Kirby Plessas didn't set out to become one of the most influential OSINT trainers in the country. She wanted to get into languages.
What followed was a career that took her from military intelligence to the Defense Intelligence Agency to the Central Intelligence Agency — including a role helping establish an innovation center dedicated to advancing OSINT tradecraft. In 2010, the Department of Homeland Security designated her an OSINT technical expert, and she has since trained more than 25,000 law enforcement professionals through contracts with the FBI, DEA, and other federal partners.
As founder and CEO of Plessas Experts Network, Kirby has built one of the most recognized OSINT training programs in the field — delivering hands-on instruction in social media investigations, dark web research, and cryptocurrency attribution to investigators at every level. She is a committee member of the OSINT Foundation, a current adviser to the International Association of Financial Crime Investigators, and co-host of two podcasts: OSINT Cocktail and OSINT IRL.
In this interview, Plessas shares insight from a career spent chasing intelligence across every major shift in the digital landscape, including:
Read the transcript or watch interview below to hear Plessas's perspective on how OSINT has evolved — and what it takes to stay ahead of the curve.
Editor's Note: Video and transcript has been edited for length and clarity.
Kyla Sims: Okay, so before we get started, I did a little bit of OSINT work myself looking into you. You're going to tell me how well I did.
Kirby Plessas: Okay.
Kyla Sims: So you are the founder and CEO of Plessas Experts Network, which was founded in 2008. You are a service-disabled veteran that began your career in military intelligence as an Arabic linguist supporting the Department of Defense.
Following your Army service, you expanded your career as an intelligence professional with the Central Intelligence Agency and the Defense Intelligence Agency, applying OSINT expertise to support the warfighter and other intelligence community missions.
You've been recognized for your contributions, and in 2007 you were selected to help establish an innovation center dedicated to advancing OSINT tradecraft.
So cool. I just get hyped reading this.
And then in 2010 — I love how I'm not even halfway through — the Department of Homeland Security designated you an OSINT technical expert.
You've trained more than 25,000 law enforcement professionals nationwide through contracts with the FBI, DEA, and other federal partners. Wow.
And of course your work doesn't stop there. It extends across corporate workshops, government contracts, public speaking, and instruction where you deliver hands-on training in areas such as social media, dark web investigations, and cryptocurrency attribution.
And your expertise has also been featured at South by Southwest Interactive, the High Technology Crime Investigation Association annual conference, and the International Conference on Transnational Organized Crime and Terrorism, among others.
I mean, we can't list them all — we'd be here all day.
You're also the former vice president of the OSINT Curious Project, a former advisor to the SANS OSINT Summit, a current adviser to the International Association of Financial Crime Investigators, a committee member of the OSINT Foundation, and a former adviser of the Osmosis Institute. And to top it all off, you also co-host a podcast called OSINT Cocktail.
So? I feel like I did okay!
Kirby Plessas: You did a great job. I do have another podcast, though — it's called OSINT IRL. We do it live on Twitch and then push it to YouTube.
Kyla Sims: I was doing a YouTube search for you, thinking "I wonder if there's other stuff on here." And I think I did actually find the first episode of that podcast.
So, there's a lot out there about you and you are incredibly prolific.
Let's start at the beginning. You started your career in US military intelligence as an Arabic linguist. What initially drew you to intelligence work?
Kirby Plessas: To be honest, I wasn't drawn to the intelligence work — I was drawn to language work. My recruiter, I don't think he had a clue what a linguist did. He told me I was going to be in an embassy translating.
Honestly, I'm very glad it went the way it did, because I think it's way more intellectually stimulating than just translating documents. And translating documents is not an easy job — that is a difficult job. I think I actually have it easier and more fun.
Kyla Sims: That's so interesting. So what does an Arabic linguist do, if you're not translating documents?
Kirby Plessas: You're listening on headphones to Arabic-language military communications and translating those, sending them up as reports so that we could identify exactly where certain military assets were.
Kyla Sims: Wow, that's intense. And before you were doing this kind of work, was there an inciting incident where you thought, "I want to go into languages"? What drew you to that?
Kirby Plessas: So I was finishing up my degree in English and trying to figure out what I was going to do from there. At the time I was the editor-in-chief of my university newspaper and I was applying for editing jobs — and somewhat journalism jobs — and just wasn't getting anywhere.
I was very frustrated and said, "Okay, fine." I had known this recruiter because he'd been around the university for a while, and I just said, "Hey, get me into languages."
And when you say that to a recruiter, the little dollar signs come into their eyes because they know they get a bonus for everyone who makes it through.
Kyla Sims: And did you learn Arabic at university, or did you learn it with the military?
Kirby Plessas: I learned it with the military. They sent me to the Defense Language Institute — 15 months, intense, nine hours a day of Arabic.
Kyla Sims: Wow. I've heard with languages, use it or lose it. Are you still able to speak it?
Kirby Plessas: It's true, although I feel like you can pull it back. I haven't been using it much lately — I can read it pretty well, sometimes with dictionaries to help. You do lose it, but I've noticed that if I'm somewhere speaking it for three days, I'm conversational again. Maybe not to the point of translating documents or identifying military comms, but conversational.
Kyla Sims: That's so fair. So that was the beginning of your career, which is already cool and interesting enough to talk about forever — but can you, in your own words, take me through your career journey and how you got to where you are today?
Kirby Plessas: Absolutely.
So I started in Army Intelligence, and when I left I went to the Defense Intelligence Agency. First I was working for a company called Open Source Publishing, owned by Elliot Jardines — he was our first ADDI of open source, probably the first person to actually lead the open source enterprise for the intelligence community. I was working with him before that too. So I worked at DIA for a while and helped with the joint warfare department. I got an award for helping the MIA/POW office — I love that award.
Then I was recruited to help with an innovation center at CIA. That work was all OSINT tradecraft, approaching it from a different angle than it had typically been taken in the community.
Before I went there, I was on the top secret network just posting what I was finding on the internet. All the social media stuff was just coming into its own around 2003 – 2007. It was just starting, pre-Facebook.
I was seeing a lot of interesting things and learning about the different kinds of tagging you can do to help identify and remember sites based on what you think they're useful for, rather than what they actually say. I started writing a blog about that on the top secret network, and when I left, people chased me down saying, "Wait — we need you to teach us this." So I talked with my mentor Elliot and he said, "Roll your company together and get going." And I did. My first customer was the state of Hawaii — I love them.
Then I had a major program for a while at NDCAC — the National Domestic Communications office of the FBI. I actually started that program with the DEA first. They found me at a conference I was speaking at, and we built out this wonderful social media investigations program. Then NDCAC took it over and expanded it beyond just DEA and their task forces to reach more people.
That program ended last January and I definitely miss it. I keep getting outreach from people asking, "When's your next one?" And I tell them: you've got to come to me now — to our website, our academy, my hosted content. I'm not traveling around the same way I was.
“Social media opened the gates to anyone putting whatever they wanted online.”
Kyla Sims: So you were talking about the pre-social media internet and being one of the first people noticing, "Hm, we can actually find some interesting stuff on here." What did this field look like then versus now from an OSINT perspective?
Kirby Plessas: So before social media — before all the Web 2.0 stuff — there was a lot on the internet, but you had to work to put it there. In some cases it wasn't too hard, but it was definitely daunting to the everyday person. The easiest things were something like GeoCities or forums. Forums were really important then and we could get some information from them, but social media kind of opened the gates to anyone putting whatever they wanted online at any time, very easily. We started seeing this rush of information.
A really good example is Twitter. Almost immediately I saw its value — even before it really gained momentum in 2009, when the Arab Spring happened and then Michael Jackson died and all the celebrities joined and brought their fans.
Even before that, I noticed that when something major happened, there was probably someone on Twitter writing about it or taking pictures.
Go back to the airplane that landed in the Hudson in New York — we were following tons of people posting to Twitter about it, much faster than the news was reporting it. There was a guy on the ferry that went to pick up the passengers from the water, and he just took pictures, handed his phone to survivors so they could call family, and sent the pictures to Twitter — and they went around the world. That citizen journalism element was huge.
At the same time, other technologies were really jumping out too. Google Maps came around about the same time, and when you can look at satellite views of places — and it's open source, so you can share it with other people, other organizations, other countries — it was a complete game changer. And then OpenStreetMap and all the others as well.
Kyla Sims: Would you say that's been the biggest shift you've had to adapt to — shifting to this new online space and finding so much intelligence there? Or was there, even within that evolution, a bigger shift you had to adjust to?
Kirby Plessas: That wasn't necessarily my biggest shift, only because I came in right as it was exploding. Before that I was doing SIGINT.
One of the bigger changes — around 2010, 2011, and snowballing from there — was social media networks closing their doors to search engines, or requiring accounts to see content. That was a major change, and it drove the evolution of needing things like sock puppets or research accounts. That was significant.
Even now, it just keeps getting harder and harder. But I'm of the opinion that information is always going to get out there anyway — some doors close, other doors open. Especially when we talk about people in the United States, we don't have as many privacy laws as most places do. And even when companies try to be a little more private, most Americans are just throwing their data out for something else to catch. So it hasn't been that difficult to find information in other ways — usually still through open source.
“I'm of the opinion that information is always going to get out there anyway — some doors close, other doors open.”
Kyla Sims: I think of early Instagram, where I feel like everything was public. And now we take it as a given that you have private profiles, but it wasn't always that way.
Kirby Plessas: Right. On Facebook, if you had a private profile in the beginning, people thought you weren't real. Now it's completely normal to have a private profile.
Kyla Sims: So looking back over all of this, was there a particular case or career moment that fundamentally shaped the way that you conduct investigations?
Kirby Plessas: I'll give you two examples, and they happened pretty close to the same time.
The first one: there was a group of hackers — they weren't doing anything horrible, just defacing things with political messaging. We wanted to figure out who they were. They were pretty sharp, had great OPSEC. I was able to figure out where they were communicating and see them talking to each other, but I couldn't necessarily identify who they were — until one of them said happy birthday to another one. I had already known where hackers from that area were talking years ago, so all I needed to do was follow that happy birthday message and start matching things up. I was able to roll them all up. It goes further, but I'll leave it there — once that happy birthday message matched up, I could easily figure out who they were. You could still do that sort of thing on Facebook.
Kyla Sims: That's wild. People don't appreciate how little information it sometimes takes to find someone.
Kirby Plessas: Absolutely. Just one thing that can tie new stuff to old stuff.
Another example would be the beginning of the dark web. The dark web has existed for quite a while, but around 2011 there weren't really a lot of people who knew it was there. Tor had just recently started around that point. I believe I might have been one of the very first people to speak at conferences and show people the dark web.
In those days, everybody on the dark web thought they had great OPSEC — but they didn't. We were finding photographs with cell phone metadata that took us to locations and things like that. We were able to pinpoint people.
Now everybody's a little smarter about it, so it gets harder. But it was kind of a gold mine at first, before people even realized that law enforcement or other investigators were looking at the dark web.
Kyla Sims: So as these things start shifting, do you find yourself looking at more sources — or were you always trying to find everything? Was there a time when you could find most of what you needed in just a couple of places?
Kirby Plessas: There was a time when you could. Twitter at one point was like the water cooler of the world — you could get at least a sample of something.
I'd say Reddit is that water cooler now. You can usually get at least a little conversation, though it's not going to be fast real-time the way Twitter was. X.com still has some of that fast real-time stuff, but I notice it's mostly reporters now rather than the people who are actually witnessing things.
Where are those people? They've scattered across all the different social networks. Maybe TikTok Live will have it, or YouTube Shorts, or Threads, or Instagram — it could be anywhere. So you have to figure out where the community you're hoping will post that stuff actually is on the internet. That has a lot to do with internet culture and subcultures, which is actually a class I teach.
I really put that class together after the Charlie Kirk shooting — everyone was wondering about the messages on the bullets, and if people had known that subculture, they would have automatically recognized it as just a — what do they call them — a shitposter.
Kyla Sims: That's a really good example of how social networks are connected to real-world events. I think people forget that the internet is a real place. There's a lot of things on there that aren't real, but it is a real place.
Kirby Plessas: Especially now. There are hangouts for different demographics — you've got to figure out where that hangout is.
“You've got to figure out where that hangout is.”
Kyla Sims: And it's so interesting how siloed the demographics are into different networks. If you're under 35, you're on TikTok. If you're over 45, you're on Facebook. And I was learning recently how Facebook is way more popular in other countries than it is in North America — still very popular with certain demographics here, but much broader demographics elsewhere. So even if you're looking at a particular country, it matters which social networks you're looking at.
Kirby Plessas: Absolutely. That's been something that's gone through time as well — I remember when MySpace basically got overrun by Facebook, South America was still all over MySpace. You wouldn't see them on Facebook. So you really have to know what's popular in a given demographic.
There are a lot of tools out there that track the statistics of what's gaining popularity in different countries. But then even within demographics, there are sub-demographics. If you're under 35 but trying to sell furniture or cars, you're probably on Facebook Marketplace. But if you're over 45 and trying to sell, like, figurines, you're probably going to TikTok for that.
Kyla Sims: I want to ask you about the innovation center to advance OSINT tradecraft. You were selected to help establish it — I'm curious how that came about and what gaps you saw that needed to be filled.
Kirby Plessas: I can't really talk much about the innovation center, but what I can say is that traditionally, OSINT was reactive — something comes across the internet, you grab it and deal with it from there. Rather than asking the question you want answered and then going to the internet to find that information.
The intelligence cycle was kind of flipped for OSINT in the past: you wait for a news report, you wait for something to come across Twitter, and then you react. Instead, you go back to basics — what's the question we want answered? — and then take it out there.
Kyla Sims: Right, that makes sense. You're also the co-host of the OSINT Cocktail podcast. There are tons of episodes — if anyone listening hasn't gone over there yet, you need to go. Well, maybe finish this first, and then go listen. I'm curious about the conversations you've had on there and whether any of them have changed the way you think about your craft.
Kirby Plessas: OSINT Cocktail has had a long run. The first two years it was Cynthia Navarro and me, audio only. Then we decided there were enough interview-style podcasts out there and we wanted to do something different. We brought in Amber and Kelly and said, okay — we're going to take pop culture, pull the OSINT tips out of it, identify the OSINT failures and what isn't true, and analyze it.
The whole thing has been great since we switched to the video format. What I find is that there are shows I normally wouldn't have watched that I end up liking, and some that even make you think a little wider about what's possible OSINT-wise.
Kyla Sims: I'm really curious what some of those shows are.
Kirby Plessas: I can't pull the names to the top of my head, but there's one with Natasha Lyon. Hers was interesting. She can tell if people are lying or not.
Kyla Sims: Is it Russian Doll?
Kirby Plessas: No, not Russian Doll.
Kyla Sims: I gotta look it up — we need to tell the people. Poker Face?
Kirby Plessas: Yes! Poker Face. Okay, so there's that one.
Another one that was a lot of fun was The Man on the Inside. To be quite honest, there's not a lot of OSINT in that one — it's more him talking to people. But one thing I thought was so true is that you see him go, "Okay, that's the person who did it. Oh no — okay, that's the person who did it." Whatever hint he gets, before any verification, he just dives right in. And you see people doing that all the time.
Even right now, one of the saddest cases — Nancy Guthrie is missing, in Savannah. It's in my area so I pay attention to it, and I see all the rumors going across Facebook and Reddit. There are a couple of live streamers, and every person who visits that house, they're on it — "Okay, who are you? Are you the crook?" I'm waiting to see the real information come out, but there's a lot of jumping on possibilities with no verification.
Kyla Sims: And I feel like — maybe you have a different perspective because you've been looking at this for so long — but as a general consumer of internet culture, I've noticed a shift in the last few years where something unverified travels around the world in 30 seconds and everybody believes it. Or the video has been edited so it's not showing what actually happened. It's almost at the point now where every time you go online you're asking, "Is that true? Is that really what happened?"
Kirby Plessas: Especially with AI. And that's the thing — I want everybody to be a little more skeptical. Even about, "We think this person did it" — if we don't have anything solid... that kind of misidentification goes way back. It goes back to the Boston Marathon bombing.
That's one of the reasons Sarah and I do OSINT IRL — the idea was to teach a little tradecraft to anyone who wants to learn it, so that citizen journalists and citizen investigators doing their own work — like, for example, with the Epstein files — have some things they can do to make sure they're not interfering with real investigations, not jumping to the wrong conclusions, and actually have data to back up their theories rather than just "that sounds right" or "this person looks like the right person."
Kyla Sims: It's like the more information that's out there, the more careful you have to be.
Kirby Plessas: Exactly. And there's too much information out there right now. You have to figure out what's valuable and what's not. It really comes down to source evaluation — that's really important.
Kyla Sims: Well, that's a great segue to talk a little more about AI. You can't go anywhere on the internet without it. It's almost bizarre to think that two years ago this wasn't even something we were talking about, and now it's like I'm breathing it, drinking it, eating it — it's just everywhere. How are you seeing it come into play in the OSINT field?
Kirby Plessas: I can think of a million great ways to use AI in OSINT investigations and in your daily flow, but I can also think of a whole bunch of ways not to use it, because there are some ways you can really mess things up.
A really recent example: there was a citizen investigator who did some work on the Epstein files and used AI to help grab mentions of funds, etc., and didn't necessarily double-check. When she published it, I put it out on LinkedIn and said, "Hey, I don't have the financial expertise to verify all of this, so I'm not going to go through every single thing." But somebody else did — the Coalition of Cyber Investigators — and they found that the AI was grabbing things incorrectly. She wasn't verifying it. I don't put any blame on her, though, because she put it out publicly, which is the right way to do it so people can peer review it and we all get better.
Now she can go back, fix where the AI went wrong, and come up with a more accurate answer — or somebody else can take the ball from there. I really love it when people show their work. And one thing with AI is that it doesn't show its work clearly.
Some of the ways I think AI can help: you can use it to find sources, to deal with data overload. But you may have to check it — in that case, it was a data overload situation where it just grabbed the wrong data. And if you ask it a question and it gives you facts with sources, go to the source and make sure it understood the source correctly, and that the source even exists.
Everybody knows the famous court case where the citation didn't exist. I've asked it to find sources for a certain kind of information, it gives me links, I click them — they don't exist. There is an article, but it just generated what it thought the link should be. I had to go do some Google dorking to find the right link.
There are still bugs being worked out of AI, and regardless of how good it gets, there's always going to be some other bug.
We published an article about that for the OSINT Foundation. I was part of the Tradecraft Committee and we published a piece on AI and using it for investigations. We covered some of the biggest problems — like a poisoned well, where somebody's putting fake information in — but we also talked about when to use it and the risk levels. If it's a high-risk situation, you can still use it, but your hands have to be in there and you have to be checking.
If it's low risk, you might be able to let it run with occasional checks. It really comes down to the level of risk and what you're dealing with.
Kyla Sims: And on the side of actually collecting evidence or conducting investigations online, trying to find connections — how is AI coming into play there? Is it making things more difficult, or is it easy to identify things like... deepfakes?
Kirby Plessas: AI-generated content is showing up more and more.
One of the earliest examples I know of was AI-generated audio. Voice cloning is super easy and inexpensive — if you have 10 seconds of someone talking you can do a quick clone on ElevenLabs, but if you have an hour of audio you can get a really solid clone.
There was a case where somebody cloned a principal's voice and was using it to put him in ethically compromising situations to try to get him fired. That was one of the earliest ones I saw showing up in cases. And more and more it will.
Scams, of course — the CEO voice saying "transfer me some money," or a child's voice saying "Grandma, I need money right now." And the facial deepfakes too — again, scams are the biggest use right now. Someone posing as a beautiful woman saying "we're dating online," and they can actually do a video chat with a deepfake now.
I want to point out — I think it was just yesterday or today — that Coffeezilla put out a video on deepfakes and deepfaked himself as Obama, Biden, and Trump through the beginning of his intro just to show how easy it was.
Kyla Sims: Oh no. Wow. I actually learned about Coffeezilla through his exposé on the Honey scam — incredible work.
Kirby Plessas: Yes. And his work on the first Epstein jail video was so good. He and another person built a virtual walkthrough of the jail that you can actually download and walk through.
Kyla Sims: Oh, wow. Very cool.
I want to jump back to talking about your education initiative. Through your company you offer a lot of education, and I want to talk more about that. When you started training investigators at scale and integrating it into the company, what was the vision? Was the company doing investigative work and the training was an offshoot, or was it more integrated from the beginning?
Kirby Plessas: It was integrated from the beginning. I started doing training first and then we started offering investigative work.
We're doing more and more investigative work now, but our online academy is still there and we do a few in-person classes here and there.
My original vision was more in-person and hands-on. That's not as feasible as it was — COVID changed things. As soon as everything shut down, all my contracts, people were saying "we have to cancel." And I said, "No, wait — give me a chance. I'll do it online and make sure all your people are trained while they're home." We went for it and it worked out really well. We already had software in place because we were doing short webinars — we just had to expand it into full-size classes.
So now my vision is to have a couple of lanes of training.
There's the traditional: you come to a class, hands-on, virtual or in person — we do some live ones.
The second is a training library where you can subscribe to everything we offer and pick and choose based on what your case needs.
But our newest one, which I'm really excited about, is our cohorts — a small group of people, over a period of time, about two or three hours of work a week. You're with me one hour a week where we talk about it and evaluate each other's work. Everybody leaves with their frameworks, with evaluations others have done, with material they can take back, and some material they can publish. We're just starting that one now.
Kyla Sims: And the folks taking these courses, are they already working in investigations, or people who want to get into it, or neither?
Kirby Plessas: All of the above. Our in-person classes are mostly people already in investigations, though they could be beginners. Organizations send their new investigators to our flagship class, which we call OSINT Comprehensive. It was three days, now it's four. The idea is it takes you from protecting yourself online and OPSEC, through all the different investigative methods, building tools, all the way to archiving your evidence, which I know you guys know a lot about, and automation.
Kyla Sims: How long have you been doing these trainings?
Kirby Plessas: Since 2008.
Kyla Sims: Wow. Since Facebook was basically public, which is so cool. So over that time, has your approach to teaching changed?
Kirby Plessas: It has to, I think, especially when you're talking about virtual versus in-person.
One of the things I loved about in-person is that with a classroom of 20 or 50 people, you can walk around and tell when someone's struggling even if they're not raising their hand. You can't do that virtually. So in virtual I try to get people active in the chat — I ask questions, run quizzes, sometimes give prizes in the chat — to get that same kind of interaction and make people feel comfortable. We use the chat and we use a Q&A section where they can ask anonymous questions if they want. We just want them comfortable enough to ask whatever they need to ask, since I can't walk over and see how they're doing.
Kyla Sims: Have you noticed a shift in the investigators you're training today compared to those you were training in 2008?
Kirby Plessas: Yes — a lot more savvy about social media and how it can be used by criminals.
In the very beginning, investigators knew about a few social media tools because they'd had to pull search warrants for them, but they weren't familiar at all with what you could get without a search warrant.
A lot of times investigators weren't actually using the tools themselves. And that's one of the things you have to do — you have to get into the tools and use them so you know what the capabilities are. You know how to share things, what can and can't be shared, what's going to end up public. You have a research account of your own, put stuff through it, share things out, and then look back at it from the outside and ask, "What can I see from somebody who's not friends with this account, logged in or not?" That's really important, and I think most investigators understand that now.
Those research accounts are getting harder and harder to create, though, because the companies don't want that many accounts. The real trolls are way better at this than investigators are — they just make their accounts regardless. They also have fewer ethics, so they can buy or hijack accounts. But one thing I say is increasingly important going forward is tools like Sockpuppet.io — they manage the account, give you a virtual phone and dashboard, and keep the account alive with SIM cards and all that.
Kyla Sims: It reminds me of something Kelly Paxton said when we talked — that criminals and investigators are using the same sources. So you really do have to use those sources.
Kirby Plessas: Absolutely. You have to be hands-on and see what the capabilities are, because you're not going to see that from the outside.
Kyla Sims: And at this point the internet is basically just social media sites and AI.
Kirby Plessas: Pretty much. I'm so glad social media wasn't around when I was growing up — it would have been trouble.
Kyla Sims: Absolutely. So if you were training a brand new investigator tomorrow, what would you insist they master first?
Kirby Plessas: Two things. First, OPSEC — identify what needs to be protected and take the steps to protect it.
Second, and this is one of the first things most OSINT practitioners learn: Google dorking. Search engine dorks. That's the key — the beginning of everything. When you learn search engine dorks, you learn how to search on things that are just in the URL, and then you start learning how URLs work.
For example, if you're doing Instagram investigations and you know somebody just posted about something, the URL is going to have a /p/ in it — you keep that and wipe out all the other garbage from your search.
But it goes even further than that. I think Google dorking is actually the basis for AI prompt engineering — it's essentially the Google dorking of AI. If you know Google dorking, you can translate that to AI and start thinking about how to game the platform to make it work better for you. Google dorking is still the thing to learn.
“Google dorking is still the thing to learn.”
Kyla Sims: We have an OSINT friend of the company who does a lot of our social media investigation guides, and he always has pages and pages of Google dorks. Every single one, he's like, "You've got to do this no matter what, doesn't matter where you're looking."
Kirby Plessas: There are a million little tools for Instagram, but Google dorking will still get some things faster than those tools will. Google just has the best capabilities for that right now.
Kyla Sims: And I'm curious — Google is integrating AI overviews and the way people use it is changing. Has Google dorking seen any degradation from that?
Kirby Plessas: I would say before AI, Google was already degenerating because of its algorithm — it tries to funnel you so much. That's actually another reason why Google dorking is so important. Now that they have the AI overview and most people just go straight to it, I usually skip it and go straight to the results below. When you do Google dorks you do get less of the algorithm noise, though I do still see it showing up even in dork results when it shouldn't.
Another thing that helps enormously — and I can't emphasize this enough — is Google's Programmable Search Engines. It's a custom search engine you can build yourself at cse.google.com. You pick the sources, and crucially, it doesn't have the same algorithm — it's just the sources. You can create a search engine with just your favorite social media sites, or just marketplace websites, so when you're searching for, say, a part for a car you're fixing, you're not getting everything out there, just items for sale. I also have some of these on my website — if you go to our resources page, you'll find our CSEs and GPTs page.
There was a point — I think it may be fixed now — where if I did a site:t.me search with a keyword like "bitcoin," the algorithm was only showing two results. I'd change the keyword to "cryptocurrency" and get two completely different results. I knew the database had more, so I think that's fixed, but I still love my custom CSE that just has t.me in it. That site:t.me search would bring up thousands of results even when the algorithm was being tough on me.
Kyla Sims: I didn't know you could make these custom search engines — that's so neat.
Kirby Plessas: I love them so much. You can whip them up fast, even temporarily, and just ditch them later if you want. And if you're trying to figure out where a demographic or internet subculture is, if you load as many social networks as possible into one CSE, you might be able to find that community based on the keywords they use.
Another example is Mastodon — there are around 16,000 servers for it. Not all have much in them, but originally you had to go to each one individually to search. I'd just make a CSE with the most popular ones so I could search them all at once.
Kyla Sims: That is brilliant. My wheels are turning.
You've seen a lot of investigators come through your training programs and you've been in the game a while. What is the mistake you see investigators make the most?
Kirby Plessas: Not vetting tools. People will see a new tool, jump on it, start using it, and not necessarily know who's behind it or what their motivation is.
Sometimes the tools don't even work well. I always say tools aren't magic. They connect to a data pipe or an API to get their data out, or they're doing something you could do manually — they just do it faster and maybe with a nicer output.
If you can identify how they're getting their data, you can decide whether you need to use the tool, and you should also figure out who's producing it.
In our resources we have a digital knowledge base where we highlight: here's the tool, here's who created it, here's what country they're from, here are the controversies it's had or hasn't had, and whether we think it's a good tool or not.
“Tools aren’t magic.”
Kyla Sims: Our Director of Customer Success used to do OSINT work and was an investigative journalist, and he was saying one of the problems he'd see constantly is he'd get on a new tool and then six months later it's not being updated anymore, it breaks, and it's gone.
Kirby Plessas: That happens all the time.
Sometimes the data source cuts them off — Instagram is notorious for cutting off tools that are scraping it. The tool dies, somebody else builds a new one and starts again.
But a lot of those scraping tools — you might actually be able to do things more efficiently by doing some vibe coding and keeping a tool to yourself. You build it, nobody else knows it exists, and it pulls exactly the data you want. I always say I love vibe coding, but I don't want people to just vibe code something and throw it out there publicly without hardening it — if there are security issues, you're on the hook. But if you build it for yourself, it's efficient and private.
Kyla Sims: And that connects to what he was saying about a book that comes out every year on OSINT techniques —
Kirby Plessas: Intel Techniques.
Kyla Sims: Yes. He said the earlier editions were "here are tools you can use," and the later editions have been "you need to build your own tools."
Kirby Plessas: Yeah, he takes it to the extreme. If you really want to harden your privacy and build everything robustly, that book is for you. But there are easier ways too, which maybe the next edition will cover.
Kyla Sims: That would be nice. And vibe coding probably hadn't hit the mainstream yet when he was drafting that book — it kind of popped up overnight.
On that note, what should investigators be preparing for on the horizon?
Kirby Plessas: It goes back to your comment about tools going away: don't depend on the tools. Figure out what they do, so that if your favorite tool disappears you can evaluate a new one or do it yourself.
A good example: tools that get ID numbers from social media. You can get those yourself. They're always in one of three places — photo URLs, the page code, or the CSS — and you have access to all of that through page source or the developer tools inspect panel. Use one of the tools to find a number, note that number alongside the person's name, and if that tool goes down, all you need to do is go to that person's page, go to the source code, and find the number again. Just simple things like that.
Be prepared for tools to die and for social media platforms to change as they try to evade scraping tools. You can always go manually — you don't have to scrape, you can just get your own data.
Kyla Sims: That makes sense. What keeps you passionate about your work today?
Kirby Plessas: It changes all the time. I love figuring out "okay, what changed now? How do I get that data?" I'm a puzzle solver, I guess. I love the changing nature of it. I know some people hate that, and I'm sure as I get older I'll probably start to hate it too — but right now I still love it.
“I’m a puzzle solver.”
Kyla Sims: What is the most unexpected source of valuable intelligence you've encountered?
Kirby Plessas: Honestly, it's social media as a whole — specifically friends lists.
If you're looking for a fugitive, map out the friends lists of his family and friends.
Looking for someone's fake account, map out the friends list.
Looking for someone with a locked-down account, map out whatever friends lists you can find, across any platform where they're visible. Amazing stuff.
Even cross-mapping — I'm working on a GPT that can do fuzzy name matching to map a person on Instagram to a person on TikTok, even if they had to use a slightly different name on one platform.
Kyla Sims: That comes up in our OSINT guides too — always check the friends list if you can. They always bring up how maybe your subject doesn't post very often, but maybe their cousin does and their profile isn't private.
Kirby Plessas: I always use North Korea as an analogy. You have one person who's as secure as can be — but it's like North Korea, all the neighbors are talking away and telling you what's going on over there.
People's mothers will wish them happy birthday. And you know how I love the happy birthdays. On Facebook, if you have a fake birthday set as public, a lot of people will say happy birthday on that day.
But if somebody says happy birthday to you on a different day, they probably know your real birthday — so they're a closer contact.
Kyla Sims: That's so funny. Well, I could spend the rest of the day asking you questions, but I won't take anymore of your time. Thank you so much — especially for going over time with me. Such a prolific and exciting guest. I really enjoyed our conversation.
I hope we can talk again, because this really felt like just an introduction — there's so much more we could get into.
Thank you so much, Kirby.
Kirby Plessas
Founder / CEO of Plessas Experts Network, Inc. (PEN)
OSINT Expert, Former Military Intelligence, Service-disabled veteran
Co-Host of OSINT Cocktail
Kirby Plessas is the founder and CEO of Plessas Experts Network, Inc. (PEN). Before devoting her work full-time to PEN, Kirby established herself as one of the foremost tradecraft experts in Open Source Intelligence (OSINT) through successful careers in the U.S. Military, the Intelligence Community, and as a contractor before founding PEN in 2008.
A service-disabled veteran, Kirby began her career in Military Intelligence as an Arabic linguist supporting the Department of Defense. Following her Army service, she expanded her career as an intelligence professional with the Central Intelligence Agency and the Defense Intelligence Agency, applying OSINT expertise to support the warfighter and other Intelligence Community missions. Recognized for her contributions, in 2007, she was selected to help establish an innovation center dedicated to advancing OSINT tradecraft. In 2010, the Department of Homeland Security designated her an OSINT Technical Expert.
As the head of PEN, Kirby has combined her intelligence background with her passion for teaching, consulting, and technology. She has trained more than 25,000 law enforcement professionals nationwide through contracts with the FBI, DEA, and other federal partners, bringing OSINT skills directly into investigative and operational environments. Her work extends across corporate workshops, government contracts, and public speaking, where she delivers hands-on instruction in areas such as social media, dark web investigations, and cryptocurrency attribution.
Kirby’s expertise has been featured at SXSW Interactive, the High Technology Crime Investigation Association (HTCIA) Annual Conference, and the International Conference on Transnational Organized Crime and Terrorism (ICTOCT). She is a former Vice President of The OSINT Curious Project, a former advisor to the SANS OSINT Summit, a current advisor to the International Association of Financial Crime Investigators (IAFCI), a committee member of the OSINT Foundation, and a former advisor to the Osmosis Institute. Through her work at PEN, she continues to advance OSINT tradecraft and share her deep expertise with diverse audiences across sectors.
Don't forget to follow and connect with Kirby @: