| ShadowDragon | |
|---|---|
| Original author | Daniel Clemens |
| Initial release | 2016 |
| Service name | OSINT |
| Website | https://shadowdragon.io |
ShadowDragon is a set of open-source intelligence (OSINT) tools used by law enforcement, financial crimes units, corporate security teams, and other researchers. It allows users to access and analyze data from social media, the dark web, archives, and other internet sources to quickly identify persons of interest and create maps of their networks. Frost & Sullivan awarded ShadowDragon its 2024 Global Entrepreneurial Company of the Year Award in the OSINT industry. [1]
CEO Daniel Clemens founded ShadowDragon Holdings, LLC, in 2016 as a spinoff of his Packet Ninjas security consulting company. [2] Clemens adopted the name ShadowDragon from the Neurocordulia genus of dragonfly, whose common name is 'shadowdragon' and which is known for its agility and hunting prowess. "Today organizations are struggling to identify, understand and stop the malicious actors and threats targeting them," he stated. [2]
Launched in 2009, ShadowDragon's SocialNet product collects data from over 200 sources, [3] including BabyCenter, BlackPlanet, Bodybuilding.com, FetLife, Fortnite, PornHub, Telegram, and Tinder, allowing law enforcement to find open source intelligence on targets. It is connected through the Maltego platform. It links an individual's accounts between sites to create a social network graph. [4] [5] [6] ShadowDragon's Horizon™ Monitor scans for possible real-time threats.
ShadowDragon's reception was mixed, with some identifying it as potentially invading individuals' privacy and others citing the need for tools to combat increasingly sophisticated bad actors. Moreover, the debate concerning ShadowDragon reflects the larger, ongoing debate on right to privacy versus security. [12]
Jeramie D. Scott of the Electronic Privacy Information Center stated, "This type of mass surveillance, which is available to the government and other entities, creates a chilling effect on online activities." [5] Samantha Floreani of Digital Rights Watch termed it "exceptionally invasive, generally operat[ing] without people’s knowledge, [and] ... potentially inaccurate". [6] Kade Crockford of the American Civil Liberties Union stated, "People shouldn’t be afraid to voice their political opinions or speak out against the police themselves because they fear the police are watching them," [8] and Arisha Hatch of Color of Change asserted that tools like ShadowDragon are "often introduced under the false premise that they are public safety and accountability tools." [11] In particular, its use has been labeled problematic with respect to sensitive areas such as abortion [5] and Black and marginalized communities. [11] Consequently, the Mozilla Foundation has called on major companies to block the ShadowDragon scraper, including Amazon, Apple, Discord, Facebook, Google, Nextdoor, OnlyFans, YouTube and others, but none have apparently done so. [13] [14]
Currently, however, Congress has passed no laws governing law enforcement's use of social media, although individual social media companies could adopt policies curtailing their use for this purpose. [15] Moreover, proponents cite the critical role that social media can play in law enforcement in providing information for investigations. [16] Clemens himself has stated that the company's products provide only publicly available information, that ShadowDragon does not “build products with predictive capabilities,” that "[n]othing proprietary or private is provided to us by the platform companies,” and that ShadowDragon vets “all in-bound requests for our products to ensure they’re not used to conduct human rights violations.” [11] Importantly, the company's website states that ShadowDragon's software does not circumvent a social medium platform's encryption or privacy settings, nor does it use "developer-level access" to access the platform's content, [10] an assurance Clemens has reiterated: “We don’t evade any encryption implementations because we’re not interested in weakening the technical security for other platforms.” [11]
Law enforcement authorities who employ ShadowDragon and similar softwares are understandably reticent about its capabilities and their use of it, as they do not want to provide information that could be used by bad actors to circumvent it. [3] However, ShadowDragon users have asserted that they do not employ it to violate privacy laws. In response to inquiries concerning the Michigan State Police's contract with ShadowDragon, MSP spokesperson Shanon Banner stated, “The investigative tools available to us as part of this contract are only used in conjunction with criminal investigations, following all state and federal laws.” [11] A spokesperson for the Polk County (Iowa) Sheriff's Office stated that he was familiar with the fears associated with use of ShadowDragon and similar surveillance softwares, but that his office used the tool to investigate crimes, not create them. "So it's not like we're using this to go search for the crime," he said. "We know the crime has occurred, and now we're using it to assist in resolving or solving or gathering information to help resolve or solve that crime." [10]
Law enforcement personnel who have been interviewed stressed the seriousness of the types of crimes that ShadowDragon would be used to investigate. The Polk County (Iowa) Sheriff's Office acquired the software as part of a grant from Operation Underground Railroad (now Our Rescue or O.U.R.) to combat human trafficking and child sex abuse. [10] Acting U.S. Attorney for the District of Massachusetts Nathaniel Mendell told NBC10 Boston that the technology would be used to focus on the most violent criminals. [8]
ShadowDragon's capabilities have been cited as significantly increasing law enforcement's ability to do its job. According to Clemens, during an evaluation, ShadowDragon enabled FBI investigators to conduct an investigation or background check in 5–15 minutes, whereas previously those would have taken two months done manually. [11] Acting U.S. Attorney for the District of Massachusetts Nathaniel Mendell told NBC10 Boston that the software makes it much easier to sift through the vast amount of data that are publicly available online. “I expect it will be extremely valuable,” Mendell said. “What used to take you a week or a month might now take you a day or a few hours.” [8]
{{cite journal}}: CS1 maint: article number as page number (link)