Cyber professionals will compete to find leads in real missing persons cases in a competition in Washington, DC, next month. 

SANS Institute has teamed up with non-profit organization Trace Labs to host the Open-Source Intelligence (OSINT) Missing Persons Capture the Flag (CTF) in partnership with local, state, and federal law enforcement agencies.

Participants, working in teams of up to four people, will gather fresh intelligence on several specific missing persons cases from publicly available data on social media, forums, government records, and even the dark web.

Points will be awarded in exchange for each piece of data uncovered that was previously unknown to law enforcement. 

At the end of the contest, Trace Labs will generate an intelligence report from the OSINT, which will be passed to the law enforcement agencies responsible for these cases.

Up to seventy-five ethical hackers and information security professionals from within the SANS community are expected to compete at the event, which will take place December 13–14. 

The first ever crowdsourced OSINT for Missing Persons CTF event was held in Toronto on July 28, 2018. Since then, Trace Labs has partnered with law enforcement, not-for-profits, and industry conferences to run over 25 similar events across five countries, bringing together over 2,000 industry professionals to work on over 200 missing persons cases.

Explaining how missing persons cases are selected for the competitions, Adrian Korn, director of OSINT operations & strategic initiatives at Trace Labs, told Infosecurity Magazine: “When we take on missing cases, we look for ones that have a significant digital footprint available. These are cases where a person has been reported missing in the past 10 years as this is the time period where social media and smartphone usage has grown the most.

“We do our best to include cases of different backgrounds and from different regions in our events. Since our efforts are all focused on looking at the public online activity of a missing person, we work with law enforcement to take on cases where they have seen significant online activity from the missing person.”

Korn said the details of which cases would feature at December’s event would remain secret until the day of the competition; however, he was able to confirm that the cases involve a combination of missing youths and adults from across the US who went missing within the past decade.  

Asked how he would respond to comments that gamifying the search for missing persons could be construed as disrespectful, Korn said: “The Trace Labs model was built to attract as many skilled cyber professionals as possible to expedite the collection of OSINT on the missing persons cases we work. With so many of these cyber professionals possessing valuable skills and using them on ‘simulated’ hacking competitions called ‘CTFs’ we saw an opportunity to refocus their efforts to do real social good. 

“With this in mind, the decision to gamify these events is solely a motivating factor for participants that we then turn into interest to continue helping with the search after the contest is over through our Trace Labs community.”