In the TraceLabs Global Capture the Flag (CTF) Event, OSINT researchers trace missing people and compete for points. Our correspondents entered the competition and filed this report.
The 21st century professional investigator must deploy a combination of shoe-leather and cyber-sleuthing techniques. Enter the TraceLabs Global Capture the Flag (CTF) Event, an online competition among volunteer OSINT research teams to use their cyber-skills to search for people reported missing.
What Is It?
These are real cases that have gone cold — law enforcement folks from around the world have requested assistance in developing new leads to find the missing. For 4 to 6 hours, teams of up to four volunteers drop into cyberspace and start hunting for those additional leads, competing against other teams that all play by the same rules.
Each piece of intel is submitted to a volunteer judge and scored by standardized values. Find the missing person’s colleague’s social media account? – 15pts. Find intel in the Dark Web? – 250pts.
Teams start the “game” with case files that include, at a minimum, a picture with a first and last name of the missing person, plus a short narrative about the person and circumstances of their disappearance.
Oh, and here’s the catch: You can’t hack, use paid databases, “like” or follow anyone linked to the person on social media, chat up the missing person’s connections, etc. The goal is to use pure online OSINT (Open-Source Intelligence) to develop new leads using a “no-touch reconnaissance” approach.
Quick Stats
According to the National Crime Information Center (NCIC), there were 521,705 missing person entries in the U.S. In 2021, 424,222 of those cases were closed because the missing had been found, the record cleared, or the case cancelled. At the end of 2021, 93,718 of those cases remained open, presumably unsolved.
With a computer and virtual private network (VPN), you can help with some of the these 93,718 unsolved missing persons cases through TraceLabs CTF.
The Team
Our March 26th CTF Team included:
Jake Rue – 10yrs USMC Veteran and 20 yrs IT networking / security; newly licensed private investigator
Mike Gay – 30 yrs IT and Critical Infrastructure Protection; newly licensed private investigator
Lindsey Smith – 4 yrs private investigator/legal services w/ MS criminal justice
Eli Wilkerson – 3 yrs private investigator & cybercrime consultant
Lindsey’s Report:
I earned a Master’s in criminal justice from Sam Houston State University, then opened a Houston-area firm called Prime Investigations and Legal Services (PrimeILS). I’m also a mother of 4 children and 2 stepchildren, which maybe gives me a different perspective than my male counterparts on this CTF team.
I joined the group after working with Eli Wilkerson on a large investigation based in Harris County, Texas. Eli and I and the other team members each brought strengths, weaknesses, strategies, and outlooks to the TraceLabs arena. Eli Wilkerson was a “hacker” of sorts — but the good kind. And I knew that I could earn points for the team by hunting down leads via social media.
My goal was to see who had been in touch with the subject before and after the date they went missing and map out a branching tree of contacts. It’s illuminating to pay attention to who shared the victim’s missing posters, who cared that they had disappeared, and who went on with their lives as if nothing had happened.
There are lots of tricks to collecting information about someone from a social media platform. For example, profile links can be very telling. One person’s name may be “Lindsey Smith”* on Facebook, but the link may show Lindsey.Johnson98. From the link alone, we may have uncovered valuable data that helps us verify a connection; 98 could be a significant number in “Lindsey’s” life. Johnson could be a maiden name or an old married name, widening our pool of connections to examine.
*Side note: As an investigator, when you tell people that your last name is “Smith”, they tend not to believe you.
Again, our team was applying the knowledge and resources we use in our investigative practices every day. But the “gamified” scenario created by TraceLabs forced us to push our own mental boundaries in a fast-paced, limited-time environment. It was an intense adrenaline rush to compete against hackers, enthusiasts, and OSINT “hunters” from every imaginable investigative specialty, all working together for one greater good — on a case that we PAID to work on, instead of for a client who paid us.
As an additional bonus, there was that euphoria of knowing that we might uncover something that the seasoned police officers originally assigned to the case hadn’t been able to find. Every investigator knows the rush of uncovering a new, previously unseen piece of evidence, especially when doing so might make a real difference to a missing person’s loved ones.
Lindsey’s Takeaways:
This experience reminded me so powerfully of the value of having a solid support team. One investigator working alone cannot do it all. Having a backup squad of solid business connections makes you an even better private investigator — and a more well-rounded person in general.
When you state your limitations outright, colleagues and clients alike are more likely to trust you.
Lindsey Smith
I learned that it’s not just OK, but very wise to say, “I don’t know how to do that, but I know someone who does.” When you state your limitations outright, colleagues and clients alike are more likely to trust you. That has been a HARD lesson for me to learn in life. (We PI’s can be pretty stubborn and independent. Ha!) Stubbornness — in the form of persistence — can be a great quality to have when digging for the truth. But the obstinate, lone-ranger mindset does you no good when you need to ask for help.
In short, I can highly recommend the TraceLabs CTF Event for any investigator. The experience honed my investigative skills and the OSINT tools at my disposal, all while our team worked together towards the good cause of finding new information in these missing persons cases.
Eli’s Report:
My Amarillo, Texas-area investigative firm, Praxis Detection SVCS, LLC, is focused on cyber/online investigations and fraud examination. I’m slowly expanding into the cyber forensics niche, since I finished the Certified Ethical Hacker (CEH) and Computer Hacking Forensic Investigator (CHFI) certifications.
I recruited Lindsey for the March 26th Team for her unique background and perspective. I knew the leadership and tenacity she exhibited during that complex Harris County case would be vital to those of us with our heads primarily in cyberspace. Lindsey is brilliant at mapping out familial and friend links. Ultimately, cyberspace is human space.
Lindsey’s social media analysis led us to discovering phone numbers, email addresses, and company associations. I loved the moments of discovery, punctuated by, “Oh, this is weird!” or “Hey, guys I found another thing” over our secure communications. Then we cyber types would divvy up the leads: “I’ll take that one and set up a ‘webcrawler’ to look for connecting links” or “I’ll pivot and make a run through known data breach information.” This dynamic worked well and proved to me the investigative firepower that investigators and subject matter experts can wield when we team up and even train together.
This … proved to me the investigative firepower that investigators and subject matter experts can wield when we team up.
Eli Wilkerson
I’ll grant that we moved more slowly and did not submit as many pieces of intel than some other teams did. Maybe that’s because our team was so diligent about ensuring the intel was solid, with a good chain of custody and affirmative links. That’s a great practice for investigator work product, but maybe not so good for leaving points on the table for the event. We might have been a bit too “forensic” with our TraceLabs efforts. So be it: we learned lots and had a great experience.
Our team lovingly calls the day after CTF the “OSINT hangover.” I can attest to plenty of lost sleep that night as I mentally replayed missed leads and pivots. But the challenges and frustrations, and the minimal entry fee (a whopping grand total of $10USD), were well worth the opportunity to ply our trade to help families who might not be able to hire professional investigators.
Eli’s Takeaways:
The TraceLabs event is a crucible that encourages critical thinking and teamwork. Participants must use pure online Open Source Intelligence (OSINT), leaving no trace (pun intended) of our cyber activities.
I have found that each run through a TraceLabs CTF event sharpens my critical thinking and develops my private investigator skills. I always find some glaring area of improvement that leads me to studying different open-source investigative tools. The landscape of cyberspace is constantly changing; current tech is updated, new technology is introduced, and people discover new ways to use the technology. Almost every type of investigation will have at least one facet that is cyber, so staying current is key.
Conclusion
What did we learn?
For us, the value of the TraceLabs CTF event goes far beyond improving our skills for our daily work. It’s about fun and camaraderie, testing personal limitations of knowledge, and the thrill of potentially contributing to a breakthrough in a missing person’s case that formerly seemed like a dead end. We pulled on new threads in cyberspace, hoping to uncover something new, and learned so many new tricks in the process.
Want to participate? You can find more information about this event at www.tracelabs.org. #OSINTforgood.
*note: Neither Eli nor Lindsey are employed by or affiliated with Trace Labs in any way. We simply found the Capture the Flag Search Party on March 26, 2022 provided personal growth, and we wanted to share it with our investigative community.
Post Script:
What were the results of the March 26th, 2022 CTF event? In 4 hours, the 150+ teams provided the following:
6,635 pieces of intel submitted, with 4,686 being accepted.
- 83 “date last seen”
- 558 “Advanced Subject Info”
- 1370 “Basic Subject Info”
- 99 “Home”
- 1415 “Family”
- 487 “Employment”
- 674 “Friends”
About the authors:
Lindsey Smith opened Prime Investigations and Legal Services in 2021 after obtaining her Master’s degree in criminal justice from Sam Houston State University. She’s a licensed private investigator and certified process server with a passion for criminal justice and psychology. Lindsey specializes in“difficult” serves and investigations.
Lindsey is a married mother of 4 children and 2 “bonus children”. In her (scant) spare time, she enjoys traveling with her family.
Eli Wilkerson opened Praxis in late 2019, initially focusing on fraud investigations. Since the spring of 2020, he’s fallen down the cyber/digital forensics investigation rabbit hole and will start a second Master’s program in digital forensics, fall of 2022.
Eli and his wife raise and compete with their Australian Shepherds. When time permits, he studies Judo and Aikido.