[Updated January 2019]
Channel 4 reality tv programme Hunted manages to get you to suspend disbelief (you quickly ignore the obvious presence of a camera person with each fugitive) as around a dozen "fugitives" are hunted by a team of hunters with
the simulated (in the case of CCTV and ANPR) powers of our UK surveillance state.
It is worthwhile thinking about some of the techniques used in the 4 series so far and how proportionate their use is in any real
cases, apart from the very most serious criminal or national security scenarios.
Twitter hash tag: #Hunted
Channel 4 Hunted home page
Hunters' techniques already used
DVLA vehicle Registered Keeper check
ANPR - Automatic Number Plate Recognition
GPS / Mobile phone vehicle tracking device attached to family / friend's car
Private aeroplane flight plans
AIS boat / ship beacon mapping
Public CCTV - realistically not available in real time except at transport hubs
Bank ATM CCTV
Bank ATM card transaction alert
Mobile hunter teams in distinctive Volvos or BMWs etc. (N.B. product sponsorship deals)
Mobile hunter teams in less distinctive white van etc.
Helicopter surveillance - limited airtime
Drones - limited battery, not so great in bad weather#
N.B. neither helicopters nor drones are likely to be used in near major airport flightpaths
Directed Surveillance "stake our"of fugitives family / friends homes using remote cameras and human watchers.
Sniffer dogs
Mobile Phone subscriber details - registered or burner ?
Mobile phone new SIM card in known IMEI handset
Mobile Phone friendship tree - other numbers called / recived when, how long for
Mobile Phone Location Data - targeted
Mobile Phone Cell tower dumps - all other people, not explicitly suspected of anything, in an area at a time
snail mail intercept of letters / postcards
Social Media monitoring
Twitter
FaceBoook
Contact chain mapping / visualisation - IBM i2 Analysts Notebook etc.
Mobile Cell Tower dump analysis to detect candidates for people who picked up a fugitive in a relatively isolated village at a certain time and then phoned their mate to arrange a further lift the next day. Harder to do in a City, but there are more Cell Towers per square kilometre. N.B. usualy a maximum of 256 simulataneous calls per Cell
Hacking of seized laptops , iPads, SmartPhones after a visit by hunters
Covert Hacking via USB malware of laptops , iPads, SmartPhones during a visit by hunters
Web bugging the USB with the fugitive extractiomn instructions to betray the IP address and thus approximate location of where it was opened
(Fugitives should make sure the internet is disconnected if they need to do this again)
Forensic analysis of paper writing pads and note books etc. to reveal writing impressions on the blank paper
Encouraging children and other casual occupants of a fugitive's family or friends or casual helper's home to talk about the exciting / famous visitor(s) and where they are going
Local radio and newspaper and social media Reward Appeals
£££ cash rewards for tips to publicised phone line or email address
Bribing £££ with reward offer other casual occupants of a fugitive's family or friends or casual helper's home to talk about the exciting / famous visitor(s) and where they are going
Psychological pressure especially on fugitives with young families
"ghost agent" - Non-hunter private investigator / CHIS acting as undercover agent e.g. picking up hitchikers and taking them to the hunters
Social Engineering / blatantly lying to casual contacts on the phone or in person contradicting the fugitives story to get information on them e.g. drop off point
Social Engineering / offering a financial reward to casual contacts on the phone or in person to get information on the fugitives e.g. drop off point
Hacking in to an Android mobile phone's Google Voice Search search history voice recordings
Hacking in to a Google account showing Google Maps search histrory
Find from bank records that recent graduate students have money problems.
Exploit this by freezing their bank accounts.
When they are recovering from wet wild camping at a local inn, the Bank Card Transaction Declined
pinpoints their exact time and location to the Hunters.
Using up almost all of their cash to py the bill, forces them to reach out to their (monitored) network of friends
Hunters techniques - not yet seen
internal Bus and Train CCTV - can't be real time
London Oyster Travel Card data - some early posters, but was it actually used ?
London Oyster travel Card combined with TfL CCTV
Mobile device Wifi Probes trying to automatically connect back to out of range home or office Wifi
Mobile device Wifi Probes trying to automatically connect back to out of range but distinctive list of "free" WiFi Access Points
GPS coordinates embedded in a digital image posted on social media - Exif metadata - like John McAfee EXIF Data May Have Revealed Location of Fugitive Software Tycoon John McAfee
Digital camera flaw analysis of digital image posted on social media to identify other photos taken with this (borrowed ?) device, which may lead to the owner
GPS Fitness tracker social media app (e.g. Strava) infiltration and analysis to identify competitive runners or swimmers or cyclists who may be contacts
Equivalent of Cell Dump using e.g. Google Maps - who has been downloading map tiles of a certain area at the relevant time for navigation ? Do their
other Map downloads give a clue as to where they are heading ?
GPS navigation device route data from "seized" vehicle that gave the fugitive a lift
GPS navigation device route data from "seized" SmartPhone of a driver gave the fugitive a lift
GPS / Mobile Phone Network tracking of vehicles fitted with E111 emergency "call the ambulance if in a crash" technology
Private Investigator / CHIS cruising the initial Start location, or, when identified the Extraction point as a mini cab driver / Uber driver to pick up fugitives and lead them into the arms of the hunters.
Fugitives' techniques already used
Wigs, and change of clothing disguises
Hats and scarves - most CCTV looks downwards, so these can make it harder for hunters to pick out enough identifying detail of your face
Human decoy disguised as the fugitive
Initial start point disguising of luggage e.g. rucksacks hidden in airline style luggage cases on with wheels
Heading for the countryside along canals etc without urban CCTV
Heading for the countryside to a network of friends
Heading for cities with network of friends
Having a huge network of friends or fans e.g. tv / pop stars with fans, political activists or Free Masons
Burner phone - not enough to swap SIMs - phoning a "watched" number hardly slows the hunters down at all
Disinformation - planting false clues for the hunters
Social Engineering / Blagging lifts / hitchiking
Social Engineering / Blagging the temporary use of a stranger's mobile phone to make a call
Social Engineering / Blagging the temporary use of a stranger's computer to use the internet etc.
Using an online mobile phone app simulator to send an App message to a physical SmartPhone
Bicycles - no ANPR
Motorbikes / scooters - less chance of ANPR
Taxis - quickly jumping in to e.g. London black cab taxi is better than waiting in the open for a bus, but risks hunters getting drop off details from the driver / company or even internal CCTV
Speed Boat
Helicopter
Celebrity fugitives can hide in a locations which are heavily fortified (Parliament) or surrounded by private security cameras and guards
(multiple private holiday homes estate owned by rich people) inaccessible to the Hunters.
Well resourced (Celebrity) fugitives seem to have multiple helpers and decoy vehicles - stretch the Hunters' resources
on a getaway.
Letting down the Hunters' Volvo car tyres worked at least once !
Hiding somewhat from village CCTV by using a closely held umbrella hiding your face
- quite normals in wet and windy Wales.
Not being seen to be travelling together on a train - but only if you do not need the comfort and support of a travelling partner when under stress
Asking someone to pass a note to your friend in the next train carriage - good but limited uses.
Getting off a an infrequent rural bus service *before* it reaches its destination in the nearest town (Abergavenny)
and heading into the countryside.
Pre-arranged Word Code e.g. "Pepsi Max" delivery time / location in SMS texts - if too anamolous from the "normal" usage
then these stand out suspiciously and Cell Location gives the ganme away.
(Should really use an Encrypted Messenger e.g. Signal Messenger or WhatsApp)
Not running immediately (so as not to draw attention) when you have spotted / heard a reconnaisance Drone overhead, then getting under wooded cover and waiting for the limited battery life to expire
like the Royal Marine Matt Mason did.
Fugitives' techniques - not yet seen
burner phone to burner phone communications to friends or family
WiFi or Ethernet connection hacking to get "anonymous" access to the internet
Use of Tor or a foreign based VPN
- Tor project https://www.torproject.org/
- Orbot for Android https://play.google.com/store/apps/details?id=org.torproject.android&hl=en_GB
- Onion Browser for iOS https://itunes.apple.com/gb/app/onion-browser/id519296448?mt=8
- FaceBook via Tor .onion address https://en.wikipedia.org/wiki/Facebookcorewwwi.onion
Use of mobile phone 3G or 4G PAYG data packages to get mobile internet access on the run
Use of Satellite Phones - easy to intercept but hard to jam or find the exact location of
Counter bribes - if social media / local press & radio campaign offering £200 , offer people giving you lift £500 as you have a chance of winning £100,000
Getting friends to run a counter Have You Spotted this Hunter social media campaign with £££ rewards on offer - fake Wanted Posters unnerved them a bit previously
Infilitrating / surveilling the Hunters' HQ
Covertly grabbing identifiable WiFi and BlueTooth MAC addresses and Probe SSIDs etc. from the Hunters, when a family member or friend is interviewed
Getting a ticket / bus / train bound e.g. for London but getting off at a stop before
Purchasing multiple transport tickets or a "roam anywhere" ticket
Using an Amazon or other courier to get a package with a burner phone to a friend or family member via an Amazon Locker or other non-home parcel pick up point
N.B. Intercept of such a burner phone and bugging / monitoring thereafter by the hunters
Hunters sending a "burner" phone to family / friends of fugitive, pretending it has come from the fugitive, to encourage them to contact them on the fugitive's secret burner phone
Pair of fugitives splitting up so that one of them can distract the hunters near the extraction point, letting the other escape / win the prize
Other contestants spotting you near the extraction point and dobbing you in, to distract hunter resources so they vcan escape / win the prize
USA Hunted technique of enrolling the good looking fugitive(s) on dating apps in an area, and then posting £££ reward info to the people who have seen or even flirted with the fugitives
Radio Monitoring the airwaves / listening to walkie talkie radio of approaching hunter teams
Radio Detecting the presence of hunter teams via their bluetooth headphone / microphones
Uber app taxi alternative - given the snooping and mapping, is this worth the risk of central digital betrays to the hunters or malware a cloned SmartPhone ?
Setting up pre-arranged series of random code words (memorised not written or stored electronically) with family / friends either as a word code about specific locations, dates, times or as authenticators of ad hoc messages(hunters have intercepted and faked postal mail messages)
e.g. getting a friendly stranger to email or social media a message to family / friends including a code word to prove its authenticity
Mobile Phone Encrypted Messenger Apps over public WiFi or via burner Data SIM
- Signal Messenger https://signal.org/
- WhatsApp https://www.whatsapp.com/
- Wire https://wire.com/en/
- Threema https://threema.ch/en
- Telegram Messenger https://telegram.org/
Pre-arranged DeadDrops for money or burner phones or messages to / from family & friends etc.
Fugitives' Errors
Buses and Trains are a bit of a trap unless hunters think you are not using them
Contacting loved ones - an essential part of the dramatic tension of the show
Taunting the Hunters
Not taking *all* available cash at an ATM
Ignoring multiple sightings of distinctive hunters' Volvo cars
Being noticably loud / obnoxious to pub / hotel staff
Failing to tip pub / hotel staff - no reason for them not to claima £££ reward if offered
Expecting a taxi driver not to give up info on drop off point if offered £££ reward
Wearing a bin liner over your head makes you stand out on CCTV, *not* the reverse !
Just changing the SIM in your mobile phone handset does nothing to stop it being tracked via the IMEI serial number sent with every voice or data call.
Getting too paranoid about real time CCTV in rural areas - the Hunters might be able to get yesterday's footage, but it could take a week
Not being paranoid enough about real time CCTV in major city centres and bus / rail / airports etc.
More dominant / arrogant partner destroying the trust of the other fugitive partner when
under pressure, by doing something percieved to be selfish, without consulatation, leadng to a break up.
Not keeping a sharp lookout for Volvo cars
Trying to get accomplices to trap a Hunters's car at a rendezvous you have tipped them off to by
taunting them
Trying to crawl past CCTV cameras like caterpillars
Putting a cover over a CCTV camera but being recognisably filmed actually doing it.
Only using 1 burner phone - the family / friend / contact *also* needs a burner phone they never use
Forces the hunters to try Co-Traveller / Cell Site Dumps which need lots more analysis which
might not be feasible in time to be useful for the next meeting / pickup / drop off
Hunters' Errors
Most of the power and resources are with the Hunters, so most of their near misses or failed captures have been literally only by a few minutes or seconds (with approriate suspension of disbelief)
They have fallen for a few of the wily / arrogant fugitives false trails and decoys i.e. deliberately false clues as to location
They have misjudged people who have helped the fugitives e.g. offering a £££ reward / bribe, and then thinking it was working only to be told that the "informant" had changed their mind or would not "grass" for the small sum offered.
The randomness of some of the fugitives hitchhiking has caused the Hunters problems in trying to guess where they might be
Where the Hunters were seen to be blatantly lying to get information, they risked the ire of the tv audience.
Despite the power of thermal imaging from (limited endurance) helicopters or drones, so far, each of the times this technology has been used by thehynters, it has only found false positve wild animals or innocent members of the public, rather than the fugitives, who it has, of course frightened and added to their stress levels, but not enough to matter.