Finding McAfee: A Case Study on Geoprofiling and Imagery Analysis

Identifying past, current, and possible future locations through the geolocation and chronolocation of media provided by a specific user.

This case study is based on a challenge from well-known entrepreneur, John McAfee, to show how relative geolocation of two points on a chronological timeline can give a likely path and possible locations in between.

To do this, two geographical points will be used, categorised by day, to geolocate a photo that was taken between those two points.

This research post is split into the following four sections, in this order:

Point B (the photo to geolocate)

Point C (where the subject is traveling to)

Point A (where and when the subject started the journey)

Geolocation analysis of the Point B image

The tools in this case study are completely free, so please do use them to follow along. I used Google Maps, GIMP (image editing) and Twitter.

Point B — The image to geolocate

Below is the tweet in question. The challenge: self-explanatory.

So where do you start in a case like this? Using a first approach to imagery intelligence (IMINT), look in the image and ask: “what do I see?”.

In the image, we have a number of clues that may indicate where this photo was taken. I’m going to number some of them in the image below.

What do we see here?

First, we’ve got McAfee. Who through his accounts may help give more clues. I’ll get to him later. This roof colouring gives an indication that it might be a brand colour. Coloured fuel bowsers indicate that this is both a fuel station, and is a unique identifier for what the brand or name of the fuel station may be. Large trucks use this fuel station, so it is likely that it is in an open area, or along a highway. There are flowers in front of the building McAfee is next to, which means it might be a store for the fuel station There’s a light blue band along the horizon. This is usually synonymous with a large body of water. This post and building would be a unique identifier on satellite imagery The horizon is not cluttered with buildings or trees, indicating it might be a flat plain and out of built-up urban areas.

That’s a lot of reference points we have to go off. And now, since we have done an initial imagery analysis checklist, we can work our way down that list to investigate each of those leads.

First is John McAfee. He is likely to indicate relevant information in his social media.

Point C (where the subject is traveling to)

In the initial tweet above the subject indicated he was “on the way to London” and that the photo was taken in the past. This identifies our destination.

How is he traveling there? Considering the location of the photo as we analysed in the eight takeaways above, it’s clear he is at a service station with his large security crew. So it’s likely he is driving to his destination.

Point A — Where and when the subject started the journey

Where did the subject come from?

This is where we can start using the intelligence tool I’d like to refer to as ‘geoprofiling’ — essentially we’re going to map out a short chronological timeline of where McAfee was in order to find where he is.

Scrolling back through his Twitter timeline, we can find this tweet. It was posted two days before the other photo.

What’s important about this tweet is it gives us a location as well as a destination. Take a look in the red box in the right of the image below.

Here is a closeup below. It says “Hotel Schlicker”.

It is in Munich, Germany.

We know this is the place where the photo was taken as there are a number of features that match those seen in geotagged images on Google Maps and Facebook.

First is the identical match of the sign and wall lining to this one found on Google Maps.