OSINT in Action: How Journalists Unmasked an Anonymous Internet Troll

The Sherlock Holmes of the Digital Age

Many of us assume that a pseudonym on X (formerly Twitter) makes us invisible. It doesn't. The Polish news outlet Wirtualna Polska (WP) has just published an investigation that reads like a textbook example of open-source intelligence (OSINT) in investigative journalism.

The goal was to identify the person behind the aggressive account "Morgenstern616." How did they do it? Not with magic, but with painstaking data analysis.

Step 1: Big Data and AI (SOCMINT)

The first step was quantitative analysis. The journalists examined more than 75,000 posts, which turned out to be a goldmine of information.

• Profiling: Artificial intelligence helped pick out the neutral posts from a sea of hate. Those were the posts where the user let slip details about their life, such as living in the Opole Province, having family near Namysłów, and having worked at a municipal office.
• Verifying the backstory: The troll's claims (e.g., "I studied with politician X from 2011 to 2013") were checked against actual student lists and the biographies of public figures. Everything matched.

Step 2: Geolocation (IMINT)

This is where the real detective work begins. The user made classic OpSec (operational security) mistakes by posting photos of their surroundings.

1. The view from the window: A photo showing a panorama of Opole made it possible to pinpoint the exact apartment block (in the so-called "militia housing estate") where the person lived.
2. An unwitting tip-off from a neighbor: A photo of a flag hung out by a neighbor who supported a rival political camp led investigators to a specific property near Namysłów.
3. Infrastructure: A picture of a defaced election poster on a particular utility pole narrowed the search area down to a small village.

Step 3: Technical Slip-Ups and the "Human Factor"

Even the most sophisticated techniques can be unnecessary when the target hands over the answer on a silver platter.

• The dog: A classic of the genre. The same photo of a mixed-breed dog appeared both on the anonymous hater's account and on Kamil Rudziński's personal Facebook profile. Remember: your pets are unique and easy to link back to you!
• The browser avatar: In one of the screenshots the troll posted to show off what AI could do, a thumbnail of a Google avatar with the letters "KR" was visible. An identical avatar (same font and colors) was tied to an email address listed in the public Central Register and Information on Economic Activity (CEIDG), Poland's business registry.
• File metadata: The same memes and graphics, with identical parameters, were posted on both accounts.

Key Takeaways

The WP investigation shows that in the digital age, every scrap of information we leave online is a piece of the puzzle. A view of the clouds from your window or a photo of your dog can be all it takes to connect the dots. For cybersecurity and OSINT professionals, it's proof that the weakest link is always the human, and the urge to show off online.

See also: Why a VPN Isn't Enough - An in-depth look at the OPSEC and identity compartmentalization techniques that protect against the kind of unmasking described in this article.

Source: Wirtualna Polska - "Die in agony and pain": How the director of a foundation set up by Maciej Lasek supports Tusk's government online (in Polish)

Further Reading

• OSINT: A Short Guide to the Art of Open-Source Intelligence – Learn how to use the techniques described in this article yourself, step by step.
• A Short Guide to Communication Privacy – Learn how to protect your privacy so you don't become the target of a similar analysis.

Until next time, Aleksander