Facebook data is super useful for open source intelligence (OSINT) investigations and academic research alike. Facebook does not make it easy to collect data from its site, however. Jake Creps posed a question on his OSINT blog about how to collect lists of people who marked themselves on Facebook as having attended certain events. In this post, I will walk you through a method I have used to collect such data.
But First…Why?
I have been interested in collecting this kind of data for reasons similar to those Creps articulated in his post. Though I do not typically think of what I do as “OSINT,” some of my past research has looked at the role of social media use by protest groups and social movements. This has included work on the movement to promote military blogging in the United States, the central role of new media technologies in the Occupy Wall Street protests, and the role of social media in the early years of the Syrian civil war. Since the election of President Donald Trump in 2016, we have seen the emergence of new protest groups on both the right and the left in the United States, many of them aided to a significant degree by their savvy use of social media.
Patriot Prayer is one such group that has caught the attention of many observers of these trends and will serve as the case study for this post. This group is based in the U.S. Pacific Northwest, in and around Vancouver, Washington and Portland, Oregon. Most media reports identify a man named Joey Gibson as the group’s leader. The group has held dozens of protests and rallies since 2017 and Gibson even ran for Senate in 2018.
Of course, any movement requires the support of more than just one person. This raises the question of who, beyond Gibson and any associates mentioned in news reports, are the core followers or supporters of the Patriot Prayer movement.
We may be able to get some insight by looking at attendee lists for past Patriot Prayer events. More specifically, we can look to see who regularly attends such events. The assumption is that those who are attending the most events are core supporters of the movement. Looking further at their profiles could then help us answer basic questions about demographics (e.g. gender, age, race), motivations for supporting the movement, issues of concern to movement supporters, other events or groups that they attended or support, etc. All of this, in turn, can help us to understand better the rapid emergence of this group and the national media attention it has garnered as a result.
How to Collect the Data
For the method that follows, you will need a few things:
- Chrome web browser
- Linkclump browser extension
- Basic knowledge of html document structure
- Some basic spreadsheet skills to begin analyzing the data
Step one is to navigate to an event page and click on the link to show a pop-up list of those interested, invited, and planning to attend or already attended (depending on if the event already occurred or not). Note that not all event pages will have the option to see this information. Whether it is displayed or not is up to the page administrator. Some choose not to display this data. In the case of Patriot Prayer, such data is available for most of the group’s early events. The administrator seems to have hidden this data for later events. However, we can collect enough from the early events to get an idea of who the core “early adopters†were.
Next, we will want to select “went†from the links along the top of the pop-up. Scroll to the end of the pop-up to make sure all data is loaded.
Now we are going to open Chrome developer tools by choosing “Developer…†from the View menu or by hitting CMD+Alt+I on Mac, Ctrl+Alt+I on Windows. After doing so, we will hit Ctrl+F (Windows) or CMD+F (Mac) to open the developer tools finder. Paste “uiScrollableAreaContent†into the finder. There should be a few results. Move through each result until the pop-up content is highlighted in blue. We’ve now found the parent element that contains all the data we need. By scrolling to the bottom of the pop-up, we have ensured that all the data is loaded even though we can’t see it.
“To use on local pages (i.e. file:// URLs) you need to go to the extensions page (chrome://extensions) and tick the option ‘Allow access to file URLs’ for the Linkclump extension.â€