The digital detective: How an internal OSINT challenge sparked organisation-wide engagement

Late last year, the Cyber Security Team within SA Power Networks delivered an internal awareness initiative designed to demonstrate how publicly available information can be used to build a detailed picture of an individual. The Digital Detective challenge presented participants with a fictional scenario in which a fake SA Power Networks employee travelling through Europe failed to check in to a hotel, prompting an investigation into their movements using open-source intelligence (OSINT) techniques. 

The objective of the initiative was to raise awareness of how everyday online activity can unintentionally expose personal information, while providing an engaging and accessible introduction to cyber security concepts for staff across the organisation.

The challenge was hosted on the CTFd platform, allowing participants to submit answers and earn points by completing progressively complex tasks. Over a two-week period, participants worked through 94 individual challenges covering a range of OSINT techniques including social media analysis, geolocation, metadata review, travel itinerary reconstruction, and correlation of information across multiple online sources. Several challenges demonstrated unique or lesser-known investigative techniques that many participants had not previously encountered, highlighting how seemingly insignificant information can be leveraged in unexpected ways to identify individuals or infer sensitive details. 

The scenario followed the fictional character Lachie Barwon as he travelled from Adelaide to London, Amsterdam, Berlin, and Munich, with participants piecing together details from publicly available clues such as online reviews, images, travel bookings, and social media activity.

Participation in the challenge was strong, with 27 teams of three to four participants taking part alongside 70 individual participants. Allowing users to participate in teams encouraged collaboration and discussion, helping participants learn from each other while applying investigative thinking techniques. The team-based format also enabled employees from a wide range of roles to engage with cyber security concepts in a practical and approachable way, regardless of their technical background.

The Digital Detective challenge was designed to highlight how commonly used websites and platforms can unintentionally expose sensitive information when privacy settings are not carefully considered. Examples demonstrated how location data, travel bookings, social media posts, and public reviews can be combined to reveal patterns about an individual’s movements or plans. Presenting these examples within a fictional narrative allowed participants to better understand the real-world implications of information sharing online in a safe and controlled environment.

Organisations looking to run similar initiatives can adopt a structured approach by creating a realistic fictional scenario, developing OSINT-based challenges of varying complexity, and hosting the event on a CTF platform such as CTFd. Providing both individual and team participation options can increase engagement and encourage knowledge sharing across the business. 

The Digital Detective challenge demonstrated that awareness initiatives can be both educational and engaging, helping promote stronger security behaviours while fostering a positive security culture.