We’ve been talking about how to understand your own core motivators, and how those can be used against you. I offered an example of how someone who needs to feel important, for example, can be encouraged to give away information simply by pressing the right buttons. Today we’ll go more in depth on that, and enter the basics of the elicitation world. Not only should you recognize it when someone is doing it to you, but you should also be able to perform the skill yourself, at least in a general sense.

What is Elicitation?

The word “elicit” literally means to draw out, to provoke. Elicitation stimulates someone into reacting the way you want them to. That could apply to information, but it could also apply to action, if you’re looking to draw out a specific reaction (or trying to start a chain of events). In the intelligence world, however, it’s usually used to describe a conversation that has a point; your target thinks they’re simply being chatted with, but you’re working them and gathering information.

In an information setting, you’re looking to collect data that can be refined, through the intelligence process, into actionable intelligence. (It bears repeating here that not all information is intelligence; you’ll often see people referring to raw information as “intel,” and that’s not how this works. We’ll talk about the intelligence process in a later article.) In an action setting, you may be looking to push or pull someone in a direction, affect their decision-making process, or otherwise influence them to take an action — or NOT take one — based on your own desires or goals.

Sometimes elicitation is completely accidental or unintentional. We’ve all known that person who somehow manages to tell you their life story when all you did was ask how things were going. Or the guy at the range who answers your “nice rifle” comment with a soliloquy on its origin, where he got the parts, where he built it, and the fact that his two brothers, one of whom works in the local body shop, are planning on building one too. Sometimes you walk away from a conversation asking yourself, “Why did they tell me all of that? If I were X, I could do Y with that information.” In situations like this, keeping in mind our work on core motivators, we can already see holes in those people’s defenses and how we can leverage them if we needed to.

Sometimes, however, elicitation is a very deliberate process that we engage in, and in order for it to work in our everyday lives, we need it to not be obvious to the person we are trying to influence or elicit information from. In fact, if you’re good enough at it, your target will never know what you’ve done, because you’ve couched your work in casual conversation. In situations where a direct question would expose your intentions or alert them that you want information you should not have, elicitation can help you basically “massage” the information you need out of your target. It’s used in social engineering, business, computer security, sales, and a wide variety of situations. To some extent, you’ve probably already done it in your everyday life. There’s a difference, however, in trying to elicit information from your teenager about where he was last night, and recognizing when an informant or other actor is trying to elicit information from you.

Why Should You Care?

Elicitation isn’t something you can readily spot every single time without training and practice. Unfortunately, the “soft skills” are often pooh-poohed in favor of more pew-pew; in reality, both are quite necessary. I like to put it this way: There are people out there whose ability to provide for their families rests on their ability to elicit information from you, influence your decision-making, and/or otherwise screw with whatever you’re involved with, and they’ve spent far more time training in how to do it than you’ve spent training in how to spot and defend against it. Never underestimate what someone is willing to become good at if it means feeding their kids. In short, if you don’t know how to do it, or choose not to pay attention to it, not only are you behind the curve on your own skill set, but you’re basically easy pickings for someone who is good at it and may have shady motives.

How it Works

Ten times out of ten, you’re not going to simply ask for the information you want. You’re going to talk around it, or discuss peripheral things, or even discuss anything BUT the subject you’re interested in. Your goals are as follows:

  1. Get the information you’re actually seeking.
  2. Get information that allows you to deduce what you’re actually seeking.
  3. Get information that will allow you to approach someone else for what you’re actually seeking.

The biggest thing to remember is that elicitation doesn’t usually ask questions. People remember questions; they don’t, however, remember every bit of a casual conversation, and the more casual it is, the less they remember. The whole point here is to encourage them to talk and give you information without you having to ask for it.

There are quite a few tactics and approaches you can use to get things moving, and if you time them right, you’ll be able to move them through the chess board at your discretion.

A Few Tactics

Correcting the Expert — This is what I talked about in the previous article. When you’re dealing with someone who is knowledgeable about a subject or possesses information you want, AND you sense that they need to be right or feel important, you can often leverage that. If they mention something you want them to expand on, you simply correct their information. They may not be able to resist the urge to set you straight.

Recognition/Appreciation — People often love to be recognized for what they do. A compliment about an achievement or skill can go a long way toward rapport building and sharing, especially if it’s followed up by an open-ended question (How did you manage to pull that one off? etc.).  Beware, however; if you overplay this or seem to gush about things to them, they may get uncomfortable and/or think something’s up. The idea here is not to be a fanboy.

The Complainer — Humans love to complain…more importantly, they love to be heard. By tapping into whatever they’re annoyed about you can get them to talk. People generally talk about work more than home unless you have a rapport already built up, but in certain cases you can use the work complaining to pivot into the home stuff or group stuff, or vice versa.

Passion and Overemotion — People love to talk about things they’re passionate about, which is good for you if you want to know something about it. Rather than go into detail about how well this works, I’ll simply say that I had a group leader tell me once — in front of other people — his entire group’s structure, hierarchy, and who did what job, all because the subject of security came up and he got excited about all the new things they had just implemented…to become more secure.

You’ll need to pay attention to a lot of different things while talking to people; everything from facial expressions (some of which will only register for 1/25th of a second and may be as subtle as the slightest twitch of the corner of their mouth) to their overall body language to their tone and responsiveness — and you have to do all of that while pretending not to notice any of it, because it’s supposed to be a casual conversation. You can also do this online or over the phone, depending on your needs and the situation; in those cases tone, word choice and other verbal cues are even more important because it’s all you have. All of this requires practice, and time, and attention.

There are many, many more of these, but this will get you thinking about how to best go about things.

Need to Know

This is why your critical information analysis is so important. You need to know not only where the lines are around your critical info, but also where someone can piece together snippets from here or there to eventually get to what they actually want. Keep in mind that intelligence isn’t usually a sprint; it’s a measured, logical, sometimes painstakingly slow process in which you are putting together a jigsaw puzzle. Sometimes pieces sit off to the side for days, weeks, or even months until you realize where in the puzzle they go, so while you might be religiously guarding the fact that you have an entire box full of unmilled 80% lowers, it’s probably also a good thing to not get into a casual conversation about how Polymer 80 has fantastic customer service, and then a month later excitedly mention that oh, by the way, you picked up an awesome drill press the other day at an estate sale. Use your brain, and think five moves ahead whenever possible.

Wrapping Up

This isn’t meant to be an entire dissertation on the topic of elicitation, or INFOSEC, or leveraging. That’s why it’s titled 101. There are many resources on the internet that can help you learn more, and I’m pretty sure you can find them. One book I can recommend is Social Engineering: The Science of Human HackingAgain, it’s not the be-all, end-all on the topic, but it’s a solid beginning. The point is to get familiar with the tactics as they’re practiced, and maybe start practicing them yourself.

Liked it? Take a second to support us on Patreon!
Share this: