Social media forensics & Madeleine McCann

The disappearance of Madeleine McCann remains unresolved. The 3-year-old went missing from a holiday apartment in Praia da Luz in 2007. Since 2011 thirty Metropolitan Police Officers, headed by Detective Chief Inspector Andy Heywood, have been trawling through thousands of witness statements and documents at the cost of £5 million, hoping to unearth a vital clue that will resolve the case.

Last week we learned that phone records could hold the key, but let’s consider the role of social media. First, some clarity… Social media refers to the means of interactions among people in which they create, share, and exchange information and ideas in virtual communities and networks. Since 2007 the role of social media in both personal and professional circles has grown from strength to strength. Let’s take a look at three popular services –

Facebook™ is a networking service launched in February 2004 and provides a social media platform for over one billion active users. It is used for both personal and professional networking, with an increasing number of organisations using it as an important part of their outreach strategy to interact with customers. Half a petabyte of new content – from messaging to media – is uploaded every single day - equivalent to about 110,000 DVDs worth of data, so one can imagine the difficulties faced in harvesting and processing such information.

Tumblr™ is a micro-blogging platform and social networking website owned by Yahoo! The service allows users to upload text posts, images, video, quotes, or links to form a short-form blog (web log). Tumblr™ hosts over 110 million blogs and 80 million new posts are created every day.

Twitter™ is another microblogging service but primarily geared towards short text based "tweets" which are limited to 140 characters. The service is used to provide swift/concise updates, and has been popularised through the adoption by celebrities. Tweets can now include links to images or multi-media content. Nearly 400 million new tweets are posted online every single day.

How can this help with the investigation into the disappearance of Madeleine McCann?

Firstly the authorities could consider a complex data mining operation to look at historical social media records and potentially identify either clues or witnesses.

So where to begin?

Text based searches would be the obvious approach, to seek out content based on keywords. The degree of coverage of this incident in the international media would suggest that the keyword parameters would have to be carefully constructed so as to limit results to that which may be potentially relevant (e.g. instances where ‘mccann’, ‘evidence’, and ‘police’ occurred in the same message or sequence of messages). The potential for a huge number of false positives is of course the concern, but these could be limited by applying date range filters or mining only across accounts registered to users in Portugal (at the risk of missing tourists).

Most social media posts – from the humble tweet to a photograph uploaded to Facebook – can include location information. This is commonly known as a geotag and may be applied to the content by the camera device or the social media service. Such tags take the form of latitude/longitude co-ordinates – in the case of the Praia de Luz, this would be 37.0972° N, 8.7434° W. Combing through current or old social media records for such tags would help identify people who have been in the relevant area. Combine this with a filter for the date range of late April / early May 2007, and the results would suggest people in the right area at the right time to potentially assist with the investigation. It may be that these are parties who need to be excluded from the current investigation or perhaps they witnessed something they considered innocuous but could be vital in the wider context of the investigation.


Note: Law enforcement labs and members of prosecuting authorities are welcome to request free licences to the following toolkits: www.facebookforensics.com, www.tumblrinvestigator.com and www.twitterinvestigator.com

Read More

Madeleine McCann - Phone Records, Forensics & big data

Madeleine McCann, aged 3, disappeared from a holiday villa in the Portuguese resort of Praia da Luz on the evening of the 3rd May 3 2007. Despite one of the largest publicity campaigns and worldwide searches in history, she remains missing. Her parents, Gerry and Kate, have led a campaign to find their daughter, refusing to give up hope.

In 2011, Prime Minister David Cameron, ordered a fresh review of the original Portuguese police investigation and drafted in thirty Scotland Yard detectives to help sift through the vast volumes of information and witness statements. So far, just over half of the forty thousand pieces of information collected by the Portuguese authorities have been assessed, but progress is being advised as being positive.

Now there have been similar stories in the press over the years, but what makes this one so interesting is its renewed focus on digital forensics. Investigators believe telecommunication records could hold the key to solving the case and are focussing their search on thousands of mobile phones, thought to belong to people who were in Praia da Luz in the days leading up to, during, and after Madeleine's disappearance.

Detective Chief Inspector Andy Redwood, who's leading the inquiry, says officers are trawling through a 'substantial amount of data' and have so far identified 41 persons of interest. With around three thousand people living in the Algarve holiday resort, and thousands more visiting during the holiday season, this task is neither straightforward nor complete. This exemplifies ‘big data’ and the complexities of effectively data mining to find those crucial (digital) needles in the haystack.

In fact, DCI Redwood admits his team have been unable to attribute (link to a named individual) a 'large number' of mobile numbers, largely due to the fact that six years have now passed and a considerable number were bought on a 'pay-as-you-go' basis. This reflects an increasingly common practice for individuals travelling overseas to buy a cheap PAYG SIM from a local vending machine or shop, so as to avoid roaming charges and benefit from local call/data rates.

Call Data Records, sometimes referred to as ‘billing records’, will show the timing, volume and patterns of communications activity. The numbers dialled, the duration of voice calls, numbers that have been sent text messages, and instances of access to voicemail. The content of the spoken conversations or the typed details of a specific text message, will not be available, but the broader picture of activity can still be important.

Then there's the issue of tracking down the thousands of holidaymakers that were in the Algarve resort where Madeleine McCann was staying when she vanished. Scotland Yard have already made contact with thirty one police forces across the world to help them piece together the records and make contact with the owners of foreign mobiles.

A powerful investigative technique is being applied to mobiles of interest – Cell Site Analysis. The intention is to identify mobile devices that engaged telephone masts in and around the Algarve holiday resort on the days surrounding the incident. The users of these devices can then be tracked down and interviewed – one of the owners may prove to have seen/heard something that could take the investigation in a whole new direction.

Crimewatch will be airing a special on the Madeline McCann investigation this evening – with exclusive interviews, fresh evidence, and a scene reconstruction.

We would welcome the thoughts of other practitioners and experts in this field on the forensic evidence in this case and other avenues of investigation that could be explored.



** Note: Afentis Forensics have had an involvement in this investigation and whilst open debate and discussion is encouraged, please could comments keep in mind the sensitivity and emotive nature of the matter.

Read More

Battle between Facebook and CEOP continues

Another verbal attack was made towards online social network Facebook by Jim Gamble of CEOP today. In a briefing with reports, he accused Facebook of being 'arrogant' and questioned their interests in collective child protection.

The disagreement between Facebook and CEOP has continued for months and has developed over the placement of a panic button on the site. The CEOP panic button allows any young social network users to make a complaint about a certain user or users should they feel uncomfortable, threatened or scared as a result of negative behaviour. Such behaviour can involve bullying, insults, general threats or the unwanted attention of a potential sex offender.

Facebook insists that the website has its own reporting system in operation and that the CEOP panic button does not offer any advantage to the social networking site. As a result, they refuse to have the CEOP branded button on Facebook.

In relation to sex offences, the question must be asked whether a panic button is really the solution to online predators posing as younger men attractive to younger females. Some would argue that general lack of awareness and naivity on a childs part would make them trusting of an offender, and that they therefore wouldn't use the button to report grooming or other indecent behaviour.

Facebook and CEOP will meet during 12th April in an attempt to discuss and resolve the situation.

Read More

Strategy for Cybercrime

A new strategy for fighting cyber crime has been released by the Office for Cyber Security.

The strategy outlines five primary objectives as follows:

Co-ordination to tackle cyber crime across Government - A need for improvement upon existing efforts of fighting cyber crime in general.

Provision of an effective law enforcement response - Enhancing operating and intelligence facilities for all law enforcement responding to cyber crime is also a priority. The development aims to be achieved through the use of 'accurate reporting systems'.

Raise public confidence - More work will be conducted in association with Child Exploitation and Online Protection (CEOP) and Get Safe Online.

Work with industry - It is hoped that more work with the private sector will prove beneficial.

Work internationally - A strong effort will be made to maintain and improve relationships between international law enforcement agencies. As a result, more children should be safe when online.

The strategy was published by Mr. Alan Campbell during 30th March and can be found here.

Read More