Using OSINT to Find Protest Events and Activist Groups on Facebook

Introduction

Last week on the OSINT podcast  I was asked a question that I don’t believe I answered to the best of my ability.  Partly because audio presents certain challenges when describing a visual process, and partly because I don’t think I fully contemplated the extent of the question or how in detail I should have gone.  This post serves as an extension of my answer on the OSINT podcast.

Getting Started

In order to find protests and activist groups on Facebook, you need a starting point.  If you simply type in “protest” or “activist” into Facebook and select “groups” or “events” you will not find what you are looking for.  I recommend finding a very popular group online and use a method of deduction to find others.  Allow me to explain.

New York City is one of the most populated cities in the United States and has a high propensity to host large scale protests.  In order to find my origin point for OSINT,  I’ll simply type “protests in new york this weekend” (no quotes) into Google.  I’ll head over to the “News” tab on the search results to find out more information. Here’s what I found.

Screen Shot 2018-11-09 at 2.09.32 PM

Let’s go ahead and select the first article by The Washington Post titled “‘Protect Mueller’: Protesters across U.S. decry president’s dismissal of Sessions as attorney general”. In the first paragraph, the article lists the organizer of the protest.  It’s MoveOn.org.  For convenience, The Washington Post provided a link to the Move On website. Here’s what that looks like.

Screen Shot 2018-11-09 at 2.12.49 PM.png

In the top left corner we have an “events” tab.  If you click on that link it will take you to a large page of links with different cities.  Bookmark this page. If you’re looking for protests in the future this is a great place to start. Now, if you navigate down to New York and click on the New York, New York link, it’ll take you to a page that let’s you know “sorry, it’s too late to sign up for this event”.  Seems like a dead end right?  Not really.

Facebook

Let’s head over to Facebook.  Once you’re there, type “Nobody is Above the Law”, the name of the protest by MoveOn.org, into the search box.  Click on the “events” tab then specify New York, New York under the “Location” selector on the left hand side.  It should look something like this.

Screen Shot 2018-11-09 at 2.17.19 PM

Notice the second event states “8586 people”.  This is a total of how many went and how many were interested in going.  We’re interested in the people that went and the other events they’re going to go in the future.  We’re also interested in the groups that they’re in that might match the MoveOn.org cause or, in some cases, be the exact opposite (even more interesting).  Why are we interested in these people?  Well if these people are active in the protest/demonstration community, they are likely to know about lesser reported demonstrations, including ones that are local only. They’re also likely to be in groups with other activists that may be radical or may link you to radicals that are in controversial groups or communities.  More on that later. Let’s start by finding who went to this event in New York.

Go to the events page and click on the link below the date and location box that says “2.3k Went, 6.2k interested”.  This will give you a pop up with a list of people that went.  It should look something like this.

Screen Shot 2018-11-09 at 2.20.54 PM

Now, 2302 is a large number.  We aren’t going to look through all 2302.  You can if you want, but I’m not interested in that much data mining for this purpose.  I’ve tried to find tools that will scrape Facebook profiles based on groups or event pages, but all the tools I’ve found have quickly been rendered useless after an API change or a web scrape ban.  If you know any tools that can speed up this process, please let me know on Twitter! For the sake of this demonstration, I am going to use the first three attendees that have a photo. Why do they need a photo?  Well if you’re a Facebook user without a profile photo I’m just going to assume you aren’t real, are a bot, or a spectator/sock puppet.

Let’s get started mining some OSINT on the first three users.

Open a new tab and go to stalkscan.com.  Stalk Scan is one of the few remaining Facebook OSINT tools that has a good UI and is relatively stable.  We will use Stalk Scan to find the groups each attendee is associated with and events associated with those groups.  In order to search under a user’s profile, you need their user ID.  You can find that by clicking on their Facebook profile, then clicking on their name.  For Lisa Ahimsa (second attendee), it looks something like this.

Screen Shot 2018-11-09 at 2.30.44 PM

Copy and paste that link into Stalk Scan. After the query, Stalk Scan will populate the information we want into the section on the left hand side titled “Profile”.  Under that section you will find “Groups”, “Future Events”, and “Past Events”.  Open each of them in a separate tab.  Let’s start with “Groups”.  What we’re looking for are groups that post 10+ time a day.  Why are we looking for this?  10+ posts a day means it’s an active community and is more likely to have events and/or activists/radicals in it. Here’s what I found under groups.

Screen Shot 2018-11-09 at 2.32.22 PM

It looks like Lisa is an animal rights activist/enthusiast.  The first two groups we’ve found are Animals First on the Second and Raising Awareness Of Factory Farming.  The first has 4.4k members, the other 648 members.  For the sake of this demonstration, we’ll select the first one.  This will take you to the group page where we will find more information.  One thing about Facebook groups is it’s one of the few places left on Facebook that has a search engine feature.  You’ll see this on the left hand side under the menu.  Go ahead and search this group for any relative keywords on your radar.  You can find posts and comments with your keyword.  Boolean operators do not work the same way they work on Google in this engine, but at least it’s something.  I’m more interested in the “Events” option in the menu.  After you select “Events” from the menu, it’ll take you to a page that looks something like this.

Screen Shot 2018-11-09 at 2.38.55 PM

It looks like they had an event last week.  It even looks like they have recurring events.  This means the community is active.  How do we know?  If you click on the last event in November, you can see 148 people went.  But I’m not seeing any protests here and I’m not seeing any upcoming events.  This means there’s nothing actionable I want to put on my radar.  I’m going to declare this a useful dead end.  This doesn’t mean I’m done here yet.  Let’s go to the “Members” section of this group to find out who the admins are.  These people organize the events and are likely to be the largest enthusiasts of the cause.  They might lead to other groups with other events that might meet my criteria.  Sound familiar?  This is exactly how we started.  The rabbit hole goes on forever until you find what you’re looking for.  Simply take the user IDs of the admins, put them into Stalk Scan and repeat the process.

Before you move on, though, let’s not forget about the other two tabs we have open.  Past and Future Events from our original user.  Because I’m focused more on actionable OSINT or events in the future that I can prepare for from a risk intelligence perspective, I’ll look at the “Future Events” tab I have open.  It should look something like this.

Screen Shot 2018-11-09 at 2.44.01 PM

Is that a Guy Fawkes mask I see?  Yes, it is a Guy Fawkes mask that I see.  What says activism/radical more than a Guy Fawkes mask?  I literally have no idea!  All joking aside, this is exactly what I’m looking for.  If you click on the event you’ll find 28 people going and 69 people interested including some details about the event.

Screen Shot 2018-11-09 at 2.45.41 PM

Is this starting to look familiar?  I bet you can tell I’m going to tell you to click on that group link provided in the description.  I am.  It leads you to a closed group called AY: New York City, NY, USA.  Now, you can request to join for OSINT collection if you want, but you really don’t have to.  The admins and moderators are publicly shown.  Not so Anonymous after all huh?  Well here’s that familiarity coming in.  You can repeat the same Stalk Scan process on the admins and moderators to find even more groups and events linking to radicalism/activism.

Conclusion

I want to be really clear on something.  The people I’ve highlighted in this demonstration have done nothing wrong.  I am not claiming they are radicals or are dangerous in any way.  It would require an immense amount of work to find the real radicals, or maybe a bit of luck.  The people highlighted in this demonstration are simply expressing their first amendment rights of freedom of speech and assembly on an public forum that is viewable by anyone.  The purpose of this post was to demonstrate the process of aggregating events related to activism and political violence.  You can quickly fill up your calendar with events that might be worth looking into.

tldr;

Find common or popular groups/event > find users associated with groups/event > put their profile information into stalkscan.com > record groups/events of interest related to users > repeat

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s