Effective Strategies for Finding People: OSINT Public Records Investigations in the U.S.

Many times, for some reason or another, it's necessary to locate a subject or establish a subject's presence in the U.S. Perhaps there is a need to serve them with notice of a court proceeding. Perhaps we need to prove they were at a certain place (or not). Perhaps we need to get a sense of where they spend most of their time. Any investigator worth their salt knows social media is often the first stop for such endeavors. Often, with a subject who is active on social media, they may just do most of the work for us.

But I don't want to talk about the obvious like social media or data aggregators. What if we have a subject with a common name and little to no active social media presence? These are cases where we can turn to public records and leverage a few different, effective strategies to try to determine a subject's location.

Now, a comprehensive post on this topic as it relates to U.S. public records is well beyond the scope any blog post. There is far too much variance between U.S. states and even counties and cities where record availability is concerned. Instead, what I aim to accomplish here is to highlight select strategies and key record repositories that might be useful for finding a subject both generally--insofar as the record types and repositories are common across the U.S.--and in Miami-Dade County, Florida, which is fresh in my mind due to some recent case work there. Some of what I cover here will be applicable across most other counties in the U.S. and some of it may vary significantly, that's just the nature of U.S. public records investigations. With that said, let's examine a few key resources we can leverage.

Where to Start

1. The Department/Secretary of State - The Department of State (at the state level, not the federal level) indexes records of corporations and fictitious names (basically, sort of a sole proprietorship) as well as UCC financing statements registered in the state. In some states, these records are searchable only by company name, in others, we have more options. For exmaple, in Florida these records can be searched by corporate officer. Fictitious names, in my experience are searchable by owner name. In addition, UCC financing statements (a form of legal notice showing a secured party has an interest in the debtor's property) are typically maintained by the Secretary of State. All of these records are potential avenues for casting a "wider" (statewide) net for your subject and perhaps identifying an address in the underlying documents. Especially if you are less certain of where to start on the county level.

   
   

2. The County Property Appraiser - Sometimes called the Tax Assessor, the property appraiser is responsible for managing property taxation. Their records include any real property in the county along with information on the property's current owner, the property's assessed value, and often its market value. In addition, there is often information in these records about the most recent sales of the property as well as whether it qualifies for a homestead exemption (i.e. is it your subject's primary residence?). Often, but not always, these records are searchable by address or by owner name. This is the case in Miami-Dade County. As such, this would probably be my next stop as I'd want to see if my subject owns a property, especially if it is their primary residence.

   
   

3. The County Recorder - Sometimes called the Recorder of Deeds, the Recorder manages official county records. This typically includes a wide range of documents that must be recorded. Everything from liens to judgments, to affidavits to property deeds is here. These records are typically searchable by party name (or grantor/grantee, which is functionally the same thing) as they are in Miami-Dade County. As such, they are an excellent resource for this task. Any number of these documents could be helpful for both identifying a subject's address and their presence (e.g. if they were signing a notarized document on a certain date, barring a case of fraud, you can be fairly certain where they were).

   
   

4. State and County Voter Records - State and county-level voter rolls provide another avenue for potentially confirming a subject's address. They are not always searchable by name, however. In addition, under certain circumstances, voter records may be protected from public disclosure.

Some Thoughts on Digging Deeper

But what if your subject has a very common name and you don't quite know enough about them to decide if the results from the above are false positives or not? This is where we can try some more creative methods to try to locate our subjects.

Suppose you have your subject's name and date of birth as a starting point. As it turns out, Florida driver's license numbers are calculated based on an algorithm that combines date of birth and name.

We can use a free online tool like this one to calculate most of our subject's Florida Driver's License number. This will provide us with a result as follows (partially redacted for privacy).

Example of a Florida Driver's License Number generated via algorithm (redacted for privacy)

Note that while the site does not provide us with the last digit of the driver's license number, it is typically a "0" or a "1".

We can then verify the license number we generated is valid by using the Florida Department of Highway Safety and Motor Vehicle driver license check. This will tell us whether the license is valid and whether there are any endorsements on it. If our subject also rides motorcycles, that may be an interesting piece of information in the context of, say, an asset search or surveillance reconnaissance.

But what good is a license number for finding a subject's address? Well, people who drive may get traffic citations. In Miami-Dade County we can search these by name, but when faced with a subject that has a common name, we can also search them by driver's license number (including non-Florida license numbers). The benefit, of course, is that a license number is a unique identifier, though I would certainly advise conducting a separate search by name, just in case. Sometimes, particularly with more recent traffic citations, the online record will contain an image of the traffic citation complete with address. While I'm not fully certain what determines whether they are available online, it seems to me post-2020 citations normally are.

If the citation is not available online, then our best best is to send someone to the courthouse to search for the citation in person. But if we get lucky, a recent citation would provide us proof of the address listed on our subject's license and their vehicle tag number. Here's an example:

Example of a Florida Traffic Citation (redacted for privacy)

Note the wealth of information available here, which I have censored for obvious privacy reasons. Among other things, we have:

• The exact date and time the citation was issued. That is, we know the subject's location and when he was there.

• The intersection where the citation was issued.

• A full address for the subject as reflected on their driver's license.

• State and type (class) of driver's license.

• Vehicle year, make, model, color, and the license plate/tag number and year of expiration. Much of this information could be particularly useful for surveillance or service of process purposes.

  
  

An added benefit of the vehicle license plate number is that, in Miami-Dade County, parking violations can be searched by license plate number. Now, just because a parking ticket was issued doesn't mean our subject was necessarily driving the vehicle. He could have lent it to a relative. Nonetheless, parking violations could constitute an additional useful data point in establishing timelines/locations of activity and perhaps even patterns of activity.

The U.S. public records landscape can get rather complex. Compared with many jurisdictions where we work, the U.S. offers a veritable smorgasbord of available records. But this is a double-edged sword. These records are diffuse, held in various offices at the state, county, and sometimes, city level. In some areas, real property records for certain properties are kept at city offices, while records for other properties are maintained at county offices, despite both addresses being within the same city! To further complicate the picture, search parameters, record availability, digitization, etc. can all vary widely within a single state or even within a single county.

This all adds up to a public records landscape whose advantages can easily become disadvantages if one is less familiar with what's available and where to look. As such, something that may seem relatively simple, like locating a subject, can easily become rather complex. As we've seen here, for better or worse, each jurisdiction has its own idiosyncrasies. Combining creativity with a solid understanding of the records landscape can increase the chances of success. And sometimes, in a tough investigation, that's the best way forward.