OSINT Investigation of Close Connections on Twitter
If you are researching someone with a Twitter account, you can quickly identify their closest or strongest relationships.
If you are researching someone with a Twitter account, you can learn a lot about them--family, friends, jobs, location, personal politics and associations--if you quickly identify their closest friends or strongest relationships. The Tweet Topic Explorer, which is intended to find the main topics in the tweets of a Twitter account, can also be used to find the account’s main friends/associates.
Why bother? NBC investigative Brandy Zadrozny said that,
"You can judge a person by the company they keep on social media. We can tell a lot about a person’s life and leanings by examining the people with whom they interact online."
WHERE TO FIND THE CLOSEST ASSOCIATES
The Tweet Topic Explorer, built by the company Neoformix, enables a researcher to see which words are most commonly used by a specific Twitter account. As seen in the visualization below, the words are separated into different bubbles that are grouped by topics. In addition, the bubbles are sized based on the number of times the word was used. This tool also puts all of the Twitter account's tweets in a list on the right side of the screen. Once can click on a word bubble, such as "coronavirus," and this will filter the list on the right so it shows all of the account's tweets with the word "coronavirus." This example is for the Twitter account of The New York Times (@NYTimes).
This is a great way to get feel for the subject matter of an account's tweets. But for the purposes of this post, this tool will be used to find the Twitter user's top associates. Also note that we are using the word "associates," which in this case will refer to friends, family, coworkers, etc.
FINDING TOP ASSOCIATES
The Twitter handles of a Twitter account's primary associates will appear in large bubbles in the Topic Map near the center. The Topic Map identifies which twitter handles appear most often in the main person's tweets because it counts each time a public tweet is "addressed" to another person or talks about that other person. In both cases the other person's Twitter handle will appear in the tweet and Tweet Topic Explorer will count the handle as one of the words that appear often in the main account's tweets.
As noted above, by clicking on any of these bubbles in the Topic Map, the list on the right will filter and show all of the tweets with that term. When one clicks on a word bubble for a twitter handle, filtered list of tweets on the right will include tweets publicly directed at that specific twitter handle, even when the handle does not appear in the content of the tweet. One can quickly identify which handles appear largest and closest to the center in the map. If the person you are researching is tweeting most often to or about these people, we will guess that these people are likely the person's main Twitter associates. This logic is far from perfect but holds up with enough people. Nonetheless there are flaws that must be considered. We will work to remedy those flaws, when necessary, in the section NATURE OF THE RELATIONSHIPS.
Side Note: The bio page for twitter accounts will often tell you a handful of things about the person. A lot of this kind of information is the sort of thing that you will know when you see it. For example, maybe there is a profile picture that reveals someone's general location, social economic background, that they have a family, etc. This might be because the person appears to be on a British city street, they are wearing expensive clothes, there are children's drawings in the background. These are sort of easy examples but hopefully my point is clear.
Side Note Continued: In addition, many bio pages have one or more lines of text that list basic information about the account owner. This information can range from profession, hobbies, political beliefs, religious background, etc. The point is that with many Twitter accounts you can tell quite a bit about a person based on a quick look at their bio.
WHICH ACCOUNTS HAVE USEFUL BIOS
The next step is to find a handful of the twitter account's top associates who have the kind of bio pages that tell you something about the account owner. Ultimately you are only looking for about five such accounts.
To do this, look at which twitter handles exist in the Topic Map and, starting with the largest and working downward, go to each of those twitter accounts' bio pages one at a time. When you open a new account's page, you will immediately know if it is useful or not. It is not worth putting any additional thought or effort into it. Usually you will only have to look at 5 to 10 accounts to find 5 good ones. If you look at more than ten, you will have to be cognizant that that means each new account may have a less significant role in the tweets of that person's account as you go further down the line toward smaller and smaller bubbles.
Once you have five accounts, take a quick look at each of their bio pages and consider what factors are common among them. This information reflects back on the original twitter user. If you are having trouble finding relevant information, considered the characteristics listed in the side note above. Try to see if you can tell where they live, what kind of people they are, are their profile photos casual or professional.
EXAMPLE OF ONE ACCOUNT'S TOP ASSOCIATES
The following is an example of a Twitter account's top associates. Look for common features that might reflect the initial Twitter account.
You may have identified a few key aspects of these accounts. The accounts are all reporters, they live in or near Washington D.C., they have international professional backgrounds, and they all mention "ICIJ."
These accounts are the primary associates of a senior official (who will not be named for the sake of retaining a shred of privacy) at the Washington D.C.-based International Consortium of Investigative Journalists (ICIJ). By the nature of his position, this official also works in journalism and has a international professional background.
It is also strongly recommended that you follow all of these well-respected reporters anyway on Twitter as well as the ICIJ (icij.org) if you are interested in investigative journalism focused on international issues.
NATURE OF THE RELATIONSHIPS
Finally, it may sometimes be necessary to research the nature of these accounts' relationships to the original account. This is especially true if one of the accounts is an outlier or is particularly relevant (maybe they are a politician and you want to know if the main person is actually friends with a mayor). And, you also want to make sure that one of the accounts is not in the person's top associates merely because they are famous.
There are three easy steps that can help determine the nature of the relationship. Basically, the goal of each step is to see if this is a two way relationship or if one person is merely following the other person.
First, Tweetbeaver allows you to quickly check if two twitter accounts are following each (with a tool called "Check if two accounts follow each other). A celebrity might be followed by a fan on twitter, but the celebrity likely does not follow each of their fans in turn.
Second, Tweetbeaver and several other sites will let you see if two accounts have any friends in common or any followers in common (with two tools called "Find common followers" and "Find common friends").
Once again, the logic here is that if they have friends in common they might actually know each other and run in similar social circles. Some websites will only let you use this feature a limited number of times.
It is possible to do this on your own with excel as many times as you want. The simplest way is to copy and paste both twitter accounts' list of followers (or people they follow) in one column in Excel and then use the "deduplicate" feature that you can look for in with the "Help" or "Search" tool. Just bear in mind that you want to keep the duplicates, do not hit remove duplicates" or you will lose the common followers from your file.
Third, Tweetbeaver will also let you see any tweets by either of the two accounts that are publicly sent to each other, are about each other, or are replying to each other (with a tool called "Find conversations between two accounts"). This is presented as a list in chronological order for the purpose of allowing you to read if the accounts are actually interacting with each other. In contrast, a celebrity will make announcements and fans will reply, but the celebrity usually doesn't reply to individual fans.
ONE STEP FURTHER?
Finally, if you want to take your research one step further, I recommend returning to Tweet Topic Explorer and looking for key words. As noted before, if you click on one of the word bubbles it will filter and show you all of the account's tweets that use that word.
So, for example, if you click on the words "like" or "love" to will discover many of their interests or perhaps their views on political, religious, or social matters. Similarly, the word "hate" is very useful. Also, consider looking for the words "husband", "girlfriend", or "kids" to see if there are any tweets that mention "my husband", "my kids", etc. to see their family status. Also consider "job", "work", "home", "parents", and "move".
By now you have learned a good deal from the overall content of their tweets. At the very least you have certainly learned much more than you could have discovered by tediously scrolling through the account's tweets in that same amount of time. Hopefully, you are ready to take this information and pivot your investigation forward.
About The Artwork Used In This Article
You may have noticed that we often like to break the norm where an article's image must be relevant to the article's subject, we find it liberating. In this issue, we push the boundaries a little more with some thought-provoking imagery and by showcasing a specific artist. We like to showcase the work of illustrators, designers, and artists when choosing our images, but have never really showcased the work of a photographer before. We thought it was time to change that. True to our form, we chose a subject matter completely unrelated to infosec.
Welcome to the wonderful world of Spencer Tunick, an artist who has been documenting the live nude figure in public since 1992. Tunick has been arrested five times while attempting to work outdoors, the charges were later dropped but the threat of arrest haunted him constantly.
Determined to create his artwork on the streets, he filed a civil rights lawsuit to protect him and his participants from arrest. In May 2000, the Second US district court sided with Tunick, recognizing that his work was protected by the First Amendment of the US Constitution.
In response to New York city's final appeal to the US Supreme Court, Justice Ruth Bader Ginsburg ruled in favor of Tunick by remanding the case back down, allowing the lower court decision to stand and the artist to freely organize his work on the streets of New York City.
Learn more about Spencer Tunick and his art using the links below: