OSINT: Missing Persons
My Experience in a Trace Labs Missing Persons CTF
Imagine your partner or child disappears and the police can’t find them. Days stretch into weeks and the weeks into months, and not a single clue can be found. I doubt I could bear the fear and desperation. I imagine it would boil into a rage, and that rage could burn only so long until eventually, it turned into a suffocating sadness.
Every year in the United States, over 600,000 people are reported missing. While the vast majority are found, in 2023 over 90,000 cases remained active. This past weekend, I joined a global network of investigators working through Trace Labs to search for 4 open cases. Over four intense hours, my team and I scoured the internet, hoping to uncover clues that might bring answers to families desperate for resolution.
What is Trace Labs?
Trace Labs is a nonprofit organization that mobilizes the power of crowdsourced OSINT (Open-Source Intelligence) to assist law enforcement in locating missing persons. Their CTF events gather investigators worldwide to work on real cases, using publicly available information to generate actionable leads.
I have admired Trace Labs for years, but juggling a full-time career and my cybersecurity degree left little bandwidth to participate. After graduating this summer, I finally had the chance to contribute.
Stepping Into the Challenge
The CTF was a four-hour sprint of data gathering and analysis. My team, composed of two other first-time players, was tasked with locating clues for four missing individuals. Points were awarded based on the relevance and quality of submitted findings, such as identifying previously unknown social media connections or geolocating photographs.
Most of my cyber efforts involve analyzing businesses and corporate vulnerabilities. Tracking down online fraud, money laundering schemes, data leaks, and other assorted vulnerability assessments is quite different from investigating missing persons. The closest I have come is utilizing social media accounts to identify possible insider threat issues and hunting for criminals from most wanted posts. Social media accounts are typically rich with active data, but for MPs (missing persons) these platforms are most often dormant. Instead of looking for patterns in recent activity, you piece together fragments from the past, following faint trails that might lead to critical insights.
The Emotional Toll of the Work
Everybody is different Nothing prepares you for the emotional impact of investigating MPs. You’re not just analyzing data; you’re slipping into someone’s life. You scroll through family photos and see birthday parties, concerts, and people hugging and smiling. Personal artifacts are laid out mapping the lives of people who haven’t been seen or heard from in months. Reading the pleas of parents and loved ones, the gravity of the work can become personal.
The hardest part is knowing that time is limited. With only four hours, we couldn’t pursue every lead. It felt like being a lifeguard swimming into rough seas, knowing there were four people floundering in the waves but only enough time to save one. How do you decide who you try to save? Or at least that’s what your heart might tell you. But try and keep in mind that you are one of a thousand lifeguards. There is your team and all the people on each of the other teams. You aren’t doing this alone.
This made it easier to compartmentalize as I examined every like from every post. Also, while sympathy for the families is natural, it can cloud judgment and lead to inefficiency. Instead, you remind yourself that the best way to help is to remain methodical and prioritize leads based on their potential impact. This mindset wasn’t easy to maintain, but like all things, it’s a process and not an event by itself. Remaining in the mindset that this is a game, isn’t callous, it’s a psychological defense necessary to make the most of limited time.
At least that’s what I tried to do. I still couldn’t help but think what if it were one of my kids. What if it were my wife? I assume with practice that maybe you get better at it. But I also feel like keeping in contact with the emotional intensity just under the surface helps fuel the fire for when you think you can’t find anything else, this propels you to dig just a little more.
Unique Challenges in OSINT for Missing Persons
Investigating missing persons cases differs from corporate OSINT work in several key ways. Most notably, the accounts you examine are often inactive or locked down, requiring creative strategies to uncover useful information. Here are some approaches that proved invaluable:
Social Media Identities: Identify all possible email addresses, accountants, usernames, and aliases
Social Media Connections: Map the person’s close relationships and reveal hidden patterns or previously overlooked leads. Look at every like for every post and start collecting names.
Engagement Data: By analyzing likes, comments, and shared posts, you can identify relationships, family members, and individuals frequently in contact with the MP.
Geolocation Clues: Examining metadata from photos or cross-referencing landmarks in images can help establish potential last-known locations.
Tools and Techniques
Pages and tools I rely on for OSINT. These offerings start broad and then narrow down to specifics.
osint-inception: This is the largest set of of OSINT operators and their tools I am aware of. Every page has something for ya. I’m still examining pages finding new stuff all the time. I recommend making your own page and building your toolsets based on your needs from the wide array supplied by these OSINT professionals.
osintframework.com: An exceptional list of tools. Some links don’t work anymore, but that’s part and partial of the process. You want to build a toolset of redundant tools. You never know what is going to go offline and need something you can fall back on. Also, redundancy helps with confirmation of the data you collect. You can’t rely on any one tool.
inteltechniques.com: Michael Bazzel’s tool set has been provided by both MIshaal Khan for his OSINT class and the Trace Lab teams.
istantusername.com: This tool is in the intel techniques list and helps me identify social media accounts.
NAMINT: also on inteltechniques list provides different possible combinations you can use to search usernames and emails based on someone's name.
The strategies I learned in Mishaal Khan’s Next Level OSINT course proved highly applicable and assisted in uncovering social connections and locating hard-to-find data. I highly recommend his beginners class at justhacking.com or check him out at the next Blackhill’s Wild West Hacking Fest conference in Feb 2025.
Lessons Learned
While the event was an incredible learning opportunity, I left with a clear understanding of areas where I could improve:
Preparation: Creating social media sock puppets and reviewing previous write-ups beforehand would have streamlined my workflow.
Organization: A mind map or checklist would have helped track findings and connections more effectively.
Time Management: With only four hours, triaging leads based on their potential impact was crucial—and something I could improve on next time.
Closing Thoughts
Participating in the Trace Labs CTF was something I had been looking forward to for quite some time and I’ll be on board for the next go around. It tested my technical skills, stretched my emotional resilience, and reminded me of the incredible power of collaboration. It’s one of the perfect forms of competition. Where a large number of people can pile on a problem and bang out a lot of leg work together for a common good. Knowing that even one small discovery could help reunite a family made every minute of effort worthwhile.
For those considering joining a Trace Labs event, I highly recommend it. The work isn’t easy, but it’s profoundly rewarding. If you’re interested in learning more about Trace Labs or participating in a Missing Persons CTF, here are some resources to explore:
Additional Training
Kase Scenarios: Black Friday sale and one free case DragonCon Detective.
OSINT Dojo: helping guide new OSINT enthusiasts
Kc7cyber: beginner-friendly detective game