7.1 Skip Tracing, Public Records & Open Source Intelligence (OSINT)

Skip Tracing, Public Records & Open Source Intelligence (OSINT)

Core Professional Standard: Skip tracing is the systematic process of locating an individual ("the skip") who has disappeared, evaded legal process, defaulted on obligations, or is a critical witness or heir in a civil or criminal matter. In California, lawful skip tracing combines methodical public records exploitation, advanced Open Source Intelligence (OSINT), and strict adherence to privacy and anti-pretexting statutes—most notably the Gramm-Leach-Bliley Act (15 U.S.C. § 6821), the Driver's Privacy Protection Act (18 U.S.C. § 2721), and the California Financial Information Privacy Act (California Financial Code § 4050 et seq.).

---

The Systematic Skip Tracing Methodology

Professional skip tracing is not random search engine queries; it is a structured intelligence cycle that proceeds from known baseline data to primary official repositories, expanding outward to secondary associative leads and physical field verification.

+-------------------------------------------------------------------------+
|                 SYSTEMATIC SKIP TRACING INTELLIGENCE CYCLE              |
+-------------------------------------------------------------------------+
|  PHASE 1: BASELINE IDENTIFIERS INTAKE                                  |
|  - Legal Name & Aliases, DOB, Partial/Full SSN, Past Known Addresses    |
|  - Relatives, Spouses, Business Entities, Phone Numbers, Email Handles  |
|                                    |                                    |
|                                    v                                    |
|  PHASE 2: PRIMARY CALIFORNIA PUBLIC RECORDS REPOSITORIES                |
|  - County Recorder (Grantor/Grantee Indices, Deeds of Trust, Liens)    |
|  - County Assessor (Parcel APN, Situs Address, Tax Roll Billing Addr)   |
|  - Superior Court Indices (Civil, Probate, Family, Criminal Dockets)    |
|  - California Secretary of State (bizfileOnline Corporate & LLC Filings)|
|                                    |                                    |
|                                    v                                    |
|  PHASE 3: OPEN SOURCE INTELLIGENCE (OSINT) & SOCMINT                    |
|  - Search Operators (Dorking), Social Media Networks, Archive Engines   |
|  - Domain WHOIS, Reverse Image Lookups, Image EXIF Geolocation Metadata |
|                                    |                                    |
|                                    v                                    |
|  PHASE 4: TRI-SOURCE CORROBORATION & FIELD VERIFICATION                 |
|  - Cross-referencing 3 independent sources; Physical Neighborhood Recon|
+-------------------------------------------------------------------------+

The Core Skip Tracing Workflow

1. Data Intake & Scoping: Gather all known historical identifiers from the client (full legal name, alias/maiden names, date of birth, Social Security Number, prior residential addresses, vehicle descriptions, former employers, and known associates).
2. Public Records Interrogation: Query county and state databases to identify real property transactions, business formations, civil judgments, probate proceedings, and criminal filings.
3. Associative Link Analysis: Track co-habitants, relatives, business partners, and co-signers who frequently provide housing, co-own vehicles, or register utilities on behalf of the subject.
4. Digital & Open Source Exploitation: Identify active social profiles, commercial marketplace listings, resumes, professional licensure, and forum participation.
5. Field Verification: Confirm physical residency or employment through non-intrusive drive-by visual verification, postal address verification requests, or lawful pretext inquiries.

---

California Public Record Repositories

Public records are government-maintained documents available for inspection or purchase by members of the public. Understanding California county-level division of record repositories is critical for locating real property, judgments, probate assets, and familial links.

+-------------------------------------------------------------------------+
|              CALIFORNIA COUNTY RECORD REPOSITORIES MATRIX               |
+-------------------------------------------------------------------------+
|  COUNTY RECORDER:   Deeds, Deeds of Trust, Liens, Grantor/Grantee      |
|  COUNTY ASSESSOR:   APN, Assessed Valuations, Tax Mailing Address       |
|  SUPERIOR COURT:    Civil Judgments, Family/Dissolution, Probate, Crim  |
|  COUNTY CLERK:      Fictitious Business Names (DBA), Vital Records      |
+-------------------------------------------------------------------------+

1. County Recorder & The Grantor/Grantee Index

Every California county operates an Office of the County Recorder that documents all recorded instruments affecting title to real property.

• Grantor/Grantee Indices: County Recorders index property documents alphabetically by party name rather than solely by parcel address.
  • Grantor: The transferor, seller, or debtor giving up an interest (e.g., borrower on a Deed of Trust, seller on a Grant Deed, judgment debtor).
  • Grantee: The transferee, buyer, or lender receiving an interest (e.g., bank on a Deed of Trust, buyer on a Grant Deed, judgment creditor).
• Investigative Utility: By searching both indices across historical years, the investigator tracks property transfers to family members, transfers into revocable living trusts, mechanics' liens, state/federal tax liens, abstract of judgments, and notices of default/foreclosure.

2. County Assessor & Parcel Databases

The County Assessor assesses all taxable real property within the county and assigns an Assessor's Parcel Number (APN).

• Situs Address vs. Tax Mailing Address: The Assessor's roll records the physical location of the property (situs) and the mailing address where the annual property tax bill is delivered.
• Skip Tracing Goldmine: If a subject rents out a rental property, the situs address is the rental unit, but the tax bill mailing address often reveals the subject's actual, unlisted primary personal residence or private post office box.

3. California Superior Court Records

California has 58 Superior Courts (one for each county). Court records are search hubs for determining legal exposure, financial strain, and personal relationships:

• Civil Index: Plaintiff and Defendant indices reveal contract disputes, personal injury claims, unlawful detainers (evictions), collections lawsuits, and formal Abstract of Judgments that identify unpaid liabilities.
• Family Law Index: Petitions for dissolution of marriage, child custody disputes, spousal support orders, and domestic violence restraining orders (DVROs) often contain detailed declarations disclosing financial assets, employment history, and child school locations.
• Probate Court Records: Probate filings for deceased estates, testamentary trusts, guardianships, and conservatorships. Crucially, probate files contain wills, inventories of assets, appraisals, and complete lists of named beneficiaries and heirs with their physical residential addresses.
• Criminal Court Dockets: Felony and misdemeanor dockets, charging complaints, bail bond filings, and probation terms (which frequently list conditions such as geographic movement restrictions or drug testing locations).

4. California Vital Statistics (CDPH & County Clerks)

Vital statistics include birth, death, marriage, and divorce certificates maintained by the California Department of Public Health (CDPH) Vital Records and County Clerks.

• Health & Safety Code § 103526 (Authorized vs. Informational Copies):
  • Authorized Certified Copies: Restricted to the registrant, immediate family (parents, children, spouse/domestic partner, siblings, grandparents), legal guardians, law enforcement, and attorneys representing the estate.
  • Informational Certified Copies: Available to private investigators and the general public. These copies contain all factual vital data (parents' names, maiden names, dates, county of event, cause of death on death records) but are stamped across the face: "INFORMATIONAL, NOT A VALID DOCUMENT TO ESTABLISH IDENTITY."

---

California Secretary of State: Business Entity Intelligence

The California Secretary of State (SOS) administers bizfileOnline, the state's centralized business entity registry for Corporations, Limited Liability Companies (LLCs), and Limited Partnerships (LPs).

+-------------------------------------------------------------------------+
|               CALIFORNIA SOS BIZFILEONLINE RECORD FIELDS                |
+-------------------------------------------------------------------------+
|  1. Legal Entity Name & SOS Entity Number (e.g., C / 2023...)           |
|  2. Entity Status: Active, Suspended (FTB / SOS), Dissolved, Merged     |
|  3. Principal Executive Office Address & Mailing Address                |
|  4. Agent for Service of Process (Name & Physical California Address)   |
|  5. Statement of Information (Form SI-550 / Form LLC-12):               |
|     - Officers: CEO / President, Secretary, Chief Financial Officer     |
|     - Directors & LLC Managers / Managing Members                       |
+-------------------------------------------------------------------------+

1. Statement of Information (SI Filings)

Every corporation must file a Statement of Information (Form SI-550 or SI-100) within 90 days of filing its Articles of Incorporation and periodically thereafter (annually for corporations, biennially for LLCs via Form LLC-12).

• Disclosed Intelligence: The SI filing requires the disclosure of the complete names and business/residential street addresses of the Chief Executive Officer, Secretary, Chief Financial Officer, Directors, and all LLC Managers or Members.
• Suspended Entities: If an entity status is "FTB Suspended" (Franchise Tax Board) or "SOS Suspended", the entity has failed to pay corporate franchise taxes ($800 minimum annual tax) or failed to submit required SI statements, signaling financial distress or abandonment.

2. Agent for Service of Process

Every business entity operating lawfully in California must designate an Agent for Service of Process with a physical street address in California (P.O. Boxes are not permitted). If a subject operates a small business, they frequently list themselves or a close relative as the Registered Agent, providing their direct residential or commercial address.

---

Driver & Vehicle Records: DPPA & California DMV Regulations

Motor vehicle registrations and driver license records contain exact home addresses, vehicle identification numbers (VIN), and physical descriptions, making them high-value targets. However, strict federal and state privacy statutes severely restrict access.

+-------------------------------------------------------------------------+
|                   VEHICLE & DRIVER RECORD PRIVACY LAWS                  |
+-------------------------------------------------------------------------+
|  FEDERAL: Driver's Privacy Protection Act (DPPA - 18 U.S.C. § 2721)     |
|  - Broad prohibition on disclosing PII from motor vehicle records       |
|  - 14 Statutory Exceptions (Litigation, Insurance, Fraud Defense, Tow)  |
|                                                                         |
|  CALIFORNIA: California Vehicle Code (CVC) § 1808.21 et seq.            |
|  - California DMV records are confidential; Requester Accounts mandated |
|  - Strict permissible use audit trail; criminal penalties for misuse    |
+-------------------------------------------------------------------------+

1. Driver's Privacy Protection Act (DPPA, 18 U.S.C. § 2721)

The DPPA regulates the disclosure and use of personal information contained in state motor vehicle records. "Personal information" includes driver license numbers, names, addresses, and medical/disability information (excluding accident reports or driving conviction records).

• Permissible Uses Under 18 U.S.C. § 2721(b):
  • Litigation: For use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency, including the service of process and investigation in anticipation of litigation.
  • Insurance: For use by an insurer, insurance support organization, or self-insured entity in connection with claims investigation activities, antifraud activities, rating, or underwriting.
  • Commercial Verification: For verifying personal information submitted by an individual to an employer or financial institution.
  • Vehicle Safety & Theft: For use by motor vehicle manufacturers or repossession/towing agents.
• Impermissible Uses: Running a license plate or driver record for personal curiosity, dating background checks, general marketing, or political opposition research is a federal crime subjecting the violator to civil liability ($2,500 minimum liquidated damages per violation plus attorney fees under 18 U.S.C. § 2724).

2. California DMV Confidentiality (CVC § 1808.21)

Under California Vehicle Code § 1808.21, all home addresses in California DMV records are strictly confidential and may not be disclosed except to authorized Commercial Requester Account (CRA) holders possessing a qualified statutory permissible purpose.

• Commercial Requester Accounts (CRA): Licensed California private investigators may apply for a CRA requester code with the DMV. Each lookup requires logging the exact case file number, permissible purpose code, and client name. The California DMV conducts unannounced on-site compliance audits of investigator record repositories.

---

Open Source Intelligence (OSINT) & SOCMINT Tradecraft

Open Source Intelligence (OSINT) involves gathering and analyzing information from publicly available, accessible online resources to uncover subject locations, behavioral patterns, professional connections, and digital footprints.

+-------------------------------------------------------------------------+
|                        OSINT & SOCMINT TRADECRAFT                       |
+-------------------------------------------------------------------------+
|  1. Google Search Operators (Dorking): site:, filetype:, inurl:, ""     |
|  2. Social Media Intelligence (SOCMINT): Clean OPSEC Sock Puppets       |
|  3. Visual Intelligence: Reverse Image Searches (Google Lens, Yandex)   |
|  4. Archive Exploitation: Wayback Machine, archive.today caches         |
|  5. Technical Reconnaissance: Domain WHOIS, DNS Records, Image EXIF     |
+-------------------------------------------------------------------------+

1. Advanced Google Search Operators (Google Dorking)

Search operators refine queries to isolate obscure documents, exposed server directories, and indexing leaks.

2. Social Media Intelligence (SOCMINT) & Sock Puppet OPSEC

• Platform Analysis:
  • LinkedIn: Employment title, former employers, coworkers, corporate projects, geographic market location.
  • Facebook & Instagram: Tagged photos by associates, geographic check-ins, visible neighborhood landmarks, vehicle appearances.
  • TikTok & X (formerly Twitter): Timestamped mobile uploads, real-time commentary, localized discussions.
• Sock Puppet Operational Security (OPSEC): An investigator must never use their personal social media profile or agency account to view a target's profile. Platforms (especially LinkedIn) notify users when their profiles are viewed.
  • Operatives utilize dedicated, sterile "sock puppet" accounts created on non-attributable virtual machines, utilizing burner emails, dedicated VoIP phone numbers, and separate browser profiles with VPN routing.

3. Visual & Technical OSINT

• Reverse Image Search: Utilizing engines like Google Lens, Yandex Visual Search, and TinEye on a subject's profile picture or uploaded real estate image to identify other social platforms, hidden dating profiles, or the original geographic location of an uncaptioned photo.
• Web Archive Engines: The Wayback Machine (archive.org) and archive.today preserve historic snapshots of deleted corporate staff pages, obsolete business websites, and removed social profiles.
• WHOIS & DNS History: Searching domain registration records (via ICANN lookup or securitytrails.com) for domains registered by the subject. Historic WHOIS records often contain the registrant's personal name, home address, registrar telephone number, and administrative email address before WHOIS privacy redactions were implemented.
• EXIF Metadata: Uncompressed image files posted on private blogs or direct message exchanges retain Exchangeable Image File Format (EXIF) metadata, revealing camera model, exact timestamp, exposure settings, and embedded GPS latitude/longitude coordinates.

---

Tri-Source Corroboration & Anti-Pretexting Statutory Compliance

+-------------------------------------------------------------------------+
|              DATA CORROBORATION & ANTI-PRETEXTING RULES                 |
+-------------------------------------------------------------------------+
|  TRI-SOURCE RULE:                                                       |
|  - Source 1: Official Public Record (County Assessor / SOS Filing)     |
|  - Source 2: Digital / OSINT Lead (Active Social Footprint / Domain)    |
|  - Source 3: Physical / Direct Verification (Drive-by Recon / Mail)     |
|                                                                         |
|  STATUTORY PRETEXTING RESTRICTIONS:                                     |
|  - Gramm-Leach-Bliley Act (15 U.S.C. § 6821): No bank pretexting        |
|  - Cal. Financial Code § 4050: Strict state financial privacy limits   |
|  - BPC § 7539(d) & PC § 538d: No peace officer/public official pretext  |
+-------------------------------------------------------------------------+

1. The Tri-Source Corroboration Rule

Proprietary skip tracing databases and OSINT aggregators frequently contain outdated "stale" records, transposed digits, or identity conflations (merging data of individuals with identical names). A professional investigator must corroborate any critical address or asset through at least three independent sources (e.g., County Assessor roll + recent Secretary of State filing + visual confirmation of vehicle in driveway) before declaring a skip located or directing service of process.

2. Pretexting vs. Unlawful Deception

A pretext is an investigative cover scenario where an operative adopts an innocent persona to elicit non-confidential information. While simple pretexts (e.g., posing as an event planner to verify an office suite occupancy) are common, federal and California state laws impose strict prohibitions against specific categories of pretexting:

3. Federal & State Anti-Pretexting Statutes

• Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. § 6821): It is a federal felony to obtain or attempt to obtain customer financial information (account balances, bank statements, transaction histories, account numbers) from a financial institution by making false, fictitious, or fraudulent representations. Investigators who hire "asset brokers" or pretext bank tellers face up to 5 years imprisonment and mandatory revocation of their private investigator license.
• California Financial Information Privacy Act (Financial Code § 4050 et seq.): Codifies strict protections for consumer financial records in California, preventing financial institutions from releasing non-public personal information without express written consumer consent.
• Telecommunications Records: Pretexting telephone carriers, mobile network providers, or internet service providers to obtain call logs, text records, or subscriber information violates the Telephone Records and Privacy Protection Act of 2006 (18 U.S.C. § 1039).
• Public Authority Pretext Ban (BPC § 7539(d); Penal Code § 538d): Falsely representing oneself as a law enforcement officer, marshal, court investigator, process server with fictitious badge, or public health official is a criminal offense under California law.