fraud investigation and remediation …...using social media for investigation purposes 28th annual...

©2017

FRAUD INVESTIGATION AND REMEDIATION

PRACTICES AND PROCEDURES

USING SOCIAL MEDIA FOR INVESTIGATION PURPOSES

Long ignored by investigators as a tool for research, social media can provide crucial

information on connections, wealth, and the jurisdictional footprint of individuals and companies

alike. As the social media landscape constantly evolves, the lines between what is permissible

and what is not begins to blur, discouraging many investigators from making use of such tools.

This session explores not only the techniques of social media research, but also discusses the

pros and cons of using these platforms and the ethics surrounding privacy concerns. This session

will show that you do not need to be a social media expert to master the techniques of social

media investigation.

DIANA NGO

Associate Director

Blackpeak

Diana Ngo leads the execution of pre-investment due diligence and post-investment litigation

support projects for PE, IPO, corporate M&A, and multinational clients in South Asia and

Southeast Asia, as well as Oceania. She advises clients on reputational risks that may affect their

operations and strategic business decisions. Ngo is particularly proficient in social media

research. Before working at Blackpeak, Ngo was the China Program Manager and a research

analyst at the Lincoln Institute of Land Policy and has worked on public policy issues relating to

energy and climate change for the U.S. Department of Energy and UNESCO. Ngo has given

multiple seminars on investigative due-diligence techniques for the Association of Certified

Fraud Examiners. She holds a master’s degree from the Graduate Institute of International and

Development Studies in Geneva, Switzerland, and double bachelors from the University of

California–Los Angeles. She is fluent in English, Vietnamese, and Mandarin Chinese.

“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,” “ACFE,” “Report to

the Nations,” and the ACFE Logo are trademarks owned by the Association of Certified Fraud

Examiners, Inc. The contents of this paper may not be transmitted, re-published, modified, reproduced,

distributed, copied, or sold without the prior consent of the author.


28th Annual ACFE Global Fraud Conference ©2017 1

NOTES Introduction

In today’s environment, it is difficult to downplay the

importance of social media in our society and how these

platforms have been integrated to our everyday life and

work. Long neglected by investigators as a tool for

research, social media is now at the forefront in providing

crucial information on connections, wealth, and the

jurisdictional footprint of individuals and companies alike.

At Blackpeak Group, our experience has shown that social

media research is most useful in some of the following

applications:

Source of wealth research useful for financial

institutions or insurance companies to onboard clients

Asset identification research useful for law firms

enforcing asset-seizing court orders

Whistleblower investigations into employees having

undisclosed interest in supplier companies through

extended family

Identifying and/or confirming the misrepresentation of

personal or business relationships

This session explores not only what an investigator can

hope to learn from using such techniques, but also

understand the limits of the information presented, learn

techniques specific to the most popular social media

platforms around the world, and recognize the ever-

changing ethics of privacy that make training and

awareness necessary.

Why Is Social Media Important for Investigations?

Imagine yourself signing into Facebook and finding a

picture of your Subject’s family in front of a home they

just sold. What does the picture tell you?



NOTES In this example, the picture can provide information on

their immediate family members, their income level,

and details about the property just sold. If the picture

has “likes” or comments, you can understand who are

the people closest to your Subject’s family and explore

the possibility of these individuals conducting business

deals with your Subject. Perhaps this information leads

you to another platform, such as Twitter, which can

detail where your Subject has recently been. So, while

you may believe that your Subject’s footprint is just in

Nashville, his Twitter activity from

geosocialfootprint.com may reveal otherwise, leading

you to investigate in another jurisdiction.

This scenario showcases that while social media can be

unconventional, it can lead investigators to clues that

traditional due diligence techniques may miss.

To this end, some information that can be found using

social media include:

Connections and relationships

Family

Friends

Undisclosed relationships

Business partners

Identification of assets

Cars, planes, jewelry, and other assets

Second homes and holiday homes

Holiday destinations or business activities in

other countries

Source of wealth

Indications of business deals

Family wealth

How Reliable Is This Information?

With any type of research technique, social media is

just one step on the path to understanding the true story.



NOTES While social media can provide a wealth of information

in some cases, it can also be damaging in others. Why?

Because most information provided on social media has

been self-reported, censored, or packaged to produce

“likes,” “follows,” or just provoke jealousy among an

individual’s follower base.

Let’s take the story of Zilla Van Den Borne (“Zilla”) as

an example. Zilla was a Dutch university student who

created a Facebook account to make people believe that

she was traveling throughout Asia; in reality, she was

just in Amsterdam the entire time. With proper timing,

incredible Photoshop skills, and props, Zilla was easily

able to fool her friends and family.

What lesson does this give us? Information from social

media is just one piece of the puzzle that requires

constant verification and corroboration from other

investigative research tools to understand the true

picture. When used properly, social media can offer

clues but it rarely produces the whole picture alone.

Only with proper verification can an investigator be

certain that what you find on social media is what

actually happened.

As such, constant training is necessary for social media

platforms as regulations, demographics, user interfaces,

and privacy rules continuously change.

Investigative Techniques

According to the “Digital in 2017 Global Overview” report

published by We Are Social and Hootsuite, approximately

half of the world’s population of 7.476 billion has Internet

access. From that number, about 37 percent are active

social media users. In contrast, 66 percent of the world’s

population uses mobile, while 52 percent of these mobile



NOTES users are active social users. In absolute numbers, active

social media users have approximately 240 million more

users than active mobile social users.

This difference is much more acute in developing countries

than developed, suggesting that mobile usage is more

common and accessible in these countries. And with

continued economic growth, active social media usage will

likely originate from a mobile first and the Internet second.

Take the Asia-Pacific region as an example. The region is

home to 60 percent of the world’s population and has a mix

of both developed and developing countries. The region as

a whole has continued to experience on average 6.3 percent

economic growth annually. This has produced greater

personal wealth, which has contributed to increased

connectedness to the Internet and social media.

The Asia-Pacific region is just a microcosm of this

phenomenon worldwide, playing into the cultural and

social experiences and needs of each country. When broken

down on a per-country basis, the use of social media

platforms varies greatly around the world.

In the United States, for example, Facebook, Instagram,

and Twitter are the most popular platforms. However, the

demographics of their user base in the United States have

changed for a while. This fact will affect investigators

down the road, as understanding what type of person or

profile would likely find on these platforms will determine

the type of information you would find.

In contrast, Europe is starting to take on a more local flavor

despite the overwhelming dominance of Facebook in the

region. There are platforms that are beginning to cut into

Facebook’s share of the market due to their ability to



NOTES combine local context with easier access to music and

video content. Take the social media and social networking

platform VKontakte (“VK”) as an example. VK is offered

in a variety of languages but its base users are generally

Russian or Ukrainian. VK does not have the global strength

of Facebook in active users, but what it does have is a

devoted base of young users who sign into the site almost

daily for their messaging, content consuming, and

networking needs. Because of VK, Russia is considered

one of the more active users of social media in Europe.

If we swing over to the Asia-Pacific region, the most

popular platforms are dramatically different in each

country. China is known for its homegrown social media

platforms such as WeChat and Weibo. In other countries,

international mobile messaging applications like WhatsApp

and Facebook messenger lead the way. Instagram is

popular among socialites and elites in Thailand,

Philippines, and Indonesia to display wealth, vacation

homes, and connections. In India, professional networking

is of utmost priority, making LinkedIn more valuable.

In this section, we’ll be exploring a number of social media

platforms to understand the demographics that use them,

and how investigators can use the platform and the various

search techniques specific to the platform.

WeChat

WeChat, owned by Tencent, is a Chinese chat

messaging application that has more than 700 million

active users as of March 2016.1 WeChat is China’s

social media application of choice, and it can do much

more than what it originally was intended to do. The

platform can serve as a medium for an individual to hail

1 www.techinasia.com/wechat-blasts-700-million-monthly-active-

users-tops-chinas-popular-apps.

https://www.techinasia.com/wechat-blasts-700-million-monthly-active-users-tops-chinas-popular-apps

https://www.techinasia.com/wechat-blasts-700-million-monthly-active-users-tops-chinas-popular-apps



NOTES a taxi, make appointments, make payments and transfer

money, and even market products or services for

companies. It also has a function that is similar to

Facebook’s timeline, allowing people following the

account holder to view their “memories.” These

functions make it much more progressive than other

social media applications, allowing it to maintain a high

rate of engagement and become a target for growth

outside of China.

At its very base, WeChat’s privacy settings are

structured so that an individual, with consent, follows

another person. As such, the amount of information

available is highly dependent on this structure. For

instance, the profile of a non-friend is very limited and

can offer basic information on their name, location,

LinkedIn profile (if it is linked), and sometimes the

account holder’s ten latest posts. With a friend’s profile,

you can view all of the above plus all of their posts,

time of sharing, and their moments. We do note that

unlike other platforms, WeChat does not show a third

party who an account holder is following or vice versa.

This will limit an investigator’s ability to widen the

search on their network.

Companies and individuals are also increasingly using

WeChat for PR purposes due to the application’s sheer

volume of active users. WeChat’s “public accounts” are

more unique than traditional marketing tools because

the platform offers a more intimate advertising

experience for their customers. These accounts do not

require consent to be able to follow and can be easily

searched on WeChat’s internal search function. WeChat

users are particularly interested in these types of posts,

as they are difficult to search outside of the application,



NOTES increasing the feeling of exclusivity among a

company’s fan base.

Understanding how people use WeChat is also very

useful for investigators operating in the Greater China

region. For instance, WeChat offers people the ability

to create exclusive groups for various activities,

industries, or associations. Examples of these groups

include alumni groups for a certain class year and major

at an elite university to a training-batch cohort at a

multinational company. Gaining membership into one

of these groups is potentially valuable for investigators

as an investigator can monitor and understand the

intricacies and jargon used in that group. This

knowledge will help an investigator understand how

best to approach potential sources for future cases.

As with other platforms, WeChat will require an

investigator to relax some of their privacy settings to be

part of the network. The level of information to disclose

is up to the investigator. It is an important

consideration, as it will determine whether potential

sources or groups are receptive to learning more about

the investigator and allows him/her to be included in

their daily musings, extracurricular activities, or more.

But once considered “in,” these sources or groups will

give an investigator a higher degree of legitimacy than

if they had established these connections somewhere

else.

Weibo

Sina Weibo, a micro-blogging tool similar to Twitter

was once China’s most popular social media platform

before WeChat launched in 2011. Despite the

platform’s downturn in users since then, Sina Weibo is

still considered one of the most influential platforms in



NOTES China with an approximate monthly active user base of

more than 200 million as of September 2015.2 What’s

more unique about the platform is that it has an equal

proportion of male and female users. Sina Weibo

commands a more educated demographic.

As a default, Sina Weibo’s privacy settings are set to

public. This means that user information, including

their career and education, are made public. An account

holder’s posts, location, time of posting, photos, and

follower/following lists are also public. Sina Weibo’s

only privacy restriction is the ability to create sub-

groups of followers where the account holder can post

more exclusive information (similar to Google+

circles).

As an account follower, an investigator can also use the

“secret follow” function. Within the platform, Sina

Weibo allows an individual to secretly follow up to ten

accounts without notifying the account holder. This is

particularly useful when an investigator wishes to

understand more about a Subject that has few followers

and thereby following them would raise red flags.

The best thing to understand about Sina Weibo is that

while it is still widely used today, users are not actively

updating as they were around the mid-2000s. Because

of this usage pattern, Sina Weibo is more useful for

investigators to establish past timelines for Subjects

rather than gather current information.

Instagram

Instagram, owned by Facebook, is a photo-sharing

social media platform. According to a 2015 Pew

2 www.chinainternetwatch.com/16366/weibo-search-users-insights-

2015.

https://www.chinainternetwatch.com/16366/weibo-search-users-insights-2015/

https://www.chinainternetwatch.com/16366/weibo-search-users-insights-2015/



NOTES Research Center study, Instagram has doubled its

number of online users from 15 percent in 2012 to 31

percent in 2015. The platform currently has more

engagement at 59 percent than LinkedIn at 22 percent.

In 2015, Instagram also took over Twitter in terms of

global users. Among its users, Instagram is most

popular with women and among the age range of 18–29

years old.

When looking at Instagram as a social media tool, it is

also useful to understand the platform’s privacy

options. Instagram has a basic “on/off” switch for its

privacy setting. An “on” setting means that only

individuals who request to be friends with the Subject,

and with the Subject’s consent, can view the Subject’s

profile. The “off” setting means that the Subject’s

profile has been set to public and that anyone, whether

they are “following” the subject or not, can view their

posts.

Once an investigator distinguishes whether a profile is

public or not, he or she can then delve in further to

gather information. The most basic information that can

be found on an Instagram profile is the Subject’s

personal information. This section is largely up to the

individual and can include information such as their

name, their location, their age, and other items or

hobbies that they believe their audience would be

interested in.

Since 2016, Instagram has rolled out a number of

changes regarding the type of format a user can post

which will affect the level of information an

investigator can gather.



NOTES The more traditional format is photos or short videos

that the Subject has posted on their profile. A picture or

short video can include information regarding their

location, timeline of events, family members, friends,

assets, shopping trips, vacations, business deals, etc.

This step is tedious but offers the most information

regarding the Subject and can produce names and

places that the investigator can further check elsewhere.

Since March 2017, Instagram has allowed users to post

multiple pictures in one post in what they call

“Carousel Posts.” Should you run into this type of post,

don’t forget to scroll right to left and gather information

on each picture!

Aside from the traditional profile format, or what you

can think of as someone’s digital photo album, is

another feature called Instagram Stories. In the summer

of 2016, Instagram Stories was rolled out to rival

Snapchat. They are essentially videos that someone can

post “live” and will disappear in 24 hours. With this

format, you can view “stories” of people you follow or

randomly view “stories” on the explore function of

Instagram without targeting a specific Subject.

Instagram Stories is much harder to use for an

investigator due to the need to “follow” or “add” the

Subject. There is no real passive viewing option for this

feature and has also been rolled out to Facebook

Messenger.

The last level of information refers to who is following

the Subject and who the Subject is following. For

particularly popular individuals, it is actually more

useful to understand who the Subject is following. This

list will be much shorter and will be the most pertinent

individuals in the account holder’s life.



NOTES Among the major social media platforms, Instagram’s

internal policies have changed greatly since it first

started. Previously, it was possible to use third-party

applications to analyze people, posts, locations, and

other information on Instagram. However, as of

summer 2016, these apps are no longer allowed access

to certain information and analyze the data.3

Facebook

Facebook is a social media platform aimed at

connecting individuals. Facebook has one of the highest

numbers of active Internet users, accounting for about

70 percent of active Internet users in the United States.

It also boasts a high engagement rate despite the

changing demographics of its users. In the United

States, for instance, Facebook’s demographics currently

skew toward the middle-aged bracket range of 30–49

years with females slightly taking the lead as its

dominant user.4

Compared to Instagram, Facebook’s privacy settings

are very complex. As a default, the platform will set an

individual’s profile as public. However, you can also

change it to “friends only,” “only me” or “custom.”

These basic settings are not comprehensive and require

some level of technical know-how to set the strongest

privacy settings. As such, this barrier has led many

users to keep their Facebook privacy settings more

relaxed.

3 appadvice.com/post/many-third-party-instagram-apps-have-stopped-

working/715311. 4 www.pewinternet.org/2015/08/19/the-demographics-of-social-media-

users.

http://appadvice.com/post/many-third-party-instagram-apps-have-stopped-working/715311

http://appadvice.com/post/many-third-party-instagram-apps-have-stopped-working/715311

http://www.pewinternet.org/2015/08/19/the-demographics-of-social-media-users/

http://www.pewinternet.org/2015/08/19/the-demographics-of-social-media-users/



NOTES Because of this, investigators have more access to

certain information than if Facebook’s settings were

kept simple. This includes:

Individuals who decide to change their privacy

settings from public to friends only. This change in

a setting can be useful to an investigator as there

may be a chance that information that was set as

public before this change is still visible.

Another instance involves an individual granting

access to other platforms such as Twitter or

Instagram to post on their Facebook page. This

allows an investigator to click on said links and find

information on another platform.

A third opportunity is via that Subject’s friends’

settings. For instance, a friend may post a picture of

the Subject, which shows up on their page.

However, this photo is set as public, allowing the

investigator to view it even if the Subject has

restricted their privacy settings. Since this photo is

public, there is a high likelihood that the friend’s

profile is also public, leading the investigator to

look at that individual’s photos and posts to find

more information regarding the original Subject.

Aside from the above, information can also be found on

pictures, interests, or groups. In this particular case, an

investigator can research who has given “likes” or

comments on a photo. In this case, investigators can

gain some level of understanding on people with the

highest security setting. Clicking on people who may

have liked these photos can lead an investigator to

someone who may have more relaxed security settings

and perhaps more photos or interaction with the

Subject. This step can also help the investigator map

out an individual’s second- or third-party connections.

Groups are another useful category under Facebook as



NOTES they are generally public. Because of this, an

investigator can search members of a group that the

Subject is affiliated with to get a better idea of who they

are or find leads on who may know the Subject.

For subjects who are hiding under an alias or a very

common name, Facebook’s search techniques can be of

particular use. Facebook has multiple ways of searching

people, which include searching their name, using

Google’s search site function on Facebook, or searching

via known associates. In the ACFE Regional APAC

Conference 2016 in Singapore, I reported that targeted

searches were possible. This is a search that helps you

narrow down people through a few pieces of

information. Unfortunately, this search is no longer

available as Facebook has changed its search algorithm

as of late.

The search using Google’s site search function,

“Subject name” site:facebook.com, is still available and

will come up with a list of possible matches. This is

useful for an investigator when they want to find

alternative sources of information on Facebook, such as

the Subject’s name being mentioned in a post or news

article. Among these search techniques though, we do

note that trying to find someone via their email address

is no longer an option with Facebook.

What’s more interesting in terms of searches is the

concept of using an individual’s Facebook ID number.

Each user has an individual Facebook ID number

connected to their account. There are a number of

public domain sites that will help with finding this

number. They include:

findmyfbid.com

findfacebookid.com

http://findmyfbid.com/

http://findfacebookid.com/



NOTES Another way to find someone’s Facbook ID number is

through a manual process. Go to the Subject’s page and

inspect the source code of that page. Usually this is a

right click to “Inspect” or “View Page Source.” Then

find “profileid=” on the source code and it will direct

you to that individual’s Facebook ID number.

With this Facebook ID number, you can find much

more information than the manual process. Some of the

more interesting finds are:

See what posts someone has “liked.”5

See what pictures someone has “liked.”6

See what pictures someone has “commented on.”7

See what past events someone has attended.8

See what pictures someone has been “tagged” on.9

See what posts someone has been “tagged” on.10

LinkedIn

LinkedIn is a social media platform aimed at

connecting professionals. LinkedIn has the fewest

active online users among the four mentioned above,

but its importance cannot be ignored. For one, LinkedIn

requires those using its platform to register with a real

name. Second, the platform assumes a certain level of

integrity with the information presented due to the

nature of how people use LinkedIn, primarily for

showcasing their career history, networking, job hunts,

and publicity for themselves and/or their firm.

LinkedIn’s demographics skew heavily toward an older

5 www.facebook.com/search/FB ID NUMBER/stories-

tagged/intersect. 6 www.facebook.com/search/FB ID NUMBER/photos-liked/intersect. 7 www.facebook.com/search/FB ID NUMBER/photos-

commented/intersect. 8 www.facebook.com/search/FB ID NUMBER/events-joined/in-

past/date/events/intersect. 9 www.facebook.com/search/FB ID NUMBER/photos-of/intersect. 10 www.facebook.com/search/FB ID NUMBER/stories-

tagged/intersect.

https://www.facebook.com/search/FB












NOTES age range, higher educated, and higher salaries. The

dominant gender using the platform is male, with the

platform being used most widely North America,

followed by Europe and Asia-Pacific.11

As LinkedIn requires members to use their real full

name, investigators may be wary of using LinkedIn to

conduct their research. However, signing into an

account will give them much more information than

using the “public” version of the platform. For instance,

a “public” profile can be accessed by using the Google

site search function for a particular individual’s name

“first name_last name” site:linkedin.com. Conducting

this type of search, while not signed into LinkedIn, will

give an investigator a simple profile while many

features of the website will be hidden from view.

On the other hand, if you sign into your account and

look at someone’s profile, you will have access to

information such as their full profile, people with

similar profiles, people who have endorsed them,

groups they are involved with, their contact

information, and sometimes a full or partial list of their

connections. This level of information allows an

investigator to branch out from just the Subject to their

wider network, creating a greater level of understanding

of who their professional peers are and who their

classmates or business partners may be.

While passively consuming information on a Subject’s

professional background is the main objective for many

investigators, LinkedIn is also a powerful tool to

develop expert sources in many different industries.

However, to do this, an investigator first needs to

11 press.linkedin.com/about-linkedin.

https://press.linkedin.com/about-linkedin



NOTES understand that to recruit an expert source, he or she

will also need to give something. In this case, an

investigator will need to give up some degree of

privacy to be part of the established LinkedIn

community.

For instance, to connect with experts from many

different industries, an investigator will need to

maintain a fairly robust profile and a wide network of

contacts. The reason for this is that under LinkedIn’s

settings, members of the community are given greater

privileges the more they are deemed “close” to another

individual. What this means in LinkedIn is that the

platform will keep track of the degree of separation

between you and another individual and dictate what

you can and cannot do in LinkedIn. For instance,

LinkedIn will label someone who you have added as

your contact and has added you back is called your

“first-degree connection.” Someone that this person is a

contact of will then become the investigator’s “second-

degree connection” and so on. Without this large

network and closeness to someone, an investigator will

be unable to add them to their contact list or directly

message them for source inquiries within LinkedIn.

This will also limit an investigator when doing a search

for a specific individual. Without a first, second, or

third degree of connection, LinkedIn will just label that

individual as “LinkedIn Member.” We note that these

principles apply to only the free version of LinkedIn. If

needed, investigators can pay for premium features

within the platform to be able to directly message an

individual who is not their friend or contact. This

feature is called “InMail.”

A quick review of LinkedIn’s privacy settings is

especially appropriate for an investigator using



NOTES LinkedIn for secondary research. As people use

LinkedIn to primarily network and find new

opportunities, the platform’s features are set to public

once you sign in. This is not the privacy setting that

investigators should be concerned about. What

investigators should understand is that people can also

view who has seen their profile. Within LinkedIn’s

privacy settings, there are options to limit this and thus

allow an investigator to view multiple profiles

anonymously.

As of early 2017, LinkedIn has changed the entire user

interface of its website to match that of its mobile app.

As such, while the above techniques are still available,

LinkedIn has made it harder to do certain things or has

eliminated some features on the website. Before this

rollout, one such feature that was available was the

ability to access an individual’s WeChat QR code on

their LinkedIn profile to directly take the investigator to

the Subject’s WeChat account. This feature is no longer

available.

Social Messaging Apps

In the last few years, social messaging apps have been

taking over the world. They include Snapchat,

WhatsApp, Facebook Messenger, Line, Viber, and

others. We Are Social has placed Facebook Messenger

in the Top 5 most used social media applications in the

United States, the United Kingdom, Brazil, and the

United Arab Emirates, while WhatsApp is placed in the

Top 5 in the United Kingdom, Brazil, United Arab

Emirates, and Indonesia.

They are extremely popular with younger demographics

and offer a greater level of privacy as they’re primarily

used for private one to one messaging purposes.



NOTES As they’re often used for private messaging purposes,

only a number of these can actually be used for

investigators in what can be deemed as “public”

information. Let’s take the case of WhatsApp. When an

investigator adds a phone number into their phone’s

address book, WhatsApp will automatically detect if

that person has an account with the app. If they do, the

Subject will show up on your WhatsApp address

account. As an investigator, you can see if the person is

active or online and if they have posted information on

their status page (i.e., location, pictures, etc.). But this is

the extent of the public information. What’s more

interesting is that WhatsApp will not notify the person

that you have added them, keeping you anonymous.

In another case, investigators should be more cautious

with using Line. This is because as soon as a person is

added into an address book, Line will automatically

contact the Subject and tell them that you have added

them. Line does not offer public information for you to

view.

Facebook Messenger and Viber are similar in that they

are used for private messaging, with little to no public

information. Snapchat, the social messaging app of

choice for those under 25 years old, is a bit different.

While it is used for private-messaging purposes, it is

highly social and many accounts consider themselves to

be “public” even though you must “add” them. This

type of account belongs to celebrities, socialites, or

other high profile people. Depending on the country in

which the investigator is in, this may be considered a

violation of privacy due to the need to “add” yourself to

that person’s following. If that is the case, there is no

truly public profile on Snapchat.



NOTES Ethics of Privacy

When using social medial for investigative research,

concerns regarding the ethics of privacy arise as people

consider whether the information they have posted to their

account is public or not. In most ways, this already has

been defined by the social media platform as set out by its

privacy settings and the Terms and Conditions for use. We

stress that it is important to remember that no actions

should be taken that breach the social media platform’s

Terms and Conditions for use.

As previously described in the above sections, privacy

settings are unique to each platform and dictate what is

public and what is not. This makes investigative research

on social media easier as investigators can clearly see what

the account holder has allowed them to see.

In other cases, it is actually a balance between what the

investigator is willing to disclose so that they too can be

part of a social network. LinkedIn’s privacy settings, for

instance, have this dichotomy that asks an investigator how

much are they willing to disclose in exchange for greater

access. If by chance an investigator wishes to close that

door and implement the strictest privacy settings, they too

will be unable to interact, connect with professionals, look

for industry experts, or even allow people to search and

contact them.

At all times, researchers and investigators should have a

complete understanding of the privacy laws in the

jurisdictions that they operate and fully abide by those

laws.



NOTES Case Study 1: Whistleblowers in the United States

A private equity client approached Blackpeak regarding

two separate but very similar whistleblower emails sent to

the firm’s general information email.

According to the emails, two males, claiming to be

shareholders of a large multinational mining company

(“Giant Mining”) had expressed concern over Giant

Mining’s decision to undertake a joint venture with the

Client’s mining company in Latin America (“LAT

Mining”). The two men understood that the Client had

invested in LAT Mining and alleged LAT Mining was

operated by an individual (“Kim”) who was plagued with

lawsuits across a number of countries. The men also

indicated that the lawsuits were attributed to Kim’s sale of

a “dubious” mine in Africa (“AFR Mining”) which had not

produced any material for close to a decade. The men also

alleged that the expert who assessed the mine for LAT

Mining and AFR Mining was no longer professionally

qualified. The Client asked to understand the background

of each men, how are they affiliated, how they know about

these issues, and what are their motivations.

Each email to the Client had a letter and two news article

clippings attached. We started by doing individual searches

on the two men, one based in California (“CA Man”) and

one based in New York (“NY Man”). Our public domain

research (corporate records, title records, identifying family

members, etc.) found that both men were in their early 20s

and whose job, property, and family did not correspond to

that of a major shareholder in Giant Mining. Our research

found no apparent connection between the two men, but

their Facebook profiles indicated that they were friends.

The trail had stopped at this point. So we went back to the

information the Client had given us before. We ran IP



NOTES address searches on each email and found that they

originated from a similar area in Los Angeles, CA. We then

analyzed the metadata of the three documents and found a

name on the .pdf of one the documents—“Daniel Park.”

Taking this lead, we used social media research and found

Daniel Park had attended the same high school as CA Man.

Both were involved in track and field in school. Further

searches of Daniel’s Facebook profile indicated that he

graduated from Temple University, the same school that

NY Man had graduated from. Our searches of this name,

“Daniel Park,” in the media, public domain, and social

media platforms did not find any more information.

So, we brainstormed. What do we understand about this

“Daniel Park”?

He’s a young man of Korean origin. From my

experiences living in Seoul, Koreans will tend to adopt

an English name starting with the same initial as their

Korean names. Assuming this, we have a partial name

now – “D. Park”).

What else do we understand at this moment?

D. Park and NY Man had attended to the same

university.

How can you find information from their university?

Many universities around the world have a robust

alumni directory on their websites. Looking at the

Temple University Alumni Directory, we found that

there are options for resetting your account via your

email should you forget your password.

How can we test this alumni directory system?

We refer to the original email that NY Man sent to the

client and found his email to be [email protected].

mailto:[email protected]



NOTES Most people use the same handle for all their accounts,

whether they are social media or emails.

Assuming this, we figure that his school email may be

[email protected].

We input [email protected] into the password

recovery system and the system says “Hello, NY Man.

We located your record! Please follow this procedure to

reset your password.”

By testing the system, we understood that we might be able

to get Daniel Park’s legal name. So, we input

[email protected] into the system and find the system

says, “Hello Dong Hyun.”

We then proceeded to verify that Dong Hyun Park and

Daniel Park are the same individuals. We did this through

his track and field records, where we found the same dates

and times for both Daniel Park and Dong Hyun Park’s track

and field meets from high school and university,

confirming a match.

But how are Daniel Park, CA Man and NY Man involved

in this and know about the Client’s investment?

As previously mentioned, our media and online searches

did not find any information on Daniel Park. However, our

searches found the name “Dong Hyun Park” related to a

number of litigation cases in connection to AFR Mining

and Kim. According to one of the litigation cases, “Dong

Hyun Park’s” father was a shareholder in AFR Mining and

had commenced legal action the company years prior. His

father alleged that Kim had misled shareholders in regards

to AFR Mining’s assets.

This “whistleblower” case was due to the Park family’s

misgivings with Kim and his business dealings. Thus, our






NOTES client, a major shareholder, was targeted due to their

potential influence the JV project between Giant Mining

and LAT Mining.

Case Study 2: Terrorist Connections

The last case heavily relies on social media to determine

connections to a terrorist group in Southeast Asia.

An institutional banking client was reviewing their roster of

their high-risk clients and noticed one client had a

connection to a mining company in Southeast Asia with a

list of suspect shareholders and directors. Most of the

shareholders had a unique last name that was similar to the

leader of a known terrorist group in Southeast Asia.

Due to the sensitivities of this case, a case study will not be

provided in this conference paper. I will go through the

case live at the conference.

fraud investigation and remediation …...using social media for investigation purposes 28th annual...

Documents