Tradecraft

What is Sock puppet?

A fake online persona an investigator uses for research, so that viewing or joining sites cannot be traced back to them or their employer.

A sock puppet is a separate online identity that an investigator uses to view social media, join groups or access forums without revealing who they are or who they work for. It needs its own email, phone number, browser profile and a believable history.

Poor separation is the usual failure: logging in from a work network, reusing a recovery address or friending colleagues links the persona back to the real person. Each organisation should also have rules for what a sock puppet may and may not do.

Where you learn it

See Sock puppet in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free