I’m still publishing deep dives of digital investigative tools and techniques, as well as round ups of OSINT tools, tips, readings, and videos. But Indicator is also the home of my reporting and investigations, as well as the work of an awesome new partner!

Indicator lives at Indicator.media and I won’t be publishing new content on Substack. If you’re already a subscriber to Digital Investigations you don’t need to do anything. I moved my content and subscribers to the new site.

If you came here to sign up, please go to Indicator.media and join me there!

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

This is the final edition of Digital Investigations for 2024. Thank you for reading and for subscribing. If you have a moment, you can vote for me in OSINT Team’s poll for the best OSINT newsletter of 2024. See you in the New Year!

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Bluesky has experienced an explosion in users and traffic, with upwards a of million accounts being created per day. Lots of journalists, researchers, and OSINTers have joined or stepped up their posting. (This is my account.)

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

It’s been a few months since my last tools and tips round up, so here we go!

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

I love investigating websites. I wrote a chapter about it for the most recent edition of the Verification Handbook and I’m always looking for new tools and methods to connect sites together, identify owners, and to analyze site content, infrastructure, and behavior.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Investigators have two new, free books to help guide open source research.

In April, the Center for Strategic and International Studies released “Open Source Investigations in the Age of Google.” From a description of the book:

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Digital advertising is a half a trillion dollar a year industry and a core element of global marketing and election campaigns. Digital ads are also commonly used in influence operations, scams and cybercrime.

Yet, in my experience, ads are rarely mentioned or taught in OSINT and digital investigative courses. I believe they’re one of the least investigated and most poorly understood aspects of the digital economy. I’ve been trying to change that by giving ad investigation workshops and by drawing attention to tools and techniques in this newsletter. I previously listed free digital ad tools and described a reporting methodology I used while investigating Google’s ad business.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Over the last few weeks, a notorious fugitive drug kingpin and the head of Israel’s secretive military surveillance unit were exposed thanks to a similar OSINT technique.

Christopher Kinahan Sr is the reputed head of the the Kinahan cartel and among the world’s most wanted fugitives. He’s evaded capture for years. But Bellingcat connected him to a Google account that has left reams of reviews of restaurants and tourist attractions going back several years. Kinahan even posted photos that showed his partial reflection, aiding in the verification process.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

It feels like I keep having to start my tools and tips posts with updates about the disappearance of tools and resources. That’s life in the world of digital investigations, where products, tools, features and exploits come and go. Platforms giveth and they taketh away…

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Geolocation

Geolocation can be labor intensive. You might view a video frame by frame to look for landmarks and other location clues, or extract dozens of screenshots to run through reverse image search engines, among many other steps.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

LinkedIn X-ray search is what sourcing experts like Irina Shamaeva call the ability to use search engines to search for LinkedIn profiles using the “site:” operator. Here’s a basic example of an X-ray search to find people at ProPublica who might report on health:

site:linkedin.com/in “propublica” “health”

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Welcome to another year of Digital Investigations! Thank you for reading and for sharing this newsletter with friends and colleagues. I appreciate your feedback and comments and intend to keep Digital investigations free.

Let’s kick off 2024 with a look at new (to me) tools and readings worth your time. I also added a new section to highlight videos worth watching. One pick is a video of Nico Dekens’s recent talk at Le Hack. He emphasized the importance of mindset, being systematic in your work, developing and testing research questions, and more. Maybe start the new year with a reminder of the primacy of mindset and workflow?

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Professional searchers and investigators often complain about the quality of Google Search results.

The low quality content, the truncated results, the emphasis on guessing what a user wants and highlighting one answer, rather than inviting complex queries… Yes, power searchers have lots of complaints. But we don’t seem to be alone.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Two recent online events offered a ton of tips and resources for open source investigations.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

Rae Baker is a maritime OSINT analyst working for Deloitte. She’s also a prolific contributor to the open source investigative community. Baker has an email newsletter, is part of the OSINT Curious crew, wrote a recent book about getting into maritime OSINT and, along with Espen Ringstad, she co-founded Kase Scenarios, an innovative training platform.

In the second edition of the Investigator Interview series, Rae and I talked about how she became an analyst, why she loves charts, and what the downward spiral of Twitter/X means for all of us. (BTW I’m on threads here, Bluesky here and Mastodon here.)

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

I just returned from the Global Investigative Journalism Network’s conference in Gothenburg, Sweden, where over two thousand journalists came together to share investigative approaches and techniques. This edition of Digital Investigations features a rundown of some of the guides and tools shared there, along with other articles and tools I’ve collected over the past month or so.

Let’s go!

Tip Sheets and Slide Decks from GIJN

📚 I attended a great panel about investigating artificial intelligence systems. The panelists, Garance Burke from Associated Press, Gabriel Geiger from Lighthouse Reports and Lam Thuy Vo from The Markup, produced a really useful tip sheet. It covers how AI systems work, methods for getting data about AI systems, and reporting tips.

📚 There’s also a FOIA template for making requests for data and information about AI systems.

📚 And Burke recently did an interview with the Reuters Institute for the Study of Journalism where she laid out tips for reporting on AI. One nugget: “Just keeping in mind how human biases can influence the ways in which these tools work is important, in addition to knowing that you have the agency yourself to deploy AI tools and experimenting in testing the systems that you're reporting on. Doing new digitally savvy open source work in your newsroom is also a good place to keep pushing.”

📚 Research trainer Marcus Lindemann did a session called Google for Nerds that offered examples of Google Dorks and tips for optimizing them. He listed the many file formats that you can use with the “filetype:” search operator. Marcus’ slide deck is a great companion to the recent article from Ron Kaminsky, “From Zero to Google Dorking Hero: Enhancing Your OSINT Arsenal.” It’s an excellent, detailed article.

📚 There was a session about using Google Pinpoint for organizing and analyzing content and data. I use it to help extract key entities form reams of PDFs and other documents, and to create a dataset of docs I can easily search. This tip sheet from Eduardo Goulart, Alice de Souza, and Reinaldo Chaves shows how to use Pinpoint to transcribe audio files, how to use content labels, how to take advantage of Pinpoint’s structured data extraction feature, and how to combine Pinpoint with tools like Hunchly.

📚 Benjamin Strick and Reade Levinson did a session (that I unfortunately missed!) focused on using satellite images for investigations. Lucky for us, they produced a tip sheet.

📚 At the conference GIJN launched its Reporter’s Guide to Investigating Digital Threats. The free, five-part online guide provides reporters and other investigators with tools, techniques and guidance on how to investigate digital threats such as disinformation, trolling and spyware. I wrote the first part of the guide and am one of the instructors for GIJN’s virtual Digital Threats training course. It’s free for journalists around the world and is accepting applicants for the second cohort. Apply by Oct. 6!

Tools

📍First off, a change that may make investigations more difficult on Twitter/X: the company rolled out the ability for paid users to hide their likes. TikTok offers this feature and it’s proven popular. We’ll see if it catches on with Twitter’s paid userbase.

📍Digital Footprint Check is a cool tool that lets you enter a username or email (as well as optional data like a phone number) and search online to find related accounts and information.

📍Want to learn how to see the invisible tracking/ID dots that digital printers embed in pages? (Think of this infamous example.) @allforosint shared a link to Forensic Dots, a tool to help you see how it works.

📍Paul Myers, one of the best digital investigative trainers in journalism, gave two sessions at GIJN. One was focused on images and he shared Face++, a tool you can use to compare two photos of a person. It provides a similarity score to help determine whether it’s the same person in both photos.

📍Henk vas Ess, another fantastic digital investigative trainer who was also at GIJN, recently launched a tool that lets you search the text of the About sections of Facebook profiles. And here’s Henk’s Substack.

📍Here’s a great collection of tools and info for investigating a vehicle. (via @0xtechrock)

📍The OSINT Newsletter shared Greynoise, a toll that provides a bevy of information about an IP address.

📍This is a great list of tools to investigate social media accounts/platforms.

Worth Reading

📚 Jon Keegan and Jesse Woo from The Markup wrote a guide to reading and analyzing website privacy policies, “How to Quickly Get to the Important Truth Inside Any Privacy Policy.”

📚 Journalists and investigators love archive.today. Ever wonder who runs it? “On the trail of the mysterious guerrilla archivist of the Internet” showcases a range of OSINT techniques to uncover clues as to the identity of its owner.

📚 Leon Yin published a great checklist that journalists can use for “Pitching Hypothesis-Driven Data Investigations.”

📚 I’ve long followed the work of Conspirador Norteño on Twitter, where they post investigative threads about fake accounts and disinformation. Now they have a free, must read Substack.

📚 The indefatigable , who tweets up a storm and writes on Substack, published a detailed guide, “When you need search by nickname in public IP addresses search engines (Shodan, Netlas, Fofa etc).”

📚 Bellingcat published “Measuring Up: How to Calculate the Size of Objects in Open Source Material.”

📚 Nico Dekens, aka Dutch OSINT Guy, wrote a handy guide, “Using AI for extracting Usernames, Emails, Phone Numbers, and Personal Names from large datasets.”

📚 @Techjournalisto offered a great thread and a PDF showing how they investigate a company name.

That’s it for this edition of Digital Investigations! Thanks for reading.

Google image context tool

For more than a decade, journalists and investigators asked Google to add the ability to sort reverse image search results by date. TinyEye does it, and it’s hugely helpful for verification. But it seemed like Google would never add this feature.

That changed in late June when Google announced the beta version of an image context tool for Fact Check Explorer. I got a live demo and it looks very promising! You can sign up here to get access to the beta, which should begin rolling out next week.

Here’s a look at some of the features…

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!

In 2011, writer and technologist Andy Baio published an article in Wired that explained how he uncovered the identity of an anonymous blogger.

“The unlucky blogger slipped up and was ratted out by an unlikely source: Google Analytics,” he wrote.

Google Analytics is a free and popular service that measures the audience of an online property. Data from BuiltWith shows it’s currently used by close to 40 million sites.

Hi! Digital Investigations has become Indicator and all of my content has moved to Indicator.media. Please go there to read and subscribe.

Indicator publishes multiple times a week. It offers original reporting, in-depth investigations, and practical tutorials on open-source intelligence (OSINT) tools and techniques.

I hope you’ll join me there!