TORONTO — Investigators will look into everything from the time of tweets, to the browser used, and even the proximity of IP addresses to Bryan Colangelo’s house to determine if the Philadelphia 76ers president is responsible for five burner Twitter accounts linked to the team, says cybersecurity expert Theresa Payton.
"It’s almost like old-school detective work, it just happens to be digital," said Payton, a former White House CIO.
The Sixers have launched an investigation into whether Colangelo used a variety of Twitter accounts to anonymously trash some of his own players and fellow executives, including Toronto Raptors president Masai Ujiri, and defend himself against criticism from fans and the sports media.
Payton, the CEO of the security consulting company Fortalice Solutions, says investigators will used what’s called link analysis to find distinguishing patterns.
"If you start to observe a pattern of life as far of these Twitter accounts go, time of day, the browser that’s used, which Twitter would know, the type of device — was it a mobile or was it a desktop or laptop? — which Twitter would know," Payton explained.
"Based on the email accounts tied to the Twitter account, are there different login attempts? What time of day? Are those email accounts used different places? So you start to do link analysis across the patterns of life that each of these seemingly disparate accounts have, and then you may find something in common.
"You may find an IP address attached to that Twitter log-in and track that down and find out it’s a coffee shop next to the suspected person’s house. Now you have some linked analysis that says’ Well, whoever’s posting this, if it’s not him or her, there clearly is a geography."’
The Sixers hired an independent law firm to probe allegations reported last week by the sports website The Ringer. Reports claim the Sixers may fire Colangelo. Other reports have linked Colangelo’s wife Barbara Bottini to the allegations.
Payton said investigators will be able to say whether or not Colangelo is behind the Twitter accounts.
"If it’s not (Colangelo), and it’s not somebody in that circle of trust in the team, then it becomes harder (to pin down the source), but not impossible to do."
She said, depending on how long the Twitter accounts were in existence, and the sophistication of the person tweeting, investigators can determine the source of the accounts in as few as 48 hours.
"Or it could take longer than that if you’re going to take something to court … to make sure you’ve got an air-tight case," she said.
Payton read The Ringer’s story, and said her "heart went out to the players" involved.
"Because there was some very not nice things said, things toward crossing that line into physical threats … as well as potentially medical information being disclosed. And all of that is not OK," she said. "But then I thought, depending on the individual or individuals behind this, they’re going to figure out who did this. Because clearly what’s being posted crossed that line."
Sixers players Joel Embiid and Markelle Fultz, former 76ers GM Sam Hinkie, Ujiri, and former Sixers players Jahlil Okafor and Nerlens Noel were among the targets of harsh or critical comments on those Twitter accounts. Colangelo has acknowledged using one of the accounts to monitor NBA happenings.
The accounts levelled scathing criticism at Ujiri.
"Ujiri was supposed to be the game changer instead he has been a trust fund baby, he has lived off what was let here and those players GOT OLD while he was evaluating," was just one of the tweets.
Payton, meanwhile, stressed the seriousness of cyber offences, pointing out that cyberstalking harassment laws in many states carry a penalty of fines and even jail time. She says its imperative to preserve evidence in these cases.
"Often people will delete things or they’ll turn off their phone … Evidence is key. Take screen shots. Don’t unplug, and call somebody to help you immediately."