Comparative analysis – finding out where we went wrong and what we got right

Preamble

My team attended Defcon 34 as Librenovus and placed 72nd in the CTF. We were all new to OSINT and were a team that had never met each other until this event occurred.

This analysis is to find out where we went wrong so we can improve for later. As a comparison, we’re using an article written by the all-women team that won the event, oSInt & Giggles.

First things first – what techniques did we actually use?

Looking at what the leading team did, we did follow a few of the same approaches: username pivots and nicknames — I think every team starts off this way, especially with social media, so we at least had that under wraps. What we had not fully utilised was Google dorking or search engine techniques; while we did use some of these, it was sparse or inconsistent depending on the individual and their experience level. This is not a failure on our part, more a symptom of inexperience in using these techniques day to day.

The actual cases – what we did right and what could be improved

Looking at the lead team’s first assessment of their cases for the most recent missing person — the case I was assigned to — here’s the point I think we missed. We did not work together as well as we could have, not until the last stretch of the CTF, and we did not pivot often either. I think this caused some level of information disconnect, leading to confusion and frustration when we did eventually work together on another case. Again, not so much a failure as a lack of experience — teamwork is often important in missing-persons cases, so gathering info and collecting clues together keeps the flow of information neater and easier to understand.

Now onto my personal analysis, as I also worked on the most recent case. I know I had used similar techniques, and I also ran into similar problems. What the lead team had done, though simple, was effective: they used dates and times in search engines to find information from before the disappearance, rather than only focusing on info after the case had happened. This is where I had missed out on vital context and clues.

The other techniques the lead team used for social media pivoting and searching profiles was something my team had done well. Though we worked as individuals, we did provide feedback to each other on what we were doing, and as a result we were able to start using similar techniques on the profiles we researched — reviewing social media profiles, discovering alternative names, finding useful pivots from names, locations and profiles found, using messages from social profiles to connect info such as relationships and family members, and using court cases and public records to find further connections.

Another technique the lead team used that we didn’t was using less-common family names to find connections — I think this is a good technique to adopt in future, to find out more about a person while cutting out the noise. Court records were another thing we used, but I think we didn’t find as much as the lead team did, so that’s something my team could look into more going forward.

One thing I believe we missed entirely was the maiden name of one of the missing people — the lead team found this, but we hadn’t. It shows we may not have been going as deep into the profiles as we could have, another consequence of splitting the workload of missing people across individuals rather than working together.

My final conclusions echo what Amy E. of oSInt & Giggles wrote, so I’ll let her words ring true.

Source: [Reflections from Def Con — oSInt & Giggles, Amy E.](https://www.linkedin.com/pulse/reflections-from-def-con-osint-ctf-giggles-amy-e-ugsfe/)

This one paragraph alone sums up everything I could have wanted to say in so many paragraphs of my own. It is profoundly useful advice, and I believe many others could benefit from reading her work.