This article was first published in June 2022 on the website of OSINT Fr.
While economic intelligence and OSINT are two terms gaining visibility with the general public, they nonetheless remain relatively vague for most non-practitioners. Economic intelligence is thus regularly associated with espionage, while anyone who explains their passion for OSINT is often asked whether they are not a somewhat creepy stalker.
Yet these are two rather noble concepts, one of which, open-source intelligence, serves the other. Anyone reading this post on osintfr.com should normally have a rough idea of what OSINT is, but economic intelligence may remain hazy: is it market research? Marketing? Intelligence work? There are several definitions, but the most complete appears to be this one: it is « the systematic gathering and interpretation of information accessible to all, in order to decode the intentions of the actors involved and understand their capabilities ». And so, like OSINT, economic intelligence is strictly bounded by the legal framework, since it is solely a matter of collecting information that is accessible to all.
Drawing on two types of assignment, this article sets out to show how OSINT is used within an economic intelligence firm, which will serve both to demystify this activity and to introduce a few particularly valuable tools.
Investigating a case of online destabilisation
A typical case in an economic intelligence firm: investigating the destabilisation of an individual or a company on the web. This may take the form of blogs or Twitter, Instagram or Facebook accounts denigrating a company. Take the case of a business that observes a significant drop in its sales without any event to justify it.
Google searches initially make it possible to identify a galaxy of websites and individuals criticising the company's products. All of these sites present themselves as independent bloggers or online comparison sites. On reading the articles, one notices that all of these sites are relatively recent. The significant drop in sales appears to be finding the beginnings of an explanation.
We now have material to investigate: first, by examining their content (statements, the « about us » section, legal notices, and so on). First observation: the sites are strangely similar, as if they had been copied and pasted with marginal changes. Another similarity: the biographies of the « bloggers » are all inconsistent and accompanied by profile photos that look like they came straight out of https://thispersondoesnotexist.com/. The legal notices, for their part, are limited to information about the hosting provider, which is not very useful. At this stage, one can already suspect a (somewhat crude) destabilisation campaign, but there is nothing yet to identify the author.
Fictional illustration close to real cases
Having thoroughly exploited the site's content (not forgetting archives.org!), it is time to turn to the technical elements. When a domain name is registered, certain information must indeed be provided, such as the name, email, telephone number and address of the person who carried out the registration. This data, viewable via a whois (such as viewdns.info), can however be anonymised. One then ends up with something like this:
That's bad luck, but it is always possible to play a wild card: the whois history! For this, however, one needs to subscribe to a paid solution, such as http://domaintools.com/. Indeed, the information is anonymous at the moment the whois is consulted, but it can happen that the owner of the domain name first entered their information in the clear, before deciding it would be wise to request anonymisation. But the web forgets very little… And, in this particular case, several historical records list the same email address and the same identity, from which it is possible to move forward.
Image borrowed here
Back to Google: a « first name surname » search returns several LinkedIn profiles, one of which looks interesting: the person describes themselves there as an SEO professional. Nothing is certain, but the lead is worth following. A second stroke of luck: the individual (whom we shall call Boris) shared a CV a few months ago, in which his email address appears… the same one used for the domain name registrations. Bingo, we know he is the right individual. It now remains to understand why, one fine day, Boris decided to create several sites to denigrate a company that does not even operate in his field of activity.
One then has to understand who he is and try to identify whether, among his connections, there might be someone with an interest in denigrating a company. As Boris has his own company, one can try to consult the articles of association free of charge via Pappers. Since these indicate that Boris is married, it is not without interest to look at who his wife is. Google searches yield little, but Pappers shows that she owns a company competing with the business being denigrated online! At this stage, the body of evidence is beginning to become substantial, and one can start from the hypothesis « Boris created these sites to denigrate a competitor of his wife » in order to try to find other elements corroborating this theory.
These online manipulation techniques are not uncommon and are not limited to the private sector. In a recent study, Openfacto thus identified more than 1,300 Russian-language sites run by the GRU, the military intelligence service.
Conducting a due diligence
Another classic economic intelligence case is due diligence. In France, the Sapin II law requires companies with more than 500 employees and a turnover of over 100 million euros to assess their partners (subcontractors, subsidiaries) in order to prevent any practices linked to corruption and breaches of integrity. This is then a due diligence assignment that will focus on several aspects, notably judicial and reputational elements. Beyond these, it also makes it possible to validate the value of a potential tie-up in light of the company's capabilities, its reputation, its momentum, and so on. A due diligence can also be conducted ahead of a service engagement.
After a brief survey of the press to become familiar with the company under investigation, it is very often useful to retrace its history. The starting point obviously consists of identifying the company in question in order to obtain the articles of association (where possible, as not every country has Pappers): this makes it possible to understand who the key people attached to the company are and whether the founders are still present.
In addition to Google searches and consulting the « about us » or « our history » pages, it is extremely valuable to use archive.org, because this resource will show how the company described itself at different moments in its existence, thereby shedding light on its strategy, its successes and its failures. The elements to be found are endless (names of former executives, their biographies, contacts, and so on), but here are a few examples that are useful for economic intelligence:
- By navigating through the different versions of a consulting firm's website, one notices that the company had a presence in Paris, Moscow and Istanbul in 2013, then Paris, Moscow and Malta in 2016, and that it now lists Paris and London. This then triggers several questions: why was it there? For what reasons did the branches close? Are the heads of those offices identifiable? If so, they could potentially be contacted.
- By navigating through the archives, it is also possible to compare sections over time. Imagine an « about us » section featuring a dozen people at one moment, then 9 a month later, then 4 three months after that. First observation: the company is losing its staff (or only updates departures…). By looking at the history in detail, one notices that the founder's son had been appointed director a few months before these mass departures. One can then put forward the hypothesis of an appointment that did not go down well, followed by a wave of departures.
- In a 2007 archive, the École de Guerre Économique promotes a « strategy for conquering Asian markets » programme, which no longer exists today. This may, for example, show that the school tried to diversify.
Once the history, activity and articles of association have been thoroughly studied, it is time to look into any judicial antecedents or other « skeletons in the closet ». To obtain this kind of harder-to-access information while remaining within the scope of OSINT, there are numerous specialised databases. Here are a few sources and what can be found in them:
- Wikileaks: an NGO that publishes leaks and made its name notably by revealing thousands of American diplomatic cables. An analyst researching the Cambodian company The Royal Group would, for example, be very interested to learn that its leader was regarded as a « relatively young and ruthless gangster ». As the individual is well known, the information was subsequently picked up by the press, but there are thousands of pieces of information of no interest to the general public that can only be found in Wikileaks;
- ICIJ: the International Consortium of Investigative Journalists also provides a search engine exploring well-known leaks (Paradise & Panama Papers, Luxleaks, Luanda Leaks, and so on). This can help prove the involvement of a person or a company in a financial arrangement in tax havens. While it is not illegal to hold interests in a company based in a tax haven, it nonetheless constitutes a red flag that needs to be dug into;
- OCCRP Aleph: the search engine of the Organized Crime and Corruption Reporting Project, which aggregates leaks and databases (commercial registers and official documents). It is a good complement to the ICIJ.
Of course, a due diligence requires consulting far more resources, the aim here being to show a portion of what can be done from open sources.
Conclusion
In the end, the assignments and the way of working in an economic intelligence firm do not really differ from the journalistic approach and the (excellent) investigations published by Projet Fox on disinformation or Openfacto on embargo violations. It is always a matter of untangling complex situations from open sources. Every assignment is unique, but the underlying principle is always the same: act methodically, consult the resources and demonstrate sound analytical judgement. The complex cases are those that require numerous pivots before finding a relevant piece of information. Finally, one must also bear in mind that not everything can be identified through OSINT, but that open-source intelligence can provide clues and help identify sources.