A Free OSINT Lesson: Why RUMINT is the Unsung Hero of Intelligence Gathering
Spill the Tea!
Gossip. Rumour. Innuendo. Humans are naturally hard-wired to love it. It’s built into our DNA, our love for that curious mix of truth and story, where knowledge and information are passed along via tales.
This makes sense, though. Humans have evolved to tell stories about the world to shape and understand it. As we’ve moved along historically, we’ve slowly begun (and we still have a ways to go) to adjust our understanding of the world into two sides: fact and fiction. There are things that we know, and there are things we imagine. Opposing forces, or so they say.
But people have never really been black and white about how they interpret the world, and there has always been that ‘in-between’ place where mixtures of the things we know and the things we imagine dwell. The place of ambiguity. And we’ve been mixing these two forces ever since our monkey brains, trapped on this spinning rock in space, looked up at the stars and told stories around fires. We have legends of ancient trickster gods like Anansi, Nanabozho, and Hermes, who shaped the world for humans but also sewed chaos as they went. We have myths of spirits and monsters and aliens, bizarre creatures created by our minds (maybe—your uncle may have something to say about it) to help us forge an understanding of certain phenomena but also confuse our interpretation of reality. Plenty of social concepts, even modern ones, fall into this same category.
Humans, no matter how hard we try, are liminal thinkers. Investigators and analysts should embrace that.
“RUMINT” has played a role in a lot of my investigations. I know that some analysts look at RUMINT as a dirty word. It’s information that is not verified, and because it may be too difficult to verify, it isn’t worth pursuing. It leads down rabbit holes that may be distracting. It is too chaotic to be used as a possible data point.
I get it. I do. Intelligence and investigations require facts, known knowns, and verifiable truths.
But humans, those involved in the case you are working on, don’t operate in this dichotomy of fact versus fiction—both the good and bad actors, the client, the bystanders, the witnesses, and those “folks in the know.” RUMINT and using it in your investigation is not about letting chaos take hold, rather, much like the trickster gods of old, using that chaos to your advantage.
The Subtle Art of Developing Sources
Investigations and analysis work varies. Not every case is the same. That is the caveat to this whole lesson. However, one great way to utilize rumour as an OSINT tool is to develop sources who hang out around the edges of your investigative space.
There may be journalists covering a local beat that ties into the investigation you are engaged in. Perhaps some activists and academics are working in a similar space and who themselves have cultivated their own sources. Moreover, they may have their own sources to supply them with information.
For example, a client tasked us with examining fraud in a very rural and remote area in Canada. Over a couple of years, a very large sum of money was shuffled around into a couple of shell companies and essentially vanished from the books. By the time the stakeholders noticed, it was long gone. Lawsuits and humiliations galore followed. Permanent Record was brought in to cover some of the investigative questions regarding the players involved in the fraud. Not to toot our horn, but we got the bastards.
I digress.
The use of sources on the ground and the local rumour mill in the community was INCREDIBLY useful. While Justin, my fearless wildman of a colleague, began crunching numbers, data points, and timelines, I began reaching out to people who had connections.
I started with Facebook and found the local community groups of the towns and municipalities. I joined them and immediately found posts about the fraud that had shown up in the local newspaper. The subsequent comment chain of “shameful” and “those assholes” gave me a good chuckle, but the “I knew this was happening because I worked for that guy before…” and the “I heard he’s done this before at another company…” became key points of interest.
I began reaching out to those folks, not saying that I was working a job, but discussing the fraud and the rumour with them like a concerned member of the public. I’d book phone calls and shoot the shit with them for 10 minutes before getting into it, but they would provide me with names and dates and even source names of people who probably knew more.
I even had one source say that they heard one of the individuals was involved in the local party and drug scene. No judgement. However, it did lead down some interesting roads and provided some insight into their associates.
While this was going on, I’d circle up with local journalists who covered the fraud, and while sometimes journalists are guarded, I explained I was investigating the matter and asked to talk off-record. Sometimes they’d oblige, and sometimes they’d tell me to fuck off. Regardless, there have been plenty of times a journalist has said to me, “Thank god someone is looking into this. I can’t… so here are my notes.”
Another interesting place I’ve gone to for source and RUMINT is Reddit. It’s pretty much a cesspool, but I have used it twice to actually make contact with individuals. In one particular project involving a sort of bizarre romance/crypto scam in Argentina (not a paid gig, but a fun pro-bono projects for a pal), I was able to talk to two victims of the same scammer who both had different pieces of information regarding him that they posted to a scammer subreddit. Rumour mills milling, as a result of their posts, they were also contacted by a third victim who was scammed.
And while they all had similar stories, they provided me with three different sets of data, such as photos, names, phone numbers, emails, and crypto-wallets. With all those selectors, correlating information became a bit of a breeze, and figuring out who this guy was became a fairly simple task.
In another situation, dealing with a wealthy and powerful asshole tech corporation, our client was interested in some possible corporate fraud. Money laundering stuff. Cooking the books stuff. Fun.
Our client had heard rumours that this particular corporation had a bot problem, and in simple terms, user numbers weren’t actually user numbers. I can’t get into more than that. I’ve been NDA’d to secrecy.
So what did we do? We began looking at online rumours of bot activity regarding this firm and where it originated. Many people pointed to Vietnam, so I started hanging out on Vietnamese Discord servers and Facebook groups and looking for discussions regarding this company.
In the span of 5 hours, I had messaged multiple Vietnamese bot herders. While most never got back to me (understandably), a few of the more curious parties did, and soon enough, we were having Telegram chats and calls at 2 AM, talking about the intricacies of how to launch this network and whether the company was trying to stop them or allowing them to stack their user counts with bullshit accounts. They were more than happy to chat, tell me stories of their exploits, and explain how this network operated
The overall lesson here is that people love to tell you what they know, especially if it's shady. Spilling the tea, as it were, is an international sport. The trick is getting people to confide in you, and that requires a bit of give. You need to talk to them. Tell them about yourself. Be human.
Gathering intelligence for an investigation or in OSINT isn't always about running these cool tools that can scan through the dark web or graph a zillion connections of data (this is cool shit, don't get me wrong), but a lot of "open source" stuff is just people gabbing. Talking to people who have boots on the ground, chatting with their neighbours, sharing a cup of coffee, or even just a phone call where you chat about your kids for a bit and their love of Bluey or your personal penchant for Coke Zero can get you through a lot of doors, and into some really solid intelligence.
Why?
People love to tell stories.
I'm reminded of the Greek god Hermes, who would often act as a sort of messenger between the gods and humans, carrying word between these two spheres.
He's a real piece of work and a real troublemaker, but his whole ideological and mythological purpose to the Ancient Greek mind was to connect the world of knowledge and the world of the fanciful, and he dwells in this mixture of both. A liminal space.
Intelligence is similar. We sift through these worlds of "knowns" and "unknowns" in order to develop an understanding of what is going on. Data can do some of that, but getting a feel for that thing you are after and understanding the vibe, the zeitgeist, and the context often comes from the tales that form around the investigation. Like Hermes, we have to fly between fact and fiction, and when we do, we have good intelligence.
Gossip. Rumour. Innuendo. RUMINT. Sure, it can be chaotic, but when harnessed well, it's invaluable.