Locating Missing Persons Using Open-Source Intelligence at DEFCON 27

Las Vegas, NV – At DEFCON 27 in Las Vegas, Unicorn Riot spoke with the organizers of an event where participants were asked to find information on real missing people in a competition called Open-Source Intelligence (OSINT) Missing Persons Capture The Flag (CTF).

Many people post information about their job, where they like to eat, or places they visit on a public profile online. Some also chose to list relationships and family members. Anything an average person can find on the public web without breaking any laws is called Open-Source Intelligence.

Participants in the CTF competition are not allowed to contact anyone connected to the case. Participants can however utilize open-source information gathered from the “dark web”. You do not need any special skills to get started, anyone with a decent grasp of how to use a search engine is off to a good start.

“We designed it [the competition] in a way that anybody could participate.” — Robert Sell

The organizers are from a Canadian non-profit organization called Trace Labs which specializes in using OSINT framework to find missing people. They hosted this competition to provide a space where DEFCON attendees had the opportunity to put their skills to use on behalf of a cause.

During the event, each team spent hours scouring through online databases and social media sites searching for various flags that would earn each team points.

When we asked the founder of Trace Labs what catalyzed their search for missing people, they responded:

“I wondered, if I’m not looking for them, who is? And the answer was sometimes, nobody.” — Robert Sell

Trace Labs investigates various types of cases regarding missing people, sometimes uncovering evidence related to human trafficking.

“Our contestants who participated were able to make a link between other cases [human trafficking] to show that they might be related” — Adrian Korn

Trace Lab’s Adrian Korn told Unicorn Riot that there are many OSINT tools you can utilize to investigate missing persons. Korn also stressed that is important to “know how to query the systems to just show you information that is already there, that you might not had found from a normal Google search.”

According to Korn, you can try to “pivot” off of someone’s publicly-listed phone number or email address “to try and paint a whole picture of their lifestyle, and see if you can use that to track their digital movements from the time they went missing to potentially finding them after.”

When significant information has been gathered on a missing person, Trace Labs then hands the intelligence over to law enforcement to assist in their search. Trace Labs hopes to get people to take part through their portal online every day or the year.

Please consider a tax-deductible donation to help sustain our horizontally-organized, non-profit media organization:

Unicorn Riot's DEFCON Coverage:

About this post

Categories: Tech

Published November 9, 2019