One man, seven identities and a network of companies that did not exist

A technology company in California found that information had been taken from its systems without authorization. Shortly afterwards the IT contractor who had been working with them stopped answering. Phones disconnected, accounts gone, no way to reach him through anything they had on file.

The suspicion was straightforward: he had taken what he could access and was building a competing product with it. Before filing anything, the company wanted to know who he actually was, how long he had been at it, which companies were connected to him, and whether they were the only ones.

The first finding changed the case

We began reconstructing his footprint across time. Email addresses, telephone numbers, domains, corporate records, professional profiles, websites, and the material that had stayed online after he removed the current version of it.

He had not been using one name. More than seven surfaced, presenting as different IT professionals with different job titles and different backgrounds. On the surface they were separate people. Once the contact details and digital assets were cross-referenced, they were one.

Phone numbers, then companies

Dozens of telephone numbers appeared, including prepaid handsets used during particular periods. Some sat on professional profiles, some on company websites, some as the contact for businesses that looked ordinary enough at first.

Those businesses were the next layer. Company names with websites, email addresses, phone numbers and plausible descriptions of what they did. Looked at properly, none of them had verifiable trading activity matching the way they presented themselves, none had an organizational structure behind them, and several of the people named as executives could not be shown to exist.

Laying the connections out

Every name, number, address, domain, company and professional identity went onto one relationship map. What that showed was a chain rather than a scattering. The fake businesses connected to the aliases, the aliases to the phone numbers, and the phone numbers back to the same underlying infrastructure.

One man had built a business ecosystem around himself. A name for dealing with one party, a different name in another context, a company to supply a business identity, a separate number for contact, a domain to make the identity look established. When an identity stopped being useful, another appeared.

The timeline told us how far it went

Each identity, number, company and asset went into chronological order. That showed which came first, which ran simultaneously, and which connections survived when an identity was abandoned.

The pattern had been running for years and it repeated. The same person presented himself to different companies as an IT authority, each time with an alias, a business and a number that supported the story.

Working backwards through the identities turned up further connections to companies across the United States, and with them the concern that the client's case was one instance of something that had been running for years.

Where it ended

Every finding was documented at its source and cross-checked against others, then assembled into a case file for the company's lawyers and for the authorities.

The client submitted it to law enforcement. A criminal investigation was opened on the basis of what the file contained.

They had asked us to find one person. What the work produced was the mechanism: the layers of identities, the businesses that existed only online, the phones bought for one purpose, and a digital presence assembled to look legitimate to anyone who checked quickly.

Why the identities failed

A person can change a name, a number, an email address and build a company that has never traded. Any of that takes an afternoon.

What none of it does is remove the traces left while each identity was being built. The work is deciding which of those traces belong to the same person, and that is a different skill from finding them.