By Norm Wilhelm, Senior Associate
Toddington International Inc.
One of the teaching points in our online investigation course
relates to the importance of identifying the user ID number that is associated with a social networking account. Not just on Facebook, Google Plus, LinkedIn, or Youtube (all used as our examples in this article), but on any other social networking website that provides each account user with a unique ID number.
Surprisingly, in a lot of investigation reports I have read over the years, even in ones I have read over the past few months, the report writer rarely ever identifies social networking accounts by their assigned ID number. The impression I receive as to why this information is not included in reports is because very few people realize how important that user ID number can be.
The Missing User ID Number - An Example
Knowing the user ID number for an account can be very advantageous for an online investigator in terms of time. The less time out of the budget that you spend confirming old information is time that can be better spent searching for new information.
As an example, consider the following:
- You receive an assignment to investigate a person;
- The previous report for this assignment is two years old;
- The previous report identifies that the person has a Facebook account;
- The report identifies the name and profile photo used at that time;
- The report identifies that the account was open to public viewing at that time;
- This person has the commonly found name of John Smith as the name on the account.
Knowing that previous reporting found social networking accounts is great information; but the report is two years old. Since then, this person can have easily changed their profile photos dozens of times; the account name may have changed; the account user name may have changed; and it is very likely that this person has changed the privacy settings on the account to hide information from public viewing (that could have been used to corroborate the identify of the account holder). As a result, it is going to take time, and effort, and time for report writing, to locate the account, check that it is still active and explain how you confirmed this. But that extra effort would not have been required if the person who wrote the first report had taken the time to write down the Facebook user ID number for that account. With that number you would know in less than one minute whether the account was still active and what name it is currently under.
Clever People And Their Tricks
Some targets of online investigations go to considerable effort to hide their accounts and account information, especially when they are aware that they are the target of an online investigation. The following are examples of some of the tricks that targets of investigations have used to try to hide, or obscure, the extent of their online activities:
- Links to accounts on the same website with the same user name but are unrelated different people;
- Multiple accounts on the same website with the same name, all used by the same account holder;
- Multiple accounts on the same website with different names, all used by the same account holder;
- Changing account names and the user ID name in the URL to conceal the original identity;
- Using privacy settings to hide information to prevent corroborating the identity;
- Hiding early account information and only leaving the last year of activity open to public viewing;
- Operating business accounts and using them as personal accounts;
- Deleting old accounts and replacing them with new accounts so that all old metadata is lost.
Hiding information by using privacy controls is probably the most common action taken today by insurance claimants and plaintiffs to conceal their online activity. As a result, metadata from social networking accounts is becoming of increasing importance in proving that these persons are active online, and for that you need either the device they use to access the Internet; or, the user ID number.
There are a wide variety of searches that can be conducted on some social networking websites if you know the user ID number. In addition, when requesting information from administrative staff of large social networking websites, there are millions of users, so it is becoming more and more common for there to be multiple accounts under the same name. Knowing the user ID number of an account eliminates any confusion as to what account or person is being referred to; there should be only one person in that company's database with that user ID number and that associated set of metadata.
Google Plus and Youtube Identification Numbers
For the benefit of those who are new to the field of online investigations, the user identification (ID) number is that unique identity assigned to a newly created account on a social networking website. This number series can be fully numeric or alphanumeric depending on the website, and in some cases may not even be issued in sequential order.
As a simple example, here is a typical URL address for an account on Google Plus (shown below). On this account for David Toddington, of Toddington International Inc, you can see the name of the account holder and some of his personal information. It is very simple to identify who this person is and confirm that this account appears to be operated by David. In this case, the user ID number is in the URL address, identifying the account as having a unique ID number of #106642132164725540673.
On a side note, some readers might wonder why Google would need an ID number large enough to handle 999+ Quintillion people (when the population of the earth is only around 7.4 billion). It is probably due to Google having acquired so many websites over the last ten years that they need that large of a number to track all of the unique account information they have acquired (and that still leaves plenty of room for future acquistions).
In this next example, I've chosen an account on Youtube for the television station BBC (shown below). On this account the user name is shown as 'BBC'. The unique identification number for this account is the channel number. If you can't find this number directly from search results, it can be found by going to the About page on the BBC account. Using Mozilla Firefox, right click on the uppermost box containing information about subscribers and description, and select View Page Source. Select Ctrl-F to open a search bar and type in channelid. One of the first results should show the alphanumeric sequence UCCj956IF62FbT7Gouszaj9w as the unique identification number for this account, shown below. I have also provided how the user name and unique ID number should appear in the URL for this account.
<meta itemprop="channelId" content="UCCj956IF62FbT7Gouszaj9w">
LinkedIn Identification Numbers
LinkedIn identification numbers are a bit trickier. The account user identification number used to be fairly simple up until about 2011, with a number in the URL address up to about eight digits. Since then, the numbering system has been changed by LinkedIn a few times, primarily due to improvements that enhance the privacy and security of users and account content. Nowadays you can see at least four types of account numbers that are open to public viewing:
- standard eight-digit numbers (i.e. 44555666)
- mixed name and eight-digit numbers (i.e. john-smith-33999888)
- mixed name and eight-alphanumerics (i.e. john-smith-222a4444)
- custom names (i.e.johngsmith, johnsmith52)
Each of these accounts still has a unique identity number, it just isn't visible on the page or in the URL address anymore. The unique identification number for this account is the memberid, for which I will use the account for David Toddington as an example. Using Mozilla Firefox, right click on the uppermost box containing information with the user name and basic profile information, and select View Page Source. Select Ctrl-F to open a search bar and type in memberid. There are often two or more memberid numbers visible on the page source, so don't just pick the first one you see. The one for the account owner is the one that matches the line shown below. In this line, the memberid is the account you are viewing (you are seeing Dave's account number), and the sessionid is the person doing the viewing (so you are seeing my LinkedIn identification number there).
Unfortunately, this only works if you are signed into LinkedIn. Also unfortunate is that a lot of searches you used to be able to do with this identification number do not work anymore.
Facebook Identification Numbers
Facebook identification numbers are in my opinion the most time-intensive to identify. First, there are three elements used to identify the account: the account user name, the url name, and the identification number unique to that account. Up until July 2010, this identification number was visible in the URL address for every person who created an account up until that time. You can still see this number in the URL on some older accounts. Facebook then offered the option of customizing your URL name for active account holders, and for new accounts being created. Later still, Facebook automatically assigned a URL name based on your account name when you created an account (i.e. jane.smith.999).
There is still a unique account identification number for each account, but this too has changed over time. Originally this identification number was seven digits long; later it became nine digits for personal accounts and ten to twelve digits for group accounts (unconfirmed as to exactly when this occurred). The current standard is a 15-digit long identification number for most personal accounts and 15 or 16 digits for most group and business accounts. Users also have the option of being assigned an identifying alphanumeric, or creating your own custom name. So basically you have the following variations active:
Norman Wilhelm is a licensed private investigator with over 20 years of experience in open source intelligence and online investigations. A highly decorated and accomplished former member of Canadian military intelligence, he has been recognized by the Supreme Court of British Columbia as an expert in open source intelligence and online investigations.
His current work at TII includes research on internet resources, curriculum development and instruction on the topic of online investigations, delivering courses to investigators working at private companies, corporate security units, regulatory agencies, provincial government departments and federal agencies.