Investigation is a mindset. Get started.
kit.exposingtheinvisible.org

—

EXPOSING THE INVISIBLE

2

THE KIT - AN INTRODUCTION

6YOU ARE ALREADY AN INVESTIGATOR

10WHAT MAKES AN INVESTIGATION

20SEARCH SMARTER BY DORKING26

RETRIEVING AND ARCHIVING INFORMATIONFROM WEBSITES34

HOW TO SEE WHAT’S BEHIND A WEBSITE

42

USING MAPS TO SEE BEYOND THE OBVIOUS

52

AWAY FROM YOUR SCREEN, OUT IN THE FIELD

60

INTERVIEWS: THE HUMAN ELEMENTOF YOUR INVESTIGATION68

HOW TO MANAGE YOUR SOURCES74

SUPPLY CHAIN AND PRODUCT INVESTIGATIONS

82

SAFETY FIRST!

90

GLOSSARY

95

CREDITS
1

—
THE KITThe Kit is a collaborative, self-learning
resource that makes investigative techniques
and tools used by experienced investigators
more accessible.

2

What is the Kit?
The Kit is a collaborative, self-learning resource that makes investigativetechniques and tools used by experienced investigators more accessible
to people and communities who feel motivated to start their own
investigations, collect and verify information, build evidence andcreate a better understanding of issues without losing sight of ethicalor safety considerations. The aim is to help people develop the ability toquestion information that they suspect is false, find information when it isscarce and filter information when it becomes overwhelming.
Here you can explore tools to access websites that have been removed
from the internet, content that does not appear in search engines ordata from videos and images that would otherwise remain invisible. You
will discover ideas on how to approach investigations into companies
and public funds or to find out how products you use and consume
were made, and what abuses might have happened along the way. You
can figure out how to use maps to investigate places and events, or how
to prepare for field research. You will get tips about talking to people
and observing places, assessing risks, collecting and using information
safely and ethically, and making sure that you and others involved canstay out of harm’s way. You will also see how to approach data from
unexpected entry points or discover information resources and tools
you didn’t know about.

This publication is a condensed version of the Exposing the Invisible Kit.
The complete kit is available online: kit.exposingtheinvisible.org

3Who is the Kit for?
The Kit is meant for everyone. It does not matter what skills you may
or may not have; it does not matter if you are just thinking of startingyour first investigation or if you have already carried out several. As
long as you have questions and curiosity, this is the kit for you.
This kit is issue-agnostic. It is not intended only for those who arechallenging corruption or abuses of power. We believe that change
happens all the time and everywhere. Neither the scope nor the scale ofyour investigation matters. Spending some time here will be worth yourwhile even if all you are challenging is your own assumptions. This ismeant to be a place where you can refine your thinking and determine
how to go about your work in a thorough, step by step manner.

Who is behind this kit?
Tactical Tech launched the Exposing the Invisible project in 2010 with
one simple goal: to showcase investigations that are sometimes outside
the realms of journalism and law enforcement. Since then, we havemade a number of documentary films, recorded hours of interviews,
collected and analysed tools and tactics, run numerous trainings andworkshops and hosted two larger events – a Data Investigation Camp, in
2017, and a ‘Kit’ Residency one year later, which gave us a starting point
for this resource. Both the concept and the content of this kit owe much to
many. Please visit the Credits section for more details.

The Kit is a resource of Exposing the Invisible (ETI):
exposingtheinvisible.org

THE KIT

45

—YOU ARE ALREADY AN INVESTIGATORThis kit will show you how to move fromcuriosity to investigation to action.

6

So you’re here
You are already an investigator. That is why you are here. You have thecuriosity, or the skills, or a problem that needs solving. You need togather information, or you’ve already found information and you want toknow how to use it.
The content of the online version of this Kit is being developed collectively
by a group of researchers, activists, journalists, developers, artists andothers eager to share knowledge on how to conduct investigations using awide range of skills, tools and techniques. Like you, they are curious andmotivated to learn about problems affecting their surroundings and to act
on that information.
Using this kit, you will uncover different ways to build knowledge that canhelp you address an issue or simply to verify information instead of taking
it for granted. Whether you are seeking to uncover corruption in local
politics, document the manufacturing process of a product you consume,or map the scale of environmental damage in your neighbourhood, here
you will find inspiration, useful techniques and important safety tips.
Investigating is like putting a puzzle together. The pieces are scatteredaround; some of them might be lost. You still want to find out what the
big picture looks like, and you don’t need all the pieces for that. That’s
what we want to show you here: how to collect relevant pieces, put them
together and draw meaning from that incomplete picture.

Investigation is a mindset
An investigation is a process of collecting and analysing informationfrom different sources and drawing conclusions that address an initialquestion, problem or assumption. This process allows you to build abody of knowledge about a person of interest, an organisation, a place,an event, a crime… you get the idea.
Investigations serve a clear purpose: it might be seeking the truth,
understanding a pattern or creating – or countering – a narrative. The
key to fulfilling that purpose is turning a body of knowledge into a bodyof evidence, an unbreakable proof, by interpreting and giving meaning
to that knowledge. The process of setting your purpose, gathering
information and extracting meaning is the central structure of
any investigation.
7

Investigations are often non-linear, iterative processes. They involvea certain mindset to approach questions from different angles andwith various tools and techniques. Be ready to rethink your strategies
along the way if your current path reaches a dead end. You may
need to consider alternative methods to interpret the same piece of
information or search elsewhere for additional evidence that refines
your understanding of the picture you’re putting together.

Risks and rewards
As you start investigating you really don’t know what you will find out
there, so be cautious and aware. There may be safety concerns, legalrisks or unexpected situations such as encountering challenges that go
beyond your skills and abilities.
Before diving in, be mindful of your own safety and the risks involvedin whatever tools, information sources and techniques you want to use.
Consider the technology and devices that are most suitable for each
investigation you plan and be aware of the physical environment youlive and work in. Just as you can find traces of events or individuals thatyou are investigating, your own research can leave traces that can put
you, your collaborators and your sources at risk.
Think of whether you need to work alone or collaborate with others,
and whether you can find alternative ways of obtaining evidence if yourinitial plan seems too risky. Of course, you can’t predict everything, andeach investigative experience is unique in its own way.
But whether you are dealing with a low-tech environment, a conflict
environment or simply the internet, you should be able to assess therisks you take and identify possible solutions by following the tips andtechniques outlined in this kit.

YOU ARE ALREADY AN INVESTIGATOR

8This kit is yours
At a time when we are all saturated by data and confronted bymisinformation, it’s important on a personal and community level for
us to be able to identify sources of problems and counter misleading
narratives that are not based on facts and evidence. If facts are valuable
in order to keep us away from unfounded rumors, then the process of
uncovering and documenting these facts is also valuable.
The greater yourarsenal of tactics themore you are able togrow and apply yourinvestigative skills
beyond what you
are already doing.

Unfortunately, you can’t always rely on others to determine the facts foryou. Journalists, civil society organisations and others who investigate
for a living are often unable to keep up with the speed at which
misinformation and corruption currently spread and affect everyone.
Sometimes you need to find out answers for yourself and conduct yourown inquiries. Luckily, there is now an abundance of information of
public interest that can be collected from offline and online resources
with accessible tools and techniques. Also, for every techniquedeveloped to mislead you these days, there are more and more opensource tools and opportunities to verify or de-bunk.
This kit wants to take advantage of all these opportunities and amplify theinvestigator’s mindset. Whether you are just starting, or you already havesome experience, this resource can help you in many ways.

9—

WHAT MAKES AN INVESTIGATION

Look at the most important elements of aninvestigation: what makes good evidence, how
to develop a strong documentation process, thevalue of verification, and the key to a safe start.

10Building solid evidence
Throughout the kit, we use the generic meaning of evidence:
information that is material to the question, problem, person or process
you are investigating. There are legal definitions of evidence thatcan be much stricter, but this generic meaning serves more diverse
investigations.
Evidence provides you with the confirmation of a claim or assumption.
It is proof of something that happened, or of something that didn’t
happen. Interpreting and attributing meaning to information
you collect produces a body of evidence. It’s important to keep in mind
that not every piece of information is, or can turn into, evidence.
An investigation is a process of organised evidence collection, whichseeks to be as close to the truth as possible. The past leaves behind
residue: dust, footprints, documents, videos, audio recordings,
witnesses, scents, paperwork, the presence or absence of somethingthat was or wasn’t there before. Collecting evidence means finding andverifying these traces. While it’s impossible to recreate history, thesetraces of events, relationships, transactions or places can be linked toprove that your story is based in reality.
Identifying links between pieces of information will bring you closer
to the answers you seek, and the evidence to prove them. After all, youwant a solid, unshakable foundation for your investigation.

11

Your checklist for good evidence
Not all evidence is good or relevant. There are some qualities that
distinguish what is “good” and useful for your investigation. The best
way to make sure you are on the right path is to test the strength,
accuracy and integrity of your information, and to ask yourself a few
guiding questions.

Good evidence:is first-hand – information you find out yourself.
is documented and preserved – you can record and demonstrate
the process that led you to the evidence.
is timely – collected and verified close to the date of the event.
can be verified by others – someone else than you should be able
to confirm its source and content accuracy.
connects other pieces of information together – helps you build
the bigger picture.
includes metadata – more information beyond the content,such as details on its author, date, location.
doesn’t expose human sources to risk – ensures vulnerable people
are not harmed.
may contradict you – it turns your initial assumptions or beliefs
upside down.
speaks for itself.
Not every piece of evidence you discover will meet all these conditions.
That’s to be expected. But some of the evidence you find will meet a lotof them – those pieces are the ones you may want to prioritise.

WHAT MAKES AN INVESTIGATION

12Without documentation, it didn’t happen
Documentation means keeping track of every step you make, every
piece of data and evidence you collect with details such as what it is,where, when, why and how it was collected. Preserving this data in its
initial form and features is crucial for your investigation.
The primary goal of documentation is to create a verifiable recordof your investigation. Let’s call it ‘investigative hygiene’ – regular
maintenance of certain practices to ensure your investigation is healthy
and can stand up to scrutiny and criticism if anyone tries to dismiss
your evidence.
As you progress, documentation can help you remember prior conclusions or how you got leads or evidence that seemed useless before but
now seems important. You might also find things you forgot to follow up
on or problems you wanted to ask someone else to help with.
Your documentation habits are important if you intend to publish yourfindings, if you ever speak to law enforcement, if you pursue a caseto court or offer your evidence to human rights defenders who represent cases of crime and abuse. Also, should personal or professional
problems or changing socio-political conditions interrupt your work, it
will be easier for someone else to interpret it and take on the rest of theinvestigation or use the evidence you managed to uncover. These habits
are also useful if you end up collaborating with other partners.
While documentation is important, there are also risk factors. Your
investigation logs may benefit potential adversaries – for example,
someone determined to stop you from uncovering their wrongdoing – if
the information falls into the wrong hands. Documentation can also put
your sources at risk if it is not properly safeguarded.
It is crucial that you assess any potential risks at the start of and during
your investigation. You need to take your safety and that of your sources
seriously, as well as keep evidence and documentation safely, using
encrypted storage and devices to protect it from unwanted access.

13

Security in-a-box is a
Tactical Tech toolkit thatcovers essential
digital safety principles,
best practices and tools:
securityinabox.org

Make sure you always inform yourself about basic digital and physicalsecurity safeguards and learn about tools and skills you may need inorder to stay safe and keep your data stored securely. We willaddress such issues through The Kit but you can also start checking
available online resources such as Tactical Tech’s Security-in-a-Box(securityinabox.org) or the tips from Security Checklist (securitycheckli.st).
When working in particularly complex situations or environments, ask
trustworthy people to advise you or look for safety trainings you may beable to attend if you feel that any of the investigations you pursue may
pose even the slightest risk.

If it’s not verified, it’s not valid.
Verification is crucial not only in the media but for every one of us as
the quality and trustworthiness of information available today is being
challenged from multiple directions – from “fake news” creators andmisinformation trolls to ill-informed social media users who spreadnews without checking sources first.
Whatever the goals of your investigation, it’s important to be able todefend how you got to the information you are presenting as evidence. If
something in your investigation is proven not to be true, it undermines
your research and any narrative or conclusion you present.
Most of the investigation techniques in this kit can be used to uncoverevidence as well as to verify it.
There are different levels of evidence during an investigation. Whatever
path you follow, you’re always trying to get closer to the first-handevidence through techniques like verification. Here are some examples
of sources of information you may need to address and verify
throughout your investigations, listed from the less credible to themost credible ones :Word of mouth. A neighbour heard that members of a minority groupin your community are being denied service at a local authority. Thissounds more like a rumour for now, so you will need to get closer tothe facts.

WHAT MAKES AN INVESTIGATION

14

Expert statements. A researcher who has tracked this sort of denial ofservice to minority groups tells you it’s frequent. An expert statement
is a good way to start validating the information, but you still needto collect some first-hand information or find more sources saying
the same.
Second-hand accounts. You speak to people being denied this service.
You are getting closer to the actual facts, but any personal experienceand statement needs to be checked with other witnesses or existing
documentation, if available.
Research documents or reports. A report from a credible NGO
describes this occurrence based on interviews with directly involved
community members. Documents from such research bring you astep closer but just as with the expert statements, you still need tocorroborate them with witness accounts or at least another source
stating the same.
Official documents. An official report documents the denial-of-service
incident. Signed and dated official papers are very strong pieces ofevidence as you can identify the institution and people responsiblefor documenting the case and follow-up with them if you havequestions. Mind institutional bias, when an office may want to hidedata rather than expose the truth, especially if it incriminates them.
You have a good piece of evidence in your hands now but some
witness or expert statements will make it stronger.
Photos, video, audio. A recording exists showing the situation
occurring. This can be a treasure of evidence for you. If the images
and audio are real, they can be linked to the location, time andpeople involved in the incident. Watch out for image and soundmanipulation by checking EXIF data and metadata, verify the source
and the contents and do not use it as evidence without reaching out
to those involved to confirm its accuracy.
First-hand evidence. You are present while the situation occurs andmaybe you even manage to film the incident. This is first-handevidence and the strongest for your investigation. You have theopportunity and, at the same time, the responsibility to document theentire incident thoroughly. You also want to make sure you establish
contact with others involved to be able to confirm your observations
and evidence, should anyone doubt the accuracy of your investigation
later on.
15

When to verify
The short answer is always.
Verification is an iterative process. You have to keep doing it over andover again. The process is not only related to one piece of evidence you
uncover, but also to how all the pieces fit together.
Any new evidence you find may cast reasonable doubt on old evidence
that you may have already verified. That is why documenting yourevidence is important; so that you can retrace your steps and verify
again and again.

Challenges of verification
Your assumptions about the credibility of your human sources can
get in the way of proper verification if these assumptions are not true.
It is essential not to take anything for granted since even the mosttrusted and reliable of sources can sometimes get it wrong, even
if unintentionally.
Another challenge is finding creative ways of verification – to be readyto use sources of information in ways they were not intended. For
example, if you want to verify whether a public official was somewhere
despite him denying so, you may not only want to visit his social media
accounts, but also those of his relatives and friends to find clues ofmessages, comments and images that may confirm or deny that.

How to verify
There are three main phases of verifying information:
Verifying the source. Where you got the information and whereit originated.
Verifying the content. Whether it is exactly what it claims to be.
Verifying its relevance. Whether it fits in to your investigation.

WHAT MAKES AN INVESTIGATION16

In any investigation, you’ll collect information from many different
sources. Some will be obvious, while others may be less clear. You
could get an anonymous email, an envelope of documents, see a video
on social media or find a document on a random website. If there is
any question about the origin of that information, it’s important toverify where it came from - whether it was from the original source,whether it is from someone trustworthy, whether it is accurate or has
been fabricated or tampered with, and whether there was some motive
behind getting that information to you.
Information and evidence can take various forms and appear on various
mediums. Images, videos, sound, written testimonies and webpages are
just a few. For each medium there are tools, techniques and tricks that
help with the process of verification, and you will find many of them
explained in this kit. You do not need to learn everything about every
medium before you start investigating. There will be plenty to discoveras you go along, and you will also be able to learn through practice.
Complex guides to verification written by experts in the field are alsoavailable for you to check if you wish to go in-depth, for example,
the Verification Handbook (verificationhandbook.com), or the
Journalism, Fake News and Disinformation handbook by UNESCO(en.unesco.org/fightfakenews.)
In order to rigorously test your evidence and keep your biases in check,
you can document your research process and your findings and present
them to other investigators to confirm that it makes sense to someone
else. However, always make sure you trust those you are sharing
information with at any stage of an investigation and that you – and any
collaborators – are aware of ways to stay digitally and physically safe as
you communicate and share information.

17

Take care of your emotions
Over the course of an investigation you will have to deal with yourpersonal feelings, principles and values in addition to establishing yourmethodology, collecting and verifying information, building evidence,and so on. You will need to identify possible biases and also be careful
not to undertake more than you can handle emotionally. These concerns
are valid when working with any type of methods and resources, online
and in the field, or with human sources and interviewees.

Personal emotions
Mental health issues like extreme stress, depression and trauma
commonly affect investigators dealing with difficult topics.
Cumulative stress and the responsibility that you have for your subjects,
your colleagues, family, and yourself shouldn’t be underestimated.
It is okay to feel low and frustrated, and to seek the counsel of moreexperienced investigators.
Speak up, and find effective therapy options if you feel that yourinvestigation is taking a toll on you. Experiencing or hearing about
trauma or investigating corruption or injustice, for instance, may put a
lot of pressure on you. Often, investigators feel that people need themto keep investigating because they may need help right away. Thiscan produce a sense of responsibility and may even convince somethat taking the time to step back and deal with their reactions is aluxury they simply can’t afford. Investigators, activists, human rights
defenders, and many others who deal directly with issues affecting
people around them may often feel this way. This is also one of the main
factors that drives investigators to continue their work, so it might besomething that drives you, too.

Your self-care, just as your safety, should always come first. If yourcapacities are dwindling due to your state of mind, that will influence
your investigation. If at any moment you feel that you can’t cope, youhave every right to take a break or even let go of something that isharming your well-being. Moreover, even when you aren’t feeling thiskind of helplessness or stress, it’s good to take breaks once in a while
and to talk to others about how you feel. Look on the bright side andconsider that even when your investigations might not be as successful
as you want them to be, you are always trying.

WHAT MAKES AN INVESTIGATION

18

Bias
It’s natural to become emotionally involved with a story, particularly
as you speak to sources you sympathise with. Our unconscious biases
make us more interested in hearing some stories, and less interested
in others. You should accept that you cannot remain a completely
detached observer. But you should still strive to be mindful of yourbiases and seek to act in a fair and honest way as much as possible. Your
investigation may fail if you push a certain point of view at the expenseof others, or neglect important context due to your personal bias. Thiscan also damage your reputation and trustworthiness.

Start where you are
There is no point in starting your first investigation by experimenting
with a completely new or uncomfortable way of gathering information.
Just start with what you are good at.
With the availability of digital devices and numerous sources of
information on the internet, it is possible to conduct various tasks of aninvestigation from behind a desk. Digital investigations often mainly
involve desk research, but they can also include basic offline research,such as going to the library and archives, making phone calls or a
combination of all these.
For other investigations, pen and paper is a more appropriate approach.
A combination of traditional and new investigation techniques can bevery effective.
Some cases will require you to conduct your own field work to gather
evidence and verify it. Field research means that you identify and collectthe information first hand and it is your responsibility to document
it and confirm its accuracy. It can consist of recording testimonies,
gathering samples, observing events and places.
Whether you are conducting digital or field research, there areimportant safety measures you need to be aware of in order to reduce
the risks.
Knowing when to reconsider, ask for help, or set a project aside fora while if possible, is also a healthy attitude and asset to have as
an investigator.

19

—
SEARCH SMARTER BY DORKING

Support your investigation with advanced
internet searches by “dorking” across different
search engines.

20

When investigating, you need to gather as much information as possible
about a topic. Advanced search techniques can help to uncover files
or leads that are relevant to the questions you are trying to answer.
For example you may be able to find a company’s tax returns or a local
government’s expenditure reports – information that may not appear on
their websites or show up when you do a regular web search.
Google dorking has
been documented
since the early
2000s. Johnny Long,aka j0hnnyhax, was apioneer of dorking. He
first posted his definitionof the newly coined
term, googleDork, in
2002. Since then, its
meaning has evolved
to include other usages.

Google dorking (also known as Google hacking) is a technique usedby newsrooms, researchers, investigative reporters and others toquery search engines in order to find hidden information that might
be available on public websites. The technique can strengthen yourinvestigations by expanding your access to information that is of
public interest but that is not, whether by design or by accident,
readily available. Google dorking is also used by security auditors to
identify evidence of digital security vulnerabilities and flaws in online
services and publication platforms.
This technique can be used on most search engines, not just Google’s, so
we typically refer to it simply as “dorking.”
Dorking involves using search engines to their full potential tounearth results that are not visible with a regular search. It allows you
to refine your searches and dive deeper, and with greater precision,
into webpages and documents that are available online. Uncovering
hidden files and security flaws by dorking does not require a great dealof technical knowledge. It’s really about learning just a few searchtechniques and using them across a number of search engines.
All you need in order to carry out dorking is a computer, aninternet connection and a basic understanding of the appropriate
search syntax: keywords and symbols – sometimes called “operators”
or “filters” – that you can use to refine your search results. To do so
effectively, however, you may also need persistence, creativity, patienceand luck.
With great information access comes great ethical responsibility.
While you can use these techniques in a responsible manner to extend
your investigations, others can use them to obtain personal data or
exploit vulnerabilities. As is often the case, intentions matter.

21

Dork it yourself
In everyday use, search engines like Google, Bing, DuckDuckGo andYahoo accept a search term (a word), or a string of search terms, andreturn matching results. But most search engines are programmed toaccept more advanced “filters” or “prefix operators” as well. A filter isa keyword or phrase that has particular meaning for the search engine.
This includes terms like:inurl:
intext:site:
feed:language:On the next page is a list of the relevant dorks - as in search operators- we identified and tested as of March 2019 for Google, DuckDuckGo,
Yahoo and Bing. This list might not be exhaustive, but the operators
should help you get started.

SEARCH SMARTER BY DORKING

22

Dork

Description

GoogleDuckDuckGo

Yahoo

Bing

cache:[url]Shows the version of the web page from thesearch engine’s cache.

✓related:[urlFinds web pages that are similar to thespecified web page.

✓

info:[url]Presents some information that Google has
about a web page, including similar pages,
the cached version of the page, and sites
linking to the page.

site:[url]Finds pages only within a particular domain
and all its subdomains.

✓

✓

✓

✓

intitle:[text] or allintitle:[text]

Finds pages that include a specific keyword
as part of the indexed title tag. You must
include a space between the colon and thequery for the operator to work in Bing.

✓

✓

✓

✓

allinurl:[text]

Finds pages that include a specific keyword
as part of their indexed URLs.

meta:[text]

Finds pages that contain the specifickeyword in the meta tags.

filetype:[file extension]

Searches for specific file types.

✓

✓

✓

✓

intext:[text], allintext:[text],
inbody:[text]

Searches text of page. For Bing and Yahoothe query is inbody:[text]. For DuckDuckGo
the query is intext:[text]. For Google either
intext:[text] or allintext:[text] can be used.

✓

✓

✓

✓

inanchor:[text]

Search link anchor text✓

location:[iso code] or
loc:[iso code],
region:[region code]

Search for specific region. For Bing use
location:[iso code] or loc:[iso code] and for
DuckDuckGo use region:[iso code].An iso
location code is a short code for a country
for example, Egypt is eg and USA is us.
https://en.wikipedia.org/wiki/ISO_3166-1

contains:[text]

Identifies sites that contain links to filetypes
specified (i.e. contains:pdf)✓

altloc:[iso code]

Searches for location in addition to one
specified by language of site (i.e. pt-us or
en-us)

✓

✓

✓
✓

✓

feed:[feed type, i.e. rss]

Find RSS feed related to search term✓

hasfeed:[url]Finds webpages that contain both the termor terms for which you are querying and one
or more RSS or Atom feeds.

✓

ip:[ip address]

Find sites hosted by a specific ip address

language:[language code]

Returns websites that match the searchterm in a specified language

book:[title]

Searches for book titles related to keywords✓

maps:[location]

Searches for maps related to keywords✓

linkfromdomain:[url]Shows websites whose links are mentioned
in the specified url (with errors)

✓

✓

✓
✓

✓

✓

✓

✓

✓

23

Defensive dorking
You can use dorking to protect your own data and to defend websites
you are responsible for. We call this “defensive dorking,” and it typicallytakes one of two forms:
Checking for security vulnerabilities in an online service, such as a website
or an FTP server, that you administer; or
Looking for sensitive information about yourself - or about someone else,with their permission - that might be exposed unintentionally on a
website, regardless of whether or not you administer that website.
For the first instance, The Google Hacking Database (GHDB)(exploit-db.com/google-hacking-database) suggests various keywords
and other terms that you can use - along with the “site:yoursite.org”
filter in order to identify certain vulnerabilities. While these searches
may help attackers locate vulnerable services, they also help
administrators protect their own.
For the second instance, we recommend starting with the following
simple commands, along with the “site:yoursite.org” filter. You canthen remove the “site:” filter to discover which other websites might be
exposing information about you or your organisation. Below are a
few examples.
You can search for your name in PDF documents with:<your name> filetype:pdf
You can repeat this search with other potentially relevant filetypes, suchas xls, xlsx, doc, docx, ods or odt. You can even look for several different
file types in one search:<your name> filetype:pdf OR filetype:xlsx OR filetype:docx

SEARCH SMARTER BY DORKING24

Or you can search for your name in regular website content withsomething like the following:<your name> intext:“<personal information like a phone numberor address>”
See the table for information about whether your searchengine of choice uses intext: or inbody: as the text-searching filter.

Visit the Kit for the complete guide “Search Smarter by Dorking”
by Gabi Sobliye:
kit.exposingtheinvisible.org/how/google-dorking.html

25

—
RETRIEVING AND ARCHIVING INFORMATIONFROM WEBSITES

You can find and retrieve historical and‘lost’ information from websites to serve
as evidence that something existed online, as
well as archive and preserve your own copies
of webpages for future reference.
26

Sometimes, when you want to verify online information, you’ll end up
following a trail that leads to broken links or to websites that are nolonger available. Other times, when you revisit a website, you may
find that a specific webpage you remember has been removed or that
information you need is no longer accessible and has been replaced withnew content.
What if there were some way to travel back in time and get a copy of thatwebpage, or even a portion of it, before it was altered or taken down?
Luckily, there are some easy techniques and digital archiving tools andservices to help retrieve old content and deleted pages so you can stillreference them in your investigation. Apart from this, digital archives
often contain information that can help you identify other importantdata such as the owner of a website, useful names, contact details,
documents and links to other sites.
Some of these tools allow you to contribute to the list of websites theyarchive by manually saving and preserving webpages at times of yourchoice. You and others can then retrieve snapshots of those websites
later on.

Archiving and retrieving content with theWayback Machine
The Wayback Machine (archive.org/web) is a project of Internet Archive(archive.org), a digital library dedicated to preserving billions ofwebsites since 1996, as part of an effort to archive the internet andprovide universal access to all knowledge. The Wayback Machine is an
essential tool for researchers, historians, investigators and scholars. It isfreely available to the public and can help you access archived snapshotsof webpages taken at various points in time.
The Wayback Machine uses automated crawlers (also called ‘spiders’)to access and archive virtually any public website. These crawlers don’t
have a fixed pattern of deciding which websites they visit and how often
they do so. As a result, you may not always find an archived version
from a specific day, month or even year. Nevertheless, the Wayback
Machine’s vast trove of data will likely be indispensable in many ofyour investigations.

27

Apart from offering a simple interface for retrieving automaticallyarchived websites, the Wayback Machine also allows you to manuallystore snapshots of webpages so you can make sure they do notsuddenly disappear from the internet.

While it is often a good idea to save HTML or PDF copies ofimportant webpages to your own devices to make sure that you havemultiple back-ups, archiving them with the Wayback Machine can add
an element of neutrality and trust if you end up sharing those archives
with others. It is also far more convenient, for most people, thanmaintaining an offline library of digital files.
Looking up pages with the Wayback Machine
In order to find a page that is no longer accessible, or to view an older
version of a webpage, simply go to web.archive.org and enter the web
address that you are searching for.
If the page was previously archived, the dates when it was saved
will appear on a calendar of the current year. You can navigate toprevious years using the timeline, which also displays a graph of how
often the page was archived each year. After clicking on the year you
are interested in, archives from that year will be marked on the calendar
with colour-coded dots.
Try searching for cambridgeanalytica.org, a website that was taken
down in 2018 due to the closure of the company.

Screenshot of theWayback Machinecalendar to accessCambridge Analytica’s
websiteRETRIEVING AND ARCHIVING INFORMATION FROM WEBSITES

28

A blue dot indicates that a full webpage capture took place on that date.
These are usually the archives you are looking for. A green
dot indicates that, when the crawler accessed that web address, it was
automatically redirected to another page on the same website. Thesearchives might not contain the content you are searching for. Orange
and red dots indicate that an error occurred during thearchiving process, so you will not find much information there.
After you select an archived version of the page, the Wayback Machine’snavigation bar is displayed at the top of the screen. This allows you tobrowse between different archives of that page by using the timeline orby clicking on the “next” and “previous” buttons.

Using the Wayback Machine to archive webpages
Another key feature of the Wayback Machine is its ability to archive
webpages on demand. Whether you are looking to save and preserve
information for an investigation or ensure the accessibility of your own
published work, you can navigate to archive.org/web and find the “Save
Page Now” form toward the lower, right-hand corner of the page. Simply
enter a web address (say “www.yoursite.com/projects”) and click the“SAVE PAGE” button.
Unless the website you enter has denied access to the Internet Archive’s
crawlers, the Wayback Machine will begin archiving it. You will see a
progress bar that will let you know when the page has been saved. Atthat point, you will be able to view the page’s archive, and a timeline will
display any previous captures from that site.

The SAVE NOW steps will only archive the page you submitted(“www.yoursite.com/projects”, in this case) not all of thecontent on that website. If you want to archive an entire website using
this method, you will need to submit each page separately.
Furthermore, this feature does not guarantee that regular archives ofthe page will be captured in the future, so you might want to revisit theWayback Machine from time to time to request additional snapshots.

29

Limitations of the Wayback Machine
The Wayback Machine has other limitations as well. Examples include:
Password-protected websites are not archived.
Dynamic websites that rely heavily on JavaScript may not bearchived properly.

Robots.txt - a file on a
website that instructs
automated programs(bots/robots/crawlers)
how to behave with dataon the website.

Website administrators can explicitly request that their sites not bearchived, either by publishing a restrictive robots.txt file, or by sending a
direct request to the Internet Archive.
Website administrators can request that previously archived content be
removed from the Wayback Machine.
There is currently no full-text search available on the Internet Archive.
In the European Union and a few other regions, The Right To Be Forgotten
legislation provides individuals with the option to request that searchengines and digital archives remove indexed content related to them,which they deem harmful or libelous. This right has limitations so noteverything can or will be removed upon request but it is worth keeping
in mind that some subjects of your investigation (politicians, criminals
and other controversial figures) could be using the opportunity totake down internet content related to them that is relevant to yourinvestigation.

RETRIEVING AND ARCHIVING INFORMATION FROM WEBSITES

30

Other ways to retrieve and archive webpages
Archive.today
Archive.today (archive.fo; formerly archive.is) archives web pages much
like the Wayback Machine. It differs, however, by only storing individual
pages, rather than entire websites, and it does so only at the request of
its users, not automatically.
Since it doesn’t crawl sites, it doesn’t have the breadth of information
you can find on the Wayback Machine. It does provide three key
features, however:First, unlike the Wayback Machine, it allows you to search the full text
of its archives.
Second, it ignores any restrictions that might be specified in the
robots.txt files of the websites that it archives. As a result, it can save
snapshots of some pages that the Wayback Machine cannot, such as
public Facebook profiles and Twitter posts.
Third, it also saves both a text copy and a graphical screenshot of
the archived pages. This sometimes provides greater accuracy thansaving the page itself, especially when archiving content that changes
rapidly (such as rolling images or snapshots of forum messages, etc.).
Like the Wayback Machine, archive.today provides you with direct
links to the archived content using web addresses with embedded
date stamps.

When you archive a webpage with a service like the Wayback Machineor archive.today - especially if it has a long, complicated web address
like an archived copy of a Google Cache entry - be sure to record thatarchived link somewhere in a file on your computer, in a secure cloud
folder or elsewhere. Relying on your browser history to find such things
is a recipe for disaster.

31

Visual site monitors
Another option to retrieve website contents and to stay updated if any
changes occur is to use visual site monitors. These are services that can
track and monitor visual changes in webpages, whether they happen incode, images, text etc. They can be very useful for researchers and help
automate some of the work if you need to monitor many websites thatare useful in your investigation.
Visual site monitors archive webpages in a different way than
the tools and services we explored above. You give the service aparticular section of a webpage to watch, and it takes a snapshot, thenmonitors the page for visible changes. If there are any changes, big or
small, the site monitor will send you an email to let you know.
Useful visual site monitors we can recommend are:
Visual Ping (visualping.io) - offers a free plan that allows you tomonitor up to 62 webpages a month. The free version can run checks
hourly, daily, weekly or monthly to compare a webpage with its
previous versions and alert you by email when modifications in text,
images, keywords or any selected page areas take place. It also works
via the Tor Browser and we recommend using this option for an extra
layer of privacy and security.
Change Tower (changetower.com) - offers a free plan that monitors
up to three websites and conducts up to six checks per day. It canmonitor a specific URL (webpage), an entire website or different
variations. It can search for changes in content (text), visual content,
html, keywords etc. The free plan stores your monitoring results for
up to a month. It also works via the Tor Browser.

Visit the Kit for the complete guide “Retrieving and Archiving
Information from Websites” by Wael Eskandar and Brad Murray:
kit.exposingtheinvisible.org/how/web-archive.html

RETRIEVING AND ARCHIVING INFORMATION FROM WEBSITES

32

33

—
HOW TO SEE WHAT’S BEHIND A WEBSITE

Tools and techniques you can use to investigate
the ownership of websites and uncover hidden
information online.

34

On the surface, websites look like they’re designed to make information
available to the public. However, there is plenty of valuable information
hiding behind what you are able to see in your web browser.
Sometimes it is important to research hidden data: to identify theindividuals or companies that own a domain name or maintain a
website, to determine where that site was registered or to dig up
content that it once contained but that has since been removed. Doingso is not always straightforward. For example, people who do notwant to be associated with a website’s content, or with the affiliatedbusiness, sometimes try to hide their connection to the site by using
intermediaries when they register its domain name.
Finding hidden content and connections is not an exact science but it
requires a combination of acquired skills, a set of methods and tools anda good dose of perseverance.

A website and its elements
To investigate a website effectively, you will need to know what goes into
one: from elements that are immediately visible to visitors to others thatexist beneath the surface.

Websites and webpages
A website is made up of webpages that display information, whichanyone with internet access and a web browser can see. That
information might include the profile of a company, a description of a
product, a collection of photographs, or just about anything else. From
another perspective, however, a webpage is really just a digital file that isstored on a disk that is attached to a computer that is plugged into powerand connected to a network cable somewhere in the physical world. It
helps to keep this in mind when investigating a website.

IP address
To visit a website, your device needs to know the Internet Protocol
address, or IP address, of the computer that hosts it. Hosting a website
means making it available to the world; the computers responsible fordoing so are often called servers.

35

An IP address is typically written as a series of four numbers,
separated by periods, each of which ranges from 0 to 255. For example:
172.217.16.174 is the IP address of one of the servers that hosts the“google.com” website, at which visitors can access Google’s searchengine.
At any given time, each device that is directly connected to the internet- be it a webserver, an email service or a home WiFi router - is identified
by a particular IP address. This allows other devices to find it, to request
access to whatever it is hosting and, in some cases, to send it content
like search terms, passwords or email messages.

Domain nameLike most long numbers, IP addresses are difficult to remember, so
we tend to use domain names instead. Each domain name points toone or more IP addresses. In the example above, the domain name“google.com” points to 172.217.16.174 and is far easier for most people
to remember.

Domain registration, registrar and registrant
Domain names are unique. There can only be one “google.com,” forexample. The process of purchasing a domain name is called domain
registration. When someone registers a domain name, a record iscreated to keep track of that domain’s official owner and administrator,or their representatives.
A person who registers a domain is called a domain registrant. Thatregistrant - or someone to whom they give access - can then point their
domain to a particular IP address. If a webserver is listening at that IP
address, a website is born.
The companies that handle the registration process are called domain
registrars, and they almost always charge a fee for their services. These
companies are required to keep track of certain information about eachof their registrants.
A non-profit organisation called the Internet Corporation for Assigned
Names and Numbers (ICANN, icann.org) governs the domain
registration process for every website in the world.

HOW TO SEE WHAT’S BEHIND A WEBSITE

36

Web host
We know that a website has a domain name and that a domain nameis translated into an IP address. We also know that every website is
actually stored on a computer somewhere in the physical world. The
computer that hosts the website is called a web host.
There is an entire industry of companies that store and serve websites.
They are called web hosting companies, they have buildings filled withcomputers that store websites, and they can be located anywhere in
the world. While it is most common for websites to be hosted in “datacentres” like these, they can actually be hosted from almost any device
with an internet connection.

Basic WHOIS look-up
When researching a website, one of the most useful sources of data canbe found in its domain registration details.
Over the course of your investigation, it might be relevant to know
who registered or who owns a particular domain (whether it is anorganisation or an individual registrant), when it was registered and bywhich registrar, as well as other details. In many cases, this information
can be accessed through third-party services that are detailed below.
Sometimes the owner of a domain would not want to appear as linked
to the site (whether to conceal something or simply to protect privacy),
so it’s worth noting that domains can be registered through proxyor intermediary organisations that conceal the full details of theregistration.
The information collected from domain registrants is called WHOIS
data, and it includes contact details for the technical staff assigned to
manage the site, as well as contact details of the actual site owner ortheir proxy.
There are many services that provide useful WHOIS data for free or for afee. Here are a few we recommend:
who.iswhois.com/whois
godaddy.com/whois
whois.domaintools.com
iana.org/whois37

As different search engines return different results for thesame query depending on their indexes and algorithms, it may bethat searching with different WHOIS query services returns varying
amounts of detail about your domain of interest. Checking withmultiple sources whenever possible is therefore a good way to makesure you collect as much information as possible, as is standard inany part of an investigation.
GDPR implications for access to WHOIS data
The European Union’s (EU) General Data Protection Regulation (GDPR)
was adopted in 2018 across the EU to safeguard the privacy of citizens’
personal data. This affects the status of public WHOIS registries in the
EU because in theory, WHOIS data of owners and administrators of
EU-registered domains should not be collected and published byregistrars. Under the GDPR, this is considered to be private information.
There is still a large grey area around applications of GDPR by EU
domain registrars, including some ongoing court cases, but as of 2019some still provide data while others restrict it. Paid services such as
domaintools.com still provide useful information that is based on
historical records.

Historic WHOIS
Historic data can be a useful tool when investigating websites, because it
can track the transfer of a domain’s ownership. It can also help identify
owners of websites who have not consistently chosen to obscure theirregistration data by using a WHOIS privacy service.
Several services offer access to historic WHOIS records, though theserecords may often be restricted to non-EU countries due to the GDPR, as
mentioned above.
DomainTools (research.domaintools.com/research/whois-history)- perhaps the best-known of these companies that offer historic
hosting and WHOIS data. However, it is a paid service that requires
you to register for a membership in order to access it.
Whoisology (whoisology.com) - a good alternative to Domain Tools
that also provides historical WHOIS data. It requires you to createan account for basic free services, as well as advanced fee-based
services.

HOW TO SEE WHAT’S BEHIND A WEBSITE

38

Reverse WHOIS look-up
When you look up the domain names registered to a certain email
address, phone number or name, it is called a “reverse WHOIS look-up.”
Several tools and services offer these kinds of searches.
When trying to locate
Here are some tools you can use for reverse searches:the owner of a domain
name, focus on locating
ViewDNSinfo (viewdns.info/reversewhois) - free and allows searches
information that canhelp you “reverseby email or phone number. It also provides other useful options
search” back to ansuch as searching by an individual or company, historical IP address
ultimate owner, suchsearch (historical list of IP addresses a given domain name has been
as a phone number,email or location.
hosted on as well as where that IP address is geographically located).

Note that IP address owners are sometimes marked as ‘unknown’ so
it helps to use several websites for your searches and combine theresults for a fuller picture.
Domain Eye (domaineye.com/reverse-whois) - requires creating
an account and provides you with 10 free searches per day.
Domain Tools (reversewhois.domaintools.com) - a useful service
but it doesn’t provide any free options for reverse WHOIS as of 2019.

39

Finding information with shared hosting and reverse IP search
Websites are hosted on one or more servers, or computers runningserver applications that transmit the site’s content to visitors.
Because web hosting costs money, related websites will often share
hosting. Analysing the other domains sharing the same hosting service
can sometimes shine a light on the owner or administrator of thesite you are investigating.
You can use the IP address to see which other sites are hosted on thesame server, and then further verify whether some of them might berelated. Some of the tools you can use to to identify shared hosting are:
ViewDNSinfo (viewdns.info/reverseip) - you can search for adomain name or IP address.
Bing IP search (www.bing.com) - add the prefix “IP:” to your IP
address query in the Bing search engine and it will reveal websites
hosted on the same IP addresses. Try with ip:213.108.108.217.
Netcraft (www.netcraft.com) - displays domain information as wellas other information that may be useful in investigating a website
such as the web trackers, hosting history and site technology.

Exposing hidden web content
Nearly every site on the internet hides something (and often, manythings) from visitors, intentionally or not. For example, the content
management systems employed by most sites hide the internal files
used to generate posts and maintain the website. Databases that store
data for sites and applications are usually hidden from public access.
There are simple tools and techniques that allow you to access suchinformation without raising suspicions. These are just small tricks that
let you see what a website is made of and what additional data it mightreveal to you about website owners or connections to other sites.

HOW TO SEE WHAT’S BEHIND A WEBSITE

40

Robots.txt
Websites indicate how scrapers and search engines should interact
with their content by using a file called “robots.txt”. This file allows
site administrators to request that scrapers, indexers and crawlers
limit their activities in certain ways (for instance, some do not want
information and files from their websites to be scraped).
Robots.txt files list particular files or subdirectories - or entire websites- that are off-limits to “robots.” As an example, this could be used toprevent the Wayback Machine crawlers from archiving all or part of a
website’s content.
Some administrators may add sensitive web addresses to a robots.txt
file in an attempt to keep them hidden. This approach can backfire, as
the file itself is easy to access, usually by appending “/robots.txt” to thedomain name, for instance: cnn.com/robots.txt.
Be sure to check the robots.txt file of the websites you investigate, justin case they list files or directories that the sites’ administrators want tohide. If a server is securely configured, the listed web addresses might
be blocked. If they are accessible, however, they might contain valuable
information.

Sitemap.xml
Sitemap files are sort of the opposite of robots.txt files. They are used bysite administrators to inform search engines about pages on their sitethat are available for crawling. Websites often use sitemap files to list allof the parts of the site they want to be indexed, and how often they wantsearch engine indexes to be updated.
To access sitemaps, you need to add “/sitemap.xml” to the domainname. Not all sites will have an accessible sitemap.xml file. The result issometimes URLs that typically do not show up in searches and you can
explore those manually.

Visit the Kit for the complete guide “How to See What’s Behind a
Website” by Wael Eskandar and Brad Murray:
kit.exposingtheinvisible.org/how/web.html

41

—
USING MAPS TO SEE BEYOND THE OBVIOUS

Explore how to use maps, geographic dataand satellite imagery to find and visualise
information, and how common mapping tools
can help you investigate a physical place andwhat happens there.
42

Maps and satellite imagery not only allow you to get an overview ofan area but also help you make connections that would otherwise bedifficult, if not impossible, to establish from ground level. You can see,for example, how a series of factories are arranged along the samerailway or river, notice a pattern of illegal deforestation in a rainforest or
assess environmental and infrastructural damage following a disaster.
Adding further information to maps – showing land ownership or
the habitat of protected animals, for example – can help you makeconnections that might be valuable to an investigation. Maps andsatellite images can also enable you to see over walls and look at what
is happening in places that are difficult to access because they are
restricted or unsafe, or far from where you are based.
Maps can be useful for an investigation if the data you use has ageographic or spatial element. Any data that can be referenced to aparticular place can be added to a map. This includes natural features,such as rivers, coastlines and elevation; administrative data such ascountry outlines, county boundaries and city limits; aerial photographs,
whether from satellites, drones, balloons or kites; and databases
containing location information, such as the addresses of all the
hospitals in a region, or a list of countries together with their
population size.
Large amounts of such data can be found for free online, often
already assembled into maps. An even greater amount of geographic
information is available to you if you’re able to assemble these different
datasets yourself, using accessible data visualisation and geographic
information system (GIS) software.
Map - a graphic
representation ofphysical areas or objects
and where they arelocated geographically.

It is also possible to generate your own geographic datasets and imagery,which you can then use to produce maps. You can create your own aerial
imagery using drones, balloons or kites, and make or add to an existing
map using basic survey techniques with simple tools such as a tapemeasure, paper and pen.

43

Geographic information is everywhere
Geodata is digital
information that’s
directly linked to aphysical or geographic
location. There is plentyof visualised geodata
available online andit may be useful when
researching certain
topics. Weather data,
land use data, zoning
maps (used for urban
planning) and building
permits are just someexamples. Social
media posts andphotographs can often
be linked to a specificplace and time via theirlocation metadata,
which can help you
verify what happened
there and when.

You are probably familiar with a number of common map
applications, and have at least one on your phone that you use
regularly. Even this basic tool can be helpful in planning and carryingout investigations.
Many such applications have features that allow you to searchfor photographs of a certain place, or find 360-degree groundlevel views. These can be useful when familiarising yourself witha place before you go, finding the address of companies locatedthere, or learning about an event at a certain time. Route planners in
map applications can help you plan your trips, and also verify times,
means of transportation, route options and costs for specific journeys.
Generally, investigations have at least one geographic component. In
most cases, the company you are investigating has physical or registeredoffices somewhere and probably also operates in a distinct location.
The people you are investigating most likely leave physical or digital
traces that can be linked back to specific places – images from theirtrips or social media posts, for example. While places may be
more obviously important in some investigations than in others – forinstance, deforestation has a clear link to a certain location – creating
maps, using geodata and geolocating evidence can often help to verify,
or call into question, other sources of information.

Understanding mapping vocabulary
Location coordinates:
The latitude and longitude (also known as lat-long) coordinates system
divides the Earth into a grid of horizontal and vertical lines and is used
to accurately pinpoint any location. Latitude measures how far a placeis north or south of the equator. The equator is 0 degrees latitude, with
the north pole at 90 degrees north and the south pole at 90 degrees
south. Longitude measures how far a place is east or west of the prime
meridian, which is at 0 degrees longitude.

USING MAPS TO SEE BEYOND THE OBVIOUS

44

Latitude and longitude coordinates can be written in a numberof formats:
Degrees / minutes: 52°31.86797’ N, 013°24.03009’ W
Degrees / minutes / seconds: 52°31’52.0784” N, 013°24’01.8054” W
Decimal: 52.5311329 lat, -13.4005015 long. North of equator is positive(plus is usually not marked), south negative (marked with a “-”). East of theprime meridian is positive, west is negative.

Main types of maps:
Thematic maps - maps showing information related to a specificsubject, such as air pollution, forest cover or election results.
Choropleths - different regions of the map are coloured to show astatistical difference, such as voting percentages or life expectancy.
Symbol maps - symbols or shapes are placed on your map, withdifferent sizes and colours. Symbol maps are useful to illustrate two
or more datasets together - for example, the number of earthquakes
around the world, together with their intensity.
Heat maps - show variations in intensity, such as how air pollutiondiffers across a city.
Satellite image Key features in maps and satellite images
images/photographs of
the Earth’s surface or ofPattern - on maps, agricultural areas can often be identified byother planets’ surfaces
taken by satellites. Thesethe pattern of farmers’ fields, which may be rigidly rectangular, or
images are often taken
circular in countries that use rotating booms for irrigation. Naturalin stages and combined
growth forest has a more irregular pattern of trees than a plantation,
to obtain a complete
overview of large areas,
which may be laid out in a grid.
to create maps, andto observe land andShape - bodies of water, such as lakes and rivers, tend to havewater surface details.

distinctive shapes and are often easy to identify on a map. Straightlines in a landscape are likely to be human-made, such as roads,
canals and land boundaries.

45

Texture - refers to how smooth or rough a feature is. Texture can giveyou clues about what you’re looking at, for example a large area ofconcrete or tarmac, such as a car park, will appear smooth on a map,
while vegetation is likely to have a rougher appearance.
Tone and colour - are really important when interpreting images.
Satellite images created using visible light (as opposed to infrared
light) are fairly intuitive to interpret, as the colours are similar towhat you would see with your own eyes. Vegetation tends to be green(though this can change over the course of seasons, it may turnbrown/yellow in the fall). Water absorbs light and tends to appear
black or dark blue, although sediment in the water will make it lookbrown; shallow water can be lighter in colour and sunlight reflections
can make it seem white or grey. Infrared images are often used tomonitor vegetation, which will appear in different shades of red(rather than green, as in visible light images).

Collecting evidence from reference maps
and photographs
Reference maps show important physical features such as rivers,
hills and coastlines, as well as buildings, roads, paths etc., plus thenames of places and streets, and are often useful for way-finding. In
many cases, they will contain additional services, such as satellite
imagery, street level views of places, detailed route planning and geolocated photographs or videos. Here are some common reference map
platforms and apps:
OpenStreetMap (openstreetmap.org) - is a free map platform createdthrough crowdsourcing. This also means that you may need toverify any information you find on it by checking other maps andconfirming geodata about the places you need to investigate. It also
has a humanitarian layer, which shows details like the locationof camps for displaced people, and is used by the humanitariancommunity for planning and coordinating responses.
OsmAnd (osmand.net) - uses OpenStreetMap’s database but is
independent from OSM. It provides satellite views from Bing. Its
mobile app (for Android and iOS) works completely offline and in
addition to route planning and navigation, it also includes foot,hiking and bike paths. It can be particularly useful if you need to map
terrains that are off-road.
USING MAPS TO SEE BEYOND THE OBVIOUS

46

Open Chart Plotter Navigator (Open CPN: opencpn.org) - is free andopen source software developed by a team of active sailors with theaim of improving the mapping of waters. It is constantly updated andtested by users and provides navigation and route planning support
as well as data about weather conditions and tides, tracking of othervessels, avoidance of possible collisions, and much more.
Google Maps (google.com/maps) - lets you plan routes, look at detailed
satellite imagery, track your own route and find photographs linked
to a certain place.
Google Earth (google.com/earth) - uses satellite imagery as
its background. It offers a number of features that Google Maps
doesn’t, including historical satellite imagery and 3D models ofterrain and buildings.
Bing Maps (bing.com/maps) - is a good alternative to Google Maps. It
provides satellite views, bird eye’s views and road views, as well as
street views (streetside) for some places. It is particularly strong ondata about street traffic (use the traffic light icon on top of the map)and distance travel planning.
HERE WeGo (wego.here.com) - free map and navigation platform
providing satellite view, terrain view, route planning and traffic
updates.
Yandex Maps (yandex.com/maps) - is a Russian web mapping service
available worldwide but with limited coverage as compared to Google
Maps. It has detailed maps only for Russia, Belarus, Ukraine, Turkey
and Kazakhstan but it is worth checking in comparison with othermap platforms because it may provide additional details, especiallyin these regions.
Baidu Maps (map.baidu.com) - is particularly useful when checking
locations in China, as it provides far more detailed coverage than
Google Maps. It includes satellite imagery, street maps, street view,and route planners for foot, car or public transportation travel.
Mapbox (mapbox.com) - allows you to add your data to a custom
designed map tile. It has a free tier that you can use to create manykinds of maps such as symbol maps, heatmaps or choropleth maps.

47

Using already mapped data and thematic maps
There are many existing datasets that can be visualised using maps.
Some information, such as the boundary of a protected ecosystem or thetransport routes of cargo ships, can only be properly understood whenviewed on a map. Other information, such as a spreadsheet showing
infant mortality rates around the world, may be comprehensible inits raw form, but putting it on a map can be a valuable way to analyse
patterns it might contain.
Many organisations that compile datasets also offer maps andvisualisation tools as part of their data portals. This list is just a starting
point to give you an idea of the resources and categories of thematic
maps that exist and that may be useful to your investigation:

Shipping traffic
Marine Traffic (marinetraffic.com) - a live map providing nearreal-time information about vessels’ positions, details and voyagerelated information, based on automatic identification system (AIS)data.
Global Fishing Watch (globalfishingwatch.org/map) - a map showing
the up-to-date positions of approximately 300,000 of the largest
commercial fishing vessels, as well as historical data on these ships’
whereabouts.

Flight traffic
Flight Radar (flightradar24.com) - a live map showing the positionsof commercial aircraft, together with flight numbers and routeinformation. Searching by flight number allows you to track
individual planes.
FlightAware (flightaware.com) - a free service allowing you to track
the real-time flight status and location of most commercial flights
worldwide as well as the whereabouts of charter and private planesin the US and Canada.

USING MAPS TO SEE BEYOND THE OBVIOUS

48

Forest cover
Global Forest Watch (globalforestwatch.org/map) - a map of changing
tree cover around the world from 2010 to the present.

Air pollution
European Environmental Agency (eea.europa.eu/data-and-maps) - a live
map of air quality data across Europe, with options to look at overall air
quality, as well as concentrations of particulate matter such as carbon
monoxide, ozone, nitrogen dioxide etc.
World’s Air Pollution (waqi.info) - a live map of air quality around theworld, with links to individual countries’ air quality monitoring agencies.

Mining and resources
Mineral Resources Data System (mrdata.usgs.gov/mrds) - provides
historical data on global mineral resources, including information
about mine ownership, all available on a user friendly map. Note thatsome of the information is outdated.

United Nations data
UN cartographic division (un.org/Depts/Cartographic/english/htmain.htm)- has a collection of maps mostly related to humanitarian andpeacekeeping operations.
The United Nations High Commissioner for Refugees - Map portal(maps.unhcr.org) - has a large number of maps available for download
related to current refugee situations. It also features a number of mapsof areas where large numbers of people have been displaced.
The World Bank (databank.worldbank.org) data portal - has an online
visualisation tool, which you can use to view their data as a map.

49

Do it yourself:
Mapping a small area, the low-tech way
Carrying out a detailed survey of a place can be useful for someinvestigations. It can help you create an accurate record of earthquake
damage to one or more buildings, for example, or document the locationof bullet holes following a shooting. This approach is low-tech, but that
doesn’t mean it should be regarded as an inferior or amateur technique:many professionals, including architects and engineers, use it to gain
the most accurate measurements.

What you need: pen and paper, measuring tape.
To practice, do a survey of a nearby place that you have easy, legal accessto. The garden or courtyard of your home or office could work.
Sketch out the area in “plan” (in 2D - viewed as flat, from above). Using
your tape measure, take measurements of the elements you have drawn
on your plan – for instance, the lengths of walls and staircases, andthe distances between them. Remember to measure diagonals in thespace, so that you can draw it more accurately later – this will help you
ascertain whether a courtyard that looks like a rectangle really does
have parallel sides, for example.
Take note of the orientation by marking which way is north. You may beable to look at an existing, less detailed map to work this out. Looking at
the position of the the sun and time of day can also be a good guide. Or,of course, you could use a compass.
It is also helpful to take photographs of the area you are surveying.
These will be useful when it comes to drawing up your survey
measurements, as they give a wider sense of what the place is like.
To get a full overview, take panoramic shots, ideally from different
places on and around the site. To build a bigger picture of the place,try to take photographs that contain as much context as possible –surrounding streets, adjacent buildings, etc. Close-up photographs of
key features, such as damage to a window or graffiti on one of the walls,
are also useful.

USING MAPS TO SEE BEYOND THE OBVIOUS

50

Visit the Kit for the complete guide “Using Maps to See Beyond theObvious”, by Alison Killing:
kit.exposingtheinvisible.org/how/maps.html.

51

—
AWAY FROM YOUR SCREEN, OUT IN THE FIELD

See what it takes to plan, run and evaluate yourfield investigations safely and effectively.

52

Field research or field investigation is any kind of information collection
and verification process for which you have to leave your house or placeof work. This means that going out to talk to a witness, observe a protest,collect environmental samples (such as water, mud or plants) or takephotos to support an investigation are part of your field research.
Field research is remarkably effective, since it often yields physicalevidence such as film, video or sound recordings, which can make eventhe most controversial and complex issues easier to understand. Thisis usually accompanied by other investigative techniques and researchstrategies. In fact, investigators often exhaust their desktop research
before considering going into the field.
While digital or remote research can be carried out relatively quickly,
field research requires planning, arranging transportation (anythingfrom a walk to several expensive flights), and doing the investigation
itself before returning home to analyse the results. Field investigations
can take half a day, weeks or even months to carry out.

Why you need field research
You can conduct field research for various purposes, including to:Corroborate digital material (such as information on satellite images)
Each field investigation
will likely require different
kinds of preparation, even
within the same project.
For instance, the way you
prepare for and execute a
seemingly simple activity
such as taking photosof a building to verify awitness’ statement canvary depending on thetype of building – whether
it’s a private residence ora government building,the headquarters of acompany or an airport.
In addition, the country,
the city and even theneighbourhood wherethese buildings arelocated can make a huge
difference to your access,your safety and the qualityof your results.

Collect environmental samples (water, soil or air)Obtain, review or copy documents that are not available remotely
Meet and interview sources and witnesses in their own environment,such as their home or workplace
Identify new sources that might provide information of interest
Expand your understanding of evidence you have already gathered
Corroborate or refute an initial hypothesis, narrative or otherexisting evidence
Confirm information on products, such as bar codes or names ofmanufacturers, if you are doing supply chain research or investigatingcompanies (see our Supply Chain section in the Kit)
Gather photographic, video or audio recordings to capture details for
documentaries or articles.
53

Skills you needAs with all investigative methods, it takes time and practice to obtain
good field research skills. Curiosity, adaptability, patience and a gooddose of caution are valuable traits that can be of great help in the field.
Other attributes you need to develop are:
The ability to adapt to rapidly changing circumstances and to predict
when a situation may change, even in highly stressful situations.
The ability to understand risks and to mediate, de-escalate and soften
difficult situations. For instance, you may be confronted by a security
guard when photographing a building as part of your research. The
way you react will determine whether you’ll have to abandon the planor whether you’ll manage to turn the situation to your advantage andgather additional information from the guard.
The ability to realistically assess qualities, skills and weaknesses. As aninvestigator you should be able to admit where you lack skills and be
ready to either postpone potentially risky work or to improve yourskills and knowledge in order to conduct it.
The ability to “blend in.” Whether you are trying to get informationfrom witnesses or obtain video and photographic evidence fromdifficult-to-access locations, you need to be able to relate to thepeople and locations you encounter.

The research cycle
Most research, whether field or remote, follows a cycle of four phases:
Plan - develop a good understanding of the objectives, logistics andrisks of your field research activity
Act - the actual field research activity
Analyse - assess and reflect on research results
Reflect - compare your research results with the objectives of yourinvestigation. More often than not, this leads to a new plan forcontinued research.

AWAY FROM YOUR SCREEN, OUT IN THE FIELD

54

Particularly with desktop and other remote research, the boundaries ofthese phases are often fluid. In fact, actual research looks much less likethe image on the left and more like the image on the right.

Planning for field research
Don’t skip on
preparation if you’realready familiar with thelocation. Circumstances
may change, the issues
you are investigating
may create newconditions and risks or
the people you need totalk to are unpredictable.

With field research, you often have to travel to and work in places you
are unfamiliar with. To increase your chances of being successful, you
should not only familiarise yourself with the research location, but also
manage logistics such as transportation and places to stay.
If you are working in different countries, you need to think about theusual administrative issues that come with travel and accommodation,
but also pay special attention to your equipment and the way you
carry information on you as you travel across borders. For instance,
there are regions where journalists and researchers are not allowed
to enter without special visas or passes, so bringing obvious recording
equipment or external hard-drives can raise suspicions.

Set your goals and objectives
Your field research will be more efficient if you set clear goals andobjectives for yourself beforehand. While each research trip is unique,there is a kind of formula for successfully fulfilling a research objective.
A research objective is usually a concrete purpose that describes what
you are trying to achieve. Ideally this purpose is SMART:Specific Measurable Attainable Realistic Timebound55

For instance, your objective may be to ‘collect photographic evidence ofa coal vessel arriving in a seaport in a few days.’ Another objective might
be to ‘meet up with and obtain documents from a confidential source
helping you to investigate suspicious decisions your local council has
made on a tender for a building project.’Plan your activities
In many cases, your field research will focus on one task, and you won’t
always need to come up with detailed task lists. In other instances, if
you plan on interviewing and recording witnesses, or collecting samples
from a place, things may get more complicated. You need to think inmore detail about equipment, locations, safety, questions to ask, etc.
For more complicated research projects, it makes sense to write down
your strategy, what questions you have to answer, the challenges you
may face as well as possible solutions to them. There is no fixed format
for this and you can do it in any way that suits you.
On the next page is an example of potential tasks for a hypotheticalsituation of going out to test water when investigating posible pollution
in a community:

AWAY FROM YOUR SCREEN, OUT IN THE FIELD

56

Component

Question

Activities

Sampling

Where to test?

Remote desktop and phone research to identify communities relying
on ground water for drinking and cooking.

Sampling

Transport& accommodation

Research best options remotely. You need battery-powered refrigerators that are large enough to hold the collected samples. Look at
motor homes (large camper vans) where you could stay during thefield research.

Testing

What lab to use?

Identify potential labs (get price quotes for 50 samples to be tested)

Testing

Equipment needs& protocols

Talk to labs to learn about sampling protocols and receive advice onrequired equipment (bottles etc.)

Testing

How to ship samples?

Identify shipping companies that are equipped to ship scientificsamples. Ask lab for guidance.

Interviewing experts
and affected community

Equipment needed?

Compile equipment list including cameras, SD cards, spare batteries,
microphones, car chargers, GPS, etc. Have backups for mostimportant equipment.

Interviewing experts
and affected community

Questionnaire forinterviewees

Develop a detailed questionnaire so you ask everyone in the affected
community the same questions. Prepare by talking to existingsources about what interviewees are likely to say about the impactof herbicides on their health and environment.

Interviewing experts
and affected community

Release forms

Prepare release/consent forms for interviewees to sign. Explain whatthese are for and what happens with the information they provide.

Before you go
There will be situations where you only have one opportunity to engage
with a witness or observe an event, so good preparation is vital. To
gather the best evidence, consider some of the strategies below.
Practice interviews - if your research is likely to involve interviewing
people, you can simulate and practice this with people in similar
situations. Consider carrying out the same kind of research at
another location in advance, in particular if the activity is low-risk.
Ask a friend or trusted collaborator to help you role-play various
situations you may encounter.
Practice your research methodology - if you’ve never taken
environmental samples, used drones or a hidden camera, forinstance, start by practicing these techniques in places that are
unrelated to your actual investigation, and in a low-risk environment.

57

The best devices canprove useless if you
don’t know how to
operate them. When you
consider that in many
situations you will only
have one chance toobtain the evidence you
need, there’s no suchthing as learning on thejob. Before you decide touse specific equipmentin the field, it’s vitalto practice with yourdevices and simulate
investigation scenarios.

Simulate what could go wrong - it’s much harder to practice what could
go wrong in your research, since you generally want to avoid suchsituations. The best way to do this is to create a risk assessment andmanagement list and act out potential problem situations together
with people you trust. You should never carry out field researchwithout an emergency contact and without someone knowing what
you are doing, so try to practice with that person in advance.
Ensure legality - knowing what is legal and what isn’t in the places
where you go on field research is critical, and should be a priority inyour risk management. Things like secretly recording a conversation
with a person can be legal in one county and illegal in another. Theselaws can even vary from state to state within a country.

Sometimes there is a difference between what will likely result in yourarrest or detention, and what is actually illegal. Instead of focusing on
written legality, look for local guidance on what is most likely to put
you on law enforcement’s radar, and how you can avoid it. Journalists
and staff at NGOs as well as other researchers working in areas you areinterested in are likely to have relevant information.
Plan your entry and exit - how you exit your location is even more
important than how you get there, especially when things can gowrong. Know the surrounding areas and have a plan to exit quickly.
Researching in remote areas, forests and other poorly mapped
places will require careful planning, including the use of GPS (Global
Positioning System) coordinates and mapping apps or even physicalmaps. Learn how to use these tools and geographic coordinates
before you go.

In the field
Once you are in the field you will start to focus on collecting the evidence
needed to meet your objective. To do this you need the right methods
and tools:
Technology - having the right technology makes a huge difference inthe field. Among other things, it can let you see over long distances,
document witness statements, gain access to places that would otherwise
be difficult to enter and collect and process evidence in various formats.

AWAY FROM YOUR SCREEN, OUT IN THE FIELD

58

Sometimes it matterswhere exactly you
found the documents.
For instance, there
are countries wherematerial that has been
put out as garbage isconsidered abandoned
property, and can betaken. Photographing
documents may be
a good way forward
but this is weakerevidence than having
the originals. You should
research these legal
aspects as part of yourplanning before going
into the field.

Evidence collection - photo, video and audio evidence is very powerful
because it counts as objective proof, although it can also be manipulated.
There is a wide range of imagery you might have to take during an
investigation, including exteriors and interiors of buildings, events,
people, animals, documents, your own activities to prove you have done
what you claim you have, etc. These situations might determine the kindof cameras and other devices you will need. Your phone camera may beof use at times but will probably have limited potential in some of thesescenarios.
Witness statements - as a general rule, keep in mind that wheninterviewing witnesses in the field, either covertly or overtly, theirstatements can rarely be seen as completely impartial. Usually, you willneed to corroborate their statements with other types of evidence fromadditional sources while in the field or later on.
Documents - you may sometimes receive or come across important
documents in the field. Be careful how you handle them. You can
use copies of documents received from libraries and archives anddocuments released by authorities through Freedom of Information(FOI) requests in any way you want. But removing documents frombuildings or other public or private locations could have significant legal
ramifications depending on the places you are in.
Environmental samples - if collecting samples (water, soil etc.) yourplanning has to address relevant sampling protocols. Rules can becomplicated and require a good deal of care and attention. If you do
not follow protocol, your samples could be of poor quality, or, at worst,
become contaminated and provide false results. Sample analysis should
always be done in accredited laboratories. Make sure you check withthese laboratories what best practices you should adopt while collecting
samples in the field.

Visit the Kit for the complete guide “Away From Your Screen, Out in the
Field” by Mario Rautner:
kit.exposingtheinvisible.org/how/field-research.html

59

—
INTERVIEWS: THE HUMAN ELEMENTOF YOUR INVESTIGATION

The techniques, skills and good practices
you need to safely identify, interview andmaintain contact with people who canprovide you evidence.
60

On Sources andInterview Subjects
It’s important to makea distinction between
interview subjects/
interviewees andsources. Interviewees
are those that you
may meet for a current
investigation, and may
or may not meet again.
Sources are those you
will need to invest
some effort in building
connections with, tocreate and maintaina network of contacts
for current and future
work. Some of yourinterviewees may
become your sources
and you will have toestablish different
dynamics with themthan you would with a
one-time interviewee.

Most of the time when undertaking an investigation, you will needto support it beyond desk and field research. This involves dealing
with with people, establishing trust, conducting expert conversations,interviewing witnesses and sometimes facing subjective reactions
to incidents. This makes it important to learn how to address difficult
subjects, how to keep yourself and your interviewees safe, andhow to build up connections with sources that might be helpful infuture investigations.
Human interactions are all about common sense and may seem fairly
intuitive on the surface. But with interviews in particular, because you
are dealing with people and people are often unpredictable, preparation
is key. Interviewing is a much longer process than just a one-time
conversation or a series of questionnaires to collect information. It
requires background research, building profiles of people, establishingtrust, anticipating risks, taking safety measures and more. Sometimes
you will need to meet people more than once, while other subjects will
be reluctant to meet at all.

Before the interview: preparation
Finding potential human sources of information and interview subjects
is your initial step. This requires research, practice and commitment.
Depending on whether you are starting your investigation from scratch,looking to add a face to your story or to collect testimonies, you will most
likely have to find and interview different people to meet different needsof your research.

Ways to identify potential interviewees:
Observe their activity on social media - create topic-related lists that you
can follow depending on the issue you are investigating. Gather a listof all those working for particular organisations or in similar fields
such as activists, civil society members or companies.

Avoid ‘liking’ or ‘following’ potential interviewees on social networks if
any connections to particular issues or people might get you in trouble,
depending on what you are investigating.
Subscribe to newsletters - most organisations have them and you canfind potential sources or interviewees among those who appear in
their publications or who write for them.
61Attend press conferences - people who are not generally accessible overemail or phone might be approachable during press conferences,
especially officials, their assistants and other institutional staff.
Attend public events - keep track of open meetings, conferences,public lectures, conventions, etc. Such events may host speakers or
participants that it would otherwise be difficult or even impossible toaccess. Collect business cards and give out yours, if you consider
it safe.
Follow blogs and webpages - such resources, if maintained by
activists or local citizens, can be rich in documentation and open
a door to someone who may become a source, provide leads for aninvestigation, or help you get in touch with the right person.
Visit official websites - these can be helpful when trying to get accessto government officials. You can find out which ministries ordepartments are in charge of your area of interest and then request
interviews with relevant officials.
Find closed, specialised groups - NGO workers, journalists and activists
sometimes rely on closed (or secret) groups to exchange informationand support. As you build more connections, you may want to reachout to someone you trust and ask about some of these groups if yourinvestigation is centered on a specific country or topic.

Types of sources and interviewees will differ depending on several
factors such as:
Their role in your investigation and information they can provide primary sources who can provide direct evidence or witness accounts; orsecondary sources who can provide additional background information.
Their position relative to your investigation – vulnerable sources(victims) vs. perpetrators; or willing to collaborate vs. adversarial sources
who are likely to interfere in your investigation.
At times, your sources can be both vulnerable and adversarial. In mostcases you will have to combine multiple approaches to address a source,
while in some cases you will be able to get what you want in fewer steps.

INTERVIEWS: THE HUMAN ELEMENT OF YOUR INVESTIGATION

62

Reaching out to sources and interviewees
Here are some basic planning guidelines:
Prioritise and organise interviews - if possible, start with interviews thatprovide background information about the investigation or aboutother potential interviewees. Then, you will be able to approach moreevidence-focused interviews. Try to go from the easiest interviews
to the most difficult ones so you can prepare better to address
adversarial subjects at the end, when you have more knowledge on
the topic.
Diversify and gain multiple perspectives - any investigation ismulti-layered. The more diverse sources you include, the richer yourevidence becomes and the easier it is to avoid bias. Include primaryand secondary sources and try to interview people across different
ages, genders, castes, classes, beliefs or job statuses.
Conduct a risk assessment - do this especially when contacting people
who are close to the problem you investigate. Sometimes you
will need to plan the order of the interviews carefully to prevent
interferences, conflicting interests or bias in your work. Consider
how risky the interaction might be for you, for the investigation, andfor your sources and interviewees.
Initiate contact - sometimes you will be able to get in touch with aninterview subject immediately. Other times you may need to rely on
someone close to them to initiate contact. Activists, organisations,lawyers or journalists may be able to put you in touch with primaryor vulnerable sources to whom they already have access. Follow
protocols for safe communication in any interaction with yourhuman sources.
Introduce yourself and your purpose - this is the first step in building
trust with your sources and interviewees. Explain your work at theoutset if you consider it safe to do so. If you run a public project, awebsite or have work that can be shared, show these to your sources
or interviewees to establish your authenticity. Avoid terms thatmight sound too heavy, like “investigator.” You can use the term“researcher” instead, but never hide the purpose of your work unlesssafety risks require you to work under cover.

63

Preparing for interviews
Once you’ve decided who you will interview and have establishedcontact, you need to prepare for the interview itself. Here is a check-list
that can help:
Travel safety andsecurity - if you travel
to unknown places,
you should do a risk
assessment of thecountry or region you
are visiting. To start,
gather information fromfriends and colleagues
who share your identity.
Risk and identity areclosely related. Thismeans that your risk is
impacted by your race or
ethnicity, gender, sexual
orientation or country of
citizenship. Sometimes,
your passport may
carry privilege andprotections; other times
it may be the opposite.

Do your background checks - gather as much information as possible
about a person / organisation / topic. Consider how safe it is to sharecertain information while doing your research on sensitive topics
and dangerous people you plan to interview.
Define your goals.
Write a list of questions, organise it.
Prepare for difficult interviewees - mark questions that you think may
raise concern or which may be faced with rejection. Prepare a set ofalternative questions that can help you obtain a response.
Use time effectively - try to save time for the really significant questions.
Respect your interviewee’s time and offer to take breaks if they need them.
Know your terms - be careful with the language you use during
your interview, both for the sake of accuracy, and out of respect.
For example, make sure that you understand terms like “trans,”“nonbinary,” “pansexual,” before interviewing someone who is
LGBTQI+. The same applies to race, social status, religion, etc.
Get the right mindset - leave your own feelings and biases aside, especially
if you have to face an adversarial source you may disagree with.
Get legal advice - get in touch with a lawyer if you have doubts about
the information that you are handling or if you obtain access to
information about a wrongdoing or a crime. Be aware of the laws that
protect (or endanger) you and your interviewees and sources, whichmight vary depending on the country.
Arrange necessary logistics carefully - how you set the time and place ofyour interviews is as important as the interview itself. Public places
may not always be the best option if your source is a victim of abuse,
while private spaces and remote areas may be a bad idea if you meeta perpetrator or a potentially dangerous person.

INTERVIEWS: THE HUMAN ELEMENT OF YOUR INVESTIGATION

64

During the Interview
The main difference
between nonattributable and off
the record is thatwith non-attributable
you can publish theinformation but you
cannot name thesource; with off therecord, you cannot
publish the informationor the source.

Part of preparing for an interview is establishing what medium orchannels you will use with your sources and interviewees. The mostcommon ones are: face to face, calls or email. On a scale from best to
worst, face to face should be your top option while email should be thelast resort.
Explain key terms - not everyone understands interview jargon, andpeople can get confused by terms like on the record / off the record,
non-attributable, anonymous, release forms, etc. Also, these may
apply differently in various contexts and cultures so better avoid
them and just explain to your interviewee how the information will
be used. This process should be a two-way conversation, expect thesource to push back at times, until you arrive at an agreement you
can both accept.
Obtain consent and permission - even if a person has agreed to talk toyou, try to obtain written permission for recording and taking photos/
videos and get their explicit agreement on how the information
they are providing will be used, or if their name will be mentioned
and how. This is especially important when interviewing minors,
where an adult should always give consent on their behalf. Note thatsome of the evidence might not be admissible if you don’t have legal
consent - especially if information may end up used in courts or as
proof by others (journalists, lawyers, campaigners, NGOs etc.).

Anonymous means you
can publish information
given during aninterview, but you mustnever name the sourceor any details that may
reveal the source. For
instance, you cannot
even mention that acertain official provided
you with the information
if that’s the case.

Establish boundaries - make sure your interviewees understand thatyou are getting in touch with them because of your work - even if you
already know them - and that the relationship is professional.
Document the interview - the testimonies and evidence that you collectfrom human sources should ideally be recorded in some form.
Ethically and legally, you can only do so after they have granted you
consent. Documenting techniques include audio, photo or video
recordings, as well as recordings of the video/phone calls.
Use recordings ethically - if you publish your investigation, choose
images or sound with utmost care. For example, if you are writing on
sexual violence, avoid images that make victims appear powerless or
weak. The same applies to minors: mind the sort of images that you
take and the legislation that applies.

65Interviews Requiring a Special Approach
Every investigation will require different human sources and you will need to vary
the type of interviews you conduct to gain a broader perspective. This may meaninterviewing people in different locations, but also some who might require special
attention because they are vulnerable or because the goal of your investigation might
be to build a legal case.
Interviews in foreign countries and other unfamiliar places
If you are planning to meet a subject in another country, consider cultural, religious,
gender and other locally relevant particularities. Make sure you have a reliable contact
or network there, and try to know the basics of the local language. This may make ahuge difference in the results you obtain. Safety is of utmost importance so do yourrisk assessment in advance and prepare your way in, your stay there, and your way out
carefully.
Interviewing vulnerable sources
Some sources might be particularly vulnerable, such as survivors of trauma, coerced
victims, victims of trafficking, threatened communities and minorities or minors. Somemight not have a good understanding of the work you are doing or what it means tohave their story, name and image published online. Perhaps they have unrealistic
expectations about whether and how you can help them after an interview. Sometimes,by speaking to you, they might be risking their freedom or physical safety. In suchcircumstances, it’s important to ensure an even higher level of care, responsibility,
ethics and legality on your side. It’s your responsibility to make sure sources
understand exactly what your use of the evidence or testimony that they will provide
means for them, how it will be used, how they will be identified, if at all, and what therisks are. Make sure to think through the possible repercussions for your source before
making their evidence and testimony public, and decide together whether those risks
are worth taking.
Interviewing adversarial sources
Some interviewees may be or become adversarial or combative over the course of yourcommunication and interviews. It might be that they are simply hostile by character orthat they are perpetrators refusing to cooperate or trying to deviate from your line ofinvestigation. It’s important to do as much research as possible before your interview
so you can speak confidently if a confrontation takes place. Most importantly, don’t
let your bias take over; even if you don’t respect a hostile person or a suspected
perpetrator, you have to approach the interview with empathy. As your time withthe source progresses, you can begin to ask more pointed and tougher questions.
Remember that getting verifiable evidence from the interview is your objective.

INTERVIEWS: THE HUMAN ELEMENT OF YOUR INVESTIGATION

66

After the interview
Assessing your interview findings and preparing the next steps is essential
to ensuring a useful follow-up to your efforts. Here are some steps andprinciples to remember:
Checks and balances - avoid your personal biases and consider yourinterviewees’ biases in order to gain a broader perspective from yourinterviews. The ways in which you display your evidence and the weight thatyou give to every interview is important. Try to counterbalance statements
accurately.
Assessing needs, thinking it over - your investigation is like a jigsaw puzzle. Even
if you have fact-checked at every step, you should revisit your evidence when
you have all your information and statements. You may
pick up details you haven’t seen before.
Giving right of reply - if the purpose of your investigation is to publish astory that accuses someone of wrongdoing, they have a right to respond to
those allegations.
Honouring the efforts of sources and interviewees - consider the time and effort
that they put into answering your questions, especially in conditions of risk
and/or limited resources. You can do little things like sending them copies orlinks to your investigation if you publish it, or reconnecting with them when
you are next in their area, if you consider it safe to do so.
Staying in touch - there are a few considerations to bear in mind if you want to
do this. Depending on who the source is, having your card or your contact
details may compromise them and/or yourself. Make sure they understandthat for their own safety it’s important to maintain secure communication,
rely on encrypted messaging applications, and only reveal new and sensitive
information when you meet or establish safe communication channels.
Know when to let go - there are different reasons why you may have to giveup your investigation. Feeling stressed and overwhelmed is natural, andthe pressure of your work may be too much at some point. In addition, yourresearch may end up showing that there is no case, or that you won’t be able
to collect all the evidence you need. Thinking your investigation over will help
you decide whether you need to let go.

Visit the Kit for the complete guide “Interviews: the Human Element of Your
Investigation” by Nuria Tesón, Ankita Anand, Jess Lempit, Megha Rajagopalan:
kit.exposingtheinvisible.org/how/interviews.html
67—
HOW TO MANAGE YOUR SOURCES

Start building your own contacts, learn how todevelop, interact with and maintain sources andhow to enrich your investigations with
their cooperation.

68

During the course of your investigation you will be in touch withpeople you will want to interview but also with others who will provide
you information over longer periods of time and whom you may notnecessarily interview. These will be your sources.

Creating an agenda and database
If you work (or plan to work) as an investigator, you need to create a
network of sources that you can rely on for information over time.
You can reach out to potential sources and build connections invarious ways: by starting with an informal interaction, having a coffee
or meeting them at their workplace. You can also try to turn yourinterviewees into sources by keeping in contact with them after you aredone with a specific interview or investigation.
When creating agendas, organise and gather contacts in a meaningful
way while also taking extra care to save and store their details safely
to protect the identity of your sources. For instance, your agenda may
involve building a topic-specific contact list of environmentalists,
lawyers, political activists, human rights researchers, officials, etc.

Don’t dismiss lower-ranking people from your network. They might beable to help you with accessing evidence and/or interviews just by being
close to those in power, or they might reach a position of responsibility
in the future and gain access to more sensitive information.
If you are (or become) known in the field of investigation, people may
also start reaching out to you and offering information over a longer
period. You should always establish their reliability and biases, ask them
about their intentions and lay out the boundaries of your relationship.

Building trustYour work is your best tool when you are trying to gain a source’s trust.
If you have done previous investigations and you were able to preserve
the privacy and safety of your interviewees and sources, others may
feel more inclined to collaborate with you. Build a reputation not only
as an investigator but as someone who cares about the people you areinterviewing, and remember to be genuine. People might be assuming ahuge risk by maintaining a relationship with you and you should always
make sure you acknowledge it.

69

Keeping contact: the law of the three calls
Never take your sources for granted. Once you have established contact
and started building a relationship, you need to show interest andmaintain contact. Ideally, don’t just call your sources when you needsomething. Rather, try applying the law of the three calls.
Once in a while, send a message showing interest in how they are doing
and make sure they feel that you are not looking for information. A
second call may follow later on to check on them, ask how things aregoing with work and in their lives, and let them know that you are up
for a coffee. This should be only for the purpose of catching up and not
to extract any information. Then, when you really need them for the
purpose of an investigation, the third call will happen naturally.
It might happen that they actually get in touch first to inform you ofsomething because you are on their mind and because they don’t
think of you as a selfish investigator who only appears when they needsomething.

Is your source compromised?
The fact that someone has been trustworthy or reliable at a certain point
doesn’t mean they are going to be so forever.
You need to preemptively check your source’s credibility and reliability
every time you meet them, and not just before the first meeting,depending on who they are, the context they are informing in, and otherfactors.
For example, you may have been in a country where someone working
for an organisation was helping put you in touch with people you
wanted to interview. In the meantime, the source or source’s family ororganisation might have been threatened or pushed to denounce you or
your work if you ever come back. Be alert to changes in their behaviour.
If they suddenly ask too many questions or want to know too many
personal details like where you live, who your partner is, who gave you
this or that evidence, their status as a reliable source may have changed.

HOW TO MANAGE YOUR SOURCES

70

Protecting sources
In the United States,
for instance, civil andcriminal courts canissue subpoenas forcing
you to disclose theidentities of confidential
sources, and you will
have to decide whether
to reveal them, or facefines and even jail time.

Confidentiality is key for your sources. If you disclose their details toothers, you compromise your sources and your relationship with them.
Your interaction must be based on mutual trust and sources have tobe sure that you will not deceive them under any circumstances. You
have the right to protect them even when asked about them by a judge,
though this might vary depending on the country you’re in. You must beaware of the legislation in your own country and in the country you will
be working from.
A good way of protecting the privacy of your relationship with sources
is to keep your communications encrypted and your contact databases
protected with passwords. Follow digital security advice and bestpractices to make sure that you are doing your best to protect yourdevices, communication and information from unwanted access.

Maintaining boundaries
When you have been investigating the same issue for some time, or
when you are just starting to build a network of reliable sources, you
may need to be careful that your relationships remain professional.
This might be tricky, and the line can sometimes become blurred,as the bond you establish with certain sources is all about trust,commitment or joining forces to fight against wrongdoing. You needto consider the fact that if your relationship strengthens to the extent
of befriending your sources you may become biased and lose bothobjectivity and credibility.
Sometimes you may get to know details that are useful for yourinvestigation in a context in which your source talks to you as to a friend
rather than an investigator. Establish the necessary boundaries to avoid
this if possible, though sometimes it will occur naturally. Try to avoid
revealing details about your personal life whenever possible. Be friendly
but professional. As an investigator you will need allies, but make surethat you are aware of the difference between someone trusting you
because of your shared friendship and someone trusting you becauseof your work.

71

If you can avoid the relationship with your source becoming personal,
you have to consider how your interactions might change. For instance,
if they disclose information in a private, friendly (and not investigative)
context, you must ask them straightforwardly whether it can be used,and never use it without their consent. Be aware that they may feelpressured to let you use the information, so consider potential risks
and don’t abuse your position of power to make them talk to you as aninvestigator if they were confiding in you as a friend. The same applies
the other way around. A source may feel entitled to ask you something
you are not comfortable doing if your relationship is too close, or use
their own power to mislead or manipulate you. Make sure that even yourclosest sources are still reliable at different moments in time.
Do not feel forced to maintain a relationship with a source if you think
your boundaries are being crossed. Don’t let them make you feel
responsible for their wellbeing. If you have done everything you canto protect them and you have no regrets about your behaviour toward
them, don’t feel obliged to go forward with an interaction that makes you
uncomfortable or may put you and your work at risk.
In addition, it can happen that sources end up interpreting your interestin them as personal and this may make you vulnerable to unwanted
advances. This can ultimately affect anyone, regardless of gender.
Establish boundaries from the beginning and stick to them.

HOW TO MANAGE YOUR SOURCES

72

Risk Assessment
There can never be too much warning or awareness about risks to safety.
Whenever you are dealing with sources you should repeatedly assess
any risk you and your source are assuming. You may consider using
pseudonyms to hide their identities when building your databases ofsources, and remember to always keep your files encrypted.
You need to decide carefully when it’s secure to get in touch with asource and how you do it. This is especially necessary if these sources
are confidential or the information they hold is controversial or
dangerous. Whenever possible, stick to encrypted communications. If
you need to use mobile or landline phones that are not secure, you may
want to establish a code with your source to make them aware that thecall might not be private and there is risk of surveillance. Don’t disclose
any sensitive information, such as your subject matter or where you
will meet. When meeting, avoid going to places you visit frequently or
where you may run into people either of you know.
`

Visit the Kit for the complete guide “How to Manage Your Sources” by
Nuria Tesón, Ankita Anand, Jess Lempit, Megha Rajagopalan:
kit.exposingtheinvisible.org/how/manage-sources.html

73

—
SUPPLY CHAIN AND PRODUCT INVESTIGATIONS

Get an overview of the main actors, stages
and processes of a supply chain, as well as themain tools, techniques and data resources forevidence collection.
74

A supply chain is a set of steps that commodities (goods or raw materials)
undergo on their way to becoming products used by consumers orindustry. Stages of a supply chain can include places where products aretransformed – for instance, an electronics company where circuit boards
are made from transistors and copper lines – and where products change
hands through transport, such as the loading of circuit boards onto atruck and their shipment to a computer manufacturing company.

Supply chain investigations focus on collecting evidence to link eachstage of a product’s journey, from the origin of the commodity (forexample, the conflict metal Cassiterite used in the solder of laptops)
to the final product (the laptop itself), which can contain hundreds ofdifferent components.
Supply chain investigations can be particularly impactful because they
have the potential to change the behaviours of entire industries when
done effectively, with thorough and reliable evidence. Investigation
findings can have an impact not only on the reputation but also thefinancial status of the companies involved, in particular when they reveal
illegal or controversial activities taking place along the chain.
In the most successful cases, this impacts the supply chain all the way
back to the origin of the product, where it may prevent social injustice,from poor working conditions and human rights abuses to land grabbing
and environmental destruction. Most supply chain investigations arecarried out by journalists or NGOs, but they can also be carried out by
determined independent investigators or people and communities
directly affected by an issue.

Shining a light on where our products reallycome from
Everything around us is part of a supply chain: from the food we eat to theclothes we wear and the devices we use. But the nature of supply chainsmeans we rarely know how commodities are produced or even where
they originate.
We might not always consider where our items come from, who harvested
their source materials and under what conditions, whether there was
exploitation or abuse at any point in the production process, or if illicit
acts were carried out along the way. However, these questions might bebrought to light when public controversies emerge about certain products
or brands.
75

Even if you are not physically present at a location where commodities
are produced or extracted, many supply chain investigations can be
carried out remotely. Indeed, in most cases, elements of a supply chain
are located far from the source - for example, wood processing andfurniture manufacturing can take place continents away from where theforest was originally cleared.

Elements of a supply chain investigation
Supply chains are often complicated networks or webs of actors,
processes and movements. While it takes thousands of links in multiple
supply chains to manufacture one laptop, investigations usually focus
on very specific components of a supply chain, such as the source of
one single element used in the manufacture of one part of the laptop,
or a single factory where one stage of the production takes place.
Maintaining such a focus makes the research more effective.
Barcodes on consumer
products can beused to identify the
manufacturer, as
well as additional
information about them.
The most commonlyused barcodes are
the European Article
Numbers / EAN, which
are usually 13 digits andused both within andoutside of Europe, andthe 12-digit Universal
Product Code (UPC),
which is very similar to
the EAN, but contains
a zero at the beginningto signify registrationin the USA or Canada.
The global standard of
barcodes is maintainedby the non-profit
organisation GS1
that has a searchable
database (gepir.gs1.org/
index.php/search-bygtin) of many (but notall) barcodes.

Supply chain research can be instrumental in linking a company
to ethical issues that taint their products, even though the physicalcomponents of the product itself may not be controversial – for example,
the violation of indigenous land rights that often occurs when producing
rubber for car tires.
Key concept to remember about supply chains are:Traceability - the passing of information from one stage in the
supply chain to the next. This can relate to the initial source of theingredients or raw material of a product, the alterations it incurredalong the way, or other relevant details that may help trace an entire
history of transportation and production. Some companies havesystems for this but many supply chains are so long and complicatedthat it can be difficult even for the companies directly involved toachieve a fully traceable supply chain.
Certification schemes - are often used to ensure that products are
manufactured, produced and traded following specific standards.
For instance, they can indicate that the human rights and traditional
land rights of local and indigenous people are observed or that notropical forests are cleared to make a specific product. Well known
certification schemes include those for organic and fair trade
produce or for sustainable timber, palm oil or coffee.

SUPPLY CHAIN AND PRODUCT INVESTIGATIONS

76

Food hygiene labels:
European Union
rules regarding foodhygiene cover all stagesof the production,
processing, distribution
and sale of animal
products intended for
consumption. This
includes, for example,
fish, meat and dairy
products, but also pet
food. Every company
that puts food productson the market has
to have a uniqueregistration code that
identifies it. These
codes are printed on
the product label andconsist of a combinationof letters and numbers
within an oval. Havea look at a product instore to find the label.
The EU has an online
database of codes andpermits (ec.europa.eu/
food/safety/biosafety/
food_hygiene_en),making it possible toidentify the name of
the company that put a
product on the market.
The database covers
imported and exported
goods and includes
details of companies
from over 80 EU andnon-EU countries.

Company finances and trading and transport processes - are essential
aspects to research and understand when tracing supply chains
across different countries. This all combines with other data you
may need to collect about the product you are trying to track and its
production prices.
Verification at every step - as with any investigation, you should always
question your initial assumptions and results to make sure that the
information you collect is relevant to what you intended to prove.
What at first appears likely may in fact have another explanation. For
instance, you might have linked a company illegally clearing forests
to a timber mill that sells to a furniture company, only to find outthat the furniture company does not actually use the timber species
harvested from the forest in question. You therefore cannot makea direct connection between the company and the illegal
deforestation activity.
Flexibility and unpredictability - are features that best define the natureof supply chain research. This means that it’s not always possible toanticipate how long your research will take. Sometimes linking two
processes can take a day of online database work; sometimes it cantake months and dozens of research strategies and tools, including
online and field research.

Fairtrade certificate logos.

77Where to start
You can start your investigation at any point along the supply chain
where you suspect unethical or illegal behaviour might be taking place.
NGOs like
Greenpeace, Rainforest
Action Network,
Rainforest Alliance,
Mining Watch and manyothers conduct researchon various supply chains
and their impact onhuman rights, theenvironment, andthe wellbeing ofcommunities living
and working along thechain. Check their workfor further inspiration,
methods and resources.

In most cases, investigators follow the trail downstream along the supply
chain from this entry point. For instance, if an investigation starts at
a mobile phone assembly plant suspected of using child labour, it will
most likely continue downstream to the brand that sells the mobile
phones, rather than upstream to the origin of the plastics and metals
used in the phones’ manufacturing process. The focus here will be to
expose illegal and unethical practices of exploiting children to producethat phone.
In some cases, however, research can occur upstream. An example
might be the case of an ill-famed company establishing a manufacturing
plant in a town whose residents want to find out if the products andcommodities entering the plant are of controversial origin.
Once you identify an entry point, you can follow a sequential path along
the supply chain to collect evidence connecting each step, be it along a
production process or a product’s transport path.
You might need to use anything from maps to identify the source
locations of raw materials or interactive transport tracking services tofollow commodity shipments, to online customs and product databases
or corporate records and stock exchange websites to learn more about
the products and companies you are focusing on. You might also
sometimes undertake field research and collaborate with others tocollect evidence and witness accounts about what happens on
the ground.

Companies tend to tightly guard information about their suppliersand customers to avoid exposing their internal mechanisms andadvantages to their competitors. Companies also sometimes hire
investigators to research the supply chains of competing products andof other companies.
Supply chain investigators look for evidence that links the chain, andthis often requires a lot of creativity since no two supply chains are thesame and access to information can vary vastly depending on the data
sources available or the geographies where research is being conducted.

SUPPLY CHAIN AND PRODUCT INVESTIGATIONS

78

The ability to ‘look sideways’ by making previously unseen connections
is a critical skill, as is being able to come up with innovative solutions toresearch problems.

Profiling supply chain actors
When thinking about supply chains, a useful first step is to understandthe various actors – the participating companies or individuals – that
operate along the way. While the actual chains are usually unique
combinations, some of the actors can be categorised into groups, which
are often connected by shipping or transport providers.
Most often, along a supply chain you will encounter the following:
Producer: company, person or group of persons that takes, grows,
mines or otherwise produces the raw materials (such as the owner ofa timber plantation).
Initial processor: company that carries out the first transformation of
the product (for instance, a timber mill turning a log into planks).
Further processors: companies that carry out additionaltransformations of the product (wood can ultimately even turn into
fiber for textiles). In many supply chains there are multiple further
processors, while other supply chains may not have any.
Importers, exporters, distributors: companies responsible for getting
the products into different countries, by operating or hiring shipping
or trucking services to carry the products (for example, shipping thewood planks to a deposit in country X, from where it can be sold tofurniture manufacturers and others).
Manufacturers: companies that carry out the last transformation
before the product is sold to consumers or industrial users (such as
the company making furniture or toothpicks).
Retailers: companies and individuals responsible for selling the
products to consumers or industrial users (like a hardware shop or
furniture store).

79

Simplified example
of supply chain actors
and their connections

Each product andshipment that exits orenters a country has an
HS code (HarmonizedCommodity Description
and Coding System)
attached to it. This is astandardised system ofnames and numbers thathelps classify
commodities worldwide.
HS codes are developed
and maintained by
the World Customs
Organization(wcoomd.org). They areuseful when tracking
product shipments andtrade (import/export)
data. The United Nations
maintains the
Comtrade database(comtrade.un.org/data),
which contains suchstatistics that are usefulfor chain of custodyinvestigations.

Let’s assume you’ve chosen your entry point in the supply chain: forexample, a local fabrics manufacturer where you suspect that workers
are mistreated and underpaid, and you want to find out what fashion
brands buy these fabrics and where they are sold. You’ve also mapped
the actors you will focus on: the manufacturer and the retailer plus
potentially, the final consumers so you can raise public awareness about
your investigation findings.
Now you know what and whom you are investigating. The next step isto establish a list of companies and people of interest. Before you move
any further, begin by researching their company ownership, businessmodels, networks of collaborators, places where they are registered
and/or operate, products they manufacture or sell, and possible
controversies surrounding them already.
By doing this background research you create a profile of your main
actors and their connections, build your foundation for further
investigation, prepare yourself for interviews with relevant people(sources, witnesses, specialists etc.), establish connections and assessyour potential risks.

SUPPLY CHAIN AND PRODUCT INVESTIGATIONS

80

Internet research is a good place to start looking for basic information
about businesses and people associated with the companies in the
supply chain you’re investigating. Try to find out as much as possible
from companies’ websites and activity reports, supply chain due
diligence reports (if available), stock exchanges (if the company islisted), media articles or social media profiles of the company, its board
and staff. At the same time, look for official documents that include thecompanies’ registration data, shareholders, subsidiaries, members of
the board, directors, annual financial reports and other relevant details.
If you already know in which countries to look for official documents,
you can start by checking available online corporate registries andother official databases, such as land records, court records, patentregistries etc.

Researching companies
The Investigative Dashboard (investigativedashboard.org) is a
resource built by the Organized Crime and Corruption Reporting
Project (OCCRP), which indexes public company registries, land andcourts records from around the world. From this platform you cango to the country and type of records you want, but note that whilesome corporate records provide free access to basic or more advanced
information, others will require registration and charge a fee to provide
detailed company records. The Investigative Dashboard also allows
you to freely search and use a database (data.occrp.org) of millions of
documents and datasets from public sources, leaks and investigations
that OCCRP has conducted in the past.
Open Corporates (opencorporates.com) is a platform that lets you
search freely for company records and related data it collects fromall over the world. In addition, the International Consortium for
Investigative Journalism (ICIJ) provides the Offshore Leaks Database(offshoreleaks.icij.org) a massive resource of company records andother useful documents that have been revealed by large leaks andprojects the group has been working on, including the Paradise Papers,
Panama Papers, Offshore Leaks and Bahamas Leaks.

Visit the Kit for the complete guide “Supply Chain and Product
Investigations” by Mario Rautner:
kit.exposingtheinvisible.org/what/supply-chain.html

81

—
SAFETY FIRST!

Stay digitally and physically safe and aware ofpotential risks at all times by adopting somebasic good practices and tools to keep yourself,
your sources and your evidence protected.
82

Staying safe is an integral part of any investigation. Your safety, and thatof your data, your human sources and your collaborators should always
be a priority.
It’s therefore vital to think of the risks associated with the type of researchor investigation activity you are undertaking in any context, in order tomitigate those risks. This is part of a process called risk assessment.
Risk assessments are a common exercise in a number of disciplines
The more complicatedand risky your activity,
involving online and offline / field activities including scientific research,the more comprehensive
journalistic investigations, information collection by NGOs, or law
your risk assessment
enforcement investigations.
should be.
Before starting your work, make sure you also have a risk mitigation
or risk reduction plan. This involves coming up with ways you could
prevent, respond to and resolve problems that might arise. This plancan help you navigate the potential issues highlighted in yourrisk assessment.

Online safety
Searching and collecting evidence online - whether it’s about social media
data, online company records, domain ownership details, website history,
image metadata, etc. - involves navigating a large number of platforms,
tools and services. Some of these work with the Tor Browser(torproject.org) and that allows you to protect your privacy to a certain
extent. Others not only do not work on Tor but they also require you
to sign up with an email address, name and other personal details.
Depending on your investigation subject, your context and that of thepeople you work with, leaving digital traces while you investigate online
might put you at higher risk.
Consider these suggestions for digital safety techniques and tools that canhelp protect your digital privacy and enhance the security of your devices
and data.
The Tor Browser is abrowser that keeps youronline activities private.
It disguises your identityand protects your web
traffic from many forms
of internet surveillance.
It can also be used to
bypass internet filters.

Accounts
Some online services require you to create an account, to choose ausername, to provide payment information, to verify an email addresses
or to sign up with your social media profile to gain access to theirplatforms. Try to limit your exposure by considering these options:
Create a more secure, compartmentalised email account, which you
can do easily with services like Tutanota (tutanota.de) or Protonmail(protonmail.com).
83

Establish a separate set of social media accounts to use with services
that require your data, in order to compartmentalise (separate) yourinvestigative work from your personal online identity.
Create a single use “identity” for a particular investigation, and disposeof it once research is done. This may be needed especially when doing
sensitive work.

Browsers
It’s a good idea to use
different browsers foryour research and forcasual web browsing. By
doing so, you are again
practicing “compartmentalisation” - using
one browser for research
and another for everything else.

As someone who is looking to uncover hidden truths, you probably
already use the internet for personal communication and for some ofyour research.
We recommend you choose a “privacy aware” browser for your research
and avoid logging in to web-based email and social media on thatbrowser. This will prevent a lot of your personal data from being sent to
the websites you visit.
Before using any of the online tools we talk about here or in the online
Kit, it’s a good idea to download and install one of these browsers. Then,
add an extra layer of certainty by testing the browser with a tool like
Panopticlick (panopticlick.eff.org) or Browser Leaks (browserleaks.com).
The results of what you see when using a privacy aware browser shouldlook different from when you visit Panopticlick or Browser Leaks with anormal browser, which would usually reveal more weaknesses.
These are some examples of tools that can help protect your privacy
while researching online, with pros and cons of using them:Some webpages block
Tor by default and you
will have to decide
whether or not to visit
them with Tor turned off.

Tor Browser (torproject.org)
Pros: This is the best privacy aware browser. The code is publishedopenly so anyone can see how it works. It has a built-in way ofchanging your IP address and encrypting your traffic.
Cons: There are places in the world where Tor Browser usage isblocked or banned. While there are ways around these blocks, suchas Tor Bridges (torproject.org/docs/bridges), using Tor may also flag
your traffic as suspicious in such places.

SAFETY FIRST!

84

Firefox (firefox.com)
Pros: It blocks trackers and cookies with a setting called “Enhanced
Tracking Protection”, which is automatically turned on when you set“Content Blocking” to “strict”.
Cons: You need to turn on this option, it’s off by default. When you use
Firefox, it’s important to remember that your IP address is still visible
to the sites you visit.

Brave’s “Private Tab
with Tor” also allows
you to visit Tor hidden
service sites - which aresites that end in .onion
and are configured to
be securely accessed
only by Tor-enabledbrowsers.

Brave (brave.com)
Pros: It tries to protect privacy without the need for turning options onor adding add-ons or extensions. Brave has a security setting to erase
all Private Data when the browser is closed. It has a feature called‘Shields’ where you can block ads and trackers. It also allows you tocreate a new “Private Tab with Tor”, which uses the Tor network toprotect your IP address (regular use doesn’t protect it).
Cons: The “payments” or “Brave payments” feature that allows
donations should be kept off as it sends data that could be used to
identify you. When using use Brave, you should use the ‘Private Tab
with Tor’ feature to protect your IP address.
DuckDuckGo (duckduckgo.com)
Pros: This is a privacy-aware search engine (not a browser) thatclaims not to collect any personal data about its users. You can
use DuckDuckGo in combination with the Tor Browser to further
preserve your privacy.
Cons: DuckDuckGo does save your search queries but it doesn’t collectdata that can identify you personally.

85

VPNs work by
disguising your IP
address, which can beused by websites you
visit to map where you
are coming from. Whenusing a VPN, rather
than seeing your real IP
address, sites you visit
will see the IP of the
VPN provider.

Virtual Private Networks (VPNs)

If you are researchinga corporation andfrequently visit its boardof directors webpage – apage that typically getsvery little traffic - yourrepeated visits from yourspecific location mightmake the company
aware of your research.

There are many VPN options and it can be confusing when deciding
which one to pick. To add to the confusion, most VPN reviews andlistings are not independent, some are really biased. ThatOnePrivacySite(thatoneprivacysite.net) is a VPN review site we can endorse.

If you cannot use Tor, another option, though less effective in preserving
your anonymity, is to use a VPN (Virtual Private Network).
Visiting a website is like making a phone call. The website you arevisiting can see your “number” - your IP address - which can be used
to map where you are coming from. Think of the VPN as a concretetunnel between you and the site you want to visit. The VPN creates atunnel around your traffic so it can’t be observed from the outside, androutes it through an intermediary server owned by your VPN provider,so your traffic looks to any site you visit like it’s coming from a different
location than where you actually are. Neither the web browser, yourinternet service provider nor the site you visit will see your IP or be able
to identify you. Sites will only see that your traffic is coming from the IP
address of your VPN provider.

It is recommended you choose a VPN company that claims that they
do not record logs of your traffic. While you should avoid most free
VPNs because they are often funding their operation by selling theirlog data (records of what sites users visit via the VPN), there are some
reputable ones we recommend: Bitmask (BitMask.net), Riseup VPN(riseup.net/en/vpn), PsIPhon (Psiphon.ca), Lantern (getLantern.com).

Communication
Whenever possible, use encrypted email (PGP - Pretty Good Privacy,) in
communication with collaborators, sources and interviewees.
For calls and messaging, there are different applications with enhanced
levels of encryption and privacy such as Signal (signal.org) or Wire
(wire.com). These are preferred over WhatsApp, though the latest is of
more common use and you may encounter people who are not easily
accessible on any other (safer) apps.

SAFETY FIRST!

86

Check the Secure
Communication guide(securityinabox.org/
en/guide/securecommunication)from Tactical Tech’s
Security in a Box fortips, tools, and methods
to keep your digitalcommunication as
private as possible.

When you are forced to rely on conventional ways of communication non-encrypted phone calls, landlines, etc., - make sure that you provide
only the minimum information and try to establish in advance what
details are less risky to communicate with the person at the other end of
the line, and how. When fearing threats and surveillance, use the above
encrypted methods to get in touch with someone close to your sources
who can help organise a meeting.

On occasion, if you think
your phone might bemonitored, consider
using a burner phone a disposable phone you
can use on one or a few
occasions and that is not
linked to you or that you
can discard easily.

Field investigations carry more physical risk than working from behinda computer. Traveling to new places, talking to people, filming, or using
certain equipment can make you look suspicious in some contexts. This
is why planning, carrying out a risk assessment, and considering thepossible consequences of your actions is vital even if you are certain
your activity is low-risk. There are no strict rules for a risk assessment
but make sure you have a clear plan established in advance, know who
your important contacts are and which individuals or organisations
could provide assistance in the field.

Field safety

Here are some essential aspects to consider when assessing yoursituation:
If your activity includes interviews with confidential or vulnerable sources,
address the risks they are exposed to in your assessment. Discuss with themany vulnerabilities they might face while collaborating with you.
Take care when deciding the order in which you collect information, thepeople that you share it with, when/where you arrange to meet them andwhere and how you store the information you’ve gathered. Start withbackground research and less risky interviews or field work first, advance as
you gather more information and always reassess the risks.
Beware of disclosing confidential or sensitive information about yourinvestigation and sources. This might put you and your collaborators at risk
depending on the context and issues you are researching.

87

Image metadata canreveal more than you
want it to. It may bepossible for someone
to use it to locate otherphotos on the internetthat you or someone
else took with the same
camera, or figure out
where you live if any ofthe photographs weretaken in your home.
While you may wish
to preserve location
information as partof your evidence,
especially during fieldresearch, you should
also be cautious about
where and how you
share images and otherlocation-based data
you collect.

Risk is inherited. If you are someone with little to no risk (you may live
and work in a safe area) but you are interviewing a person experiencing
high risk (living in a dangerous area, being under pressure, working oncontroversial issues), you inherit that risk. Your risk level will be higher
for a period of time before and after the interview. If you interview
someone for a report or an article that will be published, be preparedfor your risk to increase at the time of publication. When investigating
individuals in positions of power and influence, be prepared for a
prolonged higher risk if they become aware of your investigation.

Keeping your location safe
A number of common apps, including Google Maps and WhatsApp,
allow you to share your real-time location with specific people for alimited period of time. This feature could potentially be helpful when
conducting field research because it can allow a trusted colleague tomonitor where you are, as a safety measure.
On the other hand, sharing your location in real time can put you at risk
if others who are interested in your whereabouts are able to access thedata you share. When researching sensitive topics, or if you suspect thatyou might be under surveillance, you should avoid sharing or storing
your location without using encryption.
Instead, consider finding alternative ways of tracking your daily
movements while investigating, such as marking places and details
manually, or using a printed map. In many cases, it is wiser to disable
such location sharing features from your mobile phone and otherdevices with location tracking functions. Most smartphones allow you to
do so under “Location Settings.”

Other factors
You will encounter situations where your perceived gender, race,
religion and other personal aspects will have an effect on how you can
do your work and how people you meet and interview accept or addressyou. Be aware of this and make sure you establish clear boundaries fromthe beginning to avoid unwanted or unexpected reactions. Research theplace, culture, beliefs, and social norms of the places, communities, andpeople you visit or plan to talk to.

SAFETY FIRST!

88

Visit the “Safety First!” sections of the online Kit for detailed advice
applied to each investigation context:
kit.exposingtheinvisible.org.
89—

GLOSSARY

Aerial imagery - photographs of the Earth’s surface taken frommanned or unmanned flying objects such as airplanes, balloons, kites,
helicopters, drones etc.
API - Application Programming Interface, by which a platform canmake its data accessible to external developers for free or under someconditions or fees.
Browser extensions - also called add-ons, they are small pieces ofsoftware used to extend the functionalities of a web browser (e.g.
extensions for spell-checks, screen-shots etc).
Brute force - a password cracking technique that involves trying every
possible combination.
Cache - a temporary, high-speed storage for data that has been usedor processed and may be retrieved again quickly rather than visiting
the original source or redoing computing associated with therequested data.

CAPTCHA - an automated test used by websites and online services todetermine whether a user is human or robot.
Chain of custody - the documented history of the treatment of a piece ofevidence. A chronological record of how material (documents, samples,etc.) is handled and by whom during an investigation. The term is usedin legal cases when managing evidence but also applies to any otherinvestigations.

Choropleth - a map where the different regions are coloured to show adifferences, for example, in voting percentages, or life expectancy etc.

GLOSSARY90

Content Management System (CMS) - software used to manage content
that is later rendered into pages on the internet.
Cookie - a small file, saved on your computer by your browser, that canbe used to store information for, or identify you to, a particular website.

Commodity - traded goods or raw material.
Corroborating evidence - additional evidence that supports otherevidence already obtained. Anything that supports a witness’s story or
your understanding of information.

Crawler - also called a spider, is a piece of software that systematicallybrowses the internet to collect and index information.

Database - a system used to store and organize collections of data witha particular focus or purpose. For example, a database of land andproperty ownership in country Z.

Dataset - a collection of data sharing some common attributes and thatis usually organized in rows and columns (tables) for easier processing.
For example, a dataset of the foreign owners of land and properties incountry Z.
Directory - a container used to categorise files or other containers offiles and data.
Domain name - a name that is commonly used to access a website (e.g.
tacticaltech.org). Domain names are translated into IP addresses.
Dorking - a technique of using search engines to their full potential by
employing refined searches.
Filter - in web search context, it is a keyword or phrase that has
particular meaning for the search engine.
Full-disc encryption - encryption that happens at a device or hardware
level. For example, encrypting and entire computer’s disk would also
automatically encrypt all the data saved on it.
Geocoding - the process of converting location data, such as a street
address, into precise latitude and longitude coordinates.

91Geodata - digital information that is directly linked to a physical or
geographic location.

Geographic information system (GIS) - a system or software used
to collect, store, process, analyse, interpret and represent geographic
information.
Geolocation - finding the real world location of an object, such as theplace that a photograph was taken.
Global Positioning System (GPS) - a US system of navigational
satellites that allow users to determine their position on earth.
Hacker - traditionally, anyone who interacts with technology inunexpected ways in order to learn more about it or to exploit it.
Human source - someone who shares information with you and/orwith whom you maintain contact over time, and who may contributeinformation to your investigations.
Internet Protocol (IP) address - a set of numbers used to identify
a computer or data location you are connecting to (example:
213.108.108.217).

Land cover (data, maps) - a way of classifying maps and satellite
imagery data based on what covers the Earth’s surface: grass, trees,
water, buildings, crops etc.

Land use (data, maps) - a way of classifying maps and satellite imagery
data based on how people use the land on the Earth’s surface: foragriculture, transport, recreation, residential, etc.

Metadata - information about information. E.g.: the content of a soundfile is the recording, but the duration of the recording is a property of thefile that can be described as metadata.

Off the record - you cannot make information you receive public or
attribute it to the person who gave it to you.

On the record - you can use the information provided in an interview orconversation and mention the person that gives it to you.

GLOSSARY92

Proof of life - a document that contains confidential information andsometimes passwords that someone you fully trust will keep in order todetermine, based on your online activity (or lack of it), whether you arestill alive.

Release/consent form - forms that grant permission for the use of
information or media from interviews, or which show that you havedone your due diligence in explaining to your subjects the details andpossible risks associated with participating in your research.

Risk assessment - a method of measuring the chance that certain
threats might happen along your investigation, so you know how toprevent them and/or address them if you can’t avoid them.

Robots.txt - a file on a website that instructs automated programs (bots/robots/crawlers) how to behave with data on the website.

Satellite imagery - images of the Earth’s surface or of other planets’surface taken by satellites. These images are often taken in stages andcombined to obtain a complete overview of large areas, to create maps,
and to observe land and water surface details.

Server – a computer that remains on and connected to the internet inorder to provide a service, such as hosting a webpage or sending andreceiving email, to other computers.
Supply chain - a set of steps that commodities (goods or raw materials)
undergo on their way to becoming products used by consumers orindustry.

Thematic map - a map showing information related to a specificsubject, such as air pollution, forest cover, election results.
Tor browser - a browser that keeps your online activities private. It
disguises your identity and protects your web traffic from many forms
of internet surveillance. It can also be used to bypass internet filters.

Universal Resource Locator (URL) - a web address used to retrieve a
page or data on a network or internet.

93

Virtual Private Network (VPN) - software that creates an encrypted“tunnel” from your device to a server run by your VPN service provider.
Websites and other online services will receive your requests from - andreturn their responses to - the IP address of that server rather than youractual IP address.
Webpage - a document that is accessible via the internet, displayed in a
web browser. A collection of webpages make a website.

Web server - also known as internet server, is a system that hosts
websites and delivers their content and services to end users over theinternet. It includes hardware (physical server machines that store theinformation) and software that facilitates users’ access to the content.
Web tracker - tool or software used by websites in order to trace theirvisitors and how they interact with the site.

GLOSSARY

94

—

CREDITS
Contributing Authors: Ankita Anand, Annabel Church, Hang Do Thi
Duc, Wael Eskandar, Alison Killing, Jess Lempit, Hanna Liubakova,
Offray Luna-Cárdenas, Amber Macintyre, Filip Milosevic, Matt Mitchell,
Bianca Mondo, Brad Murray, Megha Rajagopalan, Laura Ranca, Mario
Rautner, Gabi Sobliye, Nuria Tesón, Carolyn Thompson, Marek Tuszynski, Jose Felix Farachala Valle, Chris Walker, Johanna Wild
Editors: Natalie Holmes, Christy Lange, Karolle Rabarison, Laura Ranca,
Michael Runyan, Sasha Gubskaya
Design: Tactical Tech’s design team - Cade Diehm (design lead), Ida Flik,
Yiorgos Bagakis, Philipp Dollinger
Developers for the online Kit: Jacopo Anderlini, Laurent Delleré, Wael
Eskandar, Zach Green, Danja Vasiliev, Chris Walker
Illustrations: Ann KiernanCommunications: Daisy Kidd
Project Team Behind The Kit: Wael Eskandar, Christy Lange, Matt
Mitchell, Laura Ranca, Gabriela Rodriguez Berón, Marek Tuszynski,
Chris Walker, Leil Zahra
Special Thanks: This kit would not have been possible without ourcollaboration with Share Lab and Share Foundation in co-hosting the2017 Data Investigation Camp and the 2018 Citizen Investigation Kit
Residency.
The Kit would also not have been possible without the hard work of
Exposing the Invisible’s former project lead Gabi Sobliye.
Special, special thanks to the Perast Group!

95

—

EXPOSING THE INVISIBLE
Exposing the Invisible (ETI) is a Tactical Tech project that actively experiments with ways
to promote investigation as one of the most important forms of public engagement. Througha series of films, interviews, guides and resources, ETI looks at different techniques, tools
and methods along with the individual practices of those working at the new frontiersof investigation.
exposingtheinvisible.org
eti@tacticaltech.org

GPG Key fingerprint: BD30 C622 D030 FCF1 38EC C26D DD04 627E 1411 0C02

Tactical Tech
Tactical Tech is a Berlin-based non-profit organisation that investigates the evolving
impact of digital technologies on society. Through our work we aim to educate, advocate andcreate practical solutions that contribute to the wider socio-political debate around digital
security, privacy and the ethics of data.
tacticaltech.org@info_activism
facebook.com/tactical.tech
ttc@tacticaltech.org

GPG Key fingerprint: 0X9B7146F981654FBEE17A0CAAF6B047919EC6096D
This Kit was possible thanks to the support of:and Tactical Tech’s other funders.
Licensing:
CC BY-SA 4.0
The Kit is licensed under a Creative Commons Attribution-ShareAlike 4.0
International license

Tactical Tech 202096