5 free ways to use crowdsourcing for investigations

Careful use of online sites can track down hard-to-find information and leads

We have all heard the phrase, "When all else fails, try, try again." But in an investigation, when your own skills aren't enough, your professional network can't support you, and your leads go cold, what is next? You need to try again, yes, but try a new approach. One new approach is to turn to the 'wisdom of crowds' for answers.

Following are five free ways to crowdsource useful information needed to close your investigation. With 2 billion users online and more viewers on Facebook then all evening news shows combined, the Internet can serve as your own eyes and ears to find offbeat information. It's a tactic that can't be skipped.

In Tools to identify anonymous users online and 5 free ways to track online leaks of information we used the vast database of the Internet to search for unknown and anonymous data, but with crowdsourcing the answers we need come to us. Instead of searching for known data online, learn to ask the world for help. And then know how to interpret or verify the information you receive.

[Read all of Gregg's Investigator's Toolkit columns on CSOonline.com.]

With all these tools, you must remember that anything you post essentially becomes public information. Don't post details that could compromise your investigation. (More on this cautionary note at the end of this column.)

1. Yahoo Answers. One of the oldest (and often most humorous) sites for crowdsourcing information is Yahoo Answers. Although the site is simplistic in setup and presentation, publishing a question and getting a serious answer is quite possible. Yahoo still draws a big crowd. From basic questions like "What year was the first Cromemco Dazzler computer was produced", to more advance questions regarding cybercrime, Yahoo Answers can quickly provide you that data that no search engine will ever crawl and collect.

Very important: Make sure to verify your findings on Yahoo Answers. Due to the site's size and often unmonitored setup, you can certainly receive misinformation.

2. Quora. A growing startup company recently featured in Forbes has brought back a level of crowdsourcing integrity that Yahoo Answers sometimes lacks. The site, Quora.com, is often described as a reverse-Wikipedia, where users can post and answer some of the most interesting and outlandish questions on the Internet.

Even more impressive is the growing list of insiders who post personal and in depth answers to your questions. It's not uncommon to see Craig Newman (founder of Craigslist) reply to a question, or Andrew 'Boz' Bosworth (a founding engineer with Facebook) provide a story only someone with firsthand knowledge can re-create. Questions fall between the opinion-based "What is the best sushi in San Francisco" to the most multifaceted, insider-only questions about current events, national security, cybercrime and much more.

With the same types of rules that govern Wikipedia, Quora keeps the questions and answers free from Internet trolls that could ruin such an important site. Quora is on my personal list of websites that the Internet was made for. To see my own Quora answers, check out Quora.com/Brandon-Gregg .

3. Topic-specific message boards. Message boards and forums can sometimes zero in on even more explicit answers. Looking for information about a security breach? Post on securityforum.com. Information about a rare breed of hairless cats? Sphynxlair.com. The passionate and daily users of these boards are always helpful in identifying the information you requested. Almost no question is too obscure, if you find the right community of interest.

[Also learn the basics of internal investigations]

In 2007 when my brand new Civic Hybrid was victim of a midnight hit-and-run, I posted pictures of shattered turn signal parts left at the scene by the culprit. Within 20 minutes I had the make, model and year of the pickup truck that pulverized my car.

Message boards often come and go, so before you post on your rare topic, make sure the site does have active users--or you may be waiting months before anyone comes across your request.

4. Information-sharing sites. Using websites that share criminal information like baorca.org (tracking organized retail crime suspects), posting on LinkedIn groups or even starting a fan page on Facebook for information can get you viewership and data on an unprecedented level.

These sites can function much like the message boards mentioned above. From quickly asking for benchmark data about a project at work to asking friends if they have seen a missing dog, the eyes and ears your post can far outstrip your own search efforts. This is often seen nationally with fan pages for a local missing person quickly growing past the victim's family and friends, through the local community, and becoming a nationally known website, providing a flow of leads. Just remember who your audience is when asking for different types of support.

5. Darker sites. Even some of the darker areas of the Internet offer chances to crowdsource in extraordinary ways. 4Chan.org--NSFW and often called the armpit of the Internet--has shown its crowdsourcing power numerous times, most often behind the leadership of hacking group Anonymous and their powerful denial of service attacks. Like a swarm of bees, the users of 4chan have collectively worked with Anonymous to use power in numbers to shut down Playstation's network or the Egyptian government's websites. This power, especially with a youthful audience, can be helpful in collecting data as well. Ask a question your own teenager might be fearful of answering for you, and 4chan may provide information.

Even moreso than on other sites mentioned here, be careful how and what you post. 4chan topics and discussions can turn ugly or take on a mind of their own. Keep your posts as anonymous as possible and see what you get back. You might be surprised to find the good information that comes from the site and its faithful users.

This cautionary note bears repeating: As I previously stated in Fighting organized retail crime: Forget the hype, the questions you post in any online forum become public and can be found by anyone, including your suspects, clients and peers. Make sure you are only posting need-to-know information, with limited (if any) details about your investigation or who you are. Posting on a tattoo message board looking for a specific gang tattoo and saying you're a police officer might get zero responses. Instead, consider adding a little social engineering: Say you saw "the gnarliest MS13 tattoo" and are looking for a tattoo mentor in East Los Angeles. You might just get the answer you are looking for.

Next time your leads dry up and you can't find any answers, try crowdsourcing online. The amount of data I have received from posting on Craigslist's Missed Connections and Rants & Raves alone has been unmatched by any database site I pay for.

Best of all: It's free and anonymous.

Brandon Gregg is a corporate investigations manager. His website is www.brandongregg.com.

Join the CSO newsletter!

Error: Please check your email address.

Tags Yahoosecurityinternet

More about Andrew Corporation (Australia)CA TechnologiesetworkFacebookNewmanPlaystationRCAToolkitTopicWikipediaYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Brandon Gregg

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place