Lesson 5.11

News, Media, Academic & Genealogy Sources

Learning Objectives

Search current and historical news effectively, including free archives
Use press releases, academic work, conference talks, and podcasts as sources about organizations and people
Explain how obituaries, wedding announcements, and genealogy sites reveal family relationships
Connect genealogy data to the security-question risk and to DNA-based investigations
Evaluate these sources for reliability and bias

Why These Sources Matter

News, research, and family history sources are written about people and organizations, often with details the subject would never post themselves: a quote from an IT manager about a new system, an engineer’s thesis describing a lab’s network, an obituary listing every family member. They’re also usually dated and attributed, which makes them good for timelines.

News & News Archives

Current news

Google News and Bing News: Aggregate thousands of outlets; use search operators and date filters.
Local news: Often the most detailed coverage of local businesses, schools, and people (new hires, promotions, awards, arrests, community events). National outlets rarely go this deep.
Trade publications: Industry magazines and sites cover specific sectors (healthcare IT, manufacturing, finance) and often name vendors and project leads.
Security news (BleepingComputer, The Record, KrebsOnSecurity, and others): Breach coverage, threat actor news, and takedowns.

Historical news archives

Archive	Access	Coverage
Chronicling America (Library of Congress)	Free	Historic US newspapers published through 1963; more than 23 million pages from all 50 states, DC, Puerto Rico, and the US Virgin Islands
Google News Archive	Free	Scanned historical newspapers; Google stopped adding content in 2011, but the archive remains available
Newspapers.com	Subscription (7-day free trial)	Very large archive (over a billion pages from 1690 to present across 31,500+ papers)
Library databases (e.g., NewsBank, ProQuest)	Free through many public and university libraries (verify with your library)	Full text of many modern newspapers
Wikipedia’s list of online newspaper archives	Free	Directory of archives by country

Tip: Your university library card is an OSINT tool. Libraries pay for databases that would cost individuals hundreds of dollars.

Press release wires

Companies distribute announcements through wire services such as PR Newswire, Business Wire, and GlobeNewswire. Press releases reveal:
- New executives (with bios) and board members
- Partnerships, vendors, and customers
- Acquisitions (newly acquired companies are often in the middle of IT integration, which is a period of weaker security)
- New offices and facilities
- Product launches and technology choices

Attacker use: Timing phishing around real events (“Welcome to the new company! Please re-enter your credentials in our new portal”).
Defender use: Anticipating which announcements will trigger phishing campaigns and warning employees in advance.

Academic Sources

Google Scholar: Papers, theses, citations, and author profiles with affiliations.
Semantic Scholar and arXiv: Research papers (arXiv is especially strong for computer science and physics preprints).
ORCID: Researcher profiles with employment and publication history.
University institutional repositories: Theses, dissertations, technical reports, and datasets.
ProQuest Dissertations & Theses: Usually available through university libraries.

What they reveal:
- Researchers’ names, labs, collaborators, and funding sources
- Technical details about systems studied or built (a thesis might describe a university’s network setup or an industrial control system)
- Corporate research directions (company-affiliated authors show what a company is working on)

Tip: Acknowledgment sections name advisors, lab mates, funders, and sometimes family, which is useful for mapping relationships.

Conference Talks & Slides

YouTube: Many security and technical conferences post talks (DEF CON, BSides events, vendor conferences).
Speaker Deck and SlideShare: Slide decks, often with architecture diagrams.
Conference schedule sites (e.g., Sched): Speaker bios, employers, and sometimes attendee lists (verify before class for current visibility settings).
Meetup and user-group pages: Local tech community talks.

Why it matters: Engineers proudly explain how their company built something, sometimes including internal hostnames, tool choices, cloud architecture, and team structure. This is one of the richest sources for understanding a target’s technology.

Defender use: Review what your own employees present publicly and add a pre-publication review step for talks.

Podcasts & Interviews

Executives and engineers discuss strategy, tools, and challenges on industry podcasts and webinars.
Search: Podcast search engines (e.g., Listen Notes) and platform transcripts (several major podcast apps now generate transcripts) make audio searchable (verify before class for current availability).
Video interviews: YouTube auto-captions are searchable with the transcript feature.

Tip: Listen for background details too: mentions of a city, a commute, a pet, a hobby, or the company’s tools.

Obituaries & Wedding Announcements

Obituaries (local newspapers, funeral home websites, and aggregators like Legacy.com) usually list:
- Full names, including maiden names
- Spouses, children, grandchildren, siblings, and their cities
- Hometowns, schools, employers, churches, and clubs

Wedding announcements (local papers, wedding websites like The Knot or Zola) can include:
- Both partners’ full names, parents’ names, hometowns, schools, and employers
- Wedding dates (a common password and PIN ingredient)

Why this matters for security: Together, these sources can answer many classic security questions: mother’s maiden name, city where your parents met, name of your first school.

Ethics: Obituaries are written for grieving families. Use them only when the objective requires it, and never to target family members.

Genealogy Sites

Site	Access	Notes
FamilySearch	Free (account required)	Huge collection of records and user-built family trees; run by The Church of Jesus Christ of Latter-day Saints
Ancestry	Paid (some free records)	Census, military, immigration, and vital records; user trees
MyHeritage	Paid (some free search)	International records and trees
Find a Grave	Free	Memorial pages with photos, dates, and family links; owned by Ancestry
BillionGraves	Free	GPS-tagged headstone photos

What they reveal: Birth dates and places, parents’ names (including maiden names), siblings, marriages, immigration history, and sometimes photos.

DNA genealogy and investigations

GEDmatch is a free site where people upload DNA profiles from commercial tests (such as Ancestry or 23andMe) to find relatives.
In 2018, investigators identified the suspected Golden State Killer, Joseph James DeAngelo, by uploading crime-scene DNA to GEDmatch under a fake profile. Matches with distant relatives, combined with building family trees, led police to him. GEDmatch wasn’t told about the investigation beforehand, and the case raised major privacy concerns.
Discussion point: Your relatives’ choices can expose you. You never took a DNA test, but your third cousin did.

The Security-Question Problem

Walk students through this chain:

A LinkedIn profile gives a full name and hometown.
An obituary for a grandparent lists the mother’s maiden name.
A wedding announcement gives the parents’ names and wedding date.
A genealogy site confirms birth dates.
Result: An attacker can answer “What is your mother’s maiden name?”, “In what city were you born?”, and maybe guess a PIN.

Defense (links to Module 9): Treat security questions as extra passwords. Give random, made-up answers and store them in a password manager.

Evaluating These Sources

News: Distinguish original reporting from articles that rewrite other outlets. Check the date and whether the story was later corrected.
Press releases: Written by the company for marketing. They’re reliable for what the company claims, not for independent facts.
Academic work: Peer-reviewed papers are more reliable than preprints, but both can be outdated.
Genealogy trees: User-built trees often copy each other’s mistakes. Look for attached original records.
Obituaries: Generally accurate for family relationships at the time of writing, but names and cities change.

Key Terms

Wire service: A service that distributes press releases or news to many outlets.
Preprint: A research paper shared publicly before peer review.
Institutional repository: A university’s online archive of its research and theses.
Maiden name: A person’s surname before marriage; a common security question answer.
Investigative genetic genealogy: Using DNA matches and family tree research to identify a person.

Key Takeaways

Local news and trade publications often have more detail than national outlets
Press releases reveal executives, vendors, and acquisitions, and attackers time phishing around them
Conference talks and theses can expose internal architecture
Obituaries, wedding announcements, and genealogy sites answer common security questions
Relatives’ DNA uploads can identify you (Golden State Killer, 2018)
Use random answers for security questions and store them in a password manager
Your library card unlocks paid news and research databases

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.