For those of you just joining our community, I'd like to welcome you. For those of you already in the TL community, you will know that our Search Party CTFs are not your typical CTF competition.
Our CTFs are non theoretical and focused on collecting intelligence on real missing persons so we can collectively help law enforcement with these cases. During these CTFs, emotions can run high as the thrill of competition combines with the very serious subject matter at hand.
While we try to make our CTFs fair and a positive experience, this is not always easy as we are dealing with real, live, missing persons cases and the analysis of real data. As always, the Trace Labs mission is to reunite missing persons with their families and support understaffed law enforcement agencies with crowdsourced OSINT for their missing persons investigations. As a community, we have been successful with this mission.
I ask you all to bear with me while I provide some history and background on why I started this organization.
Over a decade ago I was fortunate to discover a special group of volunteers who sacrificed their family time to put themselves in harm's way in order to save a stranger. The Search & Rescue community is composed of like minded people who are action oriented, highly skilled, task focused yet also compassionate, caring and willing to do whatever they can to help others. It takes a certain type of person to wake up at 3am on a Sunday morning with a request to climb a mountain in snow or rain. I am truly honored to know them and to say I’ve held the line with them, arm to arm.
During my time in Search & Rescue I was able to support law enforcement in reuniting missing persons with their families. I participated in many family reunifications. These events would fill you with tears of joy. You would see families fall to their knees with overflowing happiness as they saw their loved ones step off the helicopter. Even as I write this it’s hard not to be emotional. The emotion you will see from parents when they have had to think the worst for days and then discover their son or daughter is alive is indescribable. Anyone would feel proud to be able to participate in supporting this, even in a small way.
There is also the dark side to Search & Rescue. Those are the events where sometimes we need counseling. These events impact us all differently. It can be a shadow for some that changes their lives dramatically. For me, I turned more serious and laugh less now which sometimes bothers my family. I have nightmares about making the wrong decision too many times in a row which is often where we see people run into trouble in the back country.
It was during events like this that I would often think about all the people we didn’t find or what’s worse, the people we didn’t even look for. This gap always bothered me. As a father, this didn’t feel right. Around that time, we had the biggest search in British Columbia history. This search used a lot of helicopters and dropped us off into some brutal terrain. The area was so big and the terrain so brutal, the helicopters started flying over it and their recorded footage was put on YouTube for viewers to watch and see if they could detect any signs of the lost person. This was the first instance of crowdsourcing in Search and Rescue that I had witnessed.
A big part of the issue we face with missing persons is that it’s not necessarily a crime. It’s also not necessarily a high priority for law enforcement when compared to other criminal acts that need immediate attention. We can’t look for every missing person simply due to resourcing and prioritization.
In Search & Rescue we have the capability to scale by bringing in more trained volunteer members. However, sometimes we would have friends and/or family members who also want to assist. These are called “convergent volunteers” and are rarely utilized. The reason for the hesitation to utilize these additional resources is it brings increased risk to the operation. If we send the untrained public into the field, they have the potential to get lost or hurt themselves which draws resources away from the primary task. But what if you could find a way to utilize convergent volunteers to better scale?
I’ve been fortunate enough to be able to travel the world and have attended most of the main InfoSec conferences. Some of those have very large CTFs where people would come in with a large monitor and a six pack of red bull. Win or lose, the contestants are fully dedicated. When I saw this I realized I had found my convergent volunteers. If we could somehow make a safe structure for these people to operate and harness the power of this group, we could do amazing things.
As the founder of Trace Labs, I can say I am responsible for the idea but it was the hard work of our directors, core team and countless volunteers who made it a working organization. The idea was to create a space for convergent volunteers to safely participate. A place where anyone from anywhere could have the opportunity to give back to their community. An opportunity for like minded individuals from around the world to answer the call for help and to experience the immense satisfaction of helping a stranger on the worst day of their lives.
We started the organization in Canada and decided to make it a non profit to ensure it would always follow the mission to help law enforcement to find missing persons by crowdsourcing open source intelligence with volunteers. This is essentially the same way Search & Rescue works in Canada. All volunteers, with donations paying for expenses. No salaries, no administration and no need to chase profits. While we sell t-shirts and other memorabilia, we sell these at cost and instead fund operations through our Global Search Party CTF events. If you want to participate as a convergent volunteer, your ticket helps fund the operations that allow that.
In order to ensure Trace Labs was of value to law enforcement we knew that we had to be different from other efforts. We had to provide value with low risk. Therefore our scope had to be very narrow. Our mission is strictly open source intelligence which means we are limited to passive reconnaissance. We in no way perform any sort of active engagement. The reason for this is because unlike theoretical CTFs, ours involves real missing persons. Since these are real people with real lives, we must ensure the highest level of respect.
Open source intelligence often referred to with the acronym OSINT, simply means freely available public information. This is information that anyone could find, if they knew where to look. We don’t do password resets, we don’t engage, we don’t call anyone, we operate as ghosts to ensure 1) we don’t interfere with an ongoing police investigation and 2) don’t cause the families of the lost ones any unnecessary stress.
Our scope is as much about not breaking the law as it is being respectful as a decent human being.
During the inception of Trace Labs we spoke to many people about the concept. Huge thanks to all of you. This included coffee conversations with law enforcement at every level as well as professionals in the information security industry. I will always remember some of those who were onsite in operations when they spoke to me about the risks and how we must keep our scope narrow to ensure everyone was safe. This has been the reasoning for our narrow scope. Not only the safety of the missing persons, but safety for everyone.
Any time you’re dealing with sensitive topics like missing persons, you have to carefully consider all factors. The Trace Labs model was very carefully designed with this in mind. Our mandate was to not interfere with a police investigation, not break the law, not upset the friends or family, not endanger the subject or contestants and don’t allow bad actors to gain details on the subject.
This is why we only work with missing persons that have been verified by law enforcement and we used a closed system for our CTFs. This means no one team or individual ever has a full view of all the data. Also, contestants are anonymous. We don’t care who you are, all we care is that your data is verifiable.
We created a traditional looking CTF platform but rather than your regular theoretical flags with one known answer, we have real missing persons with real intelligence to gather. While theoretical is fun, nothing beats real. Win or lose, our contestants learn what OSINT techniques work and what doesn’t in the real world. They also know their contributions are directly helping law enforcement find this missing person. .
In order to crowdsource our convergent volunteers, we needed incentives. We therefore looked to the video game industry to recognize the value of gamification. It’s hard to imagine making a game out of something so serious. However, the gamification was needed to drive the crowdsourcing required. Gamification is the fuel that drives our crowdsourcing and allows us to quickly scale to hundreds of people. This is a highly cost effective way to supplement the intelligence gathered on any missing persons case. To make it engaging for beginners and experts alike, we have flags worth a few points for easy things like finding their social media and flags that are more difficult with more points like what they were doing on the day last seen.
Our worst case scenario is when we don’t find any new information that would normally allow the police to reopen the case. However, even in this scenario, the respective law enforcement agency is able to go to the family of the missing person and tell them hundreds of people searched and couldn’t find any additional information. This ensures the family knows everything that could be done, has been done.
The name Trace Labs was also very intentional. We are testing this model to see if we bring improvements to a terrible problem. We hope with your help, we will continue to push the envelope to globally improve the missing persons problem.
The last thing I will say about our CTF is that these events would not be possible without our volunteer judges. Their task is not easy and they are exhausted at the end of a CTF. Normally we have between 10 to 150 volunteer judges who dedicate their days to validating OSINT submissions in our platforms and providing their teams with guidance. This is almost always a very positive experience even though it can be challenging with different languages, time zones, etc. Our volunteers are dedicated and really want to support the mission.
While we ensure the judges are trained in the process, the process can be challenging. These volunteers do their best. However, they are human, mistakes happen. We do a few levels of quality control both during and after the event to catch most issues (especially if there is a complaint or concern). I do want to note that the judge and contestant relationship works best when the two work together collaboratively to produce the best possible leads on a missing persons case. We are always making improvements to our process to enhance the judge to contestant experience which ultimately improves our report to LE. If you have suggestions on how to improve this or other TL processes, please let us know as we are always looking for more volunteers.
With your help, Trace Labs has evolved to become a staple in the OSINT community. Do we always get it right? No. Normally when we make mistakes, it’s due to the non-theoretical nature of our CTFs that impairs the contestant's experience. If you, or someone you know, had a poor experience, let me know how we can improve and hopefully you can work with us to implement that improvement.
I know the result of having a popular CTF is people will want to win. This has become more of the focus in recent years and as a non profit organization, we hope to shift the focus back to our mission. Contestants should know that even if they don’t win a Trace Labs Search Party CTF, every piece of intel gathered counts as it could potentially be the missing piece of an investigation that could help reunite a missing person with their loved ones. This is why we also have the Most Valuable OSINT (MVO) award, an award given to the team for the best piece of intel submitted, valuing quality over quantity.
I always value the feedback of the community. My door is always open. Please feel free to reach out to me any time with feedback on how Trace Labs can improve our CTF experience and advance our mission of helping law enforcement find missing persons.
Sincerely,
Robert Sell
Founder
robert.sell@tracelabs.org
