footnote4a

Mass surveillance, government contracts, and other bedtime reading.

Update: Account sharing now scored by hours covered

The account sharing report now reports how many hours of the day an account covers, instead of a raw entropy figure, and drops operators with too few searches to score.

by Have I Been Flocked Team
3 min read
feature
audit-logs

The Account Sharing Candidates report now leads with a coverage figure: how many of the day’s 24 hours an account’s searches span, weighted by how much work happens in each hour. The entropy number that used to lead the report is still there, in a second column.

#What was wrong with the old number

The report was introduced in Feature: Search Anomalies and Account Sharing. It scored each account by the Shannon entropy of its hour-of-day search distribution and compared that against the theoretical maximum of 3.18.

Entropy is logarithmic, and the report scaled it linearly. That compressed the results. Consider an operator running 100 searches an hour through a 12-hour day shift and 10 an hour overnight — ten times as much work by day as by night, which is what a day shift with some after-hours activity looks like. That account scored 2.79 out of 3.18, or 87% of maximum, and the report colored it orange.

#Hours covered

Exponentiating the entropy undoes the compression. The result is the number of hours that, covered evenly, would produce the same distribution.

Hours Covered=eHCoverage=eH24\text{Hours Covered} = e^{H} \qquad \text{Coverage} = \frac{e^{H}}{24}

The day-shift operator above covers 16.3 hours. An account used evenly around the clock covers 24. Here is the same set of patterns under both measures, all at identical total search volume:

PatternEntropyOld scoreHours coveredCoverage
Even across all 24 hours3.1780.9924.01.00
2× day volume vs. night3.1210.9822.70.95
5× day volume vs. night2.9350.9218.80.78
10× day volume vs. night2.7900.8716.30.68
8-hour shift, light overnight trickle2.1900.688.90.37

With that change, the rankings remain the same but the classifications are changed:

CoverageClassificationMeaning
< 0.70Elevated ⚠️Broad, but the day/night split is still visible
0.70 – 0.90Anomaly 🟠Close to round-the-clock
≥ 0.90Critical 🔴Effectively uniform across all 24 hours

#A minimum volume

Operators with fewer than 240 lifetime searches are no longer listed.

Entropy says nothing about sample size. An account with 24 total searches, one in each hour of the day, scored a perfect 3.18 — the same as an account with a hundred thousand searches spread evenly around the clock. With that little data the hourly counts are noise, and the distribution they describe is not evidence of anything.

The threshold works out to roughly 10 searches per hourly bucket. The candidate count on the report dropped as a result. This follows the same reasoning as the low-volume gate already applied to the Search Anomaly Index.

#Entropy is still published

The entropy column remains in the report and on operator pages, so figures cited in earlier posts — including the 2.710 in the Georgia misuse analysis — can still be checked against the site.

As before, high coverage identifies candidates for investigation and does not prove account sharing. A 24/7 dispatch operation legitimately covers all 24 hours. Results should be reviewed in context, and the methodology panel on the report page shows the full calculation.

Reach out to humans@haveibeenflocked.com with any questions or concerns.