Open Source Intelligence (OSINT) gathering

Computer Keyboard

Often in the course of our business, we use OSINT to inform our casework. But what is OSINT and how do you not only gather the information but remain safe online whilst doing so? Here we provide a brief overview of OSINT and SOCMINT, and also some considerations around security when carrying out research and analysis.

What is OSINT?

OSINT is the practice of collecting and analysing publicly accessible information to be used in an intelligence context. Trained OSINT researchers use advanced techniques and tools in order to wade through the vast amounts of data online and offline in order to find that golden nugget of information.

OSINT is used by a wide range of industries, from recruiters looking into whether a potential job candidate is a right fit for the role to law enforcement who require intelligence on a suspect. Many security departments are performing OSINT activities more and more on their own companies to lock down their operational security.

Online information is in abundance and due to its transient nature, understanding how to navigate the surface, deep, and dark web can take people who are new to OSINT a long time to work out where and how to find pieces of information relevant to their requirement.

‘Requirement’ is a big word in the intelligence community as it is arguably the most important aspect of an investigation. Without a requirement, a clear understanding of your objectives, you will be looking into the open-source abyss and will not find success in what you are trying to achieve.

A clear understanding of the questions being asked and a plan on how to collect the information to answer those questions will make all the difference to the progression of your case.

Social Media Intelligence (SOCMINT or SMI)

The term SOCMINT was coined in a 2012 paper written by Sir David Omand, Jamie Bartlett and Carl Miller for the Centre for the Analysis of Social Media. To read the paper, click here.

SOCMINT is part of the OSINT realm and the techniques to research and investigate on social media are a little different from those across the rest of the online world. With a vast amount of personal information available and made public, SOCMINT techniques can really help you explore the deeper parts of Facebook, Twitter, Instagram, etc, and harness all the information it has according to your requirement for analysis.

Is someone watching you, watching them?

One question to ask yourself when conducting an OSINT investigation is how visible are you when searching online? Everything from your IP address through to the profiles you are using can be seen by others. There are many ways in which you can view the data that you are leaking and even more ways to resolve this issue with simple and free tools and techniques.

As a leading corporate intelligence company, Millbank Solutions not only conducts OSINT investigations for clients using our expert knowledge and skills, but we also provide you with the training to carry out these investigations yourself. Our team of former law enforcement and government agency officers have an enormous amount of experience to draw upon as well as keeping up to date with new and improved software and techniques as the online world evolves.

Whether you require 1 to 1 training on online analytical techniques, or a large group needs assistance on their safety and security when running online operations, Millbank Solutions is here to give you all the help and information you could need.

You can email us at enquiries@millbanksolutions.co.uk, or contact us via the details on our website at millbanksolutions.co.uk.

 

About the Author: Kathryn Caudrelier is the Director of Intelligence at Millbank Solutions, a leading supplier of corporate intelligence services.

Considerations when choosing a Reputational Due Diligence services provider

Two men at laptop

What is meant by Reputational Due Diligence (RDD)?

Due diligence (DD) is a term widely used in business circles generally referring to a means of information collection with which to inform a decision-making process. For example, if you are about to enter into a deal with an unknown company or individual, it would make sense therefore to do your due diligence and ensure you have all the information available to you. From there you can analyse and assess risk relating to you, your company, and its stakeholders.

A professional due diligence company may offer numerous services. Some may look at specific areas such as finance and some legal, but all are elements that inform the full DD package. We at Millbank Solutions, however, deal with background and reputational risk matters surrounding third party entities, where adverse publicity could cause significant loss (both financially and reputationally) and damage to a brand.

 

Can you afford not to engage an RDD provider?

There are obvious financial costs to engaging a reputable provider of due diligence services, and care should be taken to ensure that those costs are proportionate to the work required. However, not spending what could be a relatively small amount and gaining the information you need to make those informed decisions, could prove costly further into the business relationship with the third party, whether they are a customer or commercial enterprise.

The recent disclosure of the Pandora Papers ensured that some dealings involving high-profile businesspeople, politicians and organisations were aired for all to see. Perhaps those involved may have thought that the processes behind their dealings were untraceable and watertight in terms of information leakage. Any companies in the chain who may be innocently involved in the dealings could still get an unwanted mention. A credible RDD process may have highlighted the risks and provided the information they required to make alternative arrangements or decisions.

 

Choose your provider wisely

There are some basic questions you should ask yourself before choosing your RDD provider.

  • Has the provider formed an initial understanding of the risk and requirements?
  • Have they indicated that these risks would be explored as part of the due diligence process?
  • Do they have other skills and resources to be able to inform reporting where approved?
  • Can they evidence experience?
  • Have they indicated they will always operate lawfully regardless of where they may be required to operate?
  • Are the proposed services and costs proportionate to the risk?
  • Are their levels of communication effective?
  • Have they provided options or alternatives which could be as effective and may reduce costs?

This list is not an exhaustive list of questions, and you should certainly expect positive answers from them before issuing instructions.

 

Conclusion

It has never been more essential to carry out due diligence commensurate with both the requirement and your organisation’s appetite for risk. Given current supply-chain issues, the global financial climate, and the necessity to demonstrate resilience to stakeholders, there is an almost palatable clamour to rush to what seems to be an easy resolution to problems with little regard to the potential risks. Choose your provider with care and ensure they also do not become a threat to your operations. Choose well, and they will help you identify opportunities and avoid costly errors.

 

At Millbank Solutions, our specialist team take the time to understand the requirements of our clients and in consultation with them, formulate a plan of action that will result in them having all the information required to make the right decisions.

You can email us at enquiries@millbanksolutions.co.uk, or contact us via the details on our website at millbanksolutions.co.uk.

 

 

About the Author: Michael George is the Managing Director of Millbank Solutions and Associate Director of Investigations at Crime Prosecutors

5 ways to use credible information to make good decisions

man and woman at computer

You are only as strong as your weakest link, how fallible is the chain-holder?

Your business is the chain. You are the chain-holder. So, your ability to sort through a wealth of information to make effective decisions is crucial.

Here are 5 methods you can use to find credible information:

1- Analytical Reporting Tools: Knowing at what load the chain breaks can be quite useful when making business decisions. Tools that help with due diligence, country or regional risk assessments and counterintelligence can provide the necessary information. You will sound credible to your team, management, decision-makers etc. Decisions supported by accurate data lead to commercial growth.

2- Investigation Mentors: To achieve peak performance in sports, you need a coach – pretty simple right? Using that same logic – to make better decisions and achieve commercial growth, you need understandable insights from people who have several years of experience within the industry. They won’t necessarily label themselves as mentors but the wealth of knowledge they have can help you leverage digital insights which would take you more time, money and resources if you did it on your own.
You can contact some experienced investigation mentors here and have a chat via free consultations.

3- Data Cleansing: We all know there is a large amount of data out there. But, to make effective decisions, you need accurate and relevant data. This is where data cleansing comes in – this refers to the process of removing, updating and rectifying corrupt or inaccurate data within a database. When this is done, the data left behind is of a higher quality. Having higher quality data saves time and resources because you might be working with outdated data. This also means you have access to data that is GDPR compliant and you’re interacting with the right people within the industry.

4- Revisit and Re-evaluate Decisions: We have unconscious biases and deal with cognitive dissonance regularly. Our brains jump to conclusions, seeing the data we want to see rather than what is really there. We are often resistant to considering a different approach. Revisiting initial decisions and rationale at key checkpoints in our decision-making process can often produce more effective decisions than simply running with it from the start because it allows for re-evaluation and reflection. Step out of your usual decision patterns and look at the information again objectively. It may feel like you’re taking two steps back to move one step forward, however, in the long-run, you will be moving faster in the right direction.

5- Evolve and Question Decisions: Be sure to continually examine and question decisions. This is not to say you constantly second-guess yourself but to ensure you’re comfortable with the wealth of insights. If the landscape around you is changing but your analysed data isn’t, your decisions might become outdated. To take control and hold the chains of your business, it’s important to refresh and evolve strategies and decisions.

Bottom line:

As a chain-holder, you wouldn’t want to hold a chain that would break. You would want a chain that maintains integrity and trust. By following the 5 ways above, the chain (i.e your business) can grow more links without compromising on quality and performance.

 

About the Author: Kathryn Caudrelier is the Director of Intelligence at Millbank Solutions, a leading supplier of corporate intelligence services.

enquiries@millbanksolutions.co.uk

Choosing Independent Corporate Investigators

Two female investigators at computer

Sometimes in business, issues often arise which require timely, discreet, and often complex enquiries to provide answers and peace of mind or reassurances to stakeholders.

Large corporations may have internal risk management and compliance, or human resources function supported by legal counsel to take care of any potential misconduct or wrongdoing, but is that always the right route to take Smaller enterprises don’t have the luxury of a wraparound team of lawy?ers and investigators, but to them, the stakes are equally as high and the potential for reputational damage is as real. They therefore would need to find an external supplier of such services, often at short notice. But how do you begin to sift through the many providers out there claiming to be competent and professional in a mainly unregulated industry?

Do I need an independent investigator?  

A critical decision when considering the need for an internal investigation and prior to any action, is whether it can be carried out by internal staff, or is the problem so serious that a court case can be foreseen, and it requires an objective view and the gathering of admissible evidence? How would it look to stakeholders should it be suggested that a failed investigation was due to the lack of impartiality in the process, or merely due to a reluctance to spend?

Having considered the costs to be worthwhile, are you prepared to accept that the independent investigation team may find failings in your company’s processes and procedures?

Whether the issue in question is around insider threat, criminality, a whistleblowing instigated enquiry, or any other form of potential misconduct, decision-makers need to act quickly to understand the facts surrounding the case. Engaging an independent team can be costly and such an action is likely to create some disruption. However, it remains the most effective way for responsible companies to learn lessons, inform policy and procedural review, prevent future incidents, and remain compliant.

What services can investigators provide?

There are many companies and credible individuals providing what they describe as investigation services and their credentials can seem impressive. Some lead with the headlines around the provision of surveillance services and tracking devices, or online ‘investigation’; eye-catching stuff, but will it contribute to your investigation plan and provide the information you need? There is a vast difference between investigation, and analysis, and intelligence gathering, which can inform an investigation. They may be useful tools in the investigator’s armoury, but the methods and information gathered should feature on disclosure documents and where improperly or unlawfully conducted, they could bring adverse comment in a court and in-turn cause damage to your brand reputation. It is worth noting that intelligence services may be all that is required however, even then, they should be deployed where necessary and proportionate to do so. Choose wisely!

A professional and credible investigation team will suggest the various options available to meet objectives, but a more rounded approach should be taken during important cases such as fraud, corruption, director misconduct in insolvency cases, to name but a few. It may be that your company will seek to bring a private prosecution for example, and a full evidential package is required. In such cases, it is essential to ensure that the evidence is gathered lawfully, and submissions are admissible.

Asking if they have access to experts such as financial investigators, various forensic specialists, cyber investigation experts, disclosure officers, and legal experts is entirely reasonable given the potential cost in terms of financial outlay and reputational risk.

A less complex case may still require in-depth investigative knowledge, but it could be dealt with by a small team or individual with experience in corporate investigation. Ask for examples of cases of note they have completed and if possible, references and qualifications for peace of mind.

Engaging with your chosen team

Any professional team, whether you’re hiring a law firm, a risk management company, or private investigators, should first offer a free consultation so you can gauge whether they are the right fit for your company and that they can deal with the matter at hand. Equally, they should also be assessing compatibility and their own capabilities against the objectives.

You may have by this point, discussed confidentiality, and had an agreement signed. Whether vetted or not, this shouldn’t be a problem for any service provider. Dependent upon the elements of the case, requesting a DBS certificate or other credentials may also be appropriate.

Where you can, provide a full overview of the circumstances and your overall objective. This will help your investigators formulate an investigation plan in consultation with any experts or specialist counsel. It will also ensure that from the outset, evidence is gathered appropriately, and the correct documentation is maintained surrounding disclosure.

Conclusion

Taking the decision to involve an outside body in sensitive commercial matters is never easy. There can be a tendency toward an ill-informed choice or accessing the cheapest option, particularly when there is an urgency for action.

Doing your due diligence around investigation and intelligence service providers can help you minimise the potential for adverse publicity in the future and making the right choices can even help bring the case to an early satisfactory conclusion.

 

 

About the Author: Michael George is the Managing Director of Millbank Solutions and Associate Director of Investigations at Crime Prosecutors, a leading supplier of private prosecution services.

enquiries@millbanksolutions.co.uk

 

 

Who would want to be a covert human intelligence source?

Snitch, grass, snout, informant, source. All slang names for what are now widely known in legal terms (thanks to the BBC series Line of Duty) as Covert Human Intelligence Sources, or CHIS. An individual who has come forward or been approached with a view to providing information anonymously, all whilst maintaining a covert relationship with the person who may require the information. They will henceforth be referred to as their Handler.

Who uses CHIS?

In the Public Sector, there are many organisations that use CHIS to great effect, the obvious ones being the police and security and intelligence services, but it may surprise people to know that there are hundreds authorised to do so, who do not. This may be because of a lack of funding, experience, or plain fear of handling CHIS’. After all, there are many pitfalls to navigate in what is often a complex and dangerous field.

High-profile incidents where a CHIS has been mishandled or allowed to turn rogue can lead to negative publicity at best. I was reminded shortly before penning this, of a high-profile case where an individual had come forward to provide material that was so enticing and relevant, that the bigger picture was missed. Enter the Court order demanding that the material is handed over, an act which ultimately uncovered the identity of the source and resulted in a jail sentence for them, thus leaving a trail of irreparable reputational damage in their wake for the organisation.

Running a source

There are numerous reasons why CHIS are only allowed to be cultivated, recruited and ran by highly trained specialists within some public bodies. I have mentioned the potential for organisational damage, but there are others, such as the requirement for a high degree of tradecraft knowledge, the real risk of physical injury to CHIS and Handler, identifying the correct resources required for safe handling, legal issues surrounding the subject matter, ethics and human rights and the handling of rewards where they are expected. It’s not for everyone, even if they think they can do it. Government rules, laws and guidance ensure that each case is audited and there is a multi-step system in place which means that full applications for use and risk assessments are signed off by those in authority to do so before the relationship between CHIS and Handler can even be developed.

A cautious approach

What then of the bodies and organisations who run CHIS without any formal training or guidance other than peer-to-peer support and a bland code of conduct for reference? The immediate role that springs to mind is the journalist, hungry for the story, but perhaps seeks the information without seeing the bigger picture around the source of the information and the implications such an engagement has for those involved. History has shown that the law doesn’t always protect the source or the associated organisations. Given the magnitude of some of the stories which the media report and which are intelligence-led, I was shocked to find that there is little in the way of training and support for investigative journalists in this area. I watched a recent documentary on Amazon, which provides an overview of past high-profile FBI and CIA investigations. In one episode, which outlined the involvement of an American newspaper, the former editor asked the question ‘who would want to be a source?’ and advised the watcher to ‘choose (the journalist) carefully’, going on to explain the lack of training for many in their trade.

Training is required

Some private companies choose to use CHIS to support internal investigations or to monitor competitors. They too (unless they have recruited former specialists), have no training in the subject and run the risk of legal proceedings against them or reputational damage. Indeed, the disproportionate use of covert tactics by inexperienced or untrained personnel (and I include some investigation contractors), can often find the company in hot water as we have seen in recent months in the banking world. This however is a subject for a whole different article.

Conclusion

There are dangers, difficulties and far-reaching consequences even when all the moons align, when running CHIS. Motivation should be a key consideration, then there should be a full risk assessment and agreement with the CHIS regarding their reporting parameters. From the beginning to the end of the relationship, safety, security and welfare should always be at the forefront of the minds of all those involved. However, for the reasons already outlined, I fear many of the risks are missed or ignored and it is only a matter of time before we see the next adverse headline.

 

Michael George is the Managing Director of Millbank Solutions and a former specialist police detective. He is a subject matter expert in covert investigation, including CHIS’.

 

Contact Us

If you would like to discuss the corporate investigation and intelligence services or intelligence training packages provided by Millbank Solutions, contact us via our website here, via email at enquiries@millbanksolutions.co.uk, or by phone on +44 (0)208 191 9979 (London) / +44 (0)191 909 7007 (Durham)