Do You Know Where to Look
I Find Ownership in the News
Hidden Business Relationships in UCC Filings
Track People Down Via Lawsuits
Today’s post is just a continuation of two peeves: 1) You cannot rely on OSINT Lists, and 2) You cannot ignore Big Data. Last week, I said that OSINT was as easy as 1-2-3-4. Just know what you need; know where to look, formulate good searches, and package it nicely. Of course, it does not happen that way. If you just use follow your lists, ignore Big Data, you often miss key findings right there. You have to see the OSINT no matter where it comes from.
Recently, a client came to me with a simple request. Identify the owners of a company. Ha! I told him this is anything but simple, and quite possibly cannot be achieved. You see, there is no legal requirement in the U.S. for most closely held companies to publicly disclose their ownership—that is correct, to publicly disclose. Companies likely will have to disclose ownership to FinCen starting in 2024. Still, I said what I always say, we can search and see what we find.
As it turns out, I found some good information on the company’s ownership. It came from exactly where I expected to find it, in some old articles. It was less that I went to the right website, aka the best source, but rather, I found it because I knew what I was looking for.
I didn’t go to where the OSINT guides tell me to look. There’s an excellent resource on OSINT available via GitHub. It has several categories to get your searches going including “Phone Number Research”, “Domain and IP Research”, and “Company Research”. Given my challenge, I guess I should have started on Company Research. About 30 websites are listed, and to be fair (honest), one of them is “open ownership register,” which seems like a great place to start. Except, when you get no results from this website, look at the data sources, and see that it comes from three countries, none of which start with “United States of..." Listen, I can go on about how these lists don’t do much in the way of helping you do OSINT, but my main story is this. Do not do it this way.
I’ve pulled significant competitive intelligence insights from lawsuit filings. Lawsuit documents are also one of my best ways to get personal identifying information. Business relationships are often revealed in UCC (uniform commercial code) or real property filings. Actual open-source intelligence rarely comes by running through the lists. It often does not come from where you thought it would. To be facile, it is there when you find it, but worse, it is there when you know it is there. Company research arrives from many directions. You need to be standing in the right place to catch it.
Research, especially open-source research, tends to be taught like algebra, or I suppose like a computer program. A formula, you do X and Y and get Z. The reality is that in many cases, it is far from straightforward. You gather a bunch of documents. Look at them. Try a few more things. Look. Arriving at intelligence, answering your research topics well, requires:
1. Knowing what you’re looking for
2. A good sense of which documents matter
3. The ability to efficiently go through large amounts of data sources
Knowing What You’re Looking For
Let’s start here. If you cannot do this, everything else suffers. If you can do it, everything else falls into line. The most important research skill is understanding what you want to find. This comes in many parts. You must understand the topic, and the concepts that create your topic; for instance, if you are trying to figure out who owns a company, you must understand the different types of companies available in the place you are searching, and you must understand the disclosure requirements for that kind of company. In particular you must know the limits and restrictions and caveats and exceptions related to what you are trying to find. As noted above, you may never find the owner of a US based private company. You can find useful answers in many data sources if you know all these things. Unless you understand these things, what you are looking for can be staring down at you, and you will walk right by.
A Good Sense of Which Documents Matter
The process of collecting open source information and turning it into intelligence is one of culling the herd. You will often gather not one, but a collection of documents. If company filings are made with the SEC there will be all sorts of documents for you: annual and quarterly reports, ownership statements, and proxy records. If you find a lawsuit on your target, the casefile will contain pleadings, orders, and other paper or electronic documents. You must pick where to look.
Much of the search process consists of finding a set of documents, and then looking within that set of documents. When you find a lawsuit involving your search target, there will be a whole set of documents within the case file, what are known as pleadings and motions. These documents will be listed for you on something called a docket sheet or other title. Many, likely most, of these documents do not matter to your research aims. You must winnow out the crap and figure out where to get key data. It is not always easy. Rarely on a docket sheet will a document be titled, financial statements here. Even things like expert witness reports are not labeled as such on docket sheets. In fact, in litigation filings, almost no information may be provided in the document title. There are times when you just have to guess. It is better when you know which document to pick.
The bigger problem is, you still have to get from motion to document to finding. Just picking out the document in the casefile that has financial information, does not mean you have your answer. You then need to look through that document, analyze it, figure it out, to get to your real question, like, who owns the company.
Recently, I presented this statement:
You hear people talk about the smell test or sixth sense or “after so many searches, I just know.” The truth is, you don’t. You just get better at figuring out accuracy, authority, legitimacy.
Just as you get better over time knowing how to evaluate a piece of data, over time, you also get better at looking at a stack of documents and knowing which will be the best place to start.
The Ability Go Through Large Amounts of Data
In so many ways, OSINT is Google and Google is OSINT. The search engine is a path to information and is the most obvious method for going through millions of online sites. Whether you switch to Duck Duck Go or use Google hacks, the idea remains the same, you’re hoping to find something after putting words into the search box or omnibar. Yes, there are concepts of deep web and dark web, areas not covered by Google that impact your results. I will not dismiss those issues outright, but I do not believe they matter as much as sometimes presented. A lot of what was called deep web, invisible web, beyond Google, is now there when you google. You still need tools.
With so much out there, you need ways to make your job easier. I am a user of a couple of proprietary resources to search, global database searches I call Big Data. These programs go through all sorts of public records, social media, business documents, personal data, and webpages. As I have pointed out often, these systems are faulted for what they fail to find, instead of being lauded for all of what they do find. In other words, Big Data will not always find what you need, but you will be more likely to find what you need if you use Big Data.
The advantage of Big Data products is they sort the results into categories and provide needed summaries. It is not the bat computer, where the answer is just spit out. Instead, your Big Data results are good hints as to where to look next.
The dominant form of teaching and presenting Open-Source Intelligence, “OSINT” is via tables/charts of lists. If you need domain information, you go here, people stuff, go there. 30 years of practicing OSINT, I can tell you it seldom works that way. I find my people information in lawsuit documents. I find company ownership by reading the news. That UCC thing that shows up and you wonder what it means, I find it shows unknown relationships between companies. You have to know what you are looking for; have a good sense of what documents matter and have the ability to rampage through lots of records. That’s how I think you should research.