Advanced Sciences and Technologies for Security Applications Babak Akhgar P. Saskia Bayerl Fraser Sampson Editors Open Source Intelligence Investigation From Strategy to Implementation Advanced Sciences and Technologies for Security Applications Series editor Anthony J. Masys, Centre for Security Science, Ottawa, ON, Canada Advisory Board Gisela Bichler, California State University, San Bernardino, CA, USA Thirimachos Bourlai, Statler College of Engineering and Mineral Resources, Morgantown, WV, USA Chris Johnson, University of Glasgow, UK Panagiotis Karampelas, Hellenic Air Force Academy, Attica, Greece Christian Leuprecht, Royal Military College of Canada, Kingston, ON, Canada Edward C. Morse, University of California, Berkeley, CA, USA David Skillicorn, Queen’s University, Kingston, ON, Canada Yoshiki Yamagata, National Institute for Environmental Studies, Tsukuba, Japan The series Advanced Sciences and Technologies for Security Applications comprises interdisciplinary research covering the theory, foundations and domain-specific topics pertaining to security. Publications within the series are peer-reviewed monographs and edited works in the areas of: – biological and chemical threat recognition and detection (e.g., biosensors, aerosols, forensics) – crisis and disaster management – terrorism – cyber security and secure information systems (e.g., encryption, optical and photonic systems) – traditional and non-traditional security – energy, food and resource security – economic security and securitization (including associated infrastructures) – transnational crime – human security and health security – social, political and psychological aspects of security – recognition and identification (e.g., optical imaging, biometrics, authentication and verification) – smart surveillance systems – applications of theoretical frameworks and methodologies (e.g., grounded theory, complexity, network sciences, modelling and simulation) Together, the high-quality contributions to this series provide a cross-disciplinary overview offorefront research endeavours aiming to make theworld a safer place. The editors encourage prospective authors to correspond with them in advance of submitting a manuscript. Submission of manuscripts should be made to the Editor-in-Chief or one of the Editors. More information about this series at http://www.springer.com/series/5540 Babak Akhgar P. Saskia Bayerl (cid:129) Fraser Sampson Editors Open Source Intelligence Investigation From Strategy to Implementation 123 Editors Babak Akhgar FraserSampson Schoolof Computing andManagement Officeof the Police andCrime Sciences Commissionerfor West Yorkshire Sheffield Hallam University Wakefield Sheffield UK UK P. SaskiaBayerl Rotterdam Schoolof Management ErasmusUniversity Rotterdam TheNetherlands ISSN 1613-5113 ISSN 2363-9466 (electronic) AdvancedSciences andTechnologiesfor Security Applications ISBN978-3-319-47670-4 ISBN978-3-319-47671-1 (eBook) DOI 10.1007/978-3-319-47671-1 LibraryofCongressControlNumber:2016955064 ©SpringerInternationalPublishingAG2016 Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpart of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission orinformationstorageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilar methodologynowknownorhereafterdeveloped. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publicationdoesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfrom therelevantprotectivelawsandregulationsandthereforefreeforgeneraluse. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authorsortheeditorsgiveawarranty,expressorimplied,withrespecttothematerialcontainedhereinor foranyerrorsoromissionsthatmayhavebeenmade. Printedonacid-freepaper ThisSpringerimprintispublishedbySpringerNature TheregisteredcompanyisSpringerInternationalPublishingAG Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland Preface It is our great privilege to welcome you to our book Open Source Intelligence— From Strategy to Implementation. In this collection, we offer an authoritative and accessible guide on how to conduct open-source intelligence (OSINT) investiga- tions from data collection to analysis to the design and vetting of OSINT tools. It further highlights the broad range of challenges and complexities faced by law enforcement and other security agencies utilizing OSINT to increase our commu- nities’ security as well as to combat terrorism and organized crime. Oneofthemostimportantaspectsforasuccessfulpoliceoperationistheability for the police to obtain timely, reliable, and actionable intelligence related to the investigation or incident at hand. OSINT provides an invaluable avenue to access and collect such information in addition to traditional investigative techniques and information sources. Examples of OSINT covered in this volume range from information posted on social media as one of the most openly available means of accessingandgatheringopen-sourceintelligencetolocationdata,OSINTobtained from the darkweb to combinations of OSINT with real-time analytical capabilities and closed sources. And while OSINT by its nature is not generally gathered as ‘evidence’,itcanbepowerfulwhendeployedinproceedingsagainstcriminals.The book therefore concludes with some consideration of the legal and procedural issues that will need to be addressed if OSINT is to be used in this way. Thisbookthusprovidesreaderswithanin-depthunderstandingtoOSINTfrom a theoretical, practical, and legal perspective. It describes strategies for the design and deployment of OSINT for LEAs as well as other entities needing to capitalize onopen-sourcedata.Thebookoffersawiderangeofcaseexamplesandapplication scenarios from LEAs to defense and security agencies to industry, as well as hands-onguidanceontheOSINTinvestigationprocess.Thebookoutlinesmethods andillustratesbenefitsandchallengesusingreal-lifecasesand(best)practicesused by LEAs, security agencies, as well as industry. Another important aspect is the inclusion of legal and ethical considerations in the planning and conducting of OSINT investigations. Wewouldliketotaketheopportunitytorecognizetheworkofourcontributors toallowustodrawupontheirexpertiseforthisbook—aprocessthathasenabledus v vi Preface to highlight many of the important aspects of OSINT-related needs and require- ments of LEAs and other security actors within its chapters. This interdisciplinary approach has helped us to bring together a wide range of domain knowledge from lawenforcement,academiaandindustry topresentourreaders with anoperational focusedaspectofOSINT-basedinvestigationsandrelatedstrategicnarratives from planning to deployment. We hope that this book will serve as a compendium for practitioners, academics, teachers, and students for state-of-the art knowledge ranging from conceptual considerations to hands-on practical information to legal and ethical guidance. Sheffield, UK Babak Akhgar Rotterdam, The Netherlands P. Saskia Bayerl Wakefield, UK Fraser Sampson Acknowledgements The editors wish to thank the multidisciplinary team of experts who have con- tributed tothisbook,sharingtheirknowledge,experience, and latest research. Our gratitude is also extended to the following organizations and projects: – CENTRIC (Centre of Excellence in Terrorism, Resilience, Intelligence and Organised Crime Research), UK – Rotterdam School of Management, Erasmus University, Netherland – InformationTechnologiesInstitute,CentreforResearchandTechnologyHellas (CERTH-ITI), Thessaloniki, Greece – National University of Public Service, Budapest, Hungary – National Academy of Sciences, Institute for Computer Science and Control, Hungary – Hungarian Competition Authority – Police Services of Northern Ireland – Home Office CAST, UK – Serco Plc. – EU-FP7 Project ATHENA (313220) – EU-H2020 Project TENSOR (700024) – EU-FP7 Project HOMER (312388) – DG Home Project UNIFC2 (HOME/2013/ISEC/AG/INT/4000005215) vii Contents Part I Introduction 1 OSINT as an Integral Part of the National Security Apparatus ..... 3 Babak Akhgar 2 Open Source Intelligence and the Protection of National Security. .... ..... .... .... .... .... .... ..... .... 11 Andrew Staniforth 3 Police Use of Open Source Intelligence: The Longer Arm of Law... .... .... ..... .... .... .... .... .... ..... .... 21 Andrew Staniforth 4 OSINT as Part of the Strategic National Security Landscape . .... 33 Laurence Marzell 5 Taking Stock of Subjective Narratives Surrounding Modern OSINT.... .... ..... .... .... .... .... .... ..... .... 57 Douglas Wells Part II Methods, Tools and Techiques 6 Acquisition and Preparation of Data for OSINT Investigations.. .... .... ..... .... .... .... .... .... ..... .... 69 Helen Gibson 7 Analysis, Interpretation and Validation of Open Source Data. .... 95 Helen Gibson, Steve Ramwell and Tony Day 8 OSINT and the Dark Web.... .... .... .... .... .... ..... .... 111 George Kalpakis, Theodora Tsikrika, Neil Cunningham, Christos Iliou, Stefanos Vrochidis, Jonathan Middleton and Ioannis Kompatsiaris ix x Contents 9 Fusion of OSINT and Non-OSINT Data. .... .... .... ..... .... 133 Tony Day, Helen Gibson and Steve Ramwell 10 Tools for OSINT-Based Investigations... .... .... .... ..... .... 153 Quentin Revell, Tom Smith and Robert Stacey 11 Fluidity and Rigour: Addressing the Design Considerations for OSINT Tools and Processes.... .... .... .... .... ..... .... 167 B.L. William Wong Part III Pratical Application and Cases 12 A New Age of Open Source Investigation: International Examples.. ..... .... .... .... .... .... ..... .... 189 Eliot Higgins 13 Use Cases and Best Practices for LEAs.. .... .... .... ..... .... 197 Steve Ramwell, Tony Day and Helen Gibson 14 OSINT in the Context of Cyber-Security. .... .... .... ..... .... 213 Fahimeh Tabatabaei and Douglas Wells 15 Combatting Cybercrime and Sexual Exploitation of Children: An Open Source Toolkit. ..... .... .... .... .... .... ..... .... 233 Elisavet Charalambous, Dimitrios Kavallieros, Ben Brewster, George Leventakis, Nikolaos Koutras and George Papalexandratos 16 Identifying Illegal Cartel Activities from Open Sources. ..... .... 251 Pál Vadász, András Benczúr, Géza Füzesi and Sándor Munk Part IV Legal Considerations 17 Legal Considerations for Using Open Source Intelligence in the Context of Cybercrime and Cyberterrorism. .... ..... .... 277 Alison Lyle 18 Following the Breadcrumbs: Using Open Source Intelligence as Evidence in Criminal Proceedings.... .... .... .... ..... .... 295 Fraser Sampson