The OSINT investigative process may include searches within social media. Due to the consolidation of this field, a category of methodologies and techniques for gathering information in social media was identified: SOCMINT. A stage in the development of this methodology was the SOWEL classification. #### What is SOWEL? At the moment, there are a huge number of social networks and platforms for communicating. Let's depict a set of social networks and highlight the most famous ones for example: ![[intro_1.png]] We understand that each social network has its own peculiarity and sometimes specialization: publishing photos, sports training, computer games, etc. This leads to the realization of a certain functionality, i.e. a set of functions and features that are offered to users. Let's depict the functionalities of each social network as ellipses of different colors. The functionalities can be both common for several social networks and unique, specific only to a particular social network: ![[intro_2.png]] If we represent this scheme without social networks, we will get a set of existing functionalities. Let's call this set _SOcmint Functionalities List (SOFL)_: ![[intro_3.png]] Let's consider one of the functionalities in detail: ![[intro_4.png]] Since there can be several functionalities, it is necessary to number them. Let us denote the selected functionality as $SOFL-n$ _where,_ _n = 1,2, ... — indicates the number of the functionality_ Each social network functionality contains one or more "loopholes" (indicated by dashed triangles in the figure below) that allow to extract additional information. These "loopholes" can be either a planned part of the social network functionality or unfixed bugs. For us, these "loopholes" are weaknesses of the social network. The set of all such weaknesses related to different functionalities will be called _SOcmint Weaknesses Enumeration List (SOWEL)_, accordingly each separate weakness can be numbered and denoted as $SOWEL-i$ _where, i = 1,2, ... — indicates the weakness number_ ![[intro_5.png]] Once we have identified the _SOWEL-i_ weaknesses in the _SOFL-n_ functionality, we need to extract additional information through them. To extract information through _SOWEL-i_ weaknesses, we need a set of specific techniques, and each technique should correspond to a different weakness. Let us denote the set of such techniques as _SOcmint Techniques List (SOTL)_ and the techniques themselves as $SOTL-i.j$ _where, i = 1,2, ... — indicates the number of the weakness to which the technique is applied j = 1,2, ... — indicates the number of the technique within a given weakness_ ![[intro_6.png]] Thus, by applying _SOTL-i.j_ techniques to their corresponding _SOWEL-i_ weaknesses in the _SOFL-n_ social network functionality, we can obtain additional information: ![[intro_7.png]] However, we may be interested not in obtaining information, but in hiding it within the framework of Counter-OSINT, that is, when we want to make it more difficult to find information about ourselves in open sources. In this case, we apply counter-techniques that have the same numbering principle as the _SOTL-i.j_ techniques. Let us call the set of such countertechniques _SOcmint Counter Techniques List (SOCTL)_, and the techniques themselves as $SOCTL-i.j$ _where, i = 1,2, ... — indicates the number of the weakness to which the countertechnique is applied j = 1,2, ... — indicates the number of the countertechnique within a given weakness_ ![[intro_8.png]] Thus, the *SOWEL classification* distinguishes 4 main concepts: _SOFL — SOcmint Functionalities List SOWEL — SOcmint Weaknesses Enumeration List SOTL — SOcmint Techniques List SOCTL — SOcmint Counter Techniques List_ (Not added yet) **Remember that _SOFL_ numbering is not related to _SOWEL_, _SOTL_, and _SOCTL_ numbering.** #### Examples of use of the SOWEL classification ##### Example #1 Many social networks have the functionality of subscribing to users or adding them as friends: $SOFL-22$ The weakness of this functionality is the ability to see the user's environment: $SOWEL-2$ Often, an alternative user account may be present in the user's environment, be it subscriptions, subscribers or friends. Therefore, a technique to find the user's alternate account in the user's social environment was highlighted: $SOTL-2.5$ ##### Example #2 Some social networks have the functionality of displaying users nearby: $SOFL-14$ The weakness of this functionality is that information about a user's appearance in some places may be available to other users: $SOWEL-16$ With the help of technique it is possible to determine the geographical location of users on the map: $SOTL-16.1$