What are "Research Accounts" or "Sock Puppets"?

Ritu Gill

October 1st, 2024

In the realm of Open Source Intelligence (OSINT) investigations, "research accounts" or "sock puppets" are fabricated online personas crafted to safeguard the investigator's actual identity while providing access to information that might necessitate an account for accessibility.

While the creation of such fictitious accounts might infringe upon the Terms of Service for some online platforms, it's generally not illegal. Nevertheless, it's crucial to be familiar with these terms and to obtain any necessary permissions from your organization before creating and utilizing sock puppets.

Understanding the Purpose of Sock Puppets

OSINT investigators employ sock puppets to access content across different websites, like social media platforms, where certain information is only available to logged-in users.

Another significant reason for using sock puppets is to maintain a clear separation between an investigator's personal and professional online interactions, essentially practicing reliable Operational Security (OPSEC). This segregation minimizes the risk of unintentional actions, such as inadvertently liking a post on the subject's profile or accidentally sending them a friend request.

Consider this analogy: If you were a police officer, you wouldn't use your personal vehicle for surveillance, would you?

The same principle applies here.

Just as your vehicle can be traced back to your identity, so can your social media profiles. Hence, the importance of creating sock puppets prior to initiating an investigation.

The Advantages of Sock Puppets

For the sake of privacy, security, and maintaining the investigation's credibility, it is advised that OSINT investigators refrain from using personal social media accounts for their investigative activities.

This separation helps gather information discreetly and anonymously, and that's where sock puppets come into play.

Role of Sock Puppets in OSINT Investigations

In most cases, OSINT investigators perform passive research, implying no direct engagement with the target. However, it's vital to distinguish between active and passive open-source research, as the manner in which the sock puppet accounts are established will vary according to the research type.

Passive research doesn't involve interacting with the target, but your profile may still appear in "suggested friends" or "people you may know" lists. Thus, it's advantageous to blend in with your target group.

Active research, on the other hand, implies some level of engagement with the target. In this case, creating multiple accounts on different platforms to appear as a real person becomes even more crucial.

Guidelines for Creating Sock Puppets

Setting up sock puppets can be challenging and often relies on a trial-and-error approach. However, here are a few essential points to consider:

• IP Address: Avoid using a Virtual Private Network (VPN) while setting up a sock puppet, as many social media platforms flag VPN servers.
  Using free Wi-Fi connections at various locations (such as coffee shops) can give the impression of a user logging in from different places, hence reducing the chances of being flagged.
• Name: Use fictitious details and avoid using your real identity. Ensure the chosen name blends in with your target group to avoid raising suspicion.
• Email Address: Opt for a new email address, never used before, from providers like Mail.com, Gmail.com, Yandex.com, Outlook.com.
• Phone Verification: Use a burner phone and SIM card, if phone verification cannot be bypassed.
• Privacy Settings: Review and configure the privacy settings right away to secure your account. Depending on whether you're doing passive or active research, the degree of privacy required may differ.
• Profile Photo: Utilize images of landscapes or generic settings. Refrain from assuming someone else's identity. Consider using cropped stock images to avoid detection by platforms that flag accounts using stock photos.
• Activity: Mimic the behavior of a genuine user by posting links, liking pages, etc. The objective is to convince the platform that you are a real person.

Remember, creating a convincing sock puppet account is an art that requires careful planning, a good backstory, and a consistent online presence that aligns with the character you are portraying.

The goal is not merely to bypass the platform's security but to ensure a convincing and credible presence for the duration of your investigation.