Location data available publicly on the internet can be used to track people's historical and real-time movements. Investigators can utilize application location data to locate subjects and missing persons, research crime hotspots, and respond to critical incidents. Locating and collecting relevant location data during an investigation can significantly benefit a case. However, the process can be a legal, ethical, and technical minefield.
In this article, we’ll discuss collecting location data from applications to support investigation and demonstrate the possibilities of this data by exploring fitness-tracking apps.
How can application location data support OSINT Investigations?
- Locate Fugitives and Missing Persons - Using location data, investigators can find recent activity posted by fugitives and missing persons and utilize it to find their current location.
- Link Offenders to Criminal Activity - Investigators can use the location data of offenders to demonstrate their proximity to committed offenses, building evidence that links them as potential offenders.
- Event Security - Global security teams can use location data to monitor the movement of people around an event, identifying security and safety concerns.
- Executive Protection - Security teams should consider executives using applications that publicly post location data. Many executives of major corporations publicly share their fitness activity, revealing their home addresses and the times they are on the move in public and available for interception.
This article will introduce some tools and techniques for deriving location data from online sources during OSINT investigations. To view the full webinar click here or download the guide, which includes advanced techniques and analysis, click here.
Social Media Platforms
Location-based Social Media URL Manipulation:
Twitter - https://birdhunt.co/, https://onemilliontweetmap.com/, and OSINT geocode:40.711832,-74.011222,10km
Many Twitter posts are geotagged, meaning the user's location at the time of posting is embedded within the post. These posts can be searched using advanced operators within the Twitter platform, such as geocode:longitude,latitude,range in km, or through third-party tools like BirdHunt and Onemilliontweetmap.
To search by location within the Twitter platform, enter a keyword and the geocode: operator followed by coordinates and a range in KM, such as OSINT geocode:40.711832,-74.011222,10km.
Alternatively, the geocode operator can be automatically completed through Birdhunt. To use Birdhunt, head to https://birdhunt.co/.
Use the search bar to search for locations by keyword or scroll in on the map. When the appropriate location can be viewed in enough detail, select a location on the map by clicking on the correct location.
Once a location has been selected, hit the “CONFIRM LOCATION’ button. A subwindow will appear, enabling you to select a radius before hitting the ‘SEARCH FOR TWEETS’ button.
The results will populate within the Twitter platform. To limit results to those containing a specific keyword, add the keyword before or after the location search string.
Alternatively, investigators can use OneMilltionTweetMap to search geotagged Tweets for keywords before narrowing down on location. To use OneMilltionTweetMap, enter a keyword in the search bar on the left-hand side of the page.
Once results have populated, single Tweets will be displayed as the Twitter logo, while grouped posts will contain a number. To view posts within the group, zoom in further.
Instagram - https://instahunt.co/
Like Birdhunt, geotagged Instagram posts can be searched using a third-party tool, Instahunt. Using Instahunt, investigators can find public locations on Instagram, which stores all Instagram posts with those locations tagged within them. To use Instahunt, head to https://instahunt.co/.
Use the search bar to search for locations by keyword or scroll in on the map. When the appropriate location can be viewed in enough detail, select a location on the map by clicking on the correct location. Once a location has been selected, hit the “FIND PLACES’ button.
A subwindow will appear, enabling you to extract places from Instagram. Hit the ‘GET INSTAGRAM PLACE DATA’ button.
If you are signed into Instagram, you will be presented with a list of places within the Instagram platform. If you are not signed into Instagram, you must do so before viewing the results. Highlight the results and hit ‘Copy’ or ‘CTRL’ & ‘C’.
Instagram places will populate on the map in Instahunt. To view the location, hit the Instagram logo, redirecting you to the Instagram platform.
Snapchat - https://map.snapchat.com/@40.711832,-74.011222,14z
Snapmap enables investigators to locate all geotagged public snaps posted recently, roughly 24 - 48 hours.
Snapmap is an official Snapchat Map, which enables the public to view publicly available geotagged snaps by their embedded location. Publicly available snaps are those where the user has location data turned on on their device and has opted into location services in the Snapchat app settings. Investigators can use Snapmap to conduct a map/location-led search of public Snapchat content.
The Snapmap is a heatmap that shows areas of a high density of public snaps ranging by color, running from low, blue, through to high, red. Areas with no public snaps will display no color.
Snapmap is time-sensitive, with snaps displaying absolutely no longer than 48 hours, although usually disappearing within 24 hours. Investigators must, therefore, capture any identified relevant content immediately to ensure it is not lost.
It is relatively difficult to manipulate an embedded location within a Snap. Therefore, investigators can generally accept any location within Snapmap as genuine and can be confident that any video was posted at that time and location.
Snapmap can only be searched geographically and cannot be searched by a user’s username. Investigators can utilize Snapmap to search for public posts near locations associated with a subject, such as their address, or to research developing situations or incidents in a specific location, such as protests.
To use Snapmap, go to https://map.snapchat.com/.
Using the search bar on the left-hand side of the screen, you can search for a town, city, or village name. The results will populate below the search bar.
Once a location has been selected from the list, the map will be redirected to the selected location. Alternatively, you can manually navigate to the desired location using a mouse or trackpad.
Investigators can zoom in or out on the map to see a small or larger area and change the range of results within a hotspot. A hotspot will show the greatest density of and the largest number of videos in areas that are colored red.
Clicking on a colored area, either red, yellow, or blue, will bring up recent publicly available videos geotagged in that area.
It is difficult to associate a Snap with a Snapchat user as public Snaps on the web version of Snapmap only show the posted video. It is possible to occasionally view a tagged username or other relevant text in embedded overlay labels. Recovering embedded overlay labels is covered in the Extracting Snapchat Content section of this guide.
In addition to manually navigating to a location in Snapmap, investigators can also jump to a location using URL manipulation. In the following URL, https://map.snapchat.com/@40.711832,-74.011222,14z, “@40.711832,-74.011222” represents coordinates, while “14z” represents distance. To manipulate the URL replace “@40.711832,-74.011222” with the coordinates of the desired location.
Youtube - YouTube Geofind
Youtube videos can be geotagged with a location. Using Geofind, investigators can search geotagged videos by keyword.
YouTube Geofind enables investigators to enter an address or find a location on the map at the top of the page to search for content posted within a specific radius of the entered location. The radius can be selected from a drop-down list, ranging from 1km to 1000km.
Investigators can enter specific keywords for video results to include, and results can be filtered and limited by date, enabling content to be located for a specific timeframe.
Results for the specified criteria will populate at the bottom of the page. The map will also update to show the tagged location of the results.
Fitness Tracking Apps
Outside of the core social media sites, fitness-tracking apps provide investigators with location data relating to the subjects of their investigations. 6 popular fitness tracking apps are worth searching, including Strava, Gyroscope, AllTrails, Relive, Garmin, and Ayvri.
Investigators can find users on these fitness tracking applications using a Fitness Tracker Search Engine CSE at: https://cse.google.com/cse?cx=f4810de23ed2b0a32. To use the CSE, enter the name of a subject and hit enter. Results will populate below the adverts.
Clicking on any of the results will open the results in the relevant fitness tracking app. Results will differ depending on the platform the subject uses.
Automating Your Location-Driven OSINT Workflows
Using a tool like Skopenow, you can automate the intelligence collection processes outlined in this article to extract and analyze location-associated data and information. Skopenow automatically applies natural language processing and computer vision to discover locations in a person's or business's digital presence. Skopenow instantly and anonymously locates and archives social media accounts and posts, plots location history, flags actionable behaviors, and reveals hidden connections between individuals. Skopenow’s automatic report builder will save you time organizing the analyzed intelligence into a court-ready report. Please contact sales@skopenow.com or visit www.skopenow.com/demo to schedule a demo and activate a 7-day free trial for qualified businesses.
Remember, this article only introduces some tools and techniques for deriving location data from online sources during OSINT investigations. To view the full webinar click here or download the guide, which includes advanced techniques and analysis, click here.
AUTHOR
Steve Adams