Sofia's OSINT Exercise 007

💡 Check out Sofia's blog and this exercise here

Challenge

The photo below was taken a few years ago in a beautiful city.

Your task is to find the answers to the following questions:
a) Where was the photo taken?
b) In which year was the photo taken?
c) The big poster on the right contained a link to a website. What was the link?

Bigger image here

First Look

Beautiful city, eh? Well I’ll be damned if this isn’t some place in Portugal Sofia… 🕶🌴
The statue / structure in the image should give us the general location with an image reverse search, and that poster looks like it’s from an exhibition about ancient Egypt. That should be enough context to find the solution to this exercise.

Lisbon

As suspected Google Lens makes short work of finding the general location. This picture was taken outside a shopping center in Lisbon, the Centro Vasco da Gama.

Using the metal statue, pedestrian crossings, and patterns in the cobblestone, we can easily pinpoint the exact location this photo was taken from: 38.767694, -9.096194

Tutancâmon

I’m convinced that I can find the poster in question with the amount of information we have about it. Finding this would likely lead us to the answers to questions B and C.

Zooming in to the picture, we can make out a word that resembles “Tutankhamun”, a Pharaoh in ancient Egyptian history. It doesn’t quite fit the lettering perfectly, but it’s close enough that I’ll attribute this to language specific spelling.

Speaking of language-specifics, here’s a fun showcase why searching in the target region’s local language is usually a good idea. The Google results for the English query Tutankhamun lisbon aren’t very promising, at least nothing jumped out at me on the first results page. Whereas the Portuguese query Tutancâmon lisboa leads us to something that peaks my interest… 👀

Now my Portuguese isn’t perfect, but this logo looks suspiciously familiar…

To seal the deal, we check out the Facebook page linked on the exhibition website. We find what we’re after in the page’s photo album: the poster on the wall from our source image.

Answer C is the website we just came from: www.tutankamon.pt.

Moreover, the exhibition seems to have started in April 2019. In another one of the Facebook posts, we find the end date of the exhibition: September 22, 2019. Based on this information, answer B is likely the year 2019.

Verification

To corroborate this we investigate Street View imagery taken at different times. This location has good coverage with Street View data for 2019 and 2021, but is missing the year 2020. This shot from 2019 shows our exhibition poster, and it’s gone in this shot from 2021.

Theoretically the poster could’ve stayed up until 2020 after the exhibition had already ended, but if we take a look around in the 2019 footage, we can see this cardboard structure behind the metal statue, which is also present in our source photo and further strengthens our case for the year 2019.

While this is technically still not definitive proof that this was taken in 2019, by piling up more and more circumstantial evidence, we’re decreasing the likelihood of any competing hypotheses.

If we really want to go all in and full-send this investigation, we can collect even more evidence by trawling the depths of social media. If we can find images taken after the Street View photos from October 2019 where the poster is no longer fixed to the building, that would erase the last shimmer of doubt.

Twitter is a great place to start because of its advanced search capabilities, and frictionless web experience. Using the following syntax we can specifically search for Tweets sent from

• a specific location: geocode:<latitude>,<longitude>,<radius>
• a specific time frame: until:yyyy-dd-mm since:yyyy-dd-mm
• and which includes images: filter:images

The final query looks like this

geocode:38.767694,-9.096194,0.1km until:2020-08-01 since:2018-01-01 filter:images

And with a bit of luck a friendly stranger will have posted about their lunch and serve us exactly what we need: the lost photograph. Our Pharaoh no longer graces the wall and we’ve solved another one of Sofia’s challenges.

Answers

A: Lisbon, Portugal “Centro Vasco da Gama” (38.767694, -9.096194)
B: In 2019, likely around October
C: www.tutankamon.pt

Final Remarks

If you haven’t figured it out yet: I’m a perfectionist. I like doing things right.

Sometimes, however, perfect isn’t necessary. Some other times it might actually be detrimental to a case if by delivering a perfect report, you miss the right timing and your perfect advisory goes to the bin because an opportunity, event, or incident has already passed.

“Perfect is the enemy of good” is probably one of the most valuable lessons I have learned in my career as an intelligence analyst so far, and applies to this investigation too. If the necessary level of confidence for our assessment is not extremely high, then it’s fine to stop after confirming the duration the exhibition ran for. There are always going to be cases that need absolute bulletproof certainty, but more often than not, a good and timely report is better than a perfect and late report.

Tools used

• Google Lens
• Google Maps + Street View
• Twitter Advanced Search