in Meddling, Social Media

Practicing my OSINT skills

Yesterday, a story went viral of a North Carolina man and woman who fought off an attack by a rabid bobcat. This story made news all over the world (it was a slow news Friday, I suppose) but I became annoyed that none of the stories mentioned who the victims were. I thought this might make a good opportunity to use my Open Source Intelligence (OSINT) skills to try to identify them based on what was known so far. And what do you know, I managed to do it!

Since I hadn’t seen that the couple had granted any interviews anywhere, I figured they were not interested in publicity and I opted not to mention their names publicly. I now see that Wilmington station WECT has interviewed them so I can reveal my work. The folks involved are good people and I don’t want my post to be used to harass them so I will focus on my techniques rather than their identity.

So, at the start of this journey all I had was the video. You see them leaving their house in the morning and getting attacked by the bobcat as they attempt to get into their car. The man pulls the animal off of his wife and flings it into the yard before they escape. It’s quite wild.

We can learn a lot from studying this video.

1. We know it’s morning. On the audio, we hear the man greet the passing jogger with “Good morning.” He puts his coffee on his car.
2. Sunlight is visible on the homes in the background. Since it’s morning, we know we are facing west.
3. Key identifying items are visible. The home is near a curve. The sidewalk ends on the right side of their yard. There is a storm catch basin directly across from the driveway.

All these things help separate this home from others in the neighborhood.

Listening carefully to the clip we hear the wife frantically calling her husband’s name, Happy.

An additional bit of information came to me. Someone mentioned it happened in North Carolina; Pender County to be exact. Another person mentioned a bulletin recently put out by the Pender County Sheriff’s Department. It was a notice warning that a rabid bobcat had attacked people and to make sure all of your pets are vaccinated. It said the attack occurred on April 9th, the dead bobcat was tested at N.C. State, and the bobcat was found to have had rabies. It also mentioned that this had happened in the Creekside Subdivision of Burgaw, NC.

So, bobcats are normally extremely shy. They are nocturnal and avoid people at all costs. Interactions with people are thus very rare. It looked like the Pender County Sheriff’s bulletin must have been referring to the attack in the video.

So we know a few things so far:
1. Distinctive features of Happy and his wife’s home.
2. That their home faces west.
3. That the home is likely in the Creekside Subdivision of Pender County.

Time to go to Google Maps and see what we can find.

I put “Creekside Burgaw, NC” in to the search bar and I’m presented with a promising result:

This is a nice, compact subdivision so it shouldn’t take long to narrow down the house. Unfortunately Google Street View has not yet snapped on-the-ground photographs so we’ll have to figure this out ourselves. The subdivision only has one turn on the west side, so immediately I’m looking in the lower right corner for our house.

There is only one house shown on the street map that meets our criteria. But the video shows houses to the left of our house, among others. Where are the houses? It appears Google is not up-to-date on the construction here.

Let’s check the satellite view, as sometimes these two can differ:

No luck. We see an image of the home under construction that’s shown on the street map but none of the surrounding houses. Time to look for a more up-to-date map of the area.

Let’s check the Pender County GIS site. Local governments tend to have GIS systems to maintain more accurate maps for their tax assessments, first responders, and the like. Pender County is no exception and has a very easy to use GIS system. Let’s see what the subdivision looks like in county records:

Bingo. We now have a map showing all the lots in the Creekside subdivision. There’s a home on the western side and in the correct spot in relation to the curve. It also abuts a pond and thus has the sidewalk ending at the property line.

Perfect. This is our house.

GIS tells us the owner, too. In case you were wondering, Happy is only a nickname. Happy’s formal name is Leon H. Wade III. It is common for family members who share names to become known primarily by nicknames. To be sure this is the person we want, A search on his nickname and last name (which is not a common name and thus has higher confidence if we find a match) turns up a LinkedIn page for a gentleman who works in Wilmington, NC, which is the largest city in Pender County.

We can now say with some confidence that we found the person we were looking for. These same techniques can be used to help locate other photographs (for instance, photos of an adversary) and identify the persons in those photographs. It’s also fun.