Micah Hoffman, founder and co-owner at My OSINT Training and director of capabilities and innovation at The National Child Protection Task Force, joins us for an episode of From the Source. He shares insights into open source intelligence (OSINT), the use of AI in investigations, and how to protect oneself online while contributing to critical cases such as missing children. He also shares practical tools, ethical considerations and talks about the emotional resilience needed to operate in this field. You can read his insights below or listen to the full episode here.
Micah founded My OSINT Training, an online training academy for OSINT. For Micah, building tools that help OSINT analysts find, extract and better visualise data is one of his favourite things to do. With the help of AI and web development tools, he creates bookmarklets, which are small software applications that enable users to add functionality to a browser. Micah’s company has more than 40 bookmarklets, including ones for social media, finance, open source research and more.
‘Let's say that you visit a TikTok profile in your web browser as an authenticated or non-authenticated user. TikTok and many other websites will send more information to your system than what's rendered in the page,’ he explains. ‘What our bookmarklets do is, when you click it, it looks in the page source code and says, “Hey, look, on this TikTok page, this profile, there's a creation date and time. I'm going to extract that and show that to Micah.” So it will look on the page. It'll extract that. It'll extract the TikTok ID, the account's unique identifier, along with other relevant data. And then it pops up a little box and says, “Here's some extra data that's in your browser already that you might want to know for your OSINT investigation.”’
As AI continues to grow in popularity and use cases, Micah compares AI to a tool in a wider toolbox.
’I think a year ago, people were using AI for everything. And they could, but it wasn't the right use for the tool,’ he says.
Micah explains that he uses AI for discrete tasks because that’s where it excels.
‘I had a missing child case that I was working on and in a photo on this person's social media account, there was a street sign clearly in view,’ he begins. ‘And so I looked at the state where the person might be and I was thinking to myself, well, I can search for all of the places where this street is, and I went to my AI buddy and I said, find every street named Maple Avenue, Maple Lane, Maple Street and then I want you to make a Google Maps link in a table so that I can just click it and it'll open a new tab and then take me to that place.’
The human validation step in this process is important to Micah, who doesn’t yet use AI to parse data due to a lack of trust in AI's ability to perform this task well.
Micah’s background is in cybersecurity, and he says he learned many of his skills through online capture-the-flag (CTF) exercises. While more formal learning pathways and certifications do exist, he believes many current programmes are vendor-focused, meaning students will earn credentials tied to one specific company. With no standardised qualification for OSINT practitioners, standards and training can vary widely. And while amateur OSINT analysts have been vital to many investigations, this inconsistency can mean people miss key steps involved in protecting themselves online.
’You also have to think about the threat against you,’ he says. ‘If you're investigating Russian oligarchs, you're gonna take one level of precaution. If you're looking for missing children locally, you're gonna need others. There's a range of things you need to think about when doing this type of work.’
Micah describes three layers of online security. Firstly, the network, or where your traffic is coming from.
‘If I'm using my work's computer and I'm on their network, well, some websites will say, hey, look, you're at XYZ company or XYZ government agency, and they might treat your traffic a little differently,’ he explains.
The next layer he considers is whether your system is protected against viruses, trojans, and other threats.
‘What information is your system giving out to those websites? And how does your profile look?’ he asks.
The final layer is about protecting the individual.
‘That's a very important, legally and ethically charged topic because we have virtual private networks (VPNs), which I know can be a little bit touchy nowadays, but they protect our data and they allow us to pretend to be somewhere else,’ he explains. ‘We have virtual machines at that system level or virtual appliances or virtual browsers that allow us to really mask or change or isolate what happens when we're doing our OSINT. And then, to protect ourselves, we have virtual personas, research accounts and sockpuppet accounts, which are real profiles we maintain on social media platforms.’
The National Child Protection Task Force (NCPTF) is a U.S-based nonprofit that works directly with law enforcement to find missing and exploited children. Micah helps the NCPTF work on cases and develop tools and systems that support them.
‘Instead of law enforcement having to learn how to do things on TikTok, Snapchat, Instagram, and all these other platforms, they can focus on the other tasks they’re really good at,’ begins Micah. ‘Then a team of volunteers, in our case, the people who work the cases over at NCPTF with us, works on these cases, creates an intelligence report, and then gives that to law enforcement to act on whatever tips we were able to come up with. And that might mean, “Hey, look, Johnny, who’s missing, is posting with his friend over on TikTok, in this account. You might want to look into that.”’
He adds that while law enforcement has a great grasp of OSINT and social media, some places have more resources than others. The NCPTF's Director of Investigations, Kait Rickard, Micah and a team of volunteers, help fill that gap by piecing together evidence and ultimately supporting law enforcement in doing their job.
‘I think we like to think of ourselves more as lead generation,’ begins Micah. ‘For instance, law enforcement might share a username, phone number, email address, or even just the name and birthdate of the missing person. And then we go into the software that's been donated, or we'll just go right on to different social media platforms and examine what those accounts, what their family members are posting and provide that. So I think for us, it really is a balance between that capability enhancement and the fact that we have tools that law enforcement can't necessarily afford or, in some places, can't use, like facial recognition, breach data, and things like that.’
For Micah, working with NCPTF has been rewarding, particularly when he receives feedback that a missing child has been recovered safely. However, it can also take an emotional toll. He says it’s important to protect yourself emotionally and mentally, too. Micah sees a therapist to discuss his experiences in a confidential setting.
’I started seeing someone I could talk to about all the different things I'm seeing. I also have a very good opportunity at work to take time off or access resources that can help me take a break. I've set up different environments so that when I'm doing that work on a more sensitive case, I can isolate and segment that. I also know some positive coping strategies that I like to use when I'm stressed or affected,’ he explains.
By combining the right tools, careful validation, strong personal security, and a focus on mental health, Micah shows us how OSINT can be used responsibly in the moments that matter most.
Listen to The role of OSINT in finding missing children with Micah Hoffman, and stay tuned for more OSINT insight on Blackdot’s next podcast episode.