There are few things more terrifying and devastating than having a loved one go missing and not knowing where they are or whether they're okay. 170,000 people are reported missing every year in the UK alone, and, as much as the police can use their incredible knowledge and experience to find them, their resources are unarguably limited when facing such a huge number of cases. Thankfully 90% of children and 85% of adults are found within two days, but some individuals remain missing for an extremely long time — in March 2020, there were over 5,300 people in the UK who had been missing for over a year, 1,700 of these being children.
Trace Labs, a non-profit organisation based in Canada, specialises in crowdsourced open source intelligence (OSINT), inviting people to volunteer their time and expertise to uncover critical information about the possible locations of real missing people. The organisation partners with law enforcement agencies from around the world to run 'search party' events several times a year, where hundreds of volunteers have a fixed time (usually around four hours) to find information to help progress a set of missing people cases, carefully chosen by the law enforcement agencies. As of February 2023, Trace Labs has run 48 search parties and assisted in 380 cases, with over 11,777 volunteers taking part.
On Saturday 11th February, two of our Cyber Essentials Assessors, Alice and Steve, took part in one of the Trace Labs events. This was Alice's fifth event — she's taken part in the events for the last two and half years as part of a regular Trace Labs team — and Steve's first. They joined forces with Alice's usual Trace Labs group (Adorably Persistent Team), which has grown so much in numbers that it managed to field six teams at the recent event. Since two of these teams were local to the ID Cyber offices, the company were pleased to be able to host them, providing computers, coffee, and pizza.
As the event is hosted by a Canadian organisation, it began at 5pm GMT and finished at 9pm. Our two teams set themselves up in ID Cyber's training room a couple of hours beforehand and regular Trace Labs volunteer Gerard Barrett delivered a briefing, complete with useful hints for all the first-time participants. At 5pm, the submission portal opened and we received details of the four cases we would be working on.
As mentioned, these are real missing person cases, so it would be unethical to share specific details. But, as a general overview, we spent the next four hours combing social media profiles of each missing person and any critical associated people, looking for any notable features not included in the police reports (tattoos, regularly-worn and distinctive jewellery, make and model of mobile devices, etc.), signs of activity after the date reported missing, and ultimately indications of where the person may have gone. We identified networks of trusted contacts (as the missing person would be more likely to get in touch with one of these people than any others), used known social media profiles to identify previously unknown profiles which yielded more information, and submitted everything of value we found to the Trace Labs portal.
Every piece of evidence we submitted was assessed by a Trace Labs judge, who checked that what we had provided was verifiable (particularly if pivoting from an earlier submission) and presented in a way that would be valuable to law enforcement, with any necessary relevant supporting information.
At 9pm, the Trace Labs organisers sealed the portal and verified any final submissions, before giving a closing briefing. At this time they revealed the leaderboard, showing which teams had given the most valuable submissions. It initially felt a bit odd that we were gamifying trying to find missing people, but it's clear this is a really good way to encourage volunteers to find valuable information and to keep them pushing hard through the four-hour event. It's also a good way for teams to see how well their information compares to other teams', so they can consider looking for new tools and ways to improve their submissions. At this event, we were pleased that our team came 32nd out of 220 teams, showing that we were finding and submitting some really important information to help law enforcement agencies find these missing people.
We're now looking forward to the next event, which will probably be held in late summer, and will be using the upcoming few months to research some new tools so that we can hopefully find even more valuable information to help progress the next set of cases.
If you're interested in learning more about Trace Labs, keep an eye out for our ID Cyber Sessions episode with Dan Conn, experienced Trace Labs participant and judge.
Finally, a disclaimer: Please note that, although we were searching for only freely available information, it's unethical to do this unless as part of an official organised effort (e.g., Trace Labs) or with the express permission of the person themselves (e.g., if they want to know what information is available about them).
