(Click here to watch and listen to the video version of this blog entry)
On 27 January 2023, I published my first OSINT Exercise page, aiming to offer free educational content in the form of well structured OSINT challenges. My objective was two-fold: teaching beginners the fundamentals of finding data, verifying data, and analysing data, whilst also presenting seasoned experts with tasks that may test their skills.
Now, one year later, I not only celebrate my own achievement, but also those who have used these challenges to improve their skills. And what better way to mark this occasion than by showing how you can do an OSINT report on literally anything?
With this objective in mind, I embarked on a strange inception-like investigation, targeting my own OSINT exercises and social media presence to see what sort of intelligence I could gather from it. Essentially, an OSINT investigation into OSINT Exercises, created by an OSINT analyst (me).
All hail OSINT
Insights Into Number of Exercises and Tasks
Between 27 January 2023 and 27 January 2024, I published 22 exercise pages. Each page contained between one to four tasks, totalling 47 requests.
Out of those 22, nine exercise pages contained exactly three tasks, making this the most frequent number of requests. Only exercise #022 presented the reader four challenges. The figure below shows the number of tasks per OSINT exercise page.
The most attentive ones among you may have already noticed something interesting. The graph above provides valuable insight into one of the pages. OSINT Exercise #020’s first task was to locate it. The graph allows you to establish, without having to find the page, that it contains two more tasks, totalling three.
Insights Into Difficulty Levels
In terms of difficulty level, there is a clear (and expected) contrast in the distribution of easy, medium, and hard tasks between beginners and experts. Whilst most tasks were labelled as “medium” difficulty for beginners, a significant majority, comprising 66% of all 47 tasks, were categorised as “easy” for experts. The graph below depicts the percentage of tasks created between 27 January 2023 and 27 January 2024 classified as easy, medium, and hard, for both beginners and experts.
Applying the same approach as before, we can determine the difficulty levels assigned to the tasks in OSINT Exercise #020. The exercise announcement, posted on 28 August 2023, stated the difficulty level was marked as “Beginners: Medium”, and “Experts: Easy”. Whilst the announcement did not specify the number of tasks, we have previously established that this exercise contained three tasks. By analysing the graph above, we can verify that all three tasks were categorised as “medium” difficulty for beginners and “easy” for experts through a process of elimination.
Overall, the distribution depicted in the graph highlights the target audience. The data appears to validate the initial announcement on Twitter, which stated “I have been creating exercises to help people who want to gain #OSINT skills.”
Whilst experts will certainly still be challenged by many tasks, beginners will experience a diverse experience, ranging from easy exercises to practise, to over a third classified as “hard”, demanding a higher level of dedication to solve.
Insights Into Day and Time of Publication
All exercises were initially announced on Twitter. Throughout 2023, they also started being shared on Mastodon, BlueSky, LinkedIn, and finally on YouTube. Twitter was therefore the primary platform for collecting data related to the publication dates of each exercise page. By gathering information on when each exercise page was announced on social media, we can gain some insight into when they had likely been created. The graph below illustrates the distribution of exercise pages published on each day of the week. It is clear that Sunday was the most active day, followed by Monday and Saturday with six, five, and four exercise pages respectively. This indicates that the majority of challenges were likely created during the weekend.
We can clean-up this data further. On 26 January 2023, a day before OSINT Exercise #001 was released, I shared a tweet stating: “I have been creating exercises to help people who want to gain #OSINT skills. I will add them to my website soon but in the meanwhile here’s a sample.” The post, accompanied by a screenshot showing the briefing and tasks for OSINT Exercise #005, confirms that prior to the release of the first exercise, there were already at least five exercise pages created.
We can therefore clean-up the data regarding the publication day to obtain better intel. Considering that the first five exercise pages were likely created several days, possibly weeks, prior to their release dates, we should exclude them from our data pool. This allows us to focus on the day of the week each exercise page, from #006 to #022, was announced on Twitter.
The updated graph below further supports the hypothesis that most exercise pages were created during the weekend.
No exercise page, between OSINT Exercise 006 to 022, was announced on a Tuesday, Thursday, or Friday. Almost 50% were announced on a weekend, and almost 30% on Monday alone.
Insights Into Frequency of Publishing
As we have previously established, between 27 January 2023 and 27 January 2024, I published 22 exercise pages. However, despite maintaining a release frequency of every two weeks, there was a noticeable discrepancy between the first and second halves of the year in terms of publication frequency. The graph below illustrates the decline from an extremely busy first six-month period, to a sparser second half of the year. It is worth noting that the graph only covers January to December 2023, as there were no OSINT exercises published between 31 December 2023 and 27 January 2024.
There are a few additional insights we can draw from the data shared above. More than half of the OSINT exercise pages were published within the first three months of the project. This suggests that the abundance of material during this period may have been a result of a pre-planning, potentially occurring before the announcement of the OSINT Exercises creation. This hypothesis is supported by the Twitter post previously mentioned, shared on 26 January, 2023.
While there was a clear decline between the first three months and the following ones, the absence of exercises between late August (28th) and November (9th) is notable. An analysis of my Twitter account sheds light on a possible reason for this gap. On 24 September, I shared various photos (seen below) indicating my invitation to speak at the Europol headquarters in The Hague, with one photo specifying the event date as 20 September 2023.
Considering our early intel that exercises were likely created during the weekend, it is plausible that preparations for the Europol event affected the amount of free time available for creating and releasing new exercises.
Another gap in activity is observed between late September and early November. On 15 October 2023, I shared a link to a blog entry covering the “filetype:” advanced search engine operator. Additionally, on 27 November 2023, I shared another photo confirming my attendance at another event at the Europol, where I also gave a talk. These engagements offer a reasonable explanation for the reduced number of exercise pages in the latter half of 2023.
Insights Into Recording Date versus Publication Date
In addition to creating and publishing OSINT exercises, I also provide video walkthroughs for all challenges. These videos, uploaded to YouTube, display my entire screen as I tackle the tasks presented on each page. It is therefore possible to observe the date and time of each recording. I collected the exact time shown on the screen at the end of each video, rounding it to the nearest hour (e.g. 16:06 was rounded down to 16:00, and 22:39 rounded up to 23:00).
The graph below indicates that the most common hour for recording the walkthroughs is 23:00, with 11 videos out of 22 recorded around that time. Following closely are midnight and 22:00, with five and four videos, respectively. Overall, the data suggests a preference for recording between 22:00 and 00:00, as a total of 20 out of 22 videos were recorded during that time range.
The graph above suggests that OSINT exercise walkthroughs are recorded outside of typical work hours, between the end of the average workday and “normal bedtime”. This supports the previously discussed hypothesis that they are created during my free time, as a hobby, on weekends and evenings.
Insights Into Time Gap: Video to OSINT Announcement
Although all OSINT exercises come with a video walkthrough, the link to YouTube is not immediately posted. In the majority of social media announcements, you will find the sentence: “Solution with full walkthrough will be uploaded to YouTube tomorrow.” This implies that the recording demonstrating how to solve the OSINT challenges is typically posted within 24 hours of announcing the new exercise.
But is the video recorded within this time gap, or is it recorded prior to announcement?
To answer this question, I used the aforementioned data. Each video displayed the day and hour of recording in the bottom right corner of the screen. I designated the “date and time of announcement” as the baseline (point 0) and calculated the number of minutes between this point and the time the recording ended.
The graph below shows the deviation, in minutes, between the baseline and the time displayed on the screen at the end of the recording. A negative number (in green) indicates a video recorded prior to the announcement, whilst a positive number (in red) indicates a video recorded after the announcement.
OSINT Exercise #002 was excluded from this analysis as it required a correction due to an error. The time between the original announcement (in February) and the second recording (in April) was better measured in weeks, which would have skewed the data.
Insights gleaned from the data above reveal that, in the vast majority of cases, the video walkthrough for an OSINT Exercise page was recorded before its announcement. In 11 out of 21 exercises, the recording concluded less than an hour prior to the announcement on social media.
Four exercises stand out as an exception, with their solution walkthrough videos recorded after the announcement. OSINT Exercise #011 and #016, marked as “hard” for both beginners and experts, had announcements on Twitter stating the solution would be uploaded within three days, deviating from the usual 24-hour timeframe.
But why were they not recorded before the announcement, regardless of the difficulty? I examined tweets posted around the time these challenges were announced, and one stood out. On 11 March 2023, just 50 minutes before announcing OSINT Exercise #011 I shared: “I have achieved greatness!!! I managed to solve #osint exercise 011 so it is possible!! I will give people 3 days to try to solve it before I show how it can be done (i also need time to figure out how on earth to explain all of this).”
Given that both exercises #011 and #016 were labelled as hard for experts, and I was clearly extremely excited about solving one of them, it is likely I was too eager to release them without proper planning for the recording.
The two last exercises, #021 and #022, were also recorded after the announcement. If we examine the tweets around the time of the announcement, we may notice one that featured the photo from OSINT Exercise #022 page along the text: “You know you’re addicted to geolocations when you look at a chocolate and decide you MUST geolocate the map seen on the bar”, as seen below.
Although the tweet did not explicitly mention an exercise, the same photo was later used for an exercise page announced slightly over 24 hours later, suggesting that this exercise might have been a spontaneous decision. A tweet between these events might further support this hypothesis. On 8 November 2023, at 23:59, I replied to a comment asking for information, stating “Im afraid i cant answer those questions (yet). I have plans for this image first”.
It seems that exercises not planned in advance may require extra time for recording the walkthrough video, as I get too excited and post them shortly after solving them.
As mentioned in an analysis earlier, the first five challenges were created prior to the announcement of the OSINT Exercises. Despite being developed days, or possibly weeks, in advance, we have seen that the solution walkthrough recordings were concluded less than an hour before each announcement. We can go even further and note that OSINT Exercise #006 appears to follow a similar pattern to the initial five exercises. Whilst OSINT Exercise #007 appears to have been recorded much earlier, and exercises #008 and #009 were recorded less than 10 minutes prior to their announcement, the solution for #006 was also recorded within an hour of posting, consistent with the trend of the first five. This suggests that by the time the OSINT Exercises idea was announced on social media, I had already created at least six exercises.
Conclusion
You can do an OSINT investigation on almost anything! A simple analysis on the List of OSINT Exercises, released between 27 January 2023 and 27 January 2024, provided valuable insight into how they are developed. We can observe clear patterns of behaviour showing that I tend to work on them in the evening, most frequently during weekends, and I almost always record the video walkthrough between 22:00 and midnight. We can also establish that, prior to the announcement of the OSINT Exercises List, I had already created various challenges which were released over the first weeks. It is also possible to notice that exercises marked as “hard” for experts follow slightly different patterns. This is possibly to do with the fact that they take longer to explain, but also possibly because I appear to get overly excited with them and struggle to wait until I have recorded the walkthrough to release them on social media.
I hope you enjoyed reading about the magical world of “how Sofia spends her free time”.
Thank you so much for your support over the past year of OSINT Exercises! Let there be many more ahead.
~Sofia.
Sofia Santos | OSINT Analysis & Exercises 