Unmasking the Social Engineer: The Human Element of Security

Chapter 8

The Nonverbal Side of Elicitation

Feelings are much like waves: we can't stop them from coming, but we can choose which ones to surf.

—Jonathan Martensson

I define elicitation as the act of getting information from someone without asking for it directly. This doesn't mean you don't ask questions, and it doesn't mean you don't ask for information. Military and intel folks, living acronyms, often joke about “ASKINT”—Ask Intelligence: “If you ask them, they will tell you!” It's all about how you ask about or around the issue. It means you employ techniques to gather this information from people. I usually refer to the techniques in Robin Dreeke's book It's Not All About “Me”: The Top Ten Techniques for Building Quick Rapport with Anyone. In that book, Dreeke outlines 10 principles for building rapport with anyone; these are the keys to elicitation:

• Artificial time constraints: Using simple phrases—such as “Can I ask you a quick question?” or “I have to leave in five minutes, can I ask you a quick question?”—leaves the subject feeling more friendly about talking with you.
• Accommodating nonverbals: If you're saying that you're worried or sad and you're showing fear or anger in your nonverbals, then the subject will feel that incongruence. They may not understand why, but the red flags go up, and they feel uneasy. It is important that our nonverbal displays match the story.
• Slower rate of speech: The faster we talk the more prone we are to error, the more we sound like we ...