Sock Puppet Accounts

Learning Objectives

• After this, students can explain what a sock puppet (research persona) is and when it’s legitimately used.
• After this, students can identify the Terms of Service and legal issues sock puppets raise.
• After this, students can apply ethical rules to persona use, including never impersonating real people.
• After this, students can describe how to plan, document, and compartmentalize a persona at a conceptual level.
• After this, students can recognize when not to use a sock puppet and what to do instead.

What a Sock Puppet Is

A sock puppet is a fictitious online identity used so that research activity isn’t tied to the investigator’s real identity. In professional settings you’ll also hear research account, persona, or (in law enforcement) online undercover account.

The term predates OSINT. In online communities, “sock puppet” originally meant a fake account someone used to deceive others, such as praising their own posts or dodging a ban. That history is a reminder that the same tool can be used honestly or dishonestly, and the difference is purpose, authorization, and behavior.

Two kinds of persona use

Passive (observer)	Active (engagement)
Logs in only to view content that requires an account	Interacts: follows, friends, joins groups, messages people
Doesn’t deceive any specific person	Deceives the people it interacts with
Lower ethical and legal risk (but still usually a ToS issue)	Much higher risk: effectively social engineering
Common in everyday OSINT	Requires explicit authorization, legal review, and training

Most OSINT work, and everything in this class, stays on the passive side.

Legitimate Uses

• Viewing content that requires a login, such as LinkedIn profiles beyond the preview or public Facebook pages that hide content from logged-out visitors
• Protecting the investigator’s real identity from the target (no “who viewed your profile” notifications with your name on them)
• Protecting the client relationship so the target can’t learn who is investigating them
• Threat intelligence monitoring of public criminal channels with organizational approval (see Module 6)
• Journalism and human rights research where revealing the researcher could endanger them or their sources
• Missing-persons work (such as Trace Labs events) conducted under that event’s rules

Terms of Service and Legal Considerations

Before using a sock puppet, read the platform’s Terms of Service (see Module 2). Most major social platforms explicitly prohibit them:

• LinkedIn User Agreement
• Section 2.1: “you will only have one LinkedIn account, which must be in your real name”
• Section 2.1: “Creating an account with false information is a violation of our terms”
• Section 8.2 (Don’ts): don’t “Create a false identity on LinkedIn, misrepresent your identity, create a Member profile for anyone other than yourself”
• Meta (Facebook) Terms of Service, Section 3.1:
• “Provide for your account the same name that you use in everyday life.”
• “Create only one account (your own) and use it for personal purposes.”
• “Provide accurate information about yourself.”
• Other platforms differ. Some allow pseudonymous accounts as long as they don’t impersonate others (X has historically permitted pseudonymous and parody accounts under its authenticity rules; verify before class). Read each platform’s current terms.

What this means in practice:
- Account bans are the most common consequence. Plan for personas to be removed at any time.
- Civil liability is possible. In the hiQ Labs v. LinkedIn litigation (covered in Module 2), hiQ’s use of fake accounts contributed to its loss on breach-of-contract grounds.
- Criminal exposure depends on what you do with the persona. Merely violating ToS is generally treated as a contract issue in the US after Van Buren, but using a persona to commit fraud, harass someone, obtain protected records by pretexting, or impersonate a real person can be a crime. Many states have online impersonation laws (check your state).
- Get written authorization. On an engagement, the rules of engagement should say whether personas are allowed and whether any interaction is allowed. Many organizations also require a registered list of approved personas.
- Law enforcement and government investigators operate under their own agency policies for online undercover activity, which are stricter than anything in this class.

Ethical Rules

1. Never impersonate a real person. A persona must be fictional. Don’t use a real person’s name plus details, and don’t clone a real profile.
2. Never use a real person’s photo. Stolen photos harm the person pictured, who may get harassed or blamed, and reverse image search will expose the persona anyway.
3. AI-generated faces are not a free pass. They avoid harming a specific person, but they are a deliberate deception, some platforms prohibit them, and they often have detectable artifacts. Follow your organization’s policy.
4. Observe, don’t participate. Don’t like, comment, post opinions, or join discussions in ways that could influence the people you’re researching.
5. Don’t deceive private individuals to get private content (friend requests, joining closed groups, direct messages) unless explicitly authorized and legally reviewed. At that point you are doing social engineering, not passive OSINT.
6. No entrapment or manipulation. Never encourage someone to say or do something they otherwise wouldn’t.
7. Minimize. Use the persona only for its approved purpose and collect only what the objective requires.
8. Be accountable. Log what each persona did and why, so your actions can be reviewed.

Planning a Persona (Conceptual)

This section covers how to think about personas responsibly. It is not a guide to getting around platform fraud detection or identity verification, which you should never attempt without explicit authorization and legal guidance.

Start from the purpose

• Which platforms do you need, and what content requires a login?
• Is the need purely passive viewing?
• How long will the persona be needed: one engagement or ongoing monitoring?
• What happens if the persona is discovered?

Plausibility and consistency

A persona that looks strange draws attention, and inconsistencies are indicators (see 8.1-opsec-fundamentals.md).
- Keep it boring. An unremarkable profile attracts less scrutiny than a flashy one.
- Fit the context. The persona’s stated location, language, and interests should make sense for the content it views.
- Stay consistent across layers. Stated location vs. IP location, stated time zone vs. activity times, language and spelling habits (US vs. UK English), and account details should all agree.
- Avoid real-person collisions. Choose a common, generic fictional name and don’t borrow details from anyone you know or have researched.
- Expect scrutiny of new accounts. Brand-new, empty accounts often look suspicious to both platforms and targets. Organizations handle this through their own approved persona programs rather than improvised shortcuts.

Documentation: the persona log

Every persona should have a record kept in secure storage (not on the persona’s own accounts). A fictional example:

Field	Example
Persona ID	P-014
Display name	“Dana Miller” (fictional)
Purpose	Passive viewing of LinkedIn profiles for authorized external assessments
Approved by / date	Engagement lead, 2026-09-01
Platforms	LinkedIn (view only)
Email / phone	Dedicated research email; organization-issued number
Environment	Research VM #2, Firefox container “P-014”, VPN exit: US Midwest
Backstory summary	Generic: marketing coordinator, Midwest, uses US spelling
Photo	None, or an approved non-human/generic image per policy
Credentials	Stored in research password vault entry “P-014”
Activity log	Dates, cases, and what was viewed
Status	Active / retired (date)

“Backstopping” is the term for the supporting details that make a persona hold up when someone checks it. The more a persona needs to withstand scrutiny, the more it drifts toward active undercover work, which requires authorization.

Compartmentalization

Compartmentalization means keeping each persona completely separate from your real identity and from other personas.

• One environment per persona: a dedicated browser container, profile, or VM. Never open a persona and your personal account in the same browser session.
• Never access a persona from personal devices or your home/corporate IP.
• Dedicated email and phone for each persona. Don’t let two personas share recovery details.
• Personas never interact with each other (no following, friending, or messaging between them) and never interact with your real accounts.
• Don’t sync contacts from any device where a persona is logged in.
• Don’t cross-contaminate investigations. A persona used to watch threat actors shouldn’t be reused for unrelated corporate work; if one is burned, the others shouldn’t fall with it.
• Retire (“burn”) personas deliberately when they’re exposed, flagged, or no longer needed. Log the retirement and remove saved credentials from active use.

When NOT to Use a Sock Puppet

• When the information is available logged-out. Always try the least-intrusive method first.
• When the ToS or rules of engagement prohibit it and you don’t have explicit authorization.
• When you’d need to deceive a private individual to get access.
• When an approved alternative exists: an official API, a licensed data provider, or the client granting access to its own accounts and pages.
• When the risk outweighs the value. If discovery could endanger someone, expose a client, or create legal liability, rethink the approach.
• In this class. Don’t create sock puppets on real platforms for class exercises. Practice persona planning on paper (see labs.md) and use approved targets and practice platforms.

Alternatives to try first

Need	Alternative
See a public profile	Logged-out view, search engine results, archived copies (Wayback Machine)
Read a public Telegram channel	The t.me/s/<channelname> web preview (no account needed)
Collect data at scale	Official API or data access program
Assess a client’s own pages or groups	Ask the client for access
Monitor criminal forums	Dark web intelligence platforms (see Module 6)

Key Terms

• Sock puppet / persona / research account: a fictitious online identity used for research.
• Passive persona: a persona used only to view content, without interacting with people.
• Active persona: a persona that interacts with people; effectively social engineering.
• Backstopping: supporting details that make a persona believable under scrutiny.
• Compartmentalization: keeping personas separated from each other and from your real identity.
• Burning a persona: retiring it because it’s exposed or no longer needed.
• Persona log: the secure record of a persona’s purpose, approvals, setup, and activity.

Key Takeaways

• Sock puppets let investigators view login-only content without revealing who they are.
• Most major platforms (LinkedIn, Facebook) prohibit fake accounts in their ToS, so expect bans and get authorization.
• Never impersonate a real person or use a real person’s photo.
• Observe, don’t participate; interacting with people is social engineering.
• Keep personas fully compartmentalized: separate environment, email, phone, and IP, with no links between them.
• Document every persona and retire it deliberately.
• Try logged-out views, archives, APIs, and client access first.

References

• LinkedIn User Agreement
• Meta Terms of Service
• Browsing Profiles in Private and Semi-Private Mode — LinkedIn Help
• Multi-Account Containers — Mozilla Support