Many missing people have nobody looking for them. I am Rob Sell, a search and rescue tracker, cybersecurity professional, and founder of TraceLabs.org, where volunteers compete to find clues to the whereabouts of missing people. AMA!

have you ever gotten a tip that you suspect might be from someone with access to non-open databases who would not be authorized to give such assistance?

This is a great question and something we are very careful with. We put a lot of time into designing our scope of operations to ensure we don't cause harm. Part of that scope is to ensure all the data we collect is open source. To do that we request all submissions come with a link so we can validate it. This means a lot more work for us but at least we can ensure its all open and not behind a paywall or non open source. Thanks.

What if that non open source info is a good tip and could help law enforcement find the person? What do you do with the tip?

We only take OSINT submissions so contestants can't provide non open source info in our system. If they had such information they could submit that directly to law enforcement.

But how are you going to deal with the 4th Amendment protecting people's privacy?

People don't want any of their personal informating being obtained just in case they "went missing".

Ok two different items here: 1) We are not violating anyone rights nor the 4th Amendment. We are really strict on our scope and only source information that is open and available. The information is already there, just difficult to find sometimes. 2) We only look for people the police have officially declared missing and have asked for the publics assistance in locating. Many criminals don't want to be found but it's in the best interest of the general public for them to be located.

What are the most common reasons people go missing in your cases?

Oh boy. There are a lot of reasons but some of the common ones we see a lot are: human trafficking, run aways, child abductions, drug addictions, and suicide.

How many just want to disappear and not be found?

We don't have this information however I would say most of the people we look for want to be found. It is rare that we would see someone who doesn't want to be found. If we detect any sort of weirdness like that we normally omit it from our event. Even though the police have asked for the publics assistance with these cases, we reserve the right not to add to our system if we suspect there could be any complications like this. Normally look for things like child abductions and human trafficking which which are normally pretty to see that the victim needs the public's assistance.

Hypothetical: Waldo or Carmen San Diego?

Which would be easier to find and why

It's all about digital footprint. Waldo is older and not as active so he might be harder. Carmen is very active on social media and younger demographics so perhaps easier. However, A lot of people follow Waldo and we know he likes to go to the gym and is always buying new hats so that could make things easier. Carmen's base is San Diego so that is easier than Waldo as he is always hiding. Carmen also has more infrastructure that is likely registered in her name so again, she would be easier. So, in summary, I would say Carmen would be easier to find simply due to her digital footprint.

What was the hardest case you have ever had to solve? Brilliant work by the way. I will certainly look into volunteering!

Thanks! The best way to get started is on our Slack channel. Lots of good community support and guidance there. Also follow us on Twitter to see all our upcoming events. In Q1 of 2020 we will be doing our next big Global CTF. It's like the superbowl of all CTFs. The hardest case? Hmmm. Most are hard. I think the hardest ones are those you are close to. I see this in the faces of our contestants when they have been working on cases for a few hours. They skip lunch and just work through the breaks in order to get more intel. People want to help and get invested in this very quickly. Working as a team of 4 helps and allows the individuals to work off each other to get unstuck. Personally, some of the hardest ones I have seen are when the missing persons are involved in criminal activity. I had one which was a child abduction and the people responsible had spent years removing their social media accounts and making themselves into ghosts. This was very hard because it involved a child and the trail was cold.

Can you share an example of the clues that you and your team are looking for?

Sure. So we give the contestants a wide range of intel to look for as we realize everyone will have different skill sets and levels. We want to make this crowd sourced effort something everyone can contribute and participate in. Therefore we create different categories ranging from easy to difficult and provide points respective of the difficulty level. The full details are here: https://www.tracelabs.org/getinvolved/ctf/ At the end of the day, some of the best clues include unique identifiers such as tattoos and also intel that allows you to pivot to higher value intel. This might include an email address that then leads to a hidden social media account. That's often something that leads to actionable intel for law enforcement. We are still learning as well so we see new things at every event. Part of the magic of what we are doing is the contestants are often teaching us new techniques and methods which push the entire industry forward. We used to just look for more simple clues like social media handles whereas now our contestants are teaching us how to layer this intel to paint a better picture of direction of travel, intent and patterns of life for those subjects we are searching for. Its pretty amazing.

You're just spying on people without their consent.

Actually no. Spying would be a covert activity whereas this is overt. Also, the word "spying" insinuates a negative intent. Our effort has no negative intent or result as we have been very careful in how we build this service to ensure we reduce any chance of harm while increasing the effectiveness of our communities to do good.

Hi! Thank you for your amazing work. I want to colaborate, but the Slack Registration link is not working. How can I get in touch with you guys?

Thank you! Feedback from the community means a lot for us and is our continual guiding light. We will check into that link right away. Another way to reach us is on Twitter. https://twitter.com/TraceLabs

Have you ever found anyone?

Our contestants have done some amazing work at putting together intelligence that provides law enforcement with actionable intelligence to immediately act upon. This often allows a case to be reopened and the families with new updates. At most of our events we get "location" flags submitted and then as a team we vet this intelligence. We frequently have location information we provide to law enforcement. However, our scope prevents us from any follow up and we don't know what happens after we provide this information to law enforcement. So hard to say how many exactly. This is the nature of ensuring we don't overstep into police territory. This has to be one of our toughest questions to answer so hope I did our members justice with it. :)

If you can't follow up any case, how do you know that cases are often reopened?

We do know that if we provide new actionable intel that it often prompts the police to reopen or review a case. This is true in most countries. While we don't get any details on what is being done we do sometimes get indication that there is activity or that law enforcement is interacting with friends or family.

This is amazing work you are doing!!! I’ve actually heard about you on twitter. I see you do so many of these missing persons CTFs around the world. How do you find the time do to it all?

Thank you! Our growth and success is really the result of our amazing membership. The people who are involved and support our events put a lot of their own time into this which is really how we are able to operate. It always amazing me how dedicated our volunteers are. They work very hard to ensure every event a great experience for all contestants. It makes me proud to be part of such an amazing group. Huge thank you to all the people who have spent their Saturdays to support these events!

What made you decide to make it a competition / game vs. just having people volunteer?

Great question! I think this is such an important topic to discuss as its often misunderstood. We wanted to be able to provide a scalable and cost effective effort to law enforcement. However people are busy and missing persons is never a topic people go looking for. In fact, most people don't know a lot about the industry until they have get pulled in. Making the effort into a game allowed us to get people involved and keep them. We wanted to allow those who were contributing to be rewarded for their highly valued efforts. We wanted to make it more than just a civic duty as we needed more people than that alone would draw. Its a sensitive topic but we have shown it works so we continue to use this strategy.

Do you have friends/family members of missing persons contact you directly for help?

Everyday. We had to create an op onboarding form on our website because we get so many. The industry needs help and we are doing our best. However, there is a lot of room for improvement at every level. I feel terrible when I see some of these cases. Our members do their best to provide some tangible intelligence the police can then action. We are making a difference and I see positive change at a global level. Our recent event in Australia was amazing. We had government, law enforcement and the families all in the room with our contestants. This is an example of a progressive government who is embracing technology to bring value to those families. The really interesting thing is when we sit down at an event with both the family and law enforcement and talk through what we found. We can see the families appreciate this extra effort. Even if we don't find anything, law enforcement often appreciates the effort as well since it shows they did everything they could.

Who was the longest missing person you ever found?

Our members always amaze me. They manage to find some amazing intel on pretty much every subject we put into a CTF. Normally we try to look for people who went missing recently as we find we are able to provide better results in these cases. However, as we work with law enforcement around the world we always like to receive cases from them. This often results in cold cases which are often very challenging. We have provided actionable intel reports on people who have been missing for many years which could have led to location however I can not confirm this. These were less than 5 years missing. I'm excited as we evolve and confident that we will be able to extend that range as our members collaborate on techniques to do this.

If nobody look for them how do you know they are missing?

Another great question. Trace Labs has to be very careful when we crowdsource open source intelligence to find missing persons. We never want to go looking for someone who isn't really missing. To ensure our actions are always on the right side of the law and we are not causing harm, we take direction from law enforcement. This means on any new op we will look at the police website to ensure the person is actually missing. On our op request form we require the URL to this page before we will even consider it. We look for the wording from law enforcement that says: "This person is missing and we are asking for the public's help to find them." Trace Labs is the public and we are assisting to help find them (in a legal and respectful manner). This is key to our success to ensure we stay within these boundaries.

How did you get your account name? And, if someone thought there might be a missing person problem, who would they contact?

Sorry not sure I understand the first question. My account name on Reddit? For the second question, I would recommend that if anyone has a missing person event to report it to law enforcement right away. Many people wait which I would never recommend. Many people think you have to wait 24 or 48 hours. Don't. If you have friends or family who are missing and you think something is strange, report it right away. While many people end up coming home before the week is over, the ones that don't need our immediate attention. In the case of abductions, we want immediate awareness.

Fantastic platform. Saw you at DEFCON.

This summer, I was involved in an investigation that lead to a confession - the dossier I prepared for LEO contained log files and OSINT info for a suspect who later confessed.

I don't have any formal training in blue-teaming or intel. Just a hobby hacker.

What advice would you offer to an IT guy interested in pivoting to intel / OSINT work?

Begin doing it in your current job. Every company can benefit from an OSINT expert. Look at the company first. What is exposed? Generate a report with recommendations and present this to your Information Security team. Look at your executives. Provide them with a personal report showing their exposure. Don't share this with others but just give it to them with some recommendations on how to make improvements to their exposure. Offer to help them with this. Caveat: Do this very carefully as not everyone will be pleased to get a dossier with all their Internet details. :) Depending on your company culture, you may elect to talk to your Information Security team about this first. This experience can then prepare you to move into a role dedicated to doing this sort of work. Of course, the other excellent way to get experience is with Trace Labs. :)

What do you do when you find them and they don't want to be found?

Yes this was a big issue for us as we began building the service. What about people who don't want to be found? This was an ethical dilemma for us. We solved this issue by having strict rules around who we look for and how we look for them. We want to help but we are also fully aware that this could cause harm if we are not extremely careful. The first thing is we only look for people who law enforcement have publicly stated are officially missing and are asking for the publics assistance to locate. We find that this helps a lot as we put our faith in the police to tell us if someone is missing and should be located. There are many people who don't want to be found but in the best interest of society and even themselves its best they are. Examples of this include parents who skip out on child support and individuals who want to do self harm. Neither want to be found but I think most agree it is beneficial to locate them. We also don't get involved in any of the activity once the person is found. This is for law enforcement so we don't get involved. The police have experts that specialize in all these areas and can offer the right sort of support. We are strictly passive reconnaissance which is then used by police to help people who they deem need to be located for various reasons. From our experience, we have never seen a case where we disagreed with the need to locate the person.

"We are helping you, please don't resist"

Sometimes we do need to assist people who are not asking for our help. An example of this would be someone who is addicted to drugs. If you ask them for assistance they are likely to care more about their next fix than to get clean. Should we ignore this? Likely not. Will they resist? Likely. It is extremely hard to understand all the details of each case and we simply don't have all the information to be able to make an ethical call if we should help or not. However, law enforcement often has access to more information than we have and is the authority on these activities so we put our trust in them and follow their direction. If they ask for the publics help, we assist.

Have you ever ran in to a case that was connected to a trafficking ring like that of the Jeffrey Epstein case?

Unfortunately yes we have seen this. We see a lot of tragic things which make it even more important that services such as ours try to improve the situation. When people ask me about Trace Labs or missing persons in general I normally start that conversation with, "do you have kids." Human trafficking, drug addiction and prostitution are common and really terrible to see. We suggest if you are going to be doing this sort of work you don't use your work computer as you may see pictures that are not appropriate for your workplace. I personally think these sort of cases are the worst and most urgent and hope our community can help improve that situation.

how can i get more involved to help a company like yours i have extensive knowledge block-chain and deep-web markets and as of 4-5 months ago started studying osint basically everyday

I suggest going to our website: www.tracelabs.org and then clicking on Get Involved to sign up for our Slack channel. That will get you up to speed on what we are doing and how you can participate.

What skills would best help in these investigations, and how could someone like me contribute?

The best way is to get on our Slack channel to learn about what we are doing and how you can get involved. If you have a particular area of expertise let me know and we can see what we can do. For skill set I would focus on general OSINT investigation skills. Try by looking up yourself and see how much you can collect. Begin researching how you can collect more using the sites and tools specific to your region.

I Have been reading every thing i can on osint. Currently i am reading all the cia foia dumps on osint. What relay good interesting reads on osint would you recommend or that have been realy helpful to you? Thanks Senpai :)

There are so many great sources out there. I think our Slack channel is getting better and better for ongoing collaboration. There are also many good sites for tools and techniques. I would start with the Michael Bazzell book though as its very good.

Hey! I've been following TraceLabs from the youtube and until the last defcon. You guys are doing fantastic work! Building this OSINT community and in a through systematic way.

anyway my question, is it really possible right now for any normal people to completely erased their digital footprint like ghost? or there always any chances to get their information, as long these people don't work with government, agent, etc. How's your professional perspective would say about that?

Great question. It is surprisingly hard to ghost yourself on the Internet these days. The amount of effort will differ depending on how much info is already out there. I think for some of us in the business it's next to impossible as there is so much out there. However, for some people with a smaller footprint it is possible. The other option is to pollute the well with false information. This can take investigators down the wrong path and accomplish the same thing. In some cases it may even be easier.

Thanks all for your great questions! Signing off for now, will circle back to answer any new questions tomorrow so keep asking away.

What is your advice for aspiring future cyber security members?

Get experience and join the community. I always recommend people look at events that are occurring nearby in their community and join those. This could include a local Defcon meetup or perhaps a BSides conference. In some locations there are other events so look at what is available in your area. I would also suggest you volunteer to support the event as this will get you time with the organizers who likely know all about whats going on in the area. Besides that, come out and join the Trace Labs Slack channel, follow us on Twitter and try our next Global CTF.

How do you "track down" people who are missing? Do you use a device of some sort?

It depends... We use devices for avalanche victims and sometimes I will use a thermal camera to look for people lost in the woods but normally it's just hard work slogging through the forest using our tracking skills. I normally go in a team of three with one person in the lead. We rotate through to ensure our eyes don't get too tired. It can be really tough if its in an area with lots of foot traffic. I prefer to track at night as the light makes it easier to see tracks and other disturbances. A tracker always looks for "sign." This is often a broken twig or foot print. This will often tell us about direction of travel and sometimes even the state of mind of the person we are tracking. This translates to OSINT investigations and we also look for "sign" which can be social media postings, pictures or even platforms. This tells us a lot about the person and allows us to make educated guesses about their patterns of life and to perhaps predict their behaviour.

This is my dream job. I wanted to do forensic anthropology or forensic pathology for a long time, had an internship offer for forensics, took a death investigator training course through one of the best med schools in the country but life got in the way and now I am a cardiology nurse. I would spend hours just tootling around NAMUS thinking about how amazing it would be if I could have a career trying to match the unidentified deceased to the missing person cases, being able to examine evidence myself, close cold cases of missing persons and give families closure. I’m not too old to change my career tract back to forensics - any advice on getting into your area of expertise?

Well since you already have an established career I would recommend a step by step approach to see if you like it and if it meets expectations before you let go of what you already have. Luckily this is easy to do without much risk. There are a few options available. You can work with us and participate in our Global CTFs (next one in Feb 2020). You can also join out Slack channel to get up to speed on our ongoing operations. Outside of that I would recommend joining your local security events and seeking out those who do OSINT. Look for the physical pentesters and such as they likely train these skills. Other options would be to talk to local private investigators and see if you can freelance with them to do OSINT for them. Like most things, you can accomplish great things just by taking it a step at a time. :)

what is the most troubling open source of public information that nonetheless was useful?

I think it depends on the country. Also I see a lot of changes in the applications we typically go to for OSINT. For example, Facebook has made a lot of improvements as have special OSINT tools like Pipl. I think for me I am always amazed at the information that is freely available from government sources. In the US this is often voter information and in Canada I would say it is criminal records. I really like those sources as it provides me with alias information, address, email addresses etc. However, I am not sure how comfortable people would be if they knew that data was openly available. Is this what you mean by troubling? Thanks

Where do you usually start when it comes to cold cases?

Cold cases are difficult because there is often no recent activity by the subject plus you will find a lot of activity by other parties who are searching. This is actually very similar to real tracking. You get tracks over tracks which sometimes makes it difficult. Where to start? Really depends on the case but I tend to look at patterns of life. What does the person do on a regular basis? From there I look at where that pattern stopped. Sometimes there will be an unusual event that then needs more focus. Also, some contestants have done very well at looking at friends and family comments to the person around that time. Perhaps they went to a party that night or went on a trip with a new acquaintance. Start where ever you can and begin to create those paths of investigation. Track your progress and keep chipping away at it.

Have you had a chance to check out Michael Bazzell's new book, and if so, what you think of it?

Yes! I buy every version of it. Its really the go to book for anyone interested in learning more about OSINT. I enjoy his podcast as well. Micael Bazzell did a lot for the community and I will always be thankful for what he has provided. Great resource and highly recommended!

Are some people you found like: "I don't want to be found, go away"?

Yes this was a big issue for us as we began building the service. What about people who don't want to be found? This was an ethical dilemma for us. We solved this issue by having strict rules around who we look for and how we look for them. We want to help but we are also fully aware that this could cause harm if we are not extremely careful. The first thing is we only look for people who law enforcement have publicly stated are officially missing and are asking for the publics assistance to locate. We find that this helps a lot as we put our faith in the police to tell us if someone is missing and should be located. There are many people who don't want to be found but in the best interest of society and even themselves its best they are. Examples of this include parents who skip out on child support and individuals who want to do self harm. Neither want to be found but I think most agree it is beneficial to locate them. We also don't get involved in any of the activity once the person is found. This is for law enforcement so we don't get involved. The police have experts that specialize in all these areas and can offer the right sort of support. We are strictly passive reconnaissance which is then used by police to help people who they deem need to be located for various reasons. From our experience, we have never seen a case where we disagreed with the need to locate the person.

My brother has been missing for two weeks and we/the police are running out of options or ideas. Do you have any suggestions for people who are searching for more recently missing people?

I am sorry to hear about this. I would ensure you are working in partnership with the law enforcement agency. This means you may need to be calling them on a regular basis. Start collecting all the information you can in an organized fashion. Have regular meetings with law enforcement to go over these details and anything new. Ask what they want to do for next steps. Start a site where people can anonymously submit information. Generate a timeline of events. Talk to all their friends and acquaintances. Document these conversations and then look for discrepancies. Let police know about any discrepancies. If you use our op request form on our website we will do our best to create an ongoing op.

What is your favorite Pokémon?

I think this is a bit of a trick question. The entire Pokemon adventure is really about the selection of characters and their adventures. It's sort of like Transformers that way. Each is cool in its own way. However in order to answer your question, I would say Pikachu would be my favourite if I'm forced to pick. I'm not a big Pokemon fan however I do like the augmented reality game that was so popular. I look forward to seeing more of that technology used soon.

Do volunteer hours for your org equate to hours needed towards a private investigators license? For example, in Oregon I would need 1500 hours investigative work before I could apply to be a licensed PI.

Interesting. I am actually not sure but would like to work with you to see if we can accommodate. Would be a win/win if we could do that. If you join our Slack community my handle is Creep. Reach out and we can begin working on that. Thanks!

What are some of the tools that you use in OSINT Investigations?

There are many. I would recommend people get familiar with what we call "Google dorking." This is simply getting very good with Google. There are a bunch of parameters that you can use in your Google searching that will help you to get better results. After that, take a look at recon-ng, Maltego, Hunchly and SpiderFoot. All are good for their own purpose. I also like tools that do geofencing to look at a particular area for a particular time.

What about people who go missing and don't want to be found (example escaping an abusive situation)?

Yes this was a big issue for us as we began building the service. What about people who don't want to be found? This was an ethical dilemma for us. We solved this issue by having strict rules around who we look for and how we look for them. We want to help but we are also fully aware that this could cause harm if we are not extremely careful. The first thing is we only look for people who law enforcement have publicly stated are officially missing and are asking for the publics assistance to locate. We find that this helps a lot as we put our faith in the police to tell us if someone is missing and should be located. There are many people who don't want to be found but in the best interest of society and even themselves its best they are. Examples of this include parents who skip out on child support and individuals who want to do self harm. Neither want to be found but I think most agree it is beneficial to locate them. We also don't get involved in any of the activity once the person is found. This is for law enforcement so we don't get involved. The police have experts that specialize in all these areas and can offer the right sort of support. We are strictly passive reconnaissance which is then used by police to help people who they deem need to be located for various reasons. From our experience, we have never seen a case where we disagreed with the need to locate the person.

Can you provide a template of the most important information you need when looking for a person?

There are some excellent templates/workflows in the latest book by Michael Bazzell. In our CTFs we give each contestant with examples of what we recommend they look for. This is normally a combination of information that is not already known by police as well as information that police could act on. An example of this might be a unique identifier or perhaps some communications with friends or family on their intent. Very often this is a combination of information that is collected. You need to find one and then use it to pivot to get more higher value intel.

[deleted]

I am not familiar with that particular map but it sounds possible. I have always wanted to go caving but never been. If I do ever go it will be with a good guide who knows how to get me back and lots of extra batteries. ;)