Sock Puppet
Definition
A fictitious online identity created and controlled by an investigator to observe or interact with a target without revealing the investigation. The use of sock puppets is subject to legal and policy constraints in many jurisdictions and requires specific authorisation in covert OSINT operations.
- Field
- OSINT, covert online investigation
- Function
- Fictitious identity used to observe or engage a target
- Legal status
- Requires specific authorisation in many jurisdictions
- Risk
- Entrapment and platform terms-of-service violations
Common questions
Why can't an investigator just use their own account for covert OSINT?+
A real account exposes the investigator's identity and network to the target, can tip off the subject, and creates a mixing of personal and investigative activity that undermines evidentiary integrity. A sock puppet keeps the operation compartmentalised and deniable during the observation phase.
What legal problems can sock puppet use create if not authorised?+
Unauthorised use can amount to unlawful surveillance, breach platform terms in ways that taint evidence, or shade into entrapment if the puppet actively induces the target to commit an act they otherwise would not have. This is why agencies require written authorisation before deployment.
Related terms
- Digital Footprint
- The cumulative set of data traces a person or entity leaves across internet-accessible sources, including domain registrations, social media posts, forum accounts,...
- Metadata
- Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images....
- NCII
- Non-consensual intimate images. The category includes revenge porn, leaked private content and morphed sexual imagery. Prosecuted in India under IT Act Section...
- OSINT
- Open-Source Intelligence. Investigation using publicly available sources: social media, satellite imagery, news archives, public databases. In deepfake casework, OSINT corroborates or contradicts...
- Passive Collection
- OSINT collection that queries third-party databases and archived sources without sending any traffic directly to the target's systems, avoiding any trace on...
- Pig Butchering
- The 'sha zhu pan' romance-investment scam. Phase 1 builds the relationship over weeks. Phase 2 introduces a fake crypto or trading platform....
- Section 79 Safe Harbour
- The IT Act 2000 provision that exempts intermediaries from liability for third-party content, conditional on observing due diligence under the Intermediary Guidelines...
- Significant Social Media Intermediary (SSMI)
- An intermediary with more than 50 lakh registered users in India. Under the Intermediary Guidelines 2021 an SSMI must appoint a Chief...
- Traceability Rule
- Rule 4(2) of the Intermediary Guidelines 2021. Requires significant social media intermediaries that provide messaging to enable identification of the first originator...
- WHOIS
- A query protocol that returns registration data for a domain, including registrant name, organisation, email, nameservers, and registration and expiry dates. Since...
Explained in these topics
- Social Media Crime: Cyberbullying, Grooming and StalkingA fake account operated by a person who already has a real account, used to amplify, harass or impersonate. Bot farms operate sock puppets at scale; coordinate...
- Web OSINT and Digital Footprint Analysis