SOCMINT, GEOINT, COMINT: three sub-disciplines of OSINT explained

SOCMINT

Aric Toler, of the NGO Bellingcat, was browsing various social media networks when he successfully identified Dan Borden, a young neo-Nazi who committed a hate crime during the infamous « Unite the Right » rally held in April 2017 in Charlottesville, Ohio (USA). Within an hour, Toler found the individual being sought for the crime, by comparing the viral images of the rally’s violent brawl with photos posted on Facebook by a friend of the young American. In the end, Dan Borden was sentenced to four years in prison for his involvement in the beating of DeAndre Harris.

This example shows how Social Media Intelligence, or SOCMINT – analysis of social media – can be useful for investigations. User profiles, virtual interactions and the metadata associated with the content posted on these platforms are a goldmine of information for open-source researchers. The investigative work of law enforcement agencies is also made easier when criminal groups increasingly « cyber bang » on social media, to brag about their successes or attract new recruits.

Information from social media also plays a pivotal role in the creation of interactive maps, especially in regions where it is difficult for the media to gain access. The Afghan Witness Map is an initiative that seeks to expose human rights violations in Afghanistan. Most of its input comes from images uploaded onto Twitter, enabling individuals to access a previously impenetrable reality in just a few clicks.

What tools do you need to get started in SOCMINT?

The search website Social Search Engine enables users to search for a term or a name across multiple social media platforms simultaneously, while exifdata can be used to extract metadata from images found on the internet. This Person Does Not Exist, another relevant website, generates realistic photos for use in creating fake profiles, which are essential for safeguarding online researchers during their virtual investigations.

GEOINT

GEOINT, or geospatial intelligence, involves analysing data and images associated with a particular place. In widespread use since the start of the invasion of Ukraine, to track the movement of Russian troops, debunk disinformation and document equipment losses by armies, this sub-discipline has a great many devotees, as can be seen from the popularity of the Twitter account GeoConfirmed, which is managed by volunteers specialising in geolocation.

As an example: a photo of a darkened room, its walls marked with a prayer in the Cyrillic alphabet: this is all that the researcher Sofia Santos had to go on, to determine the exact location of a torture chamber in the town of Balakliya, Ukraine. This researcher, an avid solver of geolocation challenges, first gathered additional information from the media, including social media, before starting to explore a neighbourhood of Balakliya using Google Maps. A short virtual walk was enough to reveal the clear correspondence between the visual elements shown in a video posted by the BBC and those around the disused police station where the atrocities had occurred.

What tools do you need to get started in GEOINT?

SunCalc measures the shadows in photographs to determine at what time they were taken, while Google Earth offers a 3D view of onshore landscapes by superimposing satellite images, aerial photographs, and spatial and geographic data.

COMINT

COMINT, or communications intelligence, enables researchers to gather information about the people who send and receive virtual messages, such as their location. It is also possible to extract other metadata, for example the duration of the communications, when the voice and text-based exchanges are intercepted.

Even though COMINT is often used interchangeably with the term SIGINT (signals intelligence), the latter is a broader discipline that also includes ELINT, or electronic intelligence.

It was by analysing the metadata from the mobile phone of a certain « Fedotov » that Bellingcat researchers managed to uncover the true identity of Denis Sergeev. This Russian intelligence agent had participated in the poisoning of Sergei and Yulia Skripal in 2018. Sergeev’s movements were traced using the metadata logs associated with his use of encrypted messaging platforms, as well as the signals sent by his mobile phone to the cell towers in London, UK.

What tools do you need for COMINT?

Due to the confidential nature of the data and metadata associated with virtual communications, few tools exist that could enable members of the public to devote themselves to this discipline. On this point, the inclusion of COMINT as a sub-discipline of OSINT is subject to debate, given its inaccessibility to the wider public.