ELICITATION TECHNIQUES

Covert Information Collection From Human Sources

„Well, I’m not really supposed to share this, but…”
Plentiful social engineering and HUMINT attempts that aim at information collection lead the subject to share a phrase like this (followed by something that is often important or sensitive). It happens when the target has finally reached a point where they want to share information, although they know they are not supposed to.

This is good. But there is something more powerful.

That is when elicitation agents lead a person to volunteer information without them even realizing they have just shared something important, sensitive, or confidential.

By definition:

Elicitation is an effort in which a seemingly normal conversation is contrived to extract (sensitive) information.

Elicitation techniques are conversational techniques that trigger subjects to divulge information.

In social engineering attack simulations, I have utilized elicitation techniques and pushed the boundaries of this discreet information collection strategy. I have seen how far this can go. In this process, there have been two main observations:

1. People are often completely unaware of the value of the information they share.
2. People are often completely unaware that the woman they are having this light and fun conversation with is trained in covert information collection.

But I am still in the business of security. I end up in rooms with select teams where I deliver counter-elicitation training, which I now find crucial to security awareness. In these rooms, participants are taught to detect elicitation attempts and expand with the realization that not everyone who is likable is also trustworthy or has their best interest in mind.

Last, my work with law enforcement and government employees countering crime and dealing with human sources has also made clear that elicitation techniques provide an incredible advantage when they can (or are allowed to) use them to solve crimes or maintain safety within a community.

So, let’s talk about elicitation:

• What it is and why it works.
• The top 3 universal human tendencies that make it work.
• 3 highly effective elicitation techniques (+ 1 unexpected one).

This blog is only a small but useful introduction. There is a lot more to be said on this subject regarding the psychology that makes this process work and many more elicitation techniques. But if we were to cover it all, the article would turn into a small book, or a small class.

Let’s dive right in; I will try to keep this short and to the point.

What Is Elicitation?

Elicitation is a conversational methodology used to gather information discreetly. In simple terms, it is seemingly regular discussion but with a specific purpose: to collect information that is not readily available without raising suspicion that specific facts are being sought.

The techniques are usually subtle, non-threatening, easy to disguise, deniable, and effective.

The conversation can be in person, over the phone, or in writing. It often resembles a regular social or professional conversation, like those taking place at networking events…

There is a process and a compound effect in elicitation. You can learn the techniques, but you will need to work on the skill.

Still, it demands some prerequisites:

• A basic understanding of human nature
• Rapport building skills
• Decent interpersonal communication skills

Understanding certain human characteristics enhances an elicitor’s confidence, preparation, and execution. However, it also enhances self-awareness when it comes to defending against these techniques.

But why do people talk? Which psychological principles interplay in a conversation, and what makes them decide to reveal sensitive details (intentionally or unintentionally)?

Human Tendencies; Why Elicitation Works

Human behavior is a complex maze, but you can create some predictable routes if you learn enough about it.

Here are the top 3 behavioral tendencies that I have observed during elicitation attempts:

1. People tend to talk about things they shouldn’t if it makes them feel significant.

They want to appear cool, smart, or important. At the same time, they may not realize the value of information they share. Subtle admiration on the elicitor part makes the subject’s reward neurons fire — a biopsychological response that is highly addictive and urges them to keep sharing more. We all have a need for recognition. But some have it more than others.

2. We feel the urge to correct untrue statements or defend our opinions.

It comes from a natural tendency to be right and to prove your knowledge when you hear something untrue. To “set the record straight”. This is a particularly powerful tendency.

3. We tend to think poorly when we are excited.

Excitement often shadows critical thinking and interferes with the mental filtering of the information people receive or disclose. People tend to want to stay in a state of excitement, and they do that by expanding on the topic they are enthusiastic about -especially when the elicitor also offers appropriate encouragement. Other times, they may share something they shouldn’t in the flow of the conversation.

These are some basic underlying principles that we can keep in mind. We all share these tendencies to a degree. Like mentioned earlier, these are not the only behavioral characteristics we share that are important for elicitation, but they are certainly some of the most frequently observed ones.

Elicitation Techniques

Typically, we do not start a conversation directly with an elicitation technique. Only in very few, provocative occasions.

In most other cases, elicitation techniques are injected into a discussion after building a certain level of rapport with the subject.

An elicitation conversation will often start with very harmless, non-sensitive topics. Progressively, it may touch subjects that are more sensitive to discuss. Specific topics of interest may be brought up momentarily, and then the conversation can fall back to more unsuspecting areas of discussion again. It is a science, but it is also an art. In all cases, the elicitor closely observes how their subject responds and adapts their approach (or persistence on a topic) accordingly.

Tip: The more sensitive the information we inquire about, the more important it is to avoid using direct questions. Instead, use statements.

Here are the 3 highly effective techniques:

• False Statements & Citing Sources

When the conversation has been steered to an area of interest, the elicitor starts making (false) statements and citing external sources.

It may sound something like the following:

“I was reading in an article the other day that your company will proceed with XYZ financial strategy…” (when inquiring about a company’s next steps)

“I follow an accomplished security leader on social media and he was saying that XYZ technology is state of the art in physical security and it is completely unhackable…”

False statements trigger a need to correct them and “set the record straight”. The conversational partner is getting the satisfaction that they are demonstrating knowledge and feel significant (especially on topics of interest the other person is actually knowledgeable on).

• Leading Questions

Questions that can be answered with a quick “yes” or “no” statement but contain at least one presumption. In many cases, the answer will expand into a lengthier response.

“So you basically also worked on developing those famous infrared sensors before you left that company?”

As opposed to: “What were your responsibilities at your prior job?”

• Macro to Micro:

Elicitors may start a conversation on the macro level and then gradually guide the person toward the topic of actual interest.

For example, they may start talking about the economy, government spending, and potential defense budget cuts …

…and then:

“Well, it is only logical that the X program will be affected if there are budget cuts!” (leading statement)

After observing their conversational partner’s response (including nonverbal indications), a good elicitor will either stay a little longer on the topic or start reversing the process, taking the conversation back to macro topics to conceal their interest. They may return to it later from a different angle.

Alright, here is a bonus one, with an example that happened recently:

• Silence

Yes, this is an elicitation technique, also called a “strategic pause”. You will need to become comfortable with silent pauses whether you want to defend against elicitation or be the elicitor.

Silence is inherently uncomfortable for most people. Especially when you do not know each other very well.

Once the elicitor is on a topic they want to learn more about, a silent moment will trigger the other person to fill in the gap by expanding on the topic.

In a recent engagement, I was having small talk with a subject when we started discussing how tedious traffic in the area is, causing me to arrive late at work the previous day…and how I got further delayed by those tedious new security mechanisms that were recently installed at our offices (remember the macro-to-micro technique).

Their response:

Them: — “Ugh, I know. I just can’t be convinced this complexity is needed. I find some security procedures ineffective, that’s all.”

Me: — “…”

Them: — “For example, I do not even bother badging in anymore, I just go through this side door we have…”

You can bet we looked for that side door later.

This is a particularly powerful technique when employed at the right moment. It’s used in intelligence gathering, negotiations, and even interviews, but many people overlook its simplicity and impact.

We are just scratching the surface. As with any powerful skill, it comes with a dual responsibility. Elicitation techniques can be extremely useful (when used appropriately and for the right reasons — e.g. in criminal investigations), but also extremely dangerous (e.g. in social engineering attacks).
Whether in law enforcement, corporate security, or negotiations, awareness and education about elicitation techniques are vital to safeguarding sensitive information and building a more secure environment.

Want to know more?

To expand on the topic, you may access our on-demand online class on ELicitation Techniques. To learn about 15 different elicitation techniques, you may join the class at: https://digital-trails.academy/p/elicitation-techniques-covert-information-collection-from-human-sources

If you have questions or work with a team that can use counter-elicitation training, you may also contact me on LinkedIn, X, or Bluesky.

Thank you for reading, and stay safe!

xxx