Username correlation is one of the most productive techniques in open-source investigation. People reuse handles across platforms because remembering different ones is tedious, and a distinctive handle can lead from a throwaway account to a decade of public activity. It is also one of the easiest techniques to get wrong.
The false positive problem
Enumeration tools take a username and check whether a profile with that name exists on each of several hundred sites. They are fast, free or cheap, and genuinely useful for discovery. But "a profile with this name exists" is a very different statement from "this profile belongs to our subject", and the gap between the two is where investigations go wrong.
An analyst who copies the tool's output into a report has not found the subject's accounts. They have found a list of places to look, most of which will turn out to be someone else.
Our own test
To measure the gap, we re-ran automated enumeration on the primary usernames of subjects in 40 closed investigations where we already knew, from verified work, which accounts belonged to the subject.
| Result | Hits | Share |
|---|---|---|
| Account verified as belonging to the subject | 214 | 16 percent |
| Different person with the same username | 531 | 40 percent |
| Site reported a match that did not exist | 297 | 23 percent |
| Abandoned, squatted or placeholder account | 204 | 16 percent |
| Impersonation of the subject by a third party | 66 | 5 percent |
| Total | 1,312 | 100 percent |
The tools also missed 38 accounts that we had found by other means, mostly because the subject had varied the handle slightly or used a platform the tools did not cover. Automation saved time on discovery and then created several hours of verification work per case. That is a fair trade, as long as the verification actually happens.
Why tools get it wrong
- Common strings. Handles built from ordinary words, first names and birth years are shared by thousands of people. The more ordinary the handle, the less a match means.
- Site behavior. Some sites return a valid page for any username, or redirect missing profiles to a search page, which tools read as a hit.
- Recycling. Platforms release handles from deleted accounts, so the current holder may have no connection to the person who used it five years ago.
- Squatting and impersonation. Notable subjects attract people who register their names, sometimes to sell, sometimes to mock and sometimes to deceive investigators like us.
The verification ladder
Every candidate account climbs the same ladder before it can appear in a report as belonging to a subject. Each rung is documented, and the account's captures are preserved and hashed whatever the outcome.
- Does the account exist? We confirm a real profile with content, not a placeholder or a search page.
- How distinctive is the handle? We estimate how many people could plausibly use it. A twelve-character string with no dictionary words carries far more weight than a first name and a year.
- Do independent attributes match? We look for the same profile image, which we trace through reverse image search to find earlier copies, not to match faces. We look for links between accounts in bios, the same external website, consistent biographical details, the same writing habits and activity in the same time zone.
- Does the timeline fit? Account creation and activity dates must be consistent with what is known about the subject. An account created after the subject was arrested is not the subject's.
- What else would explain it? We state the strongest alternative explanation, such as a namesake, an imitator or a shared family account, and record why the evidence favors one over the other.
Weighing links
Not all matches are equal. We classify each link between a candidate account and a subject before deciding what the account can support.
| Link | Typical weight | Why |
|---|---|---|
| Account links to the other account in its own bio | Strong | A deliberate act by the account holder, hard to fake retroactively |
| Same original image, earliest copy on a known account | Strong | Original files are rarely shared, and earliest appearance establishes source |
| Distinctive handle with matching details | Moderate | Strong if the handle is rare, weak if it is common |
| Similar writing style or activity hours | Weak to moderate | Supportive, but shared by many people |
| Same common username only | Weak | Never enough on its own |
Our rule is simple. An account is reported as the subject's only with at least two independent links, at least one of them strong. With fewer, it is reported as a possible account, with its links listed, or not reported at all. How those links translate into confidence language is set out in Attribution is a standard of proof.
What absence means
A username that returns no hits tells you very little. Subjects vary handles, use platforms the tools do not cover and delete accounts. We record negative results because they show what was checked, but we never present the absence of a match as evidence that a subject has no online presence.
One operational note: some enumeration services run on infrastructure we do not control and may log what is searched. Our analysts use them only from managed research environments and never enter client names or case references.
Before an account is reported
- Confirmed as a real profile, captured and hashed?
- Handle distinctiveness assessed and recorded?
- At least two independent links, one of them strong?
- Timeline consistent with the subject's known history?
- Strongest alternative explanation stated and tested?
- Negative results recorded alongside the positive ones?