Building a Hells Angels Database with Hunchly

Today I will teach you about Hells Angels and Hunchly and how one of these two is useful when looking into the other.

In the past year, I have worked two cases in which I stumbled upon links to Hells Angels while investigating individuals. I was surprised how much information people affiliated with this group shared publically on Facebook and other social media sites. Whether they were just supporters or full members, it became quite clear that they did not care about data privacy. Most profiles had open friend lists, some of them displaying thousands of friends. Hells Angels affiliates are not hard to find. You will likely stumble across one of the following acronyms and/or terms on their profiles: AFFA (Angels forever, forever angels), HAMC (Hells Angels Motorcycle Club), Support 81 (8 = H, 1 = A), SYL81 (Support your local Hells Angels), Eightyone.

There are a couple more, but this article is not about the Hells Angels per se. Since these individuals have so much open information on Facebook, their profiles are the perfect playground to try out Michael Bazzel’s Facebook tool on IntelTechniques.

I had just finished working on the first case and subsequently erased all the data linked to that case, when a second case soon revealed links to Hells Angels as well. If only I had saved some data from my first case. I roughly knew where I could start off, but most of this knowledge came off the top of my head and was sketchy. Before I started the second investigation, I made sure I wouldn’t make the same mistake again and decided to use Hunchly to save my findings. That way, if a third case with the same links should ever occur, I will have a great starting point. For those of you who do not know, Hunchly is a web capture tool. It automatically collects and documents every web page you visit. The best part is that it indexes everything, so you can search within the data afterwards. Using this amazing tool allowed me to create a fully searchable Hells Angels database!

First off, I created a new casefile and then let Hunchly collect Facebook friends lists of people affiliated with my target or any Hells Angels in the area my target originated from. As some of the profiles had thousands of friends, I used a little Chrome extension (Simple Auto Scroll) to automatically scroll down friends lists, so they would be captured in whole. Whenever I looked at profiles and found information that could not be automatically indexed, I would take notes in Hunchly or tag (caption) pictures. I have learned that a lot of intelligence can be obtained by closely looking at pictures on social media. In the following example, one Hells Angels member had obscured the tags on his vest. Based on the information in his profile, it became clear that he must belong to the Aarhus chapter in Denmark. I tagged this picture, meaning it would pop up if I ever searched for “Aarhus” in Hunchly.

1

I ended up tagging all pictures that included chapter names, functions, nicknames or general indications on the location. If I am interested in finding the security chiefs and weapons masters, all I have to do now is search for “Sergeant at Arms” or known abbreviations. Looking for “arms” gives me several results in Hunchly.

2

The first two are displayed because I manually tagged these pictures and added a caption. The third result is from a webpage that Hunchly captured, in which the person actually listed “SGT At Arms” as his current occupation. Hunchly also allows you to refine searches. I can narrow these results down and, for example, only search for Sergeants at Arms in a specific chapter. Searching for “arms + sacramento” only reveals one result, which I had captioned with the information I saw in the picture. As you see, the picture is actually mirrored.

3

All collected data is saved offline. Should the online profile ever change, be locked down or deleted, I still have a version to work with. By using Hunchly and remembering to tag pictures with captions and also take notes on webpages, I have created a useful database on Hells Angels Facebook profiles. From here on, it is also always possible to go to the live versions of webpages, so any updates can also be captured within the same casefile.

If you are not using Hunchly yet, I suggest you have a look at it. The use case described above is just one of many. Furthermore, if you ever come across friendship requests from people named “AFFA” or “HAMC”, you might want to think twice before accepting them. Or else you might wind up in my Hells Angels database.

Matthias Wilson / 07.03.2019

Sieben Praxistipps für Jedermann

“Googeln können wir selbst!”. Diesen Satz hört man häufig, wenn man mit Kunden über OSINT-Recherchen spricht. Dass zu einer umfänglichen Recherche ein bisschen mehr als “googeln” gehört, wollen wir heute anhand einiger Beispiele aus dem Ermittleralltag darstellen.

  1. Pseudonyme in sozialen Netzwerken identifizieren

Immer mehr Personen nutzen in den sozialen Netzwerken Pseudonyme, so dass eine direkte Suche nach ihnen nicht möglich ist. Anstatt die Personen direkt zu identifizieren, hilft es häufig, die Zielperson indirekt über bekannte Familienangehörige oder Freunde zu recherchieren. Dazu versuche ich, eine befreundete Person mit offener Kontaktliste zu identifizieren, die ich dann nach der gesuchten Person durchsuche.

  1. Recherche in der Landessprache

Ermittler neigen dazu, nur in ihrer jeweiligen Muttersprache oder mit englischen Suchbegriffen zu recherchieren. Dies beschränkt das Suchergebnis erheblich. Wenn ich meine Recherche aber um Suchbegriffe in der jeweiligen Landessprache erweitere, kann ich meine Trefferanzahl um ein Vielfaches erhöhen. Sprachdefizite behebe ich mit diversen Übersetzungsprogrammen wie Google Translate und Co.

  1. Einsatz von OCR-Software

Häufig stoßen wir bei Recherchen auf Dokumente, die nicht durchsuchbar sind, weil sie beispielsweise eingescannt wurden. Insbesondere bei mehreren tausend Seiten kann dies sehr hinderlich sein. Dafür empfiehlt sich der Einsatz einer sogenannten OCR-Software (optical character recognition), die die Zeichen in dem Dokument erkennt und dieses in ein durchsuchbares Dokument umwandelt. Je besser die Qualität des Ausgangsdokumentes ist, desto besser ist auch das Ergebnis.

  1. E-Mail-Adressen über Passwortzurücksetzung bei sozialen Netzwerken recherchieren

Bei mehreren sozialen Netzwerken lassen sich über die Passwortzurücksetzungs-Funktion die E-Mail Adressen recherchieren, mit denen das jeweilige Profil angemeldet wurde. Dazu benötigt man lediglich den Benutzernamen. Teile der dann angezeigten E-Mail-Adresse werden zwar durch Sternchen weitgehend unkenntlich gemacht, dennoch lassen sich die E-Mail-Adressen meistens aus den erkennbaren Mustern rekonstruieren.

  1. Firmen-E-Mail-Adressen rekonstruieren

Fast jedes Unternehmen verfügt über eine Webseite mit entsprechender E-Mail-Systematik. Das am häufigsten genutzte Muster dürfte wohl vorname.nachname@domain.com sein. Bei Dienstleistern wie z.B. www.hunter.io lassen sich die Muster der E-Mail-Adressen zu den dazugehörigen Domains ganz einfach recherchieren. Kenne ich den Namen einer Person eines Unternehmens, sei es aus einem persönlichen Gespräch oder einer Recherche in sozialen Netzwerken, kann ich die E-Mail-Adresse nach der Firmensystematik mit hoher Trefferwahrscheinlichkeit rekonstruieren.

  1. WhatsApp Profilfoto

Im Rahmen von Recherchen stößt man häufig auf Nummern von Mobiltelefonen. Wenn man die Nummer in seinen Kontakten abspeichert, ist es ggf. möglich, bei WhatsApp das dazugehörige Profilfoto der Nummer zu sehen. Schon häufig konnten wir so weitere Erkenntnisse aus dem Foto ziehen.

  1. Geburtsdaten über Stayfriends recherchieren

Das Schulfreundenetzwerk www.stayfriends.de ist besonders in Deutschland bei den 30 –  60-jährigen populär. Wenn ein Profil zu einer Person vorhanden ist, ist es auch sehr wahrscheinlich, dass das Geburtsdatum hinterlegt wurde.

Ingmar Heinrich / 31.10.2018

Vlog Post: OSINT – A Starting Point for other Intelligence Gathering Disciplines

After playing around a bit with different video production platforms, I think we finally found something that suits our needs. In the future we will try to produce short and informative videos for the tl;dr fraction. Warning: These might contain humor and sarcasm!

This is a first try, feel free to comment and provide feedback.

Matthias Wilson / 25.10.2018

Using Strava in Law Enforcement Investigations

Strava is social network used to track athletic activities with wearables that has been fallen into disrepute in the past, because its Global Heatmap featured the ability to pinpoint military bases and patrols as well as covert locations of intelligence services, based on the aggregated user information. Initally, zooming into the heatmap would also reveal the profiles of individual athletes. That isn’t exactly how you imagine OPSEC.

This sparked a huge outcry, and several nation’s militaries subsequently banned the use of activity trackers. Strava also reacted promptly, updating the heatmap and ensuring that they “respect your privacy and share your concerns about the security of information you may submit to Strava’s websites”.

However, even after the updates made, it is still possible to harvest sensitive information from the data published by Strava. Strava informs users via their website that if the Enhanced Privacy Mode is toggled on, “your activities are still visible in public locations like the Flyby, group activity features, and segment, public club, and challenge leaderboards”. The means that profiles of individual athletes can still be accessed through segment leaderboards.

Now how can we use this knowledge for law enforcement investigations?

Imagine the following situation: The body of an unidentified male was found on July 18th 2017 near a pond named “Amphibientümpel” in the Forstenrieder Park in Munich. Initial crime scene investigations come to the conclusion, that the victim was murdered on site. The autopsy reveals that the victim had deceased during the afternoon of July 16th 2017.

The Forstenrieder Park is favored among athletes. Dozens of runners, hikers and cyclists use the trail next to which the body was found on a daily basis. Maybe one of them had noticed something suspicious on the day of the crime?

strava1

Law enforcement investigators trained in OSINT check the Strava website to see if the aforementioned trail is classified as a segment. It is and on the day of the crime, two top times were added to the segment’s leaderboard. Via this leaderboard the investigators are able to access the profiles of these athletes, including the names of both and also pictures they have uploaded.

strava2

One of these athletes uses Enhanced Privacy Mode, hiding the athletic activities on his profile from users. To view these activities he must give consent to individual users and allow them to follow him.

The other athlete publicly provides access to all his data. After all, he is using Strava to compare himself with other athletes. The investigators go through his activities and notice that the run listed in the leaderboard started at 16:59 p.m. In conclusion, he was in the vicinity of the crime scene at the presumed time of death.

strava3

The athlete uses his real name in his profile, which makes it easy for the investigators to find him and contact him for further questioning. The athlete was unaware of the crime as of now. However, he did recall seeing a small truck parked in between trees near the pond that afternoon. According to his accounts, the truck belonged to a local crafts business. Although he had initially wondered as to why the vehicle was parked there, he hadn’t spent any thoughts on it after the run. This clue was vital to commence further investigations and eventually led to an arrest.

The quintessence of the story: OSINT should be integral part of all investigations. In our case, OSINT provided a witness and this witness’ accounts led to solving this violent crime. Nonetheless, this requires skilled investigators…

Sebastian Schramm / 31.08.2018