Lesson 7.1

Verifying Information

Learning Objectives

Evaluate a source by asking who published it, when, why, and whether they could actually know what they claim
Tell the difference between true independent corroboration and the same claim repeated many times
Decide whether two online identities belong to the same person using several strong identifiers, not just a name
Run a basic image and video verification workflow: find the original, check metadata, confirm location and time
Explain why AI-generated and manipulated media are hard to detect, and why provenance and context matter more than “spotting the fake”

Why Verification Matters

Collection is the easy part of OSINT. Search engines, social media, and automated tools will hand you thousands of data points in minutes. The hard part, and the part that separates a professional from someone who “found some stuff online,” is working out which of those data points are true, current, and about the right person or organization.

Getting it wrong has real costs:
- For a pentest or red team: a phishing campaign aimed at people who left the company years ago, or an attack plan built on a technology the client no longer uses.
- For a defender: hours spent chasing a “breach” that turns out to be recycled data from 2019.
- For a person: being publicly accused of something they had nothing to do with. Some of the cautionary cases later in this file show how bad that can get.

The working rule from the intro lecture is the one to drill in: treat everything as unverified until it is corroborated.

Evaluating a Source

Before judging a piece of information, judge where it came from. Five questions cover most of it:

Question	What you’re looking for	Red flags
Who published it?	A named person or organization with a track record	Anonymous accounts, brand-new accounts, sites with no “about” information
When was it published?	A clear date, and whether the information is still current	No date, a date that doesn’t match the content, old content re-shared as new
Why was it published?	The source’s motivation (inform, sell, persuade, deceive)	Strong emotional language, a product to sell, a political agenda, a “leak” someone wants to monetize
How would they know?	Direct access: they were there, they own the system, they wrote the document	Second-hand claims, “a friend told me,” no explanation of how they got the information
Where else does it appear?	Other independent sources confirming it	Only one source, or many sources that all trace back to the same post

Primary, secondary, and tertiary sources

Primary: the original. A company’s own SEC filing, the original uploaded video, a court record, a DNS record you queried yourself.
Secondary: someone reporting on or interpreting the original. A news article about the filing, a blog post embedding the video.
Tertiary: summaries of summaries. Wikipedia, aggregator sites, people-search sites, “top 10” lists.

Always try to work your way back to the primary source. Secondary and tertiary sources are useful for finding the primary source, but details get lost or changed at each step.

Lateral reading

Instead of reading deeply within a site to decide if it’s trustworthy (which is exactly what a well-designed fake site wants you to do), open new tabs and look up what other sources say about that site or account. A professional-looking “security research firm” with no footprint anywhere else on the internet is a warning sign.

Independent Corroboration

Corroboration means a second source confirms the claim. The key word is independent: the second source must have its own access to the information, not just be repeating the first.

Circular reporting

Circular reporting happens when a claim bounces between sources until it looks well-supported, even though it all started from one place.

Example (fictional):
1. An anonymous forum post says “Company X was breached last week.”
2. A small blog writes an article citing “reports online.”
3. A larger site cites the small blog.
4. Social media accounts share the larger site’s article.
5. Someone then “confirms” the breach by pointing to the larger site.

Five sources, but only one actual source: the anonymous forum post. Everything else is an echo.

How to check independence

Follow every citation back until you reach the original claim.
Look for different kinds of evidence, not just more of the same kind. A forum post, a DNS change, and a company statement are three independent types; three news articles quoting the same forum post are not.
Check timing. If every source appeared after one specific post, they probably all came from it.
Ask whether each source had its own access to the facts.

Identity Resolution: Same Name ≠ Same Person

One of the most common and most damaging OSINT mistakes is deciding two things belong to the same person when they don’t.

Strong vs. weak identifiers (selectors)

A selector is any piece of data that can identify or point to a person or account: a username, email address, phone number, photo, and so on. Selectors are not all equally reliable.

Strength	Examples	Why
Strong	Email address, phone number, unique username tied to an email, account ID numbers, a photo that matches exactly across accounts	Usually unique to one person
Medium	Uncommon full name plus city, employer plus job title, distinctive writing style, the same profile photo	Narrows it down but can still match multiple people
Weak	Common name, first name only, a city, a hobby, a generic username like `mike123`	Matches many people

A worked example (fictional)

You’re looking for Jordan Lee, an IT administrator at Company X.
- A LinkedIn profile: “Jordan Lee, Systems Administrator at Company X, Denver.” (medium: name + employer + role)
- A GitHub account jlee-sysadmin with a commit email jordan.lee@companyx.com. (strong: work email matches the known email format)
- A Reddit account jordanlee posting in a Seattle subreddit about a new job at a bakery. (weak: common name, different city, different job)
- An Instagram account with the same profile photo as the LinkedIn profile. (medium-to-strong: confirm with reverse image search that the photo isn’t a stock image)

A careful analyst links the LinkedIn, GitHub, and Instagram accounts (with stated confidence) and does not link the Reddit account. It might be the same person, but nothing ties it to them except a very common name.

Rules of thumb

Require at least two independent, medium-or-strong identifiers before linking accounts, and say how confident you are.
Watch for username collisions. Tools like WhatsMyName and Sherlock report that a username exists on a site, not that it belongs to your target.
People-search sites merge records. They regularly combine two people with similar names into one profile, or attach an old address to the wrong person.
Information ages. People move, change jobs, change names, and reuse usernames that someone else abandoned.
Record why you linked two things. If you can’t explain it, you haven’t verified it.

Checking Account Authenticity

Before trusting what an account says, check whether the account is what it appears to be.

Account age: A “company official” account created last week is suspicious. Many platforms show a join date on the profile.
Post history: Scroll back. Does the history match the claimed identity? Did the account suddenly change topics, language, or name?
Handle and name changes: Accounts get bought, sold, and repurposed. Archived copies of the profile (Wayback Machine) can show what it used to be.
Profile photo: Run a reverse image search. Stock photos, photos of other people, and AI-generated faces are common on fake accounts.
Followers and engagement: Thousands of followers but almost no real interaction, or followers that are themselves brand-new accounts, suggest bought followers or a bot network.
Posting patterns: Posting around the clock with no breaks, or in perfectly regular intervals, suggests automation.
Cross-platform consistency: A real organization usually links its official accounts from its own website. Start from the website and follow its links rather than trusting a search result.

Verification badges are not proof

On X (formerly Twitter), the blue check used to mean the platform had confirmed the account’s identity. Since the platform switched to paid verification and removed legacy check marks in April 2023, a blue check mainly shows that the account pays for a subscription. During the May 2023 fake Pentagon explosion incident (see below), one of the accounts spreading the image was a blue-check account impersonating Bloomberg News. Treat badges as one weak signal, not verification.

Image and Video Verification Workflow

Most misleading images and videos online are not sophisticated fakes. They are real media shared with a false story attached: old footage presented as new, or footage from one place presented as another. A simple, repeatable workflow catches most of these.

Step 1: Find the earliest version

Run a reverse image search on several engines (Google Lens, Bing Visual Search, Yandex Images, TinEye). Each has a different index.
TinEye can sort results by oldest, which helps find where an image first appeared.
For video, extract keyframes (still frames) and reverse search those.
If an image appeared online before the event it claims to show, the claim is false.

Step 2: Check the metadata

exiftool photo.jpg
exiftool -GPSLatitude -GPSLongitude -DateTimeOriginal -Model photo.jpg

- Metadata can show the camera or phone model, original capture time, GPS coordinates, and editing software.
- Most major social platforms strip metadata when an image is uploaded, so an image downloaded from social media usually has little or none.
- Metadata can be edited. Treat it as a lead to check, never as proof on its own.

Step 3: Confirm the location

Match visible features (signs, buildings, road markings, mountains, shop names) against maps, satellite imagery, and street-level imagery.
Detailed geolocation technique is covered in Module 4 Collection Techniques.

Step 4: Confirm the time

Shadows: Tools like SunCalc show the sun’s direction and height for any place and time. Shadow direction and length should match the claimed time.
Weather: Historical weather records should match the weather in the image (rain, snow, clear skies).
Content clues: Seasonal plants, event banners, storefronts that opened or closed at known times, vehicles, and clothing.

Step 5: Examine the content itself

Look for inconsistencies: mismatched lighting or shadows, warped straight lines, repeated patterns, blurry edges around objects, text that doesn’t make sense.
Forensic filters (such as error level analysis) can highlight areas that were edited, but they are easy to misread. Treat them as a reason to look closer, not as a verdict.

Step 6: Investigate the uploader

Who posted it first? Were they plausibly there? Apply the account authenticity checks above.
If possible, contact the original uploader to ask how and when they captured it. (In a professional setting, this is an active step that needs to fit your scope and OPSEC plan.)

Tool: InVID-WeVerify verification plugin

The InVID-WeVerify plugin is a free browser extension for Chrome and Firefox, widely used by journalists and fact-checkers, that bundles several of these steps:
- Keyframes: splits a video (from a URL or an uploaded file) into keyframes for reverse image search
- Metadata: reads metadata from images and videos
- Magnifier: zooms, sharpens, and flips images at pixel level to examine small details such as signs or license plates
- Forensic: a set of filters for spotting signs of image editing
- Reverse search: sends images or keyframes to several reverse image search engines at once

If you prefer command-line tools, ffmpeg can extract frames from a video for reverse searching:

# Save one frame per second of video as numbered PNG files
ffmpeg -i video.mp4 -vf fps=1 frame_%04d.png

AI-Generated and Manipulated Media

Types of manipulated media

“Cheapfakes”: real media that is cropped, slowed down, sped up, re-captioned, or taken out of context. No AI required, and extremely common.
Edited images: objects or people added or removed with editing software.
Fully AI-generated images: created from a text prompt.
Deepfake video: a person’s face or body swapped or animated to do or say things they never did.
Voice clones: synthetic audio imitating a specific person’s voice (a common tool in phone scams and business email compromise).

Why “spot the fake” is not a reliable strategy

Guides often list visual tells for AI images: odd hands, garbled text, inconsistent lighting, strange reflections, melted-looking backgrounds. These can help, but:
- Generation models improve quickly, and each tell tends to disappear with newer models.
- Real photos can have odd artifacts too (compression, motion blur, lens distortion), which leads to false accusations that a real image is fake.
- AI-detection tools give probabilities, not answers. They can be wrong in both directions, and they may not work on newer models or on images that have been compressed, resized, or screenshotted.

Provenance: Content Credentials (C2PA)

The C2PA standard (“Content Credentials”) lets cameras, editing tools, and AI generators attach a cryptographically signed record describing where a file came from and how it was edited. It is useful, but it has important limits:
- It is a provenance system, not a detection system. It records what the signer claims, including whether AI was used.
- Many platforms and messaging apps re-encode images on upload, which strips the credentials. A stripped file gives no sign that credentials ever existed.
- So the absence of Content Credentials proves nothing. Most real photos online don’t have them.

What to do instead

Focus on the things generation tools can’t easily fake: provenance and context.
- Where did this first appear, and who posted it?
- Do independent, reliable sources confirm the event happened?
- Do the location and time check out?
- Would the event have left other traces (other photos from different angles, official statements, news coverage, local reports)?

Case: The fake Pentagon explosion (May 22, 2023)

An image showing smoke near what appeared to be the Pentagon spread rapidly on social media, including from blue-check accounts, one of which was impersonating Bloomberg News. The US stock market dipped briefly during the minutes it circulated before recovering once it was debunked. Analysts pointed to signs that the image was likely AI-generated, but the fastest debunk was contextual: there were no other photos, witnesses, or official reports of an explosion, and local authorities confirmed nothing had happened.

Lesson: a single image with no corroboration should never be treated as confirmation of an event, no matter how many accounts share it.

Cautionary Cases: When Verification Fails

Boston Marathon bombing and Reddit (April 2013)

After the bombing on April 15, 2013, users on Reddit and other social media platforms tried to identify the bombers from crowd photos. Among the people wrongly named was Sunil Tripathi, a Brown University student who had been missing for about a month. The false claim spread widely before the FBI identified the actual suspects. Tripathi’s body was found on April 23, 2013. Reddit’s general manager, Erik Martin, publicly apologized to the family for the “online witch hunt.”

What went wrong:
- Resemblance in low-quality photos was treated as identification.
- The fact that someone was missing was treated as evidence they were involved.
- Crowd enthusiasm replaced verification; each share made the claim look more credible (circular reporting).
- No one considered the harm to an innocent person and their family.

Charlottesville rally misidentification (August 2017)

After the white nationalist rally in Charlottesville, Virginia, social media users claimed a torch-carrying man in a photo was Kyle Quinn, an assistant professor at the University of Arkansas. The “evidence” was a physical resemblance and an “Arkansas Engineering” T-shirt. Quinn was actually in Arkansas at the time. Even after the university publicly corrected the claim, the misidentification kept spreading, and Quinn and his wife spent the weekend hiding at a friend’s house because of threats.

What went wrong:
- A weak identifier (a shirt) plus a resemblance was treated as a match.
- No one checked whether he could have been there (his location at the time).
- Corrections spread more slowly than the original accusation.

The takeaway for students

Both cases involved people who believed they were helping. Good intentions don’t replace verification. In professional work, a wrong identification in a report can lead a client, an employer, or law enforcement to act against an innocent person. This connects directly to the ethics material in Module 2.

Verification Checklist

Use this before any finding goes into a report:
- [ ] I traced the information back to its original source
- [ ] I evaluated who published it, when, why, and how they would know
- [ ] At least one independent source confirms it (or I marked it unverified)
- [ ] Any identity link uses at least two independent medium-or-strong identifiers
- [ ] I checked account age, history, and authenticity for any account I’m relying on
- [ ] For images and video: I found the earliest version and checked location and time
- [ ] I considered whether the information is outdated
- [ ] I considered alternative explanations (see 7.2-analysis-and-cognitive-bias.md)
- [ ] I recorded my confidence level and the reasons for it
- [ ] I captured and documented the evidence (see 7.3-documentation-and-evidence.md)

Key Terms

Verification: establishing whether collected information is accurate, authentic, and about what it claims to be about
Corroboration: confirmation of a claim by a second, independent source
Circular reporting: when many sources repeat one original claim, making it look better supported than it is
Primary source: the original record, document, or media
Lateral reading: judging a source by checking what other sources say about it
Selector: a piece of data that identifies or points to a person or account (email, username, phone number)
Identity resolution: deciding whether different records or accounts belong to the same person
Keyframe: a still frame extracted from a video, often used for reverse image search
Cheapfake: media manipulated with simple methods (cropping, re-captioning, speed changes) rather than AI
Deepfake: AI-generated or AI-altered video or audio that imitates a real person
Provenance: the documented origin and history of a piece of content
Content Credentials (C2PA): a standard for attaching signed provenance information to media files

Key Takeaways

Everything is unverified until independently corroborated
Ask: who published it, when, why, and how would they know?
Ten sources repeating one post is still one source (circular reporting)
Same name ≠ same person: link identities only with multiple strong identifiers
Blue checks and follower counts are not verification
Image workflow: earliest version → metadata → location → time → content → uploader
You can’t reliably “spot” AI fakes; check provenance and context instead
Misidentification destroys innocent lives (Boston 2013, Charlottesville 2017)

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.