Tweet
Share on Pinterest
15556 Hits
DEC
26
0

I took a look at Instagram's Terms of Service so that you won't have to.

Posted by Brett Shavers
in  Digital Forensics

Who really reads the Terms of Service anyway?

Are EULAs and TOSs intentionally designed as multi-page, single-spaced, 4 font, legalized writing to confuse users or simply to dissuade users from reading past the first paragraph?

A few highlights from Instagram

“…you hereby grant to us a non-exclusive, royalty-free, transferable, sub-licensable, worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your content…”

Translated: All your content is ours. We do with it as we wish.

Opinion: You create it, Instagram/Facebook will make money off of it with no compensation to you. This is the model of how “free stuff on the Internet” works.


“It can also include what you see through features we provide, such as our camera, so we can do things…”

Translated: We have access to your camera, I mean “Instagram’s” camera.

Opinion:  They haz your phone camera.


“For example, we log when you’re using and have last used our Products, and what posts, videos and other content you view on our Products. We also collect information about how you use features like our camera.”

Translated: Instagram keeps track of everything that you do on their platform, including the use of their camera.

Opinion: Sure. I get it. But this would be like a car rental company keeping track of every place you drove the car that you rented. Car rental companies probably do that too…


“We also receive and analyze content, communications and information that other people provide when they use our Products. This can include information about you, such as when others share or comment on a photo of you, send a message to you, or upload or import your contact information.”

Translated: Instagram collects data about you even when you don’t provide it.

Opinion: Do they mean private messages too? Sure. Why not.


“…we collect information from and about the computers, phones, connected TVs and other web-connected devices you use that integrate with our Products, and we combine this information across different devices that you use.”

Translated: We gonna map out your network.

Opinion: Yikes!


“Information we obtain from these devices includes: …operating system, hardware and software versions, battery level, signal strength, available storage space, browser type, app and file names and types, and plugins…mouse movements….unique identifiers, device IDs, and other identifiers such as from games, apps or accounts you use…associated with the same device or account…Bluetooth signals and information about nearby Wi-Fi access points, beacons, and cell towers…your GPS location, camera or photos….name of your mobile operator or ISP, time zone, mobile phone number, IP address, connection speed, and in some cases, information about other devices that are nearby or on your network, so we can do things like help you…”

Translated: Everything. We take everything.

Opinion: For the love of all that is good and holy! This looks like a digital forensics examination (and I mean “digital exam” as a “digital prostate exam”.


“Advertisers, app developers, and publishers can send us information through Facebook Business Tools they use…about your activities off Facebook including information about your device, websites you visit, purchases you make, the ads you see, and how you use their services whether or not you have a Facebook account or are logged into Facebook.”

Translated: In case you didn’t get it earlier, we take everything, even that which is not on our platform.

Opinion: Instagram/Facebook is a third-party data collector that takes your data from another third-party data collector which probably takes your data from another third-party data collector. All to be curated ultimately by Facebook/Instagram. You don’t even need to have a Facebook account!


“For example, we can suggest that you join a group…

Translated: We know what is best for you. This might because we know everything about you or because we want you to behave a certain way and believe in what we want you to believe in.

Opinion: When you want to see a movie, you might want to ask a friend or read reviews, but you don’t have to. You can simply choose to see or not see a movie. Facebook/Instagram requires that you agree to be pushed toward groups that they want you to join. Kinda like getting jumped into a gang that you didn’t think you wanted to do, but got pushed into it by the local gang bangers.


“We use location-related information such as your current location, where you live, the places you like to go, and the businesses and people you’re near-to-provide..can be based on things like precise device location…IP addresses, and information from your and others’ use of Facecbook products…”

Translated: We know everywhere you been, exactly where you are now, and can accurately predict where you will be going next.

Opinion: This is life on IoT and our addiction to “smart” devices. And we must agree to it in order to use ‘free’ services.


“…we use face recognition technology to recognize you in photos, videos, and camera experiences…”

Translated: Ha! We haz your biometric data too!

Opinion: Facial recognition is one of the security features that we have to give up, but is something that we can’t change like a password.


“..when you search for something on Facebook, you can access and delete that query from within your search  history at any time, but the log of that search is deleted after 6 months.”

Translated: Not only do we see what you search for, but we keep that, just in case…

Opinion:  Forensic peeps know this. Anything you type online is there for everyone to see, even those you don’t want to see it, potentially forever.


“We share information globally, both internally and with the Facebook Companies, and externally with our partners and those you connect and share with around the world…your information may, for example, be transferred outside where you live…”

Translated: We not only take, curate, analyze, and store your information indefinitely, but we will share it around the world to our “partners”.

Opinion: Who are the “partners” and WHY DO THIS?!?


Summary

Free is not free.

Social media platforms are like leopards stalking dinner. You don’t see the leopard. You don’t think anything about it. And you don’t care that tidbits of your Internet activity are being analyzed by humans, ML, and AI. By the time you realize how much private data is gone, it is too late to much about it. Presumably, this is all for a profit motive, in which you make none. Worst case scenario is a nation-state obtaining this immense data. But that would never happen..

 

update: This from Twitter, best visual of EULAs that I have ever seen.

https://t.co/uYXup8iEdE

— #StopTheStupid! Goat (@bill_e_ghote) December 26, 2020

 

0
  10104 Hits
Tweet
Share on Pinterest
10104 Hits
DEC
16
0

White Paper: The Susceptibility of Interconnected Devices in a Global Concept as Surveillance Affects the Consumer-user

Posted by Brett Shavers
in  Digital Forensics

I read an article that China used technology to spy on users via their phones (https://www.theguardian.com/us-news/2020/dec/15/revealed-china-suspected-of-spying-on-americans-via-caribbean-phone-networks). 

Here is my white paper analysis.

#1 - If a device has connectivity with at least one other device, it can be,  has been, or will be compromised.

#2 - If a device has the ability for connectivity with at least one other device but isn't connected yet, see #1.

#3 - If a device is airgapped from any other device, it can still be compromised.

#4 - If a device has a speaker, someone you don't know can hear you.

#5 - If a device has a camera, someone you don't know can see you.

#6 - If one nation-state is monitoring your device, probably another one is too (maybe your own government!).

The good news is that criminals are more easily identified, tracked, arrested, charged, convicted, and incarcerated.

The bad news is that every bit of your life is logged somewhere, by multiple entities without your consent or knowledge.

 

0
  6071 Hits
Tweet
Share on Pinterest
6071 Hits
    Previous     Next
1 2 3 4 5 6 7 8 9 10

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2023 Brett Shavers