O P E N

I N T E L L I G E N C E

Tools for online political research
Investigations into the political realm aim to delineate the “faces” and profiles of contemporary powers as seen through their various
manifestations and roles in the present-day debates and struggles. By collaboratively mapping these powers’ composition, mechanisms andalliances, political investigations can help trace changes across time and space, allowing us to create useful knowledge that can fuelthe self-defence and reaction strategies of civil society organisations in their quest to expand civil rights or to stop their regression.

In Argentina, this is part of a tradition of social politicisation of research introduced by local human rights movements after the lastcivil-military dictatorship (1976-1983), giving shape to a meaningful process of democratisation under the slogan that was a cry, apractice and then a method: "Memory, Truth and Justice". Democracy, in spirit and in action, was strengthened by feminism, environmentalism
and a diversity of street movements. And, democracy in opposition, every day and on every corner, in the face of the reactionary,authoritarian advance that sought to restrict rights and lifestyles.

Faced with the question of “how to defend ourselves against contemporary violence?”, we create tools, information and research that enrichpublic debates and strengthen community responses. Whether by focusing on in-depth analyses or through deeper inquiries to map power andinfluence, political research and investigation seeks to give a name to an existing interdisciplinary experience, linked to the processesof struggle and their temporalities.

Although academic and journalistic investigation / research techniques are fundamental in this context, they are not enough on their own.
Territorial (cross-border) interconnections together with collaborative methods of data collection and analysis contribute to a strategicand engaged view of the conflicts. In the tensions between disciplines, contaminated by various ambitions and activist practices,intersecting horizons of intervention and experimentation can emerge.
Investigation is political not only because of its object and the collective, interdisciplinary and networked nature of its dynamics,
but also because it assumes the territory of information as a strategic field of debate.
It seeks to develop collective and connective research skills to identify, document and report abuses, and to defend oneself whilegathering evidence. It supports the development of critical perspectives, alternative narratives and strategic interventions in a context
where information, subjected to a trend of monetisation and appropriation in the hands of a few, is a source of speculation and manipulation.
How can we build autonomous ways of information access, re-appropriation and processing capacities that provide democratic alternatives
to the capitalist valuation of data? The struggle for real data democratisation, so that it becomes a common good and not a commodity,
should not only be fought at the legislative or state level, but also through concrete grassroots initiatives.

Adversaries may become blurry amidst abstract webs of data and connections, but the effects of the abuses that mark people’s existence
today are not. They are evident and palpable.

Unlike the secrecy typical of state (or para-state) intelligence linked to a central and hierarchical apparatus, political research makessocially relevant data openly available through collaborative approaches via horizontal networks, and supported by freely accessible techtools. Its methods are characterised by a democratization and decentralisation of information.

Today, practically anyone with a cell phone and basic knowledge of photography, video and audio data collection can contribute to politicalresearch experiences. Technology has democratized the act of documenting and reporting, and has contributed to more people being able toinvestigate matters and events in-depth, anywhere in the world. There is a great amount of public interest information that can be collected
and processed with accessible tools and techniques.

In this context, new forms of commitment and participation emerge. With our own commitment to collaborative research practices, we will focus
here on exploring the vast ocean of information scattered on the internet through so-called OSINT (open source intelligence) techniques.
But this is not the only resource that fuels political research, whose sources also extend to the territorial knowledge embodied in local
communities, specialized technical or academic sources and, when available, public or private databases, documentation from court cases
and materials amassed by institutional archives.

https://kit.exposingtheinvisible.org/en/

https://exposingtheinvisible.org/
With the support of Tactical Tech, we share some useful resources for online research based on the "Exposing
the Invisible" Kit, which werecommend for more in-depth browsing. In a context of information saturation and constant tension, we aim to strengthen our societies’abilities to question information that may be false, find more information when it is scarce, and filter information when it becomesoverwhelming.

JUSTIFICAR TEXTO SI HAY TIEMPOO S I N T
Diving into an ocean of information
Open Source Intelligence – is a professionalization of abasic concept related to free or low-cost information, tools
or media that can be accessed, reviewed and used by averagepeople, without licenses or active permits. Intelligence,in this case, means information, data, knowledge obtained
from openly available sources.

OSINT is not just information available by any means. It refers to information legally accessible bya member of the public, like a Mercado Libre review, an unprotected tweet, an unsealed court document,
or a construction site’s activities seen from the street. OSINT also describes information leaked tothe public, like the “Papeles de Panamá” or information published by Wikileaks.org.
Legally accessible information means something different depending on where you live and who you are.

ht ps:/ www.icij.org/investigations/panama-papers/

ht ps:/ kit.exposingtheinvisible.org/en/osint-ocean.html

https:/ wikileaks.org/

An important aspect of OSINT research is that it relies on creating overlaps and meshing knowledge fromdifferent sources. Each source creates deeper understanding and further develops in a wider context.
Individual pieces of information may not be accessible to everyone, but combining enough different
sources can help develop seemingly useless data into meaningful results.

Many governments and corporations are required to publicly register information, but thisoften happens in decentralized ways, thus making the data less accessible, hard to index
and difficult to trace historically and geographically, across regions and institutions(even when these institutions are be connected). The information is always most powerfulwhen it can be brought together – combining datasets that have mutual importance.

Let’s remind ourselves that with OSINT (as with many other kinds of information), there is a tension
between the seemingly obvious “good” of open, transparent and free information and the “good” of wanting
to protect personal, sensitive data of individuals from exploitation. Free and open data about companies,
governments and the environment may be a human right, just as many people believe that personal privacy
is a human right. Perhaps this tension won’t be resolved until data protections for corporations and theassets they often hide can be properly separated from those for natural persons.

OSINT investigations often require creativity andintuition: seeing where different datasets slot
together, imagining where we might find something
useful, or pursuing new sources even when we’ve
found a dead end, time and time again. Sometimes
the information we want or need simply is not OSINT–
it happens. But layering information, pulling in
additional context, adding seemingly small details
to our pool of data, and looking in unusual places
can usually get us where we need to be.
OSINT resources can lock into each other like puzzle
pieces or can develop a picture like photo chemicals
when used all together. Seemingly useless or irrelevant
open data can be transformed into extremely powerfultools and used to further important investigations
using OSINT research techniques.

We know none of this is easy. Turning information into evidence, and then into knowledge,
action and justice requires time, effort, persistence and courage. But we believe this endeavour
is necessary. Investigating the issues that define our here and now, as well as our future, is vital.

D O R K I N G

Dorking essentially refers to advanced online searches – using
search engines to their full potential to unearth results thatare not visible with a regular search. With a few keywords andsearch “operators”, it is possible to refine a query, increasing
the levels of accuracy when browsing web pages, databases anddocuments available online. Uncovering hidden files and various
websites’ flaws through the use of dorking doesn't require a great
deal of technical knowledge, but rather learning a few techniques
and using them across various search engines
BUSQUEDA AVANZADA
A “prefix operator” is a special text that is added
before the searched text in a search bar. Here are someexamples of dorks based on “prefix operators.”

REGULAR SEARCH
is a regular way of asking for information, either
by typing a full question <<how to make pancakes?>>or choosing keywords <<pancakes recipe>>.

IN PRACTICE
With great information access comes
great ethical responsibility.

The following is a simple example of a dork that
does rely on a prefix operator. It will searchhttps://tacticaltech.org for all indexed PDF files
hosted on that domain:site:tacticaltech.org filetype:pdf

While you can use these techniques, ina responsible manner, to extend yourinvestigations, others can use themto obtain personal data or exploit
vulnerabilities. As is often the case,intentions matter

Another example, which returns all websites under
the tacticaltech.org domain that have the word<<invisible>> in their titles, might look like this:site:tacticaltech.org intitle:invisible
If you need to use a search term that contains
multiple words, you can surround them with quotation
marks:
site:tacticaltech.org intext:exposing intitle:“the invisible

D U C K D U C K G O
https://duckduckgo.com/
We included the most widely used searchengines and the most common and useful“dorks” that go with them.

Dorks can also be paired with a general search term.
For example:
exposing site:tacticaltech.org, or
exposing site:tacticaltech.org filetype:pdf

Our preferred service is DuckDuckGo,a privacy-focused search engine,which claims not to collect personal
information about its users and storessearch queries in such a way that theycannot be attributed to specific users.

Here, <<exposing>> is the general search term, andthe filters and narrow down the results.
site:filetype:That said, if you are doing sensitive
research, it makes sense to use the
Tor Browser in combination with
DuckDuckGo, to further protect yourprivacy. And fortunately, DuckDuckGo
is much less likely than Google toblock Tor users or make them solve CAPTCHAs.

Each filter keyword ends with a colon (:)
and is followed by the relevant search term or termswith no space before or after the colon!

That this list might not be exhaustive, but the operators should help you get started.
Identifies sites that contain links to filetypes specified(i.e. contains:pdf).

caché:[url]Shows the version of the web page from the search engine’s cache.

related:[url]Finds web pages that are similar to the specified web page.

info:[url]Presents some information that Google has about a web page,
including similar pages, the cached version of the page,and sites linking to the page.

hasfeed:[url]Finds webpages that contain both the term or terms for which
you are querying and one or more RSS or Atom feeds.

Finds pages only within a particular domain and all its
subdomains.

ip:[ip adress]

Find sites hosted by a specific IP address.

language:[languange code]

Returns websites that match the search term in a specified
language.

site:[url]intitle:[text] o allintitle:[text]

Finds pages that include a specific keyword as part of theindexed title tag. You must include a space between the colonand the query for the operator to work in Bing.

contains:[text]
feed:[feed type, i.e.rss]

Find RSS feed related to search term.

allinurl: [text]

Finds pages that include a specific keyword as part of theirindexed URLs.

book:[title]

Searches for book titles related to keywords.

meta:[text]

Finds pages that contain the specific keyword in the meta tags.

maps:[location]

Searches for maps related to keywords.

Searches for specific file types.

linkfromdomain:[url]Shows websites whose links are mentioned in the specified
url (with errors).

allintext:[text], intext:[text]
o inbody:[text]

Searches text of page. For Bing and Yahoo the query is
inbody:[text]. For DuckDuckGo the query is intext:[text].
For Google either intext:[text] or allintext:[text] can be used.

altloc:[iso code]

Searches for location in addition to one specified by languageof site (i.e. pt-us or en-us).

inanchor:[text]

Search link anchor text.

filetype:[file extension]

location:[isocode], loc:[isocode]o region:[region code]

Search for specific region. For Bing use location:[iso code] or
loc:[iso code] and for DuckDuckGo use region:[iso code].

*An iso location code is a short code for a country for example, Egypt is eg and USA is us. For more: https://es.wikipedia.org/wiki/ISO_3166-1

https://www.exploit-db.com/google-hacking-database?category=8

For more examples: Files Containing Juicy Info from Exploit Database

DEFENSIVE DORKING
You can use dorking to protect your own data and to
defend websites for which you are responsible.
This is called <<defensive dorking>>,
and it typically takes one of two forms:

https:/ kit.exposingtheinvisible.org/en/google-dorking.html#term-ftpserv

https://www.exploit-db.com/google-hacking-database

The Google Hacking Database (GHDB) suggests various keywords
and other terms that you can use - along with the filter
in order to identify certain vulnerabilities. While thesesearches may help attackers locate vulnerable services,
they also help website administrators protect their own.
site:yoursite.org.

NOR ALL ADVANCED SEARCH TECHNIQUES RELYON PREFIX FILTERS OR OPERATORS“

1

Checking for security vulnerabilities in an online
service, such as a websitehttps://kit.exposingtheinvisible.org/es/google-dorking.html
or an FTP server that you
administer.

Adding quotation marks <<”...”>> tells mostsearch engines to match an exact phrase:"pharmacies on duty in Buenos Aires"2

Searching for sensitive information about yourself or about someone else, with their permission that might be exposed unintentionally on a website,
regardless of whether or not you administer that website.

To look for sensitive information, you can start with thefollowing simple commands, along with the filter. You canthen remove the filter to discover which other websites
might be exposing information about you or your organisation.
Below are a few examples.site:yoursite.orgsite:

Placing an all-caps OR (O in Spanish) between
results with either term:“pharmacies or drugstores in Buenos Aires”
Adding an asterisk <<*>> in a quoted phrase
works as a wildcard giving the option to thesearch engine to include results that haveother characters or another arbitrary term:“pharmac* on duty in Buenos Aires”
An asterisk replaces multiple characters.

WARNING
If you search for your name oraddress and then your ID number,
you're giving this information to
whoever runs the search engine.
Even Tor can't protect you fromthis type of privacy leak..

Adding <<->> (minus) in front of a word
excludes results with that term:"pharmacies on duty in Buenos Aires -homeopathy"
A minus <<->> acts as NOT while a plus sign

Or you can search for your name in regular website content
with something like the following (see the table above for
information about whether your search engine of choice uses
or as the text-searching filter): intext:inbody<your name> intext:”<personal information like a phone
number or address>”
You can also search for information associated with the
IP address of your servers:
ip:[your server’s IP address] filetype:pdf*-<<+>> acts as AND.

You can search for your name in PDF documents with:<your name> filetype:pdf
You can repeat this search with other potentially relevant
filetypes, such as xls, xlsx, doc, docx, ods or odt. You caneven look for several different file types in one search:<your name> filetype:pdf OR filetype:xlsx OR filetype:docx

Osearch terms tells the search engine to return

R E S O U R C E S

ht ps:/ w w.bruceclay.com/blog/bing-go gle-advanced-search-operators/-Advanced Search Operators for Yahoo, Bing and
Google/ By Bruce Clay Inc.

https://es.wikipedia.org/wiki/Google_Hacking-Googlehacking tips/ From Wikipedia.
https://help.duckduckgo.com/duckduckgo-help-pages/results/syntax/

https://help.duckduckgo.x/-DuckDuckGo/ How to use advanced syntax.

https:/ www.lifewire.com/bing-advanced-search-3482817

hvestigative_Onli-Bing
Advanced Search Tricks You Should Know/

Article by Tim Fisher, Lifewire.

https:/ ahrefs.com/blog/google-advanced-search-operators/

- Google Advanced Search Operators, the Complete
List/

By Joshua Hardwick, Ahref.com.

https://www.exploit-db.com/google-hacking-database?category=8

For more examples, have a look at Exploit Database’s list of Files Containing Juicy Info.

V E R I F I C A T I O N
ht ps:/ kit.exposingtheinvis ble.org/en/investigation-concepts.html#if-its-not-verified-its-not-valid

Don't take anything for granted and question your own assumptions.Information
can take various forms and appear on various mediums. Images, videos, sound,
written testimonies and webpages are just a few. For each medium there aretools, techniques and tricks that help with the process of verification.
You do not need to learn everything about every medium before you startinvestigating. There will be plenty to discover as you go along, and you will
also be able to learn through practice: It helps to always start with thefollowing question:

WHAT DO YOU KNOW WITH 100 PER CENT CERTAINTY?
IF IT’S AN IMAGE
Do you know who took it? When was it taken?
On what camera? In what place? How do you know
it hasn’t been modified? Could anyone try to
mislead you by providing this image?
Can you truly confirm that subjects and events
shown in an image are from the specific day,time, place and incident you are investigating?
Is the issue contentious? Are there sides thathave something to gain by spreading this information?
There could be groups spreading false information
hoping that someone might give them attention
without checking.
It is important to save and archive theinformation as soon as you find it
Before verifying, download the photoor video and take a screenshot of the post (if itappeared on a social media, a website or a messaging
app for instance). Its author could delete it ifthey realize they made a mistake or noticethat they have been exposed

To delve into verification techniques
You can consult the following resources:-Verification
Handbook,ficatiedited
https://datajournalism.com/read/handbook/veri
on-1 by Craig Silverman.

-9 tools for verifying images, de Ijnet
https://ijnet.org/en/story/9-tools-verifying-images

https:/ exposingtheinvisible.org/en/guides/behind-the-data-metadata-investigations/
-Behind the Data: Investigating Metadata,
de Exposing the Invisible.

https:/ kit.exposingtheinvisible.org/en/fact-checking.html

-Get Your Facts Straight: The Basics ofFact-Checking, by Deepak Adhikari. A guide from

Exposing the Invisible: The Kit, Tactical Tech.

Important tools that help you retrieve historicalonline content, and archive online content
for future reference are:https://archive.org/

The Internet Archive: The world's largest digital archive,
allows you to search and retrieve previously archived content.

https://web.archive.org/
https://archive.vn/

WayBack Machine: An Internet Archive tool that allows you to
manually save and archive web pages online and retrieve
archived websites. It has some shortcomings with archiving
and displaying images and graphics from webpages but it cantake screenshots of such pages if you manually select theoption when saving specific webpages.
Archive Today: An online tool for archiving and retrievingarchived online content. It works similarly to Wayback Machine
and it automatically takes screenshots of webpages, thus images
and graphics are easier to preserve. Unlike Wayback Machine,
Archive Today saves snapshots only on demand, meaning webpages
that people preserve manually.

IF IS INFORMATION
There are three main phases ofverifying information:
THE SOURCE:Where you got the
information and where it originated.
THE CONTENT: Whether it is exactly
what it claims to be.
ITS RELEVANCE: Whether it fits in to
your investigation.

ARCHIVING ONLINE CONTENT
Websites get taken down, webpage contents change
and valuable links break causing you to lose
track of information you might have seen online
in the past. Fortunately, there are some easy
ways to retrieve old online content and deleted
webpages so you can still use them in yourresearch. Various methods and tools allow you
to also save currently accessible pages so you
can access them later, even if they get modified
or deleted at some point in the future.
There are several services that automaticallyarchive older versions of websites. In addition
to content, these digital archives often contain
information that can help you identify otherimportant data, such as the owner of a website,
useful names, contact details, documents, andlinks to other websites.
Some of these services allow you to contributeto the list of websites they archive by manuallysaving webpages at a time of your choice, so you
and others can retrieve copies and screenshotsof those webpages and websites later.

For an overview of how to archiveand retrieve archived content on theinternet, read the guide"Retrieving and Archiving Informationfrom Websites" from Exposing theInvisible: The Kit.

https:/ kit.exposingtheinvisible.org/en/web-archive.html

G E O L O C A T I O NThere are plenty of guides and tutorials for learningand practicing how to geolocate photos and videos, andto identify and verify images from a specific location
or event. The following are a good starting point:

https://kit.exposingtheinvisible.org/en/geolocation.html

Geolocation Methods: A step-by-step guide, Exposing
the Invisible Kit.

https:/ exposingtheinvisible.org/en/guides/geolocating-images-suncalc/More than Meets the Eye: Geolocating Images Using
Creativity and SunCalc, by Robin Taylor, Exposing
the Invisible.

https://factcheckingday.com/articles/31/how-to-geolocate-a-video-or-image-in-5-steps
https:/ www.bellingcat.com/resources/how-tos/2014/07/09/a-beginners-guide-to-geolocation/

Geolocate videos or images in 5 steps,by the International
Fact-checking Network.
Beginner's guide to video geolocation ,by Eliot Higgins,
Bellingcat.

Quick reference guides to verify videos, First Draft News.
https://firstdraftnews.org/wp-content/uploads/2017/03/FDN_verificationguide_videos.pdf

https:/ www.bellingcat.com/resources/2020/12/03/using-the-sun-and-the-shadows-for-geolocation/

Using the Sun and the Shadows for Geolocation, by Yourivan der Weide, Bellingcat.

https:/ www.bellingcat.com/resources/how-tos/2017/06/30/advanced-guide-verifying-video-content/
https:/ www.bellingcat.com/resources/how-tos/2017/10/17/conduct-comprehensive-video-collection/

Advanced guide to verifying video content, by Aric Toler,
Bellingcat

Geolocation involves plenty of observational
capacity to identify the location of photographs
and videos, patience and some research skills
to identify keywords and image elements tosearch for in order to identify possible
locations. While searching, we can resort
to a variety of free online tools to geolocate
events and places such as:

https:-Open/ www.openstreStreet
etmap.org/#map=4/Map-40.44/-63.59
-Overpass Turbo
https://overpass-turbo.eu/
-GoogleEarthons/#earth-pro
Pro
https://www.google.com/earth/versi

How to carry out a comprehensive video collection,
by Aric Toler, Bellingcat.

https://kit.exposingtheinvisible.org/es/maps.html

Using maps to see beyond the obvious, by Alison Killing,
Exposing the Invisible Kit.

Analysing And Preserving Metadata

Tools to view, verify or edit image metadata
Phil Harvey’s Exiftool: https://exiftool.org/ Metadata viewer andeditor available for download and use on your own computer. Apartfrom reading metadata, this tool allows you to read, write andedit metadata from photos and videos. It is safer to use when
dealing with sensitive material, as opposed to uploading yourimages online for metadata viewing.
Image Verification Assistant:
https://mever.iti.gr/forensics/index.html/ A tool for image
verification on the web.
Fotoforensics: https://fotoforensics.com/ Online image analysis
tool, for metadata checks and information on whether an image has
been altered (watch out when uploading images for checks – do not
do so if using sensitive material or trying to stay digitally
undetected.)

Metadata is information that describes
properties of a file, be it image, document,sound recording, map etc. For example thecontents of an image are the visible elements
in it, while the date the image was taken,
the location and device it was taken on, arecalled metadata.
Metadata (of photographs, videos, documents
and other types of files) can be easily
altered and is thus vulnerable as evidence
since it’s not always easy to prove, verify
and 100% confirm its reliability when it
comes to the original source, or other details
such as date or time.
Below are some tools that can help view,
verify, edit or safely record and preserve
original image metadata

R e v e r s e i m a ge search tools to try
a n d i d e n t i f y the source of an image

R E S O U R C E S

https://exiftool.org/

Tools to safely capture, preserve and share metadata

TinEye: https://tineye.com/

of your images to use as evidence:https:/ guardianproject.info/archive/camerav/

Google Images: https://www.google.com/imghp?hl=en-EyeWitness: https://www.eyewitness.global/
Recording app to capture verifiable photo andvideo documenting abuses.

Yandex Images: https://yandex.com/images/
InVid https://www.invid-project.eu/, a browser extension that
divides a video into key frames, with which you can perform
reverse image searches.

https://www.eyewitnessproject.org/

-Save: https://open-archive.org/save
App designed to help you store and share mobile
media while ensuring your identity remains
protected. Free, open-source, and available for
iOS and Android

YouTube Data Viewer: https://citizenevidence.amnestyusa.org/,
which allows you to access the date and time when a video has
been uploaded to YouTube for the first time.

WARNING

https:/-BingMaps
www.bing.com/maps/?cp=-36.021891%7E-60.014191&lvl=11.0
-HereWeGo.
https://wego.here.com/?map=-34.60849,-58.37344,10,omv

ht ps:/ open-archive.org/save/

Be careful when uploading images to the web forverification. It is not recommended to upload compromising
images or if you intend to maintain digital anonymity.

-Proofmode: https://proofmode.org/
App that turns your photos and videos into secure,signed visual evidence.

https://kit.exposingtheinvisible.org/es/maps.htm

See more about using maps in investigations in the guide "Using maps to see beyond the obvious",
by Alison Killing, in Exposing the Invisible: The Kit.
https://kit.exposingtheinvisible.org/en/

https:/ revistacrisis.com.ar/autores/equipo-de-investigacion-politica-edipo

Content prepared by EdIPo (Equipo de Investigación Política)
at Revista Crisis (Argentina). With the support of Tactical Tech
June- July 2023

https://revistacrisis.com.ar/

Published under Creative Commons (CC)cc

https://creativecommons.org/licenses/by-sa/4.0/.

License Attribution-ShareAlike4.0
Internacional (CC BY-SA 4.0)

ht ps:/ cdn.t c.io/s/exposingtheinvisible.org/media20/article/InteligenciaAbierta-article-EdiPo-2023-es.pdf
Translated from Spanish, and adapted by
Exposing the Invisible, Tactical Tech.