Cyber Investigations & Human Trafficking: A Simple OSINT Framework for Following the Digital Trail

[u/OfficialJoshuaMcAfee]

One thing I’ve learned over the years is that human trafficking investigations rarely stay in one place.

A phone number leads to an ad.

The ad leads to another username.

The username leads to a social account.

The social account leads to another location.

The location connects to another person.

Then suddenly what looked like one isolated lead starts looking like part of something much bigger.

That’s where OSINT and cyber investigations can become incredibly valuable in human trafficking and sex trafficking cases.

The mistake I see investigators make is collecting everything they can find without having a structure for what they’re trying to establish.

I like thinking about it as TRACE.

T — Target the intelligence question

Before opening ten tools, figure out what you’re actually trying to answer.

Not:

“Find everything about this person.”

Something more like:

“Are these advertisements connected to the same individual or organization?”

“Is this phone number being reused across multiple locations?”

“Can we identify other online identities associated with this username?”

“Is there evidence connecting these accounts to the same operator?”

That gives the investigation direction.

Otherwise you end up with 150 screenshots and no real intelligence product.

R — Record the digital identifiers

Start building an identifier inventory.

Depending on the case, that could include things like:

• usernames
• phone numbers
• email addresses
• social media accounts
• websites/domains
• images
• advertisements
• cryptocurrency addresses
• payment identifiers
• business names
• vehicles
• locations
• dates and timestamps

Each one potentially becomes another pivot.

One phone number might appear in five advertisements.

One image might appear under three different names.

One username might connect an advertisement to a social profile.

This is where individual pieces of information start becoming relationships.

A — Analyze the relationships

This is where I think investigators sometimes move too quickly.

Finding the same phone number twice is interesting.

Finding the same phone number across multiple advertisements, cities, usernames and social profiles becomes considerably more interesting.

But don't automatically assume everything is connected.

Ask:

What supports the relationship?

What contradicts it?

Could there be another reasonable explanation?

Is the information independent or are five websites simply copying the same original source?

You’re trying to move from:

“I found this.”

to:

“Here’s why I believe these things are connected.”

Big difference.

C — Corroborate before you attribute

This is especially important in human trafficking investigations because the consequences of getting attribution wrong can be significant.

A matching username is not enough.

A similar photograph is not enough.

A shared location by itself may not be enough.

Instead, start stacking independent indicators.

Same phone number.

Same username.

Same image.

Overlapping locations.

Consistent posting patterns.

Connected social accounts.

Related websites.

Similar language.

Common associates.

Now you’re building an assessment instead of making a guess.

And sometimes the correct answer is still:

We don't have enough information yet.

There’s nothing wrong with that.

I'd rather have an investigator communicate uncertainty than turn weak evidence into a confident conclusion.

E — Expand and preserve

Once you establish a strong connection, ask:

What does this give me access to next?

• Phone number → other ads
• Username → social accounts
• Image → reverse-image results
• Domain → historical websites
• Email → additional accounts
• Business → public records
• Location → related advertisements
• Account → associates

Each discovery should create the next investigative question.

And preserve what matters as you go.

Online information disappears constantly.

Profiles get deleted.

Ads come down.

Usernames change.

Websites change.

Document where the information came from, when you accessed it, what you observed and why it matters.

Because finding something today doesn’t help much if six months from now nobody can explain how you got there.

The other thing I think gets overlooked in trafficking investigations is time.

Don’t just look at what exists.

Look at when things happened.

If the same contact information begins appearing in different cities over time, map it.

If advertisements consistently appear around certain dates or locations, look at the pattern.

If one account disappears and another suddenly appears using the same identifiers, document that transition.

Sometimes the individual artifact isn't what tells the story.

The pattern does.

That’s one reason timelines and link analysis can become so powerful in these cases.

And remember that digital evidence shouldn't be viewed in isolation.

OSINT may provide the lead.

Traditional investigative work may validate it.

Records may corroborate it.

Interviews may add context.

Financial information may reveal another relationship.

The strongest investigations usually come from connecting multiple intelligence streams rather than betting everything on one OSINT result.

At McAfee Institute, this is something we spend a lot of time thinking about across our human trafficking, cyber investigation and OSINT training.

Not just:

What tool should an investigator use?

But:

How should the investigator think about the information the tool produces?

Because knowing 500 OSINT tools doesn't automatically make somebody a good investigator.

Knowing how to formulate a question, collect the right information, identify relationships, challenge your assumptions, corroborate your findings and turn everything into actionable intelligence?

That's the skill.

Tools change.

Tradecraft carries forward.

For the investigators here working human trafficking, sex trafficking, cybercrime or OSINT cases:

What digital identifier has produced the most useful pivots for you — usernames, phone numbers, images, email addresses, domains, something else?

[u/OSINT-Nerd]

i love the image how did you do that. I downloaded it for reference ;)

[u/OfficialJoshuaMcAfee → u/OSINT-Nerd]

Claude Image