What’s the deal with ‘websleuthing’? News media representations of amateur detectives in networked spaces

Introduction

In recent years, increasing numbers of people have flocked to networked spaces to analyse a wide range of cases. They engage in varying levels of amateur detective work including but not limited to searching for information, uploading documents, images and videos, commenting, debating, theorising, analysing, identifying suspects and attempting to engage with law enforcement and other organisations and individuals connected to the cases. Examples of such spaces include Websleuths, The Doe Network, Reddit Bureau of Investigations and NamUs.gov. ¹ Websleuthing, cyber detective work and digital vigilantism are some of the terms used to describe this phenomenon. For the purpose of consistency within this article, we will hereafter use the term websleuthing.

Websleuthing has made the headlines on several occasions, perhaps most notably in relation to the 2013 Boston Marathon bombing. Photographs taken by those at the site were posted online and pored over by websleuths in an attempt to identify the individuals responsible. Reddit, the self-proclaimed ‘front page of the internet’ (Reddit, 2016), saw the emergence of multiple discussions – most notably a Find the Boston Bombers Subreddit, ² which led to the identification of several individuals, none of whom were responsible for the atrocity. A different type of websleuthing is described by the journalist Deborah Halber (2014) who explores a group of websleuths cross-referencing missing persons’ cases with public records of unidentified bodies in an attempt to find matches. Websleuths also gather around cases that first come to their attention via mainstream media. Sizeable communities convened in the aftermath of the Serial podcast (Chicago Public Media and Glass, 2014) – which explored the conviction of Adnan Syed for the 1999 murder of his former girlfriend Hae Min Lee – and the Netflix documentary Making a Murderer (Synthesis Films, 2015) – which cast doubt on the conviction of Steven Avery for the 2005 killing of Theresa Halbach.

Developments in computer hardware and software and innovations in networked technologies have given the armchair detective (Soothill, 1998) a new lease of life. Enabled by the digital, networked, interactive and hypermediated characteristics of contemporary culture (Miller, 2011), they can now join communities of like-minded people. Any private citizen with an interest in crime and a smartphone, laptop or tablet can now go online and connect with others in crowdsourced amateur investigations. Websleuthing is the embodiment of participatory media, where the lines between the producer, consumer and subject are blurred, there are fewer restrictions in relation to time and space and online activities have real world, embodied consequences (Bolter and Grusin, 1999; Bruns, 2008; Deuze, 2012; Jenkins, 2006; Ritzer and Jurgenson, 2010). The opportunities for content creation and sharing and the acceleration in the speed at which these processes occur is ‘the biggest change that media-criminologists have witnessed’ (Jewkes, 2015: 4).

These developments raise some interesting questions: Who are websleuths and why do they get involved in websleuthing? What activities do they engage in? What types of case do they investigate? Given the fact that criminal justice organisations are increasingly using social media (Ellis and McGovern, 2015; Johnston and McGovern, 2013), what are the nature of their relationships with websleuths? What impact does websleuthing have on suspects, victims and websleuths themselves? How should we make sense of them? Within this article, we begin to tackle some of these questions by exploring the criminological literature around websleuthing, refreshing the conceptual and theoretical contexts of this topic and reporting upon our own research into news media representations of websleuths. As such, we hope to build stronger frameworks within which to understand websleuthing and facilitate further research.

Vigilantes, digilantes and paedophile hunters

Research around websleuthing is somewhat thin on the ground. However, criminologists who have explored it have placed a particular focus upon the detection of alleged child sex offenders. Huey, Nhan and Broll (2013) draw upon a nodal government theoretical framework and argue that the nature and scale of criminality in networked culture is such that law enforcement are unable to tackle it. This necessitates input from a range of other actors – including the general public. They identify civilian police, ‘who collect and relay information on actual or potential online crimes to law enforcement’ (Huey et al., 2013: 85). A range of motives drives these websleuths – being inspired by television coverage of others engaged in such activities, having been victims themselves or wanting to protect children. Further insights are provided by Campbell (2016), who explored the case of Stinson Hunter, who leads a group of ‘paedophile hunters’. Like Huey et al. (2013), Campbell (2016) also contextualises these activities within policing conceptual frameworks. Campbell argues that Hunter’s activities are unlikely ever to connect to wider policing structures given the transgression of formal policing boundaries around consent, accountability and justice that this would involve.

Terrorist atrocities have also been gathering points for websleuths – an area explored by Nhan, Huey and Broll (2015). They use the term digilantism to refer to Reddit activity following the Boston Marathon bombing. They outline a range of activities, including searching for information, sharing and analysing photographs of suspects and drawing upon individual specialist knowledge. They also noted the digilantes’ failure to identify the correct suspects and the false accusation of several innocent people. Nhan, Huey and Broll note in both of their studies (Huey et al., 2013; Nhan et al., 2015) that relations between websleuths and law enforcement are antagonistic. Law enforcement do not trust websleuths, claim they hinder investigations and dismiss their information as of little value. Websleuths defend their efforts and complain that they are rarely acknowledged or credited. In conclusion, Nhan et al. argue that websleuths are undervalued – offering many pairs of eyes and ears, they can rapidly mobilise to gather information and draw on a wide range of individual assets and skills. Nhan et al. emphasise the importance of tackling law enforcement mistrust through regulatory strategies to limit potential harms if websleuths’ power is to be realised.

Smallridge, Wagner and Crowl (2016) outline a conceptual framework for cyber-vigilantism – an adaptation of Johnston’s (1996) thesis. They detail multiple cyber-vigilante activities, one of which is crowdsourcing for justice where justice-seeking civilians collectively pool their expertise in response to real and perceived societal wrongs. A distinction is made between organised and spontaneous crowdsourced activities:

On the one hand, there are relatively organized civilian groups that rely upon the expertise of initiated volunteers to carry out their activities. Well organized civilian groups … engage in a variety of activities to identify criminals … who operate online … In contrast, there are short-lived groups that mobilize in response to a particular injustice or social wrong. These groups generally dissipate quickly as the initial furore of the initiating event fades into memory … (Smallridge et al., 2016: 62–63)

Smallridge et al. name the paedophile exposé group Perverted Justice as an example of organised crowdsourcing for justice. In relation to the spontaneous category they point to those convening in online spaces like 4Chan to name, shame and dox ³ alleged wrongdoers. The organised/spontaneous dichotomy could be fruitful as it acknowledges diverse motives, skillsets, temporal patterns and divisions of labour amongst websleuths. However, we are cautious about the continued use of the term vigilantism because it implies a limited and specific type of activity. Whilst adapting existing theory can be important for conceptual development, doing so may be limiting if it is confined within criminological boundaries so we were keen to explore other territory.

Those exploring websleuthing from other disciplines – notably media and communications studies – offer some additional insights. One such researcher is Trottier (2014, 2016), who whilst still using the term vigilantism, acknowledges the broader social and cultural context. He defines digital vigilantism as ‘a process where citizens are collectively offended by other citizen activity, and coordinate retaliation on mobile devices and social platforms’ (Trottier, 2016: 1). Digital vigilantism is conceptualised as a form of weaponised visibility, whereby retaliation for perceived wrongdoing takes the form of exposure to public scrutiny and has real, embodied consequences. Trottier claims that networked spaces facilitate decreased public confidence in state control over crime, creating the conditions in which digital vigilantism can thrive. They do so by opening up information flows, serving as gathering points for comment, serving as repositories for personal data and enabling peer surveillance. In a society where to be is to be seen (Thompson, 2005), Trottier argues that we should not conceptualise digital vigilantism and weaponised visibility as aberrant practices but as manifestations of the values and norms of digital cultures. Trottier’s contribution is valuable because he moves the debate on – transcending the online/offline dichotomy often assumed by criminologists when dealing with networked media (Brown, 2011) and linking the discussion to wider theory around digital culture.

In summary, current research in this field has made interesting observations. Focusing specifically upon particular types of offending – notably terrorism and child sex offences – criminologists have identified websleuth activities as well as some of the associated challenges and opportunities. However, enquiry has tended to locate websleuthing within the conceptual frameworks of policing and rely upon the idea of vigilantism. If we are to push this field of study further and facilitate conceptual and theoretical development, we must transcend these boundaries.

Cultural criminology and infotainment: Consuming, producing, witnessing

Cultural criminology concerns itself with the learned and shared values, attitudes and behaviours of social groups in relation to crime and deviance, exploring how crime and criminals come to be defined as such and how labelling plays out in a range of social spaces – virtual/networked spaces being of crucial importance (Hayward, 2012). Cultural criminologists have however argued that theorising around networked media has not gone far enough in considering implications for social life and lived experiences of crime, points that are particularly pertinent to current sense-making around websleuthing:

… rather than focusing solely upon models of diffusion or thinking about the Internet simply as a digital tool, we should instead focus upon the experience of the internet – how it functions in particular ways for particular purposes. This in turn allows us to think about digital/online (criminal) activities as a process, that is, as phenomena in constant dialogue and transformation with other phenomena/technologies. (Ferrell et al., 2015: 170–171)

Cultural criminology offers a fruitful conceptual framework for further understanding websleuthing for several reasons. Firstly, it takes a flexible position in relation to media, encompassing older, more established media like books, television, radio and newspapers but also newer media like the internet and social networking sites. Accordingly, it is appreciative of the fact that the dividing line between older and newer media is not clear cut – they influence and shape each other (Bolter and Grusin, 1999). Secondly, it encompasses both media representations of crime and the use of media in constructing, maintaining and shaping identities and realities. These phenomena are often described as loops, processes by which ‘everyday life recreates itself in its own image’ (Ferrell et al., 2008: 130). These points are particularly relevant for websleuthing as networked technologies have enhanced opportunities not only for people to consume cases but to participate in collective investigations and create their own representations. The loops around websleuthing continuously feed into the construction of our realities, connecting to broader frameworks – or spirals – of culture and crime (Ferrell et al., 2008, 2015).

Infotainment has long been woven into these spirals of culture and crime. This term describes representations characterised by an intermingling of fact and fiction, imagined and real, combining both information and entertainment (Ferrell et al., 2008; Fishman and Cavender, 1998; Jewkes, 2015; Leishman and Mason, 2003; Parker, 2012; Surette, 1998). This is further explained by Surette:

Infotainment can be defined as the marketing of edited, highly formatted information about the world in entertainment media vehicles. The reality in infotainment is more about the reality we wish for than the reality that exists. The feel with infotainment media is that you are learning the real facts about the world; the reality is that you are getting a highly stylized rendition of a narrow, edited slice of the world … infotainment combines aspects of news, entertainment and advertising under a single umbrella. (Surette, 2015: 19–20)

Whilst this genre has proliferated in recent years – accelerated by increasing amounts airtime to fill (Surette, 2015) – its roots can be traced much further back. For example the 17th century saw the emergence of the Newgate Calendar – a collection of true crime accounts that both fuelled and fed curiosity around crime and crime-fighting (Turnbull, 2010, 2014). William Roughhead’s accounts of the Deacon Brodie murder trial in Edinburgh were later remodelled by Robert Louis Stevenson into the fictional work Dr Jekyll and Mr Hyde, highlighting the practice of the real informing the fictional (Seltzer, 2008). The true crime genre, described by Seltzer (2007: 16) as ‘crime fact which looks like crime fiction’, saw a resurgence following Truman Capote’s In Cold Blood, which told the story of the 1959 murders of four members of the Clutter family in Kansas. True crime television later came to explicitly incorporate armchair sleuthing with the 1984 launch of the BBC’s Crimewatch, followed by America’s Most Wanted and Police Camera Action! These shows brought real violent crime into living rooms, appealing for the public’s help and as such, highlighting the role of private citizens in tackling crime (Jermyn, 2007). More recently, true crime podcasts have become very popular – season one of Serial was the fastest podcast on iTunes to reach 5 million downloads (Vincent, 2014). Serial fans gathered on the Serial Subreddit to theorise and speculate as they would over an episode of CSI, prompting the victim’s brother to enter this media space and post an impassioned response, proclaiming ‘TO ME ITS REAL LIFE!’ (Yardley et al., 2015). Amidst these developments, crime endures as a news media staple, with violent crimes like murder eclipsing the property offences that constitute the majority of police recorded crime (Jewkes, 2015; Maguire, 2002).

Infotainment is an acknowledgement of messiness and complexity. Rather than seeing news and entertainment, fact and fiction as buckets into which we can sort particular media outputs, infotainment presents the contemporary mediascape as a hall of mirrors (Ferrell, 1999), in which the street scripts the screen and the screen scripts the street, where linearity, cause and effect are merely abstract concepts and ‘the line between the real and the virtual is profoundly and irrevocably blurred’ (Hayward and Young, 2004: 259). In making sense of our appetite for violent crime infotainment, Seltzer (2008: 13) argues that this is part of ‘contemporary wound culture’, in which he describes trauma, violence and terror as key gathering points, a ‘theatre for the living’ (Seltzer, 2008: 14) in the ‘strange attraction of the murder leisure industry’ (Seltzer, 2008: 35). Entertainment has long featured a dark undercurrent in which audiences are drawn to the suffering of others. Seltzer’s idea of the murder leisure industry and opportunities for immersion in wound culture are evident in other popular cultural pursuits, from the family board game Cluedo to murder mystery weekend breaks, to periodical magazines like True Detective.

Audiences have never been docile recipients of true crime infotainment, passively absorbing the content they consumed. They have discussed, dissected and speculated around cases with others. They have always had the option to communicate with producers of mediated representations – for instance the ‘letter to the editor’. During the past two decades, however, major shifts have occurred. Audiences now have considerably more participatory opportunities when it comes to infotainment – they can post a comment on an online news article, tweet about a television programme using a hashtag or join one of the multiple online communities established to discuss and debate particular cases. They are able to produce their own critical or counter-representations even if they have little in the way of formal media production training. They can investigate even if they aren’t trained investigators. It can be argued that the affordances of networked media have combined with wound culture to create a new form of active, performed and embodied witnessing (Howie, 2012). Websleuths are a manifestation of such witnessing and as such, should be understood as more than public actors in a nodal governance security network (Campbell, 2016; Huey et al., 2013; Nhan et al., 2015). They are active meaning-makers. Their activities are in constant dialogue with – and reflective of – other social phenomena. In further studying websleuthing with this in mind, we may begin to unravel the loops and spirals around these activities and better understand their criminological implications, and social and cultural contexts. Within the following sections, we report upon our empirical study, which focused upon media representations of websleuthing.

Approach to the study

In making an empirical contribution, we wanted to capture contemporary understandings of websleuthing by identifying perceptions and exploring the different meanings attached to these activities. To address these aims and objectives, we opted to explore representations of websleuthing in news media, describing the subsequent coverage and analysing the themes and perspectives emerging within it. News media representations of websleuthing are important because they play a significant role in shaping public understandings of these activities (Surette, 2015). However, we were conscious that the news media reporting was highly likely to be influenced by concerns around newsworthiness (Jewkes, 2015) and hierarchies of victimisation (Greer, 2004). As such, we were mindful of the likely overrepresentation of websleuthing around violent crimes featuring ‘ideal’ victims (Christie, 1986).

In forming our sample, we carried out a series of systematic searches of the Nexis news database. We searched the headlines and lead paragraphs of major world publications using a combination of terms including ‘web sleuths’, ‘cyber detectives’, ‘amateur sleuths’, ‘internet sleuths’ and ‘online detectives’. We opted to search for content from all of the available dates up until 30 June 2016. We then refined the sample to exclude any content that was not relevant to our study – for example stories of people engaging in sleuthing around non-criminal issues like family history research or investigating infidelity. Once this process had been completed, our final sample comprised 97 articles.

Our analytical approach drew upon the principles of Ethnographic Content Analysis (ECA) (Altheide, 1987). This enabled us to combine quantitative and qualitative techniques, reflexively travelling back and forth between the two as the analysis progressed. In addition, it allowed scope to embark upon the research in a theoretically informed manner whilst allowing sufficient flexibility to encompass alternative views and ideas. We decided to note activities on an article by article basis rather than a case by case basis as we wanted to capture the extent of coverage particular themes and perspectives were given.

We began our analysis by logging quantifiable data from the articles in an Excel spreadsheet. This included article title, author, publication, year, the country in which the publication was based and the country or countries in which cases discussed in the article had occurred. In addition we recorded the types of case and noted the networked environments of websleuthing. Thereafter we uploaded the sample onto the NVivo qualitative analysis software (QSR International, 2012) and thematically analysed each article. This consisted of firstly reading each article twice in an attempt to immerse ourselves in it and develop an appreciation not only of the content but also of the context (Tesch, 1990). Thereafter, we read through each article a third time but additionally noted the words, phrases and sentences that captured key concepts. In order to record our impressions, reflections and understanding of the interrelationships between concepts, we used memos. The memos were then used to identify codes. The codes acted as labels or tags, which enabled the development of segments or units of meaning (Miles et al., 2013). This facilitated the grouping of content under specific headings, for example, websleuths accusing victims’ families, harmful effects of websleuthing upon the criminal justice system, doxing – suspects’ personal information released online and websleuths’ contributions to investigating cases. We developed these headings independently of each other before discussing our findings collectively to address queries or differences in understandings. Following on from this, we began to independently arrange these headings into broader categories and met again to critically discuss the interrelationships between them, developing clusters of codes (Coffey and Atkinson, 1996). The clusters we developed included websleuthing and the criminal justice system, outcomes of websleuthing, activities of websleuths and the history and context of websleuthing. Thereafter, we revisited the Excel spreadsheet, this time adding new categories that we could quantify from the groupings established from the codes – this included the different types of activity websleuths engaged in, the nature of their engagement with the criminal justice system, websleuths’ motives and the overall position of each article in relation to websleuthing as a concept.

It is important to note that analysis of this nature has a range of limitations – debate often revolves around credibility and internal validity (Lincoln and Guba, 1985), the quality of the analysis dependent not only on the processes deployed but also the quality of the texts being analysed (Bryman, 2012). We sought to address these challenges through transparency in identifying our sample and assigning meanings to the content we were analysing. Our approach enabled us to explore both the quantifiable parameters around contemporary understandings of websleuthing as well as the more nuanced interpretations of the impact and implications of these activities. We describe our key findings in the following sections.

Websleuthing in the news: Key findings

Scope and nature of coverage

The earliest article we uncovered was published in 1998 (Butcher, 1998). Each year, the number of articles about websleuthing have ranged from zero to 12 (see Figure 1). It is important to note that 2016 figures only include articles up to the end of June of that year – however, this time period contains the highest number of articles in our sample (n = 12, 12.4%).

OPEN IN VIEWER

Figure 1.

Number of articles referring to websleuthing.

Regarding the countries in which the publications in our sample were based, over half (n = 52, 53.6%) were UK publications, just under one-fifth (n = 19, 19.6%) were US publications, just over one in 10 (n = 12, 12.4%) were Canadian, around one tenth (n = 10, 10.3%) were Australian, two (2.1%) were New Zealand publications, one was Chinese (1%) and one was Singaporean (1%) (see Figure 2). An interesting contrast emerged when examining this alongside the countries where the cases being written about occurred – the majority were from the USA (see Figure 3). The majority of cases referred to in the articles in our sample had occurred in the USA, despite the fact that nearly four-fifths (n = 78, 80.4%) of the articles in our sample were published by non-US news publications. That a large proportion of the cases being explored by websleuths originate in the USA is not particularly surprising given their very high profile – partly attributable to their presence in mainstream media. For example, following the Netflix series Making a Murderer, the Subreddit investigating Steven Avery’s conviction had nearly 4 million page views by December 2015 (Griffin, 2016). In addition, many purpose-built websleuthing sites were established in the USA – for example, Websleuths launched in 1996 to explore the killing of six-year-old US beauty pageant star JonBenet Ramsey. It now boasts 83,000 members, 230,000 threads and 11 million posts (Dewey, 2015).

OPEN IN VIEWER

Figure 2.

Country in which publications were based.

OPEN IN VIEWER

Figure 3.

Countries in which cases had occurred.

There was a total of 110 references to types of case. We discovered 17 different case types: homicide (n = 29, 26.4%); property offences – encompassing theft, vehicle crimes and damage to property (n = 22, 20.0%); terrorism (n = 14, 12.7%); missing persons (n = 12, 10.9%); frauds, cons and scams (n = 9, 8.2%); unidentified bodies (n = 4, 3.6%); animal cruelty (n = 3, 2.7%); sexual offences – adult victims (n = 2, 1.8%); sexual offences – child victims (n = 2, 1.8%); and extortion (n = 2, 1.8%). In addition, there was one mention each (n = 6, 5.5%) of war crimes, bullying, hate speech, lewd conduct, environmental crime and computer hacking (see Figure 4). Therefore, whilst a wide variety of cases are reportedly being explored by websleuths, there is an overemphasis on violent crime, which we expected given its newsworthiness (Jewkes, 2015).

OPEN IN VIEWER

Figure 4.

Type of case.

We coded all articles in relation to whether they were positive, negative, evaluative or descriptive about websleuthing. The two former categories are self-explanatory. The latter two refer respectively to those articles that presented pros and cons but did not arrive at a definitive conclusion and articles that simply outlined what had happened in a particular case. Over one-third of articles (n = 37, 38.1%) adopted a positive position on websleuthing. Each of the other categories – negative, evaluative and descriptive – each represented one-fifth (n = 20, 20.6%) of the articles in the sample (see Figure 5). Further exploring the two most prominent types of case in the sample – homicide (n = 29, 26.4%) and property offences (n = 22, 20.0%) – there were variations in the position the articles adopted. Websleuthing around property offences was more likely to receive positive coverage than that around homicide cases – see Figure 6. Illustrative headlines included, ‘Computer expert turns online sleuth to track down stolen computers’ (Alleyne, 2011) and ‘Web detective work nabs burglary suspect’ (Thomas-Lester, 2005). Cautionary headlines typified coverage of websleuthing around homicide, for example ‘Netflix’s Making a Murderer shows the limits of websleuthing’ (Horgan, 2015) and ‘Stranger than fiction; True crime dramas are having a moment, but at what cost?’ (Metz, 2015).

OPEN IN VIEWER

Figure 5.

Overall position of articles.

OPEN IN VIEWER

Figure 6.

Position of articles in relation to websleuthing around homicide and property offences.

Online spaces

Our sample referred to 44 unique online spaces used in websleuthing (see Figure 7). There was a total of 141 references to online spaces: Reddit (n = 22, 16.3%); Facebook (n = 21, 14.9%); Twitter (n = 10, 7.1%); blogs (n = 9, 6.4%); Google (n = 8, 5.7%); Websleuths (n = 7, 5.0%); eBay (n = 7, 5.0%); YouTube (n = 6, 4.3%); unspecified chatrooms (n = 3, 2.1%); Imgur (n = 3, 2.1%); Doe Network (n = 3, 2.1%); 4Chan (n = 3, 2.1%); Tumblr (n = 3, 2.1%); suicide chatroom (n = 2, 1.4%); Craigslist (n = 2, 1.4%); LinkedIn (n = 2, 1.4%) and MySpace (n = 2, 1.4%). There was one mention each (n = 27, 19.1%) of an extremist chatroom, an extremist website, an alcoholism recovery chatroom, Vine, Photobucket, Best Gore, Google Earth, Periscope, Google Street View, an unspecified instant messenger service, MSN Messenger, Yahoo Instant Messenger, Missing Persons’ Cold Case Network, Ontario’s Missing Adults, Cold Cases, Scam Detectives, GoFundMe, Buzzfeed, an unspecified government website, Gumtree, Amazon, Yelp, Kijiji.com, Ramsey Family website, Jameson245.com and VKontakte. We arranged the unique spaces into categories depending upon what type of online space they represented (see Figure 8). These were: social media (n = 39, 27.7%); chat – including 4Chan and Reddit (n = 33, 23.4%); case specific sites (n = 24, 17.0%); products and services sites (n = 13, 9.2%); content sharing sites (n = 12, 8.5%); search engines (n = 8, 5.7%); other sites (n = 6, 4.3%); maps (n = 3, 2.1%); and messenger services (n = 3, 2.1%). The articles reported varying types of usage of the spaces. Social media, for example, was used both to create an online gathering space around a case – for instance, a Facebook page – and as a resource to search for information about individuals connected to a case, through viewing their Twitter feeds or other social networking profiles. Websleuths also gathered around purpose-built websites dedicated to a specific case or type of case – for example, Websleuths or the Doe Network. Other online spaces served as hosting platforms for content – for instance YouTube – whilst sites like eBay listing products for sale are scanned and analysed for stolen property.

OPEN IN VIEWER

Figure 7.

Online spaces referenced in articles.

OPEN IN VIEWER

Figure 8.

Categories of online space.

Websleuthing activities

We were able to categorise websleuthing activities into a similar framework to the organised/spontaneous dichotomy proposed by Smallridge et al. (2016). However, we had to first remove the ‘crowdsourced’ characteristic because it soon became clear that not all websleuthing activities were crowdsourced – some people engaged in websleuthing on their own. These cases often related to property crimes where a victim set out to search for their stolen property for sale on the internet – for example, a man who located £10,000 worth of rare china stolen from his home on eBay (Anonymous, 2004). This also however included a lone websleuth who targeted terrorists, posing as a sympathiser to gain access to information (Shane, 2016). We therefore categorised the sample into ‘group websleuthing’ and ‘solo websleuthing’. The majority of articles (n = 88, 90.7%) mentioned either one or the other but eight made reference to both (8.2%) and one referenced neither (1.0%), so there was a total of 104 mentions. Group websleuthing constituted just over half (n = 59, 56.7 %), whilst solo websleuthing represented just under half (n = 45, 43.3% (see Figure 9).

OPEN IN VIEWER

Figure 9.

Group websleuthing and solo websleuthing.

We then redefined and refined the Smallridge et al. (2016) organised/spontaneous dichotomy. We interpreted ‘organised’ as ongoing and long-term websleuthing around a particular case or type of case, with multiple objectives, activities and commitment of significant resource. Examples included the activities of the Doe Network, where websleuths scour missing persons’ reports and coroners’ records in an attempt to find matches (Carlson, 2012), and the work of a lone websleuth who investigated internet scammers, contacted victims to warn them and passed information on to internet security contacts (Bradbury, 2007). We defined ‘spontaneous’ as short-term websleuthing in response to a single event, where aims were limited – for example, to identify a suspect or locate stolen property – and activity would likely cease upon aims being met. An example was the Find the Boston Bombers Subreddit. As both types of websleuthing can be carried out alone or in groups, we revisited the 88 articles which mentioned either solo or group websleuthing to determine which were organised and which were spontaneous. The largest proportion was organised group websleuthing (n = 28, 32%), followed by solo spontaneous websleuthing (n = 27, 31%), group spontaneous websleuthing (n = 22, 26%) and solo organised websleuthing (n = 10, 11%) (see Figure 10).

OPEN IN VIEWER

Figure 10.

Combinations of group and solo, organised and spontaneous websleuthing.

We also explored the activities websleuths were reportedly engaging in – there were 528 references to activities. We identified 17 different activities: analysing content posted by others, e.g. images, videos or documents (n = 82, 15.5%); looking for details or information (n = 72, 13.6%); discovering details or information (n = 70, 13.3%); identifying and/or locating suspects (n = 53, 10.0%); reporting findings to law enforcement or other relevant organisations (n = 46. 8.7%); sharing content with other websleuths (n = 38, 7.2%); commenting on and speculating around cases (n = 32, 6.1%); linking cases or details together (n = 26, 4.9%); launching campaigns or appeals for information (n = 22, 4.2%); extending activities beyond the internet, e.g. visiting places connected to cases or making enquiries over the telephone (n = 22, 4.2%); engaging or attempting to engage with suspects (n = 18, 3.4%); applying professional or specialist expertise (n = 16, 3.0%); baiting or luring suspects (n = 13, 2.5%); doxing (n = 7, 1.3%); engaging with or attempting to engage with victims or victims’ relatives (n = 6, 1.1%); delegating tasks to other websleuths (n = 4, 0.8%); and hacking (n = 1, 0.2%) (see Figure 11).

OPEN IN VIEWER

Figure 11.

Reported websleuth activities.

When considering activities alongside types of websleuthing, we noted some interesting findings. ⁴ Compared to reports of solo websleuthing, reports of group websleuthing contained higher percentages of references to analysing (19.2% vs. 12.2%), commenting (29.9% vs. 0%) and sharing 28% vs. 5%). In contrast to group websleuthing, reports of solo websleuthing contained a higher percentage of references to extending activities beyond the internet (6.9% vs. 2.7%) and reporting findings to relevant authorities (14.3% vs. 4.6%). The linking of cases and details was more prominent in reports of organised than spontaneous websleuthing (6.9% vs. 3.0%). Spontaneous websleuthing featured a greater proportion of references to identifying and/or locating suspects (11.2% vs. 8.6%), as well as extending activities beyond the internet (6.4% vs. 1.6%). Solo spontaneous activities were evident in the case of Edinburgh cyclist David Livey, who found an advert for his stolen racing bike on Gumtree, arranged to meet the seller for a test ride, then pedalled up to a police officer to report the crime (Anonymous, 2014). The case of a Reddit group who searched for the person responsible for leaking nude pictures of the actress Jennifer Lawrence highlights the clustering of activities around spontaneous group websleuthing:

Users of the reddit social networking service have been combing the web for clues and their suspicions soon turned on Bryan Hamade, a 27-year-old man from Georgia. Redditors claimed that screenshots posted by the leaker of the Lawrence photos showed network drives in the background which matched drives on Mr Hamade’s computer. In an interview Mr Hamade strenuously denied being responsible and said he was being bombarded with abusive phone calls and emails by internet vigilantes. (Sanchez, 2014)

Websleuth identities, motives and experiences

We discovered little quantifiable information relating to the socio-demographic characteristics of websleuths. This was not particularly surprising given the affordances of the online spaces involved. For instance, chat sites like Reddit allow members to post by anonymous username and despite social media spaces containing socio-demographic information in personal profiles (Baym, 2015; Chambers, 2013), followers of particular cases may number hundreds or thousands, and hence are unlikely to be explored in news reports. However, the sample did contain some insights into websleuths’ backgrounds. Some articles referred to professions, particularly those who drew upon their expertise whilst websleuthing. An article about the site Websleuths noted doctors, nurses, psychologists, social workers, teachers and prison officers among its membership (White, 2015). Another about the organised terrorist intelligence group 7Seas Global listed a lawyer, economist, security expert, judge, estate agent and private detective (Mitchell, 2004). Articles profiling solo websleuths noted a range of other professions including car salesman, paralegal, mortgage underwriter and computer programme designer. Beyond professional identities, family statuses were also noted – particularly regarding female websleuths as mothers (for example, Lightfoot and Morgan, 2012; Thomas-Lester, 2005). Websleuths sometimes expressed frustration at this emphasis upon their gendered roles, ‘Rossmiller is angry that some news reports have portrayed her merely as a “Montana mom”. “I am so upset about the press presenting me as this stupid little blonde woman patrolling the Internet”, she said’ (Harden, 2006).

We discovered 199 references to motive and 11 main motives: achieve justice or closure (n = 37, 18.6%); uncover new leads or information (n = 25, 12.6%); have been a victim of crime or affected by the type of case (n = 24, 12.1%); reclaim stolen property (n = 17, 8.5%); fascination with a case or type of case (n = 18, 8.0%); desire to assist victims or family/friends of victim (n = 13, 6.5%); sense of proximity to case (n = 11, 5.5%); take on a challenge (n = 11, 5.5%); protect people or things that matter to them (n = 8, 4.0%); prevent crime (n = 8, 4.0%); and to highlight injustices or alleged wrongful convictions (n = 6, 3.0%) (see Figure 12). Particularly poignant statements from websleuths emerged around the combined motives of fascination and justice. In relation to the JonBenet Ramsey case, a websleuth who set up a website for case news, tips and archives stated, ‘It’s hard to walk away … I want to see this killer caught and convicted’ (O’Driscoll, 2001). In an article about an organised group pursuing fraudsters, one member is quoted as stating, ‘When someone sends you something that they think is fake, it’s very hard not to do something. You can’t look away. It gets under your skin, I guess’ (Monroe, 2016).

OPEN IN VIEWER

Figure 12.

Reported motives for websleuthing.

We identified additional themes regarding the impact of websleuthing upon websleuths. One outcome was a criminal record – experienced by Toby Lopez, who served 14 months in prison when FBI counter terror agents imprisoned him in relation to his online communications with alleged terrorists (Shane, 2016). Financial losses were suffered by those who invested in computer equipment for their websleuthing and those who gave up their paid employment to create time for websleuthing (Bradbury, 2007; Das, 2007; Shane, 2016). Linked to this were effects on personal lives when websleuths became obsessed with cases. This included a neglect of personal commitments, a sense of obligation towards victims and secondary victims, unexpected feelings when cases were solved and receiving threats from people involved in cases. Extracts from articles exploring a number of these impacts and outcomes are included below:

This online detective work is his life. Most of his free time is spent in front a computer. ‘Everyone has obsessions of some type, but this is out of hand’, he says. ‘I worry that if I stop, I’ll lose track and I’ll never be able to maintain what I’m doing now, at this depth’. But while his online activities grow, his real life has suffered and his friendships have withered, ‘I’m in my 50s and most guys my age are married’, he says. (Bradbury, 2007)

‘Some people say it must be really exciting, but it’s more like a duty and a burden … it has taken a part of me that I will never have back – my privacy. I’ve tried to stop doing it but I can’t: I worry that I’m going to miss something and that other people will suffer and possibly die because of it. Maybe it’s become an addiction’. She shrugs, ‘I try not to think about that aspect too much’. (Das, 2007)

She stayed up all night, drinking Diet Coke and refreshing the site to check for new comments as the puzzle pieces came together. In less than a day, her makeshift blog got 100,000 hits. It was the first hint that what Wright had started might get beyond her control. (Monroe, 2016)

In the months since Mr. Callahan was identified as a possible match, Ms. Johanneck has served as an informal intermediary between the curious public and his relatives. ‘I can’t explain the feelings I get when talking to Jason’s family’ she wrote in April. ‘I spent years trying to find the family of Grateful Doe, only to find that ‘success’ is heartbreaking’. (Rogers, 2015)

Websleuthing and criminal justice

There were 131 references to comments or actions by criminal justice personnel. We identified eight types of comment or action: using information provided by websleuths (n = 37, 28.2%); listening to websleuths who contacted them (n = 27, 20.6%); warning about the potential negative impact of websleuthing upon the criminal justice process (n = 17, 13.0%); appealing for information in online spaces n = 16, 12.2%); thanking websleuths for their assistance in a case (n = 12, 9.2%); outlining the constraints faced in acting upon information provided by websleuths n = 9, 6.9%); acknowledging the presence of websleuths in the contemporary context (n = 8, 6.1%); and correcting inaccurate information circulated by websleuths (n = 5, 3.8%) (see Figure 13). Appeals for information often involved the disclosure or release of information relating to cases. This included photographs and videos – of suspects, stolen property, pieces of evidence relating to cases and even of unidentified bodies. It was clear that criminal justice personnel do sometimes thank websleuths for their assistance, most notably in relation to property crimes where stolen items are traced and suspects identified. One example was the case of Maryland websleuth Karen Todd:

‘She pretty much cracked the case’ said Prince George’s County police Detective Ray Gignac, who handles property crimes for the Bowie District. ‘She’s a pillar of the community – someone who takes a step forward to reduce crime. It’s pretty amazing’ … Prince George’s police plan to present Karen Todd with a special commendation. (Thomas-Lester, 2005)

OPEN IN VIEWER

Figure 13.

Reported types of comment/action by criminal justice personnel.

A consistent theme, however, was an emphasis upon the limits of websleuth assistance. Criminal justice personnel were often quoted stating that whilst websleuths had helped they had not solved a case. An example relates to a case where an organised group of websleuths claimed to have matched a missing Las Vegas man to an unidentified body in Utah, ‘But Sheriff Dale Stacey of Rich County, Utah, said The Doe Network “only helped find family members”, not identify the body’ (Shachtman, 2004). Linked to this, there appeared to be a general reluctance in many cases to even acknowledge that websleuths had in some way contributed to an investigation. One such example related to police in Australia posting pictures of items found with an unidentified murder victim on the police Facebook page. Despite many Websleuths members claiming to have identified the items, an article covering the case stated, ‘A NSW ⁵ police spokeswoman won’t say if the force uses Websleuths, adding, “Where appropriate, criminal investigations by police will include online inquiries”’ (Sutton, 2015). In addition, in relation to a group providing information about suspected terrorists, one article noted, ‘The FBI admits to being familiar with the organization. “The FBI is aware of this group but we can’t comment on their specific role”, FBI spokesperson Megan Baroska told the Star’ (Mitchell, 2004). The limitations upon criminal justice personnel in making use of information provided by websleuths was also a common theme – often focusing upon evidentiary thresholds and procedural policies. One case in point related to an officer’s comment about a group of websleuths who had traced and chased a suspected fraudster, ‘… the woman ran out the back. Police caught up with both women in a cobbler shop but let the suspect go. “They were chasing her based on her being a suspicious person”, Police Commander Newsham said, “We couldn’t arrest her for that”’ (Dvorak, 2002).

A further theme related to the potential threat that websleuths posed in relation to the criminal justice process. Notable here were comments relating to the additional work that websleuths created for these organisations – leading to more cases opening than being closed (Dewey, 2015). This also included impacts upon trials that collapsed after websleuth jurors researched cases online (Camber, 2010; Jacobsen, 2007; Norfolk, 2008). In addition, impacts upon suspects emerged as a key theme – particularly those who experienced unwelcome attention. One such case concerned Casey Nocket, exposed after allegedly defacing national parks with graffiti:

At times, things got ugly. Nocket’s social media accounts were posted to Reddit. A White House petition was started demanding that the Parks Service ‘pursue the most serious of charges for these offenses’. Nocket’s Tumblr was deleted, and then restarted by someone else as a troll account. A family member spoke with the hiking blog Trailmob, and said that they were concerned for Nocket’s safety. Some users started posting her home address, though others quickly chastised them. (Woolf, 2016)

The potential impact of websleuthing upon victims and secondary victims was also noted by articles in our sample. This mostly related to intrusion in their personal lives and attempts to contact them. One article referred to websleuths contacting the friends and families of suspects they were investigating, ‘via Facebook, sometimes angrily and other times just out of curiosity’ (Monroe, 2016). However, there were examples of positive outcomes – for example Kirsten Boucher, who engaged with the websleuths researching the case of her missing husband, ‘conversing with the sleuths has been a positive experience. Knowing other people care means a lot to her’ (Dempsey, 2014).

Conclusions

Within this article, we set out to address a range of questions about websleuthing. In this concluding section, we summarise our findings in light of existing literature and suggest directions for future research.

In relation to social identities, websleuths remain relatively mysterious. We know little about their ages, genders and ethnicities. What we can infer about social class is also limited, relying upon accounts of newsworthy websleuths. Our research does, however, suggest that they are motivated by factors in addition to those previously identified. Alongside victimisation and a desire to prevent the victimisation of others (Huey et al., 2013), we discovered motives that appear to embody infotainment witnessing and wound culture (Seltzer, 2007, 2008): fascination; immersion; feelings of proximity; the desire to participate in achieving the type of ending more commonly seen in fictionalised representations of crime; the prospect of discovering a new lead; the naming and shaming of a suspect; and justice or ‘closure’.

Websleuthing also appears more varied than existing literature suggests. Whilst vigilantism is evident in some websleuth activity, websleuths are far more than simply vigilantes. They adapt, adopt and create online spaces as places to gather, engage in discussion, conduct research, build case repositories and host content. In addition, websleuths do not only operate in organised or spontaneous groups (Campbell, 2016; Huey et al., 2013; Nhan et al., 2015; Smallridge et al., 2016). They also operate alone – often with a view to investigating a specific crime which has affected them as victims or secondary victims. Clusters of specific activities are associated with group and solo, organised and spontaneous websleuthing.

Websleuths investigate a wide variety of cases, including homicide, missing people, terrorism, property offences and sexual offences. Our study suggests that there is a disproportionate emphasis upon homicide. However, given the nature of our sample, it is difficult to ascertain whether websleuthing really does overemphasise violent crime – which would be consistent with Seltzer’s (2007, 2008) wound culture thesis – or whether websleuthing around violent crime is simply more likely to be reported because of the newsworthiness of this type of crime. This may also go some way towards explaining the dominance of high-profile US cases in our sample. Equally, however, overrepresentation of US cases could also be explained by the relative ease of access to some US case materials – enabled by databases such as Westlaw and public information acts in force in some states.

With regards to websleuth relationships with criminal justice, our study suggests that they remain mixed. Whilst there were some examples of positive interactions, the assertion by Huey et al. (2013) and Nhan et al. (2015) that these relationships are antagonistic also held true. Whilst criminal justice systems are increasingly encompassing online spaces in their appeals for information, this does not appear to be associated with better relationships with websleuths. Whilst criminal justice may draw upon information that websleuths provide, it seems that they often label websleuths as problematic: doing more harm than good; opening rather than closing cases; lacking understanding of procedural constraints; harming the criminal justice process; and having the potential to negatively affect suspects, victims and others affected by cases. In addition, websleuthing is not without consequence for websleuths themselves. For some, interest can turn into obsession, blurring the boundaries between their lives and the lives of others in which they have immersed themselves. Future research should more thoroughly critique the claimed successes of websleuths. In instances where they claim to have contributed towards solving a case – and law enforcement have acknowledged this contribution – which of their activities have been particularly valuable? Could it be that activities not requiring extensive training – scouring websites for stolen property for instance – might one day be ‘outsourced’ to such volunteers? Or could it be that only websleuths with specialist expertise will become part of formal policing structures? This was the suggestion by former UK Home Secretary Theresa May in her announcement of new police powers to identify Police Support Volunteers with professional qualifications in areas such as accountancy and computing (Home Office, 2016).

With regards to contemporary sense-making around websleuths, the articles in our sample took a range of different positions. Of note was the overrepresentation of positive articles in relation to property crimes, which was not evident when the cases being written about involved homicide. This suggests that journalists are making judgements about the appropriateness or inappropriateness of websleuthing in certain situations. Future research should explore the degree to which this is true more generally – both in terms of the views of the general public and among victims of such crimes. In times of austerity and police budget cuts, is taking the initiative on non-violent crime – or the law into your own hands –becoming increasingly acceptable?

We argue that websleuthing can be understood as an outcome of contemporary society’s networked and multidimensional true crime infotainment experience, a manifestation of the norms and values of digital culture (Trottier, 2016). However, in relation to websleuths’ identities, realities and impacts, there remain more questions than answers. In future research, criminologists should seek to further unpick the complex and diverse motives, choices, forms, activities, impacts and environments of websleuthing that this article has outlined. This will involve direct engagement with websleuths and the people and organisations affected by them. The methods for such enquiry will include both the traditional but also the newer ethnographic approaches tailored to a networked world. An example of such approaches are the virtual ethnographic or netnographic (Hine, 2015; Kozinets, 2015). Criminologists should continue to immerse themselves in the worlds of the people they study but should do so both online and offline – in acknowledgement that websleuthing and other such activities involving the internet are ‘embedded, embodied and everyday’ (Hine, 2015: 19).