Typically, the first step in investigating a breaking news situation playing out on social media is to save and screenshot everything you can find. Social networks often act quickly to remove the pages of named suspects in high-profile crimes. And if you want to study these accounts, you need the raw material.
You also need to verify that the accounts actually belong to the suspect. In Mr. Sayoc’s case, his accounts didn’t match the name given out by law enforcement. On Twitter, he went by “Cesar Altieri.” On Facebook, he went by “Cesar Altieri Randazzo.” Verifying account ownership often takes a combination of conventional reporting (contacting the platforms, as well as law enforcement) and digital forensics. Often, it’s hard to be 100 percent sure, but in the case of Mr. Sayoc, several clues — such as photos of decals posted to his Twitter account that matched the photos of his van — helped us feel confident enough to move forward.
While I was verifying Mr. Sayoc’s accounts, my colleagues helped me scrape their contents. My colleague Rich Harris built an automated tool that allows for the mass-archiving of tweets. It’s incredibly useful, and allowed us to save thousands of Mr. Sayoc’s tweets before they were taken down. I also took screenshots of the images that appeared on Mr. Sayoc’s Facebook page, and another colleague, Paul Murray, helped me archive years’ worth of Mr. Sayoc’s Facebook posts.
In Mr. Bowers’s case, others first discovered his profile on Gab and, luckily, a few of them archived the contents on archive.is, a website that allows you to save a snapshot of a website at a given point in time. Someone also posted a video to Bitchute, a video-sharing site, that showed a person scrolling through Mr. Bowers’s Gab feed before it was taken down. We used that video, plus the archived posts, to reconstruct as much of Mr. Bowers’s feed as possible inside a Google doc, which we shared with the team reporting on the shooting.
Sometimes, once you find one piece of a social media trail — say, a username or alias used on one website — you can use it to find other pieces. Other times, you hit a dead end. I have a small toolbox of apps and utilities I turn to in situations where I need to dig deeper into a given person’s social media presence. But in this case, I didn’t need to — there was more than enough information on each suspect’s profiles to start reporting on them.