Kreller Hot Topic Report | The Role of Digital Footprint Research in Corporate Compliance

On the same day in Miami, a US District Judge sentenced Anthony Gignac to 18 years for impersonating the Saudi Arabian Prince, Khalid bin al-Saud, in order to defraud investors of over $8 million dollars after offering them an opportunity to purchase a stake in the Saudi state oil company, Saudi Aramco. According to a DOJ press release, Gignac purchased fake diplomatic license plates, hired body guards outfitted with false diplomatic security badges, dressed in “traditional Saudi garb,” and surrounded himself with “luxury goods consistent with the lavish lifestyle of a Saudi Royal.”

He also developed an Instagram account for his royal persona, under the username “princedubai_07.” The Instagram page included pictures of Saudi royals tagged as family members along with photos of ostentatious jewelry and watches, designer goods, high-end restaurants and hotels, luxury cars, bundles of cash, as well as images of an American Express Business card with the words “Bin Al-Saud” and “Al-Saud Group” on prominent display. As stated in the November 20, 2017 criminal complaint for the above case, in addition to the Aramco scam, Cignac used this assumed identity to “obtain unauthorized credit at retail stores,” receive money from fictitious bank accounts, and make fraudulent attempts to purchase a multi-million dollar hotel in Miami (identified in a November 2018 Vanity Fair article as the Fontainebleau Miami Beach).

In a June 3, 2019 press release describing the Arbab/Proficio Capital case, Richard R. Best, Regional Director of the SEC’s Atlanta Office, stated the alleged scheme is a “reminder that investors… should carefully research investment opportunities and the people offering them.” Today, this research typically begins with typing an individual’s name into a search engine and browsing his or her digital footprint (e.g. corporate bio, website, Facebook page, LinkedIn profile, etc.); we Google them.

A quick survey of a company or individual’s web presence may satisfy casual curiosity. However, without a mindset of healthy skepticism, such a review can serve to reinforce or introduce misinformation about the individual or company in question. Many fraudsters rely on social media as a part of a marketing strategy, in which they sell friends and followers on their purported identities as successful or connected individuals. A trained analyst will be able to see past this salesmanship in order to spot any red flags lurking in those tweets or Facebook feed.

When done correctly, social media research can be used to augment a due diligence or compliance investigation. A thorough examination of an individual’s digital footprint will approach material presented via social media as low-credibility information which should, if possible, be corroborated by additional sources. Additionally, a due diligence investigator will be able to analyze the principal’s social media presence as one element within a broader risk assessment, by viewing posts against the backdrop of corporate filings, legal records, and other relevant documentation.

Using Digital Footprint Research to Enhance Due Diligence        
An examination of the social media presence of the Subject Company’s principal can yield valuable insights into the workings of potential partner entities. A close review of the principal’s LinkedIn profile, digital CV, and corporate biography is a natural starting point for verifying an individual’s business affiliations, possible government affiliations, educational background, and past and former colleagues. Such research is also vital for identifying aliases, previous names, nicknames, and usernames. Attempting to verify this self-reported information is often an early step in deep-dive research regarding the individual’s career trajectory.

When making compliance decisions about a new or low-profile company, getting an accurate sense of the principal’s past business successes or failures can provide actionable information which may otherwise be unavailable for a company without a rich media presence. In a recent example, Kreller was charged with conducting a due diligence review of an airplane engine trading company with a small staff and negligible online presence. However, the corporate bio of the principal individual indicated that he had formerly worked in the securities industry. Subsequent research through FINRA revealed substantial regulatory issues for the principal which would not have been located through a media sweep on the engine trading company alone.

In addition to providing a starting point when searching for business affiliations and conducting employment and education verification, social media sites can fill in the details of the principal’s life and relation to his or her business ventures. While each case involves unique circumstances and challenges, social media research should minimally seek to address the following questions as part of a wider due diligence review:

1. Is the individual’s social media presence commensurate with his or her role in the company? Does the principal appear to have the skills and knowledge appropriate to his or her position?
2. Does the principal appear to be engaged in the day-to-day workings of the company? If not, is the principal acting as a stand-in or paper director, while another hidden stakeholder controls the company’s operations?
3. Does the principal’s lifestyle appear to be coherent? In the case of Anthony Gignac his Instagram page presents a disjointed picture in terms of his assumed identity as a Saudi prince, from the username referencing “Dubai” to the July 12, 2016 photo, gleaned from elsewhere on the internet, of a suitcase filled with cash accompanied by the decidedly un-aristocratic tag “Gettin that chicken.”
4. Does the principal appear to be living within his or her means? Are there any indications of outsized spending, travel, gambling, or addiction? A review of Syed Arbab’s Twitter profile revealed evidence of multiple trips to Vegas casinos during the year of his alleged crimes.
5. Does the individual’s social media presence raise concerns about his or her decision making abilities? Is there any information apparent on the individual’s social media accounts that could lead to legal or regulatory ramifications or a public relations scandal?
6. Are any of the individual’s email addresses linked to any known data breaches and thus potentially compromised for use by nefarious parties?

While often thought of in the context of research on individuals, digital footprint research can also be invaluable in determining potential risk factors for a potential partner or client company. A close review of a company’s website and social media pages can help determine whether a company has adequate resources for a proposed activity. In one example, Kreller was commissioned to conduct a due diligence review of a trucking company, whose website included photos of a purported “fleet” of vehicles. On closer inspection some of the pictured trucks contained US DOT numbers related to other seemingly unaffiliated trucking companies. Several photographs also contained watermarks suggesting they were pulled from other websites. Such details might cause a client to question not only the size of the fleet but the overall trustworthiness of the company when assessing the risk associated with a potential partnership or business deal.

Digital footprint research can expose other warning signs for companies as well, including evidence of plagiarism on the company’s website and discrepancies within the company’s reported activities. In one instance, Kreller was requested to initiate a due diligence review of an entity whose name indicated that the company was involved in IT consulting; however, the company’s webpage revealed that the Subject Company was purportedly involved in defense logistics and sales throughout Africa – a high risk industry in a high risk region!

An archived version of the website indicated that the Subject Company was previously engaged in IT activities, but no information was located to explain the seemingly abrupt turn to defense logistics. A deeper analysis of the current website, including its source code, suggested that much of the material from the site had been lifted from another defense industry website. Research did not reveal adverse media or legal filings for this company; however, the inconsistency in the company’s self-presentation, as well as the apparent plagiarism, would likely give many prospective partners pause.

As seen in the aforementioned examples, digital footprint analysis can, and often does, reveal pertinent information which may not be disclosed in news reports or court records, and thus can be a useful tool in compliance.