False Personas and Covert Research Accounts for OSINT

Maintaining anonymity is often vital during internet investigations. Using a personal social media account for OSINT can expose the investigator and their investigation. Viewing a profile may trigger a notification, with the platform recommending the investigator to the subject through “people you may know”. 

The moment a subject catches wind of an investigation like this, they're prone to altering their behaviours and routines. Such alerted subjects can also pose tangible risks to investigators, jeopardizing not only the investigation but potentially the safety of those involved.

To remain anonymous during an internet investigation, investigators can use covert accounts, also known as false persona accounts and sock puppet accounts. Covert research accounts help create separation between an investigation and the person or organisation conducting it. However, not every investigation requires a fully developed false persona. In many cases, a basic research account is sufficient.

The level of identity development should reflect the access required, the risk of attribution and the degree of interaction involved. Creating an elaborate fictional identity when a simple viewing account would achieve the same objective adds unnecessary risk.

What Is a Covert Research Account?

A covert research account is an online account used to conduct research without disclosing the investigator’s real identity.

These accounts are sometimes called “sock puppets”. Although widely understood within the OSINT community, that term can suggest manipulation or inauthentic influence. “Covert research account” is generally more appropriate in professional policies, reports and legal proceedings.

Covert research accounts range from basic accounts used only to access platform functionality to developed personas capable of operating credibly within a particular online community. It is useful to distinguish between three levels.

Level 1: Basic Research Account

A basic research account exists primarily to provide access to a platform.

It may be used to:

• Run searches that are unavailable to logged-out users
• View public profiles, posts or marketplace listings
• Follow public pages or channels
• Reduce exposure of the investigator’s personal account
• Separate investigative browsing from ordinary platform activity

The account does not normally communicate with subjects, request access to private spaces or present an elaborate identity. These accounts could be under a false name or even the investigating company name depending on investigative requirements. For many OSINT investigations, this is all that is required.

Level 2: Covert Research Persona

A covert research persona has enough detail to appear plausible if another user views it. It might have an appropriate name, profile image, general location, interests and a limited history of ordinary platform activity. Its purpose is not necessarily to deceive a particular subject, but to prevent the account from appearing empty or obviously investigative.

A research persona may be appropriate when:

• Empty accounts are routinely blocked or rejected
• Membership of a broad community requires a credible profile
• The subject is likely to inspect followers or group members
• Research will continue over an extended period
• The platform removes accounts that appear inactive or inauthentic

Even at this level, the account should normally remain observational.

Level 3: Undercover Covert Identity

An undercover covert identity establishes or maintains relationships with other users while concealing the investigator’s real identity or purpose.

This could include:

• Sending friend or follow requests
• Joining closed or restricted groups
• Communicating directly with a subject
• Participating in discussions to build credibility
• Encouraging another person to disclose information
• Developing a continuing relationship with a person or group

This is substantially different from using an account to view public material. It introduces greater legal, ethical, operational and evidential risk and should not be treated as routine OSINT.

For UK public authorities, interaction of this kind will generally engage RIPA and the rules governing Covert Human Intelligence Sources. The Home Office code explains that online activity may become CHIS conduct where an investigator establishes or maintains a relationship for a covert purpose. Appropriate advice and authorisation may therefore be required before any interaction begins.

Private-sector investigators are not authorised by RIPA in the same way, but they must still consider data protection, privacy, misrepresentation, platform rules, contractual restrictions and the lawfulness of their conduct.