What is Misattribution – Part 3: Non-Technical Misattribution

Chatting, shopping, making friends…it’s hard to remember a time when those activities didn’t take place primarily online. Everything we do online says something about who we are. The process is largely involuntary, making it challenging to intentionally manufacture this aspect of identity. In this part of our series on misattribution, I’ll explore non-technical misattribution; basically, everything that identifies someone online other than the information that computers and networks reveal.

Listen to the Ntrepid Cast podcast on this topic.

What Is Non-Technical Misattribution?

While the technical side of misattribution often receives the most attention, non-technical misattribution is what actually causes most of the problems for online operators. I divide non-technical misattribution into four elements: online presence, social, financial, and linguistic.

Misattributed Online Presence

A misattributed online presence starts with the accounts the identity uses. Email, retail, social media, chat, phone, and forum accounts combine to create an online presence. All of these must be specific to the identity the operator wishes to portray. Depending on what information is visible, and how much the opponent can access, users must take great care when creating these accounts to keep them separate from one another. Some of these services will publicly show contact or other identifying information about the account holder. However, much more information may be visible to the service provider themselves or to anyone able to compromise the accounts. Account history and activity are also part of one’s online presence. Accordingly, fake identities are often discovered because they don’t have a realistic history of plausible activity going back quite a way, or a good story for why the accounts were just created.

Social Misattribution

Social misattribution relates to what online connections and personal networks reveal. In many cases, “friends,” “connections,” and “followers” are visible to others on social media services. If someone doesn’t have any connections, that looks suspicious. However, even having numerous connections may not fool a sophisticated opponent. Real people have complex social connections. Many of their friends will know each other and fall into loosely interconnected groups. Randomly chosen connections are unlikely to have that pattern and are another way of detecting fake identities. Consequently, users need to manage these social factors if they hope to successfully develop their non-technical misattribution.

Financial Misattribution

Financial misattribution tries to hide the operator’s hand in paying for any services or capabilities purchased by a chosen identity. Banks have strict “know your customer” rules and can be pressured to reveal information about account holders. It is very difficult to create misattributed financial transactions using conventional banking and credit providers. In response, many operators have moved to using cryptocurrencies like Bitcoin to make misattributed payments. This is problematic, because the entire history of Bitcoin transactions is visible on the blockchain. If multiple transactions share the same source of funds, then other online users will assume they have been conducted by the same hidden actor. As a result, this connection can expose that those different identities are all actually puppets in the hands of a single actor.

Linguistic Misattribution

Finally, users need to misattribute linguistic identifiers. At a minimum, the operator needs to sound like a native speaker of wherever they are supposed to be from. Yet, formal classroom language will not cut it. Effective linguistic misattribution requires the use of slang and other forms of familiar speech. Additionally, patterns in writing can directly expose the writer’s identity. Many “anonymous” authors accidentally unmask themselves through their writing styles; investigators might compare these styles with a pool of suspect authors. In online operations, this can be used to be discover an operator’s real identity, or for multiple identities to be connected to each other.

As we’ve shown, keeping track of all these non-technical misattribution characteristics over multiple identities can quickly become complicated. Non-technical misattribution mistakes can directly expose an operator’s true identity, but more often will simply show that their alias identity is a fake.

In the next and final part of this series, I will look at the challenges of maintaining misattribution and how it goes wrong.