The FBI uses fake profiles on various social media sites. It's one way in which they can target suspects using encrypted messaging apps.
gettyDespite showing frustration at being unable to break into secure messaging apps like WhatsApp, in some cases, police investigators actually want criminals to use them. In Guam earlier this year, one target of a pedophile sting was even encouraged to move onto WhatsApp so that police had a better chance of discovering his true identity.
It started in November 2020 with a fake profile on Whisper, a social networking app that encourages users to share secrets anonymously. The Storm_Ocean account, which remains active and was created in a joint operation between the FBI and the Air Force Office of Special Investigations (AFOSI), made one post, the text layered over the body of a young woman, fully clothed and sat on a bed, obscuring her face with her phone. It read: “Parents are going out this weekend. Who’s gonna come get me. Don’t message if you are going to me mean and tell me I’m to [sic] young.” The AFOSI agent running the persona had also given her a name, “Emmalee” or “Em,” and an age, 13.
The bait worked. Investigators claimed that another user, going by the name Forsei responded to Em’s post, writing: “If you are underage it’s technically illegal of me to do so. That’s just legal means. Age is just a number except by the law.” The agent then gave Forsei his mobile number, “in an attempt to move the conversation to WhatsApp and to collect information on Forsei’s true identity.” As the conversation continued there, Forsei expressed his desire to have sex with Em, and said he’d bring condoms and takeaway chicken to her house in Guam, according to the warrant. He was caught with both, after the meeting was set up, and the sting primed, investigators claimed. When questioned, he said he was planning to have sex with Em, though felt she was the one pushing him in that direction. (The suspect, Christopher De Leon Guerrero, has pleaded not guilty and is awaiting trial.)
Meanwhile, the AFOSI agent had sent a request to Facebook-owned WhatsApp to preserve data related to the suspect’s account. The investigators wanted IP addresses and any account activity WhatsApp could provide. They did not ask for message content, which is protected by end-to-end encryption and is impossible to retrieve from WhatsApp servers.
Though such data requests from WhatsApp are common, it’s less common to see a government investigator actively try to move a target to the platform. Though the FBI has consistently called for Facebook and other major tech companies to provide access to encrypted communications, it’s clear they have other ways to obtain data pertinent to investigations. They can monitor WhatsApp users, for instance, either through lawful orders for information or via so-called “pen registers,” which are a kind of wiretap on the account metadata, giving police access to up-to-date, almost real-time account activity.
Whisper users not entirely anonymous
The police didn’t just rely on WhatsApp for corroborating information. They also obtained information from WhisperText, the San Mateo company that runs Whisper, which had, in 2014, courted controversy for providing user data to the Department of Defense. Whisper was able to tell police that the Forsei user was male, aged between 26 and 29, “whose phone location services placed him on Guam.” According to the warrant, Whisper can provide various information to law enforcement, including location, chat log timestamps, the content of whispers and IP address.
The feds have used the same tactic on Whisper before. According to a search warrant from 2019, a detective with the Boone County Sheriff's Department Cyber Crimes Task Force (BCCCTF) in Missouri set up a “decoy” of a 14-year-old girl. When they’d posted a simple whisper saying that boys were immature, a suspect got in touch and arranged a meeting, only to be arrested and charged with attempted sexual enticement of a minor. He pleaded guilty and was given 10 years in prison in 2020.
Whilst the FBI and other government agencies can’t read your WhatsApp messages or see who is Whispering, they can get enough information from either to potentially locate a target.
This story is part of The Wire IRL feature in my newsletter, The Wiretap. Out every Monday, it’s a mix of strange true crime and real-world surveillance, with all the relevant search warrants and court documents for you to pore over. There’s also all the cybersecurity and privacy news you need to read. Sign up here.
