Something we don’t talk about often enough–and we should–is the concept of elicitation, or the process of getting someone to tell you information without them realizing they’re giving it to you. The biggest problem with it is simple: It’s getting done TO us a lot more than we’re doing it to anyone else. That needs to change.

There are several ways to elicit information from someone, and they range from the blatantly obvious instant gratification type to the completely sneaky, long-game, over time version. You should be familiar with both–especially because the folks with the .gov after their name have all kinds of time to do it. Let’s take a closer look.

Why Does Elicitation Work?

The beauty of elicitation is that it isn’t some kind of magic. It’s simply leveraging and exploiting facets of people’s personality, and the basic things that exist in human nature. In our quest to learn from everyone, and not just the people we like, we’re going to look at the FBI’s page on elicitation (I refuse to link to it, however. You can find it yourself). Here’s a list of traits that the FBI likes to exploit:

  • A desire to be polite and helpful, even to strangers or new acquaintances
  • A desire to appear well informed, especially about our profession
  • A desire to feel appreciated and believe we are contributing to something important
  • A tendency to expand on a topic when given praise or encouragement; to show off
  • A tendency to gossip
  • A tendency to correct others
  • A tendency to underestimate the value of the information being sought or given, especially if we are unfamiliar with how else that information could be used
  • A tendency to believe others are honest; a disinclination to be suspicious of others
  • A tendency to answer truthfully when asked an “honest” question
  • A desire to convert someone to our opinion

elicitation 2How many of those fit you? I guarantee a good number of them. If you love those Facebook debates, guess what? You’re on this list. If you can’t stand to hear incorrect information without standing up and saying “That’s wrong because…” then you’re on this list. If you’ve never done an assessment of your critical information, you’re probably underestimating the information you know. If you need to feel like you’re contributing something and have those efforts recognized, you’re on the list. In other words, whoever you are, something on this list will probably work on you if you’re not paying attention.

How it All Works

Elicitation is actually less work, in some ways, than you might think. It simply requires setting aside your own wants and beliefs and needs (such as your need to talk a lot in a conversation), and encouraging the person you’re talking with, to talk more. Let’s look at some examples.

Target: I can’t believe the laws about guns and ammo they just passed here in California.
Collector: I haven’t had a chance to study them. Are they really that bad?
Target: YES they are horrible! I don’t know how my group is going to keep up our weekly ammo buys now.
Collector: Weekly ammo buys?
Target: Yeah, we do a group buy of 5000 rounds every week. It lets all 10 of us get bulk ammo at a reduced price. We’ve been doing it for about 6 months now.
Collector: Oh, nice. That’s pretty shrewd of you! Good planning!
Target: We’ve got some very good connections. One of my guys’ cousins works at the gun shop on 173rd, and he makes sure we get a good price under the table. I could hook you up if it wasn’t for the stupid law. We’re not sure how we’ll get any now. Good thing we stocked up.

Three different tactics were going on here, in succession.

Tactic 1: Naive Mentality, or playing stupid. In the first exchange, the target made a complaint; the collector paid attention, and played as though he didn’t know what the fuss was about. The target was all too happy to expound on his anger and how that law will affect him directly.

Information gained:

  • He’s in a group.
  • They do weekly ammo buys in bulk.

Tactic 2: Repetition. This is where the collector picks up on the key words in the statement, and repeats them back to the target, who will then (again) expand on his statement.

Information gained:

  • Number of rounds purchased.
  • Number of people in the group.
  • Time factor.
  • These three figures mean the collector now knows a baseline of how much ammo each individual in the group has (not counting any previous or side purchases). He knows, at the very least number, what the ammo count is for that group.
  • It’s a good bet that the 5000 rounds is also all in one caliber, which means the collector now can guess that they all run the same weapons platform as well.

Tactic 3: Flattery. People love to be complimented on their skills, their looks, whatever. It’s no different in the patriot/liberty/III movement. In this case, all the collector had to do was compliment the target’s “planning skill” and he got a few more nuggets.

Information gained:

  • Source of the ammo.
  • Location of the source.
  • Nature of the source, and the fact that he’s not internal.
  • The sales are “under the table,” and from a legal gun shop.
  • Perhaps most important: a peek into the target’s mindset. Not exactly an out of the box thinker. They “can’t” get ammo because of the “law.”

If you were playing for a different side, what could you do with that information? How hard would it be to shut down that avenue completely–ensuring that not only can they not get bulk ammo, but no one else in the area can buy anything from that shop?

These are only three very common tactics. There are plenty more. At this point you might be thinking, “who cares if the group has 5 or 50,000 rounds? How is that critical?” What if the collector is a fed looking to know about supply caches? What if he’s simply a ‘marauder’ planning to steal the supplies of others instead of preparing for himself? What if…? And you may, through your critical information assessment (you’re doing one, right?), decide that the amount of ammo you have available to you is okay to be public knowledge. That’s fine—except this guy also decided that the other 9 members of his group ALSO have their ammo numbers as public knowledge. As I’ve said before: your choice to employ information security is yours alone. However, you don’t get to make that decision for others. And if your being a big mouth puts THEIR information at risk, then you’re a jackass.

All of the above comes down to this: The tactics can be used against anyone, on any topic. I have done them, I have seen them work, and I’ve even been caught by them myself. It sounds like a good time to talk mitigation and prevention.

How to Combat It

Here’s an alternative conversation that could/should have happened:

Target: I can’t believe the laws about guns and ammo they just passed here in California.
Collector: I haven’t had a chance to study them. Are they really that bad?
Target: Yeah. I’ll send you a link. Or just do a search for them. You’ll see. Let me know what you think.
Collector: Are these going to affect you and your group?
Target: I don’t have a group. I can’t even keep my own family in line.

See the difference? Here the collector used a new tactic as well when the first one didn’t work–he straight up went fishing. By pretending to already know the target had a group, he encouraged the target to confirm that yes, this will affect them. The target did something that is not exactly easy for a lot of people to do: He hinted at his own incompetence. Even when it’s false, people have a hard time with this. They want to be seen as knowledgeable and competent–which, if you remember from the beginning of this article, is one of the exact things that can be exploited.

Being vigilant can be difficult, but it’s worth it. Here are a few basic examples on what to look for.

  • Flattery – If someone frequently compliments you and you’re not married to them, they want something. People who constantly tell you how amazing/skilled/etc. you are should trip an alarm in your head. If it sounds too good to be true, it is.
  • Frequent repetition – If you’re having conversations where someone is repeating key pieces of your side of the conversation, be aware. Don’t expand. Think through what you just told them that prompted the repetition and decide if you just screwed up–and if you did, how to stop the damage.
  • Be aware of leading questions and fishing expeditions. Figure it this way: Does the person you’re talking to need to know the information you’re about to give them? If not, then it doesn’t matter if it seems as though they may already know. Don’t fall for it.
  • If they are bold enough to flat out ask a direct question, simply ignore it or tell them you don’t know (another difficult thing for folks to do). If you don’t want to lie to people, you can simply say, “Look, I don’t have those kinds of conversations,” and let that be the end of it.
  • Normally I would say to trust your gut. Unfortunately, far too many people have managed to put their “brotherhood” over their brains. It cannot be said enough: Just because someone calls you “brother” does not make them so, and just because you trust someone does not make them trustworthy.
  • Think before you talk. Every time, no matter who you’re talking to.

Elicitation can’t be taught in the space of an article, nor will reading this make you impervious to all forms of it. What it can do, however, is make you want to learn more, to do some research, and to get familiar with it yourself. It does come in handy for a lot of reasons–good, solid ones.

Here’s an interesting case for you to see it in action. And when you’re done, here’s a bit more.

Clef two-factor authentication