This workshop introduces participants to advanced internet search methods, tips and tools, all under the umbrella of a technique known as “dorking.” Participants will learn and practice the technique across different search engines, while applying it to various investigation contexts. The workshop also includes tips on essential digital safety and privacy aspects relevant when searching, collecting and sharing information online.
Topic: advanced internet search methods and "dorking" operators, tips and tools.
- To introduce participants to advanced internet search techniques focusing on using search operators, reverse image search and other creative search options.
- To apply advanced search techniques and "dorking" across different search engines.
- To raise the participants' awareness of ways to protect their privacy while searching and discovering methods for checking online security vulnerabilities.
- Identify ways to make use of advanced search techniques in one's context.
- Use advanced search techniques.
- Use reverse image search techniques.
- Find out ways to protect safety and privacy while searching.
General guidelines for trainers
- This workshop can be divided into 30-40 minute long sessions. Breaks are not included in the timeline; you can decide when to allocate them based on your context. Between sessions, you can add a short break or a quick energizer activity.
- For group activities, divide participants into teams of 3-5 people. Please adapt times allocated to feedback and post-exercise discussions/debriefing based on the number of participants and size of groups. You can also encourage participants to assign various roles when working in groups. These roles can include Facilitator, Note-taker, Timekeeper, Presenter or Artist (if a visual presentation is required.)
- For online workshops, we recommend sharing a timer on the screen during energizers and small group activities.
- Whenever possible, adapt the workshop examples to the context of your audience.
Mode of delivery: online / in-person workshops
Workshop duration (without breaks): 2 hours and 40 minutes
Number of participants: 6 to 24
For online workshops:
- Video-conferencing platform of your choice
- Online polls and quizz apps (e.g. Slido, Mentimeter, etc.)
- Whiteboard application, (such as Mural, Miro, etc.)
For offline / in person workshops:
- computers for each participant or one per team
- flip chart paper
Related Exposing the Invisible guide:
- "Search Smarter by Dorking", Exposing the Invisible: The Kit.
Workshop activities and templates, to download:
Opening (15 minutes)
Read Watch Listen | 5 minutes
Grab attention by posing a question or commenting on a relevant topic, image, etc.
Introduce yourself and the goals of the workshop.
Optional: introduce the source of the workshop material (Tactical Tech)
Inform participants of the workshop agenda.
Suggest ground rules for the workshop: how you expect participants to act and react, respect each other, etc. Depending on the time you spend with the workshop participants, if you are running a longer training you could also consider working on a Shared Agreement or commonly agreed Code of Conduct (see suggestions in the ETI Facilitator's Guide.)
Participants' introductions / Icebreaker
Produce | 10 minutes
Facilitate a round of introductions by asking participants to answer a couple of questions about themselves, their work, their workshop expectations, etc.
Alternatively, you can pick an icebreaker exercise that encourages participants to get creative by drawing answers or ideas on an online whiteboard or, if off-line, stand up and perform some tasks. Check the Icebreakers section in the ETI Facilitator's Manual for inspiration.
Introduction to "Dorking" and advanced online search (25 minutes)
Read Watch Listen | 15 minutes
[10 minutes] Detailed case study:
Tell the story of this investigation while pinpointing the different methods that were used: "Locating the Netherlands' Most Wanted Criminal by Scrutinising Instagram", by Bellingcat.
Provide brief background to the story and why the investigation was needed.
Focus on the research steps conducted by the investigators.
Detail the methods used, note the key methods such as use of search operators, reverse image search, crowdsourcing on social media.
Specify the main tools and how they were used in the context.
Give some clues but also ask participants to suggest solutions, and sometimes stop to ask participants "how would you do this?" before disclosing the next investigation steps or findings.
[5 minutes] Briefly explain what "(Google) Dorking" is.
Introduce different examples and cases of advanced search techniques.
Adapt examples to the context of your audience as much as possible.
Collaborate | 10 minutes
Divide participants into small groups and ask them to discuss:
- "How is dorking relevant to your work?"
Share the points on a shared (online) whiteboard / flip chart paper.
How Dorking Works (30 minutes)
Read Watch Listen | 10 minutes
Prepare and give a presentation including:
Briefly introduce "Search Operators" (also called "dorks"): definition and purpose/use.
- Use this table for reference and also show other resources (for example: https://neilpatel.com/blog/google-search-operators/; https://moz.com/learn/seo/search-operators).
Provide a few examples of dorks.
Emphasize the fact that even if two search engines support the same operators, they often return different results - it is important to know why as this influences the effectiveness of the technique:
the same search engine can return different results based on the location where the search is carried from, or
two different search engines from the same location, using the same search operators, can return different results because they might use different search algorithms, etc.
Search Operators Cheat Sheet
Investigate | 15 minutes
Divide participants in small groups of 3-5 members, using online break-out rooms or separate areas/tables in the workshop space (if offline).
Ask groups to create their own 'Search Operators Cheat Sheet' used with Google, DuckDuckGo, Yahoo and Bing by completing a table of search operators (template available below).
The table includes a column with the search operators / "dorks" and a column for describing what each operator does.
Some elements are missing in the table, and participants have to identify the missing parts and complete the table. They will need to use it for a quizz during the next activity.
- Highlighted parts can be left empty for participants to fill out.
- Search Operators Cheat Sheet (Word file - the table can be downloaded and shared online for editing, or printed for in-person workshops)
Return of a Dork
Discuss | 5 minutes
Following up on the previous activity, run a quiz with all the participants.
Ask a series of questions and by raising hands, representatives of different groups (from the previous activity) can answer based on the cheat sheet they filled out.
Questions can be in the following formats:
- What will this "xyz" dork return?
- What dork to use to return "xyz" information?
Bonus: How Reverse Image Search Works (15 minutes)
Reverse Image Search
Read Watch Listen | 5 minutes
NOTE: Reverse image search - a search conducted by image instead of text in a search engine - is used together with advanced text search techniques and connects to "dorking" in that way. As a trainer, you can decide whether to include this section in the workshop as an additional skill, or not.
Introduce what Reverse Image Search is.
Introduce the different tools available and demonstrate their use with an image of your choice:
Practice: Searching by Image
Practice | 10 minutes
Divide participants in small groups.
Show a series of pictures of places, people, items on a shared (online / projected) whiteboard and ask participants to find-out "What / Where / When / Who is that?" through reverse image search.
If online, upload the images to a public cloud storage and provide the links to participants to download and search.
Let's Dork! (40 minutes)
Activity: Dorking Scavenger Hunt
Collaborate | 25 minutes
Divide participants in small groups of 3-5 members.
Assign a series of missions for the groups to complete within 20-25 minutes.
The missions can include advanced searches across different search engines to find a list of items such as:
- a specific image with an exact size,
- a list of house prices in a certain location,
- a document related to local public spending in selected areas,
- a .pdf report on air pollution levels in a certain location,
Check on each group's progress during the activity.
NOTE: You can adapt this list of items based on your participants' context and needs, trying to give tasks that may be relevant to their interests or expectations.
What worked, what didn't
Discuss | 15 minutes
Upon return from their group missions, ask a representative of each team to share their findings with the rest of the groups, answering the following questions:
- Which search operators did you use? What worked well what didn't?
- What did you find that was interesting?
- Did search results differ across search engines? If yes, how?
Provide feedback and tips as needed.
Safety First! (15 minutes)
Read Watch Listen | 10 minutes
Prepare and give a short presentation on precautions to take before using dorking as an investigative technique including the following points:
Be aware of legal issues - dorking can result in retrieving documents that may not be meant for public access.
Use the Tor Browser when applicable - take care however, since it's difficult to use with some search engines and may be illegal in some countries (trainers need to check where this is the case in their participants' context)
Use a VPN (Virtual Private Network)
When at risk, choose privacy-aware search engines such as:
- "Safety First!" Guide, Exposing the Invisible: The Kit.
- "Search Smarter by Dorking" guide - "to dork or not to dork" section, Exposing the Invisible: The Kit.
Read Watch Listen | 5 minutes
Prepare and give a short presentation on "Defensive Dorking" including the following points:
Checking for security vulnerabilities.
Looking for sensitive information.
Dorking yourself (and why that is important/useful).
- "Search Smarter by Dorking" guide / "defensive dorking" section, Exposing the Invisible: The Kit.
- "How to Dox Yourself", by Kristen Kozinski and Neena Kapur, the Global Investigative Journalism Network (GIJN)
Closure (15 minutes)
Wrap-up Activity: Takeaway Poster
Produce | 5 minutes
- Shared drawing pad / slide / whiteboard (online)
- Whiteboard / flip-chart paper, post-its, markers (offline)
Ask participants to create a takeaway poster by sharing their answers to the following question in the shared whiteboard / drawing board:
- What are your main takeaways from today's workshop?
Give participants a few minutes to write and/or draw their thoughts and read the thoughts of others.
- Review and highlight some of the points on the shared board.
Read Watch Listen | 5 minutes
Wrap up the workshop and sum up its contents.
Run a quick review of the session. Each participants would say:
- one thing they found very good about the session and
- one thing they would improve for the next time
You can encourage participants to ask questions or give some final tips.
Share contact information if relevant, and any follow-up details.
To keep participants informed about what is going on at all times, trainers can effectively sum up workshop contents following these steps:
- [in the introduction] tell participants what is going to happen;
- [during each part of the session / workshop] remind them what is happening;
- [at the end of the session/workshop] tell them what just happened. In addition, at the end, trainers need to make sure they point out which expectation have been addressed.
Please reach out to us at Exposing the Invisible if you:
- have any questions about this workshop plan and facilitation guidelines,
- use this workshop plan and want to share feedback and suggestions that can help to improve them,
- adapt the workshop plan to a specific context and want to share the results with us,
- want to suggest new activities, tips or examples that can be added to this workshop,
- want to share your expertise and collaborate with us on developing and testing new workshops.
Contact: email@example.com (GPG Key / fingerprint: BD30 C622 D030 FCF1 38EC C26D DD04 627E 1411 0C02).
Credits and Licensing
CC BY-SA 4.0
This content is produced by Tactical Tech's Exposing the Invisible project, and licensed under a Creative Commons Attribution-ShareAlike 4.0 International license
- Workshop authors: A. Hayder, Laura Ranca, Wael Eskandar
- Instructional design: A. Hayder
- Editorial and content: Christy Lange, Laura Ranca, Wael Eskandar
- Graphic design: Yiorgos Bagakis
- Website development: Laurent Dellere, Saqib Sohail
- Project coordination and supervision: Christy Lange, Laura Ranca, Lieke Ploeger, Marek Tuszynski, Safa Ghnaim, Wael Eskandar
This resource has been developed as part of the Collaborative and Investigative Journalism Initiative (CIJI) co-funded by the European Commission under the Pilot Project: "Supporting investigative journalism and media freedom in the EU" (DG CONNECT).
This text reflects the author’s view and the Commission is not responsible for any use that may be made of the information it contains.