Digital Threat Digest - Ulterior motives of the internet sleuth
On Monday, Michigan State University was attacked by a mass shooter; the institution went into lockdown and three students were killed. It has become the norm for well-intentioned misinformation and conspiratorial disinformation to spike following such events, as seen following the shootings in Uvalde, Texas, and Buffalo, New York, in 2022.
I remember the online frenzy that gripped Reddit almost exactly ten years ago, as users on the platform sought to identify the perpetrators of the Boston Marathon bombing, and promptly misidentified a suspect. Then another. And a third.
Ten years later little has changed. On Monday, a false claim from Twitter circulated online which wrongly identified the name of the shooter despite the information circulated from the State University Police which described the actual suspect. The tweet had a photo attached, apparently from a security camera, warning that the (wrong) individual was still on the loose and considered armed and dangerous. Of course, other users immediately shared photos of that same misidentified suspect—having doxxed his Facebook—across social media, claiming he was the shooter.
It is, somewhat, positive that a few journalists and other social media users attempted to correct the misinformation. But this brings us to a recurring problem:
Even if false information is challenged (and corrected), it will never reach every person who saw the original misinformation.
Not all threat actors share the same motivations. Some want to destabilise a medium sized democracy, some just want to make money. Some want to do a little of both. Not all of these constitute the same level of danger or impact.
The ‘Internet Sleuth’ is a threat actor that has learned how to benefit from these real world criminal events and the information overload that follows. These online creators that take a laissez-faire approach to sharing factually based information on the internet. Internet Sleuths pop up on your TikTok ‘For You’ page and give daily updates on murder investigations, missing persons cases, and active law enforcement investigations. They deal in gossip, rumour, and weak deductions and thrive off the interest that society has in mysterious or violent events.
This type of content creator comes off the back off documentaries such as Don’t Fuck with Cats, where an online community of people worked tirelessly to find the identity of a killer. We see these sleuths reach their peak during missing persons cases, forming communities to investigate cases like those of Gabby Petito in the US and Nicola Bulley in the UK. They also came out in droves during the weeks following the murder of four university students in Idaho.
When I first noticed this trend, I thought it was a positive one where the Internet was being used for good. Crowdsourcing information and getting a wide variety of thoughts and opinions on a complex or mysterious case could help investigators, right? Nope. In the OSINT world, there are certain principles we apply when measuring the veracity of information, including checking sources, using official data where possible and confirming every piece of information we have. Internet Sleuths do not hold these principles in such high esteem – they work in, ‘what ifs', ‘what about this’ and ‘guys hear me out, I’ve solved it trust me’. Now, I actively disengage with these creators, who call themselves amateur detectives and profit from adding to confusion and speculation. While it is tempting to want to hear the new update in a case that has captured the attention of society, it only fuels this kind of obsession that people seem to have with giving their, normally untrained, two cents into an active investigation.
PGI’s Digital Investigations Team brings you the Digital Threat Digest, SOCMINT and OSINT insights into disinformation, influence operations, and online harms.
More about Protection Group International's Digital Investigations
PGI’s Digital Investigations Analysts combine modern exploitative technology with deep human analytical expertise that covers the social media platforms themselves and the behaviours and the intents of those who use them. Our experienced analyst team have a deep understanding of how various threat groups use social media and follow a three-pronged approach focused on content, behaviour and infrastructure to assess and substantiate threat landscapes.
Disclaimer: Protection Group International does not endorse any of the linked content.