Network mapping

Contents

No Trace Project > Threat Library > Techniques > Network mapping

Contents

Network mapping is the process by which an adversary gains insight into the organization and social relationships of a given network. By gaining this insight, an adversary can select individuals for additional scrutiny, arrest, or recruitment as informants.

The State very frequently uses social media friends lists (a form of open-source intelligence) for network mapping because they do not require a warrant or legal authorization.

Used in tactics: Incrimination

Mitigations

NameDescription
Anonymous phones

You can use anonymous phones to make it harder for an adversary to map your network.

Avoiding self-incrimination

An adversary can use information obtained through self-incrimination to endanger not only the individual from whom the information was obtained, but also the rest of their network. To mitigate this, you should not talk to an adversary under any circumstances, and you can avoid providing biometric information (face photograph, fingerprints, DNA) if possible.

Compartmentalization

You can compartmentalize your different identities (or projects) to make it harder for an adversary to map your network.

Digital best practices

You can follow digital best practices, and in particular use end-to-end encrypted messaging applications on encrypted devices, to obscure your social networks and make it harder for an adversary to map your network.

Fake ID

During an ID check, you can present a fake ID to make it harder for the State to map your network.

Need-to-know principle

You can apply the need-to-know principle to make it harder for an adversary to map your network.

Network map exercise

An adversary can map a network by using infiltrators and informants to monitor the network: infiltrators and informants build credentials through association, build social profiles of people in the network, find pressure points to instigate interpersonal and political conflict, and entrap people. To mitigate this, you can conduct a network map exercise to make your network more resilient to infiltration attempts and help ensure it does not place trust in people who could be or become informants.

Used in repressive operations

NameDescription
Mauvaises intentions

To prove that the defendants knew each other and were therefore likely accomplices, the investigators used several clues[1]:

  • They were arrested at the same demonstrations.
  • They called each other on the phone regularly.
  • They lived in the same place for long periods of time, as shown by their phone records.