News, Resources and Useful Information for the Online Investigative and OSINT Professional from Toddington International Inc.
TII Logo

Toddington International Inc.

Online Research and Intelligence Newsletter

February 2017 EDITION

Welcome to the Newsletter


With applications being taken to February 20th to apply to be a "Fugitive" on the upcoming Season 3 of the hit UK TV series "Hunted", we are pleased to announce that Season 2 of the programme is now airing in Australia on ABC2 and we'll be in Sydney during that time presenting our Two-Day Advanced Open Source Intelligence and Online Investigations Masterclass.

Seating is now limited so sign up now to learn the advanced skills you need to be effective as an online investigator and analyst while gaining insight into some of the unique lessons learned while we filmed this innovative series!
 


e-Learning Graduates
 
Congratulations to the following students who are among those who have successfully completed the 40 hour Using the Internet as an Investigative Research Tool™ e-Learning program this month:
  • Jonathan Sigmaringam - BMO
  • Chris Kaminarides - Hastings Direct
  • Jeff Timmermans - Xpera Risk Mitigation and Investigation
  • David Fitzgerald - South Australia Police
  • Gord Olson - RCMP
  • Zahide Huseyin - Hastings Direct
  • Denise Li - RBC
  • Kenneth Dodd - RBC
  • Teodora Harrop - Capita 
  • Kuldip Jutla - RCMP
  • Antonia Xenopoulos
  • Matthew Wright - South Australia Police 
  • Malyka Tan - BMO
  • James Skinner
  • Leroy Stockton - UN Special Tribunal for Lebanon

Upcoming Select World Wide Training Dates


Please Contact Us Directly for your In-House Training Requirements
 



"Latest Trends in SOCMINT, OSINT & Cyber-Psychology"
One-Day Masterclass

March 20, 2017, Calgary, AB
Early Bird Pricing in effect for a Limited Time!
 

"Advanced Open Source Intelligence and Online Investigations Masterclass (Australia Edition)" 
2-Day Comprehensive Training Program

February 27 - 28, 2017, Sydney Australia
 


"Advanced Open Source Intelligence and Online Investigations Masterclass (SE Asia Edition)" 
2-Day Comprehensive Training Program

March 30 - 31, 2017, Manilla, Philippines
April 3rd - 4th, 2017, Singapore

 

"By The Numbers" - Facebook and LinkedIn User Identification

By Norm Wilhelm, Senior Associate
Toddington International Inc.


One of the teaching points in our online investigation course relates to the importance of identifying the user ID number that is associated with a social networking account.  Not just on Facebook, Google Plus, LinkedIn, or Youtube (all used as our examples in this article), but on any other social networking website that provides each account user with a unique ID number. 

Surprisingly, in a lot of investigation reports I have read over the years, even in ones I have read over the past few months, the report writer rarely ever identifies social networking accounts by their assigned ID number.  The impression I receive as to why this information is not included in reports is because very few people realize how important that user ID number can be.


The Missing User ID Number - An Example

Knowing the user ID number for an account can be very advantageous for an online investigator in terms of time.  The less time out of the budget that you spend confirming old information is time that can be better spent searching for new information.  
 

As an example, consider the following: 

  • You receive an assignment to investigate a person; 
  • The previous report for this assignment is two years old; 
  • The previous report identifies that the person has a Facebook account;
  • The report identifies the name and profile photo used at that time;
  • The report identifies that the account was open to public viewing at that time;
  • This person has the commonly found name of John Smith as the name on the account. 


Knowing that previous reporting found social networking accounts is great information; but the report is two years old.  Since then, this person can have easily changed their profile photos dozens of times; the account name may have changed; the account user name may have changed; and it is very likely that this person has changed the privacy settings on the account to hide information from public viewing (that could have been used to corroborate the identify of the account holder). As a result, it is going to take time, and effort, and time for report writing, to locate the account, check that it is still active and explain how you confirmed this.  But that extra effort would not have been required if the person who wrote the first report had taken the time to write down the Facebook user ID number for that account.  With that number you would know in less than one minute whether the account was still active and what name it is currently under.  


Clever People And Their Tricks

Some targets of online investigations go to considerable effort to hide their accounts and account information, especially when they are aware that they are the target of an online investigation.  The following are examples of some of the tricks that targets of investigations have used to try to hide, or obscure, the extent of their online activities:
 

  • Links to accounts on the same website with the same user name but are unrelated different people;
  • Multiple accounts on the same website with the same name, all used by the same account holder;
  • Multiple accounts on the same website with different names, all used by the same account holder;
  • Changing account names and the user ID name in the URL to conceal the original identity;
  • Using privacy settings to hide information to prevent corroborating the identity;
  • Hiding early account information and only leaving the last year of activity open to public viewing;
  • Operating business accounts and using them as personal accounts;
  • Deleting old accounts and replacing them with new accounts so that all old metadata is lost.


Hiding information by using privacy controls is probably the most common action taken today by insurance claimants and plaintiffs to conceal their online activity.  As a result, metadata from social networking accounts is becoming of increasing importance in proving that these persons are active online, and for that you need either the device they use to access the Internet; or, the user ID number.  

There are a wide variety of searches that can be conducted on some social networking websites if you know the user ID number.  In addition, when requesting information from administrative staff of large social networking websites, there are millions of users, so it is becoming more and more common for there to be multiple accounts under the same name.  Knowing the user ID number of an account eliminates any confusion as to what account or person is being referred to; there should be only one person in that company's database with that user ID number and that associated set of metadata. 

 

Google Plus and Youtube Identification Numbers

For the benefit of those who are new to the field of online investigations, the user identification (ID) number is that unique identity assigned to a newly created account on a social networking website.  This number series can be fully numeric or alphanumeric depending on the website, and in some cases may not even be issued in sequential order. 

As a simple example, here is a typical URL address for an account on Google Plus (shown below).  On this account for David Toddington, of Toddington International Inc, you can see the name of the account holder and some of his personal information.   It is very simple to identify who this person is and confirm that this account appears to be operated by David.  In this case, the user ID number is in the URL address, identifying the account as having a unique ID number of #106642132164725540673.  

https://plus.google.com/106642132164725540673/ 

On a side note, some readers might wonder why Google would need an ID number large enough to handle 999+ Quintillion people (when the population of the earth is only around 7.4 billion).  It is probably due to Google having acquired so many  websites over the last ten years that they need that large of a number to track all of the unique account information they have acquired (and that still leaves plenty of room for future acquistions). 

In this next example, I've chosen an account on Youtube for the television station BBC (shown below).  On this account the user name is shown as 'BBC'.  The unique identification number for this account is the channel number.  If you can't find this number directly from search results, it can be found by going to the About page on the BBC account.  Using Mozilla Firefox, right click on the uppermost box containing information about subscribers and description, and select View Page Source.  Select Ctrl-F to open a search bar and type in channelid.  One of the first results should show the alphanumeric sequence UCCj956IF62FbT7Gouszaj9w as the unique identification number for this account, shown below.  I have also provided how the user name and unique ID number should appear in the URL for this account. 

https://www.youtube.com/user/BBC 

<meta itemprop="channelId" content="UCCj956IF62FbT7Gouszaj9w">

https://www.youtube.com/channel/UCCj956IF62FbT7Gouszaj9w 

 

LinkedIn Identification Numbers

LinkedIn identification numbers are a bit trickier.  The account user identification number used to be fairly simple up until about 2011, with a number in the URL address up to about eight digits.  Since then, the numbering system has been changed by LinkedIn a few times, primarily due to improvements that enhance the privacy and security of users and account content.  Nowadays you can see at least four types of account numbers that are open to public viewing: 

  • standard eight-digit numbers (i.e. 44555666)
  • mixed name and eight-digit numbers (i.e. john-smith-33999888)
  • mixed name and eight-alphanumerics (i.e. john-smith-222a4444)
  • custom names (i.e.johngsmith, johnsmith52)

Each of these accounts still has a unique identity number, it just isn't visible on the page or in the URL address anymore.  The unique identification number for this account is the memberid, for which I will use the account for David Toddington as an example.  Using Mozilla Firefox, right click on the uppermost box containing information with the user name and basic profile information, and select View Page Source.  Select Ctrl-F to open a search bar and type in memberid.  There are often two or more memberid numbers visible on the page source, so don't just pick the first one you see.  The one for the account owner is the one that matches the line shown below.  In this line, the memberid is the account you are viewing (you are seeing Dave's account number), and the sessionid is the person doing the viewing (so you are seeing my LinkedIn identification number there). 

https://www.linkedin.com/in/davidtoddington 

memberId:45856526,sessionId:382720836,sessionFullName:'Norman Wilhelm'

Unfortunately, this only works if you are signed into LinkedIn.  Also unfortunate is that a lot of searches you used to be able to do with this identification number do not work anymore.  

 

Facebook Identification Numbers

Facebook identification numbers are in my opinion the most time-intensive to identify.  First, there are three elements used to identify the account: the account user name, the url name, and the identification number unique to that account.  Up until July 2010, this identification number was visible in the URL address for every person who created an account up until that time.  You can still see this number in the URL on some older accounts.  Facebook then offered the option of customizing your URL name for active account holders, and for new accounts being created.  Later still, Facebook automatically assigned a URL name based on your account name when you created an account (i.e. jane.smith.999).  

There is still a unique account identification number for each account, but this too has changed over time.  Originally this identification number was seven digits long; later it became nine digits for personal accounts and ten to twelve digits for group accounts (unconfirmed as to exactly when this occurred).  The current standard is a 15-digit long identification number for most personal accounts and 15 or 16 digits for most group and business accounts.  Users also have the option of being assigned an identifying alphanumeric, or creating your own custom name.  So basically you have the following variations active:

https://www.facebook.com/profile.php?id=1234567

https://www.facebook.com/profile.php?id=123456789

https://www.facebook.com/profile.php?id=1234567890

https://www.facebook.com/profile.php?id=123456789012

https://www.facebook.com/profile.php?id=123456789012345

https://www.facebook.com/jane.doe.13 (assigned)

https://www.facebook.com/janey-doe (custom)

 

Norman Wilhelm is a licensed private investigator with over 20 years of experience in open source intelligence and online investigations. A highly decorated and accomplished former member of Canadian military intelligence, he has been recognized by the Supreme Court of British Columbia as an expert in open source intelligence and online investigations.

His current work at TII includes research on internet resources, curriculum development and instruction on the topic of online investigations, delivering courses to investigators working at private companies, corporate security units, regulatory agencies, provincial government departments and federal agencies.

Sponsored Message

Resources for the OSINT Professional

etools.ch - Meta search engine (search Bing, Google, DuckDuckGo, and more)

namecheckr.com - Search usernames on multiple social networks

tcdata360.worldbank.org - World Bank's Open Trade and Competitiveness Database; search by keyword, or browse by country or indicator

ilovepdf.com - Free PDF editing tools 

howmanyofme.com - Interesting site that may indicate how many people have the same name in the US (there are 46,883 John Smiths!)

turtlapp.com - Encrypted alternative to Evernote

serpstat.com - SEO platform with keyword search tool

radaris.com - Public Records Deep Search: Comprehensive information from US local, state and federal sources

peekier.com - New privacy-oriented search engine

bandicam.com - Free Windows screen recorder

visualcapitalist.com/interactive-mapping-flow-international-trade - Fascinating visualization mapping international trade on a 3D globe, plotting exchange of goods between countries

 


Want more? Visit our continually updated, FREE Online Research Resources Page featuring hundreds of links, cheat sheets, investigative guidelines and more!
 

Comprehensive E-Learning Program:
Using the Internet as an Investigative Research Tool™ 

 
 
e-Learning: "Using the Internet as an Investigative Research Tool"

Take your Online Research and Intelligence Skills to New Levels

The most comprehensive and up-to-date Internet Research e-Learning program available anywhere, "Using the Internet as an Investigative Research Tool" is designed to enable investigators, researchers and intelligence personnel to find better online information, in less time, at less cost, with less risk".

For a fraction of the cost of a classroom based training course, our flexible and interactive virtual classroom environment allows candidates to progress at their own pace and competency level with a qualified personal instructor on hand at all times to ensure success. Initially launched in 1998, this highly acclaimed and continually updated online course has been successfully completed by over six thousand investigators and knowledge workers around the world.

As a HRSDC certified educational institution, TII provides Canadian students with a T2202 Tax Receipt and a Certificate of Completion from the Ontario Police College.

Enrollment takes only a few moments; online credit card payments are accepted, group discounts and licensing options are available for five or more registrants.



Bonus: Tuition fee includes a one-year subscription to the newly revised and updated TII Premium Resource Knowledge Base, a premium resource of some 4,000 deep web resources and sites (an additional $299 value)

 

Visit the TII e-Learning page to find out more and instantly register, or contact us directly with any questions

Also of Interest to the OSINT Professional


Copyright © 2017 Toddington, All rights reserved.