How to use social media to determine the location of a person

Obtaining the location of a social media threat actor can provide important information in the process of assessing risk. Verifying a user's geographic area is critical to determining the credibility and risk level of threat content posted. Investigating the true location of threat actors can clearly transform seemingly unfounded, low-risk social media threats into actionable and worthy of escalation.

The level of difficulty in determining the location of social media threat actors varies. Some users are generous with their location, listing the cities they live in or frequent in the "About" section of their profiles, or by geotagging their posts. However, users are likely to be reluctant to share their location if they post threatening content to remain anonymous online.

We also need to consider that capable threat actors may have anticipated the possibility of threatening searches and have tried to deploy countermeasures to block detection. In terms of identifying locations, users can spoof their geographic area by providing false information in their profiles. For example, they can list a false location in their "About" section and posts as a defensive tactic.

How to determine the location of a person?

Threat actors' posts can be examined in more depth to begin to narrow down the user's geographic location. Posts that contain personal images taken by or belonging to the user are a good place to start. Analyzing images uploaded by users in a public environment can provide an idea of where they are located. For example, identifying famous landmarks in the background or even studying subway ads can provide clues.

Posts may also include photos taken in an individual's home, which can provide evidence of possible geographic areas. This could be something as simple as a grocery bag with a regional supermarket print on it, or an analysis of the socket pattern on an electrical outlet in the background.

Social media users can also post screenshots of cell phone screens or pictures of computer screens. By analyzing the date and time stamp shown on the screen compared to the date and time stamp seen in the post, we are likely to be able to determine the time zone in which the user is located.

All humans sleep. Analyzing the time periods when users post, and the periods when they do not post within 24 hours, can also help us better understand where they may be located. This approach is most effective when studying users with a large number of daily posts. An effective tool for gaining insight into Twitter users' work schedules can be found here - Knowlesys Intelligence System.