Investigative Journalism and Digital Threats in 2024 Elections

hello everyone and welcome we're going to get started thank you for joining us um so this is a global investigative journalism Network webinar and today we are talking about uh investigative journalism and digital threats in the 2024 elections uh I'm your moderator my name is Craig Silverman I'm a reporter with propublica and I do a lot of work covering disinformation and other related topics I'm also one of the instructors for G's digital threats uh training sessions which we are accept ing applications for so if you want to learn more about that take a look at

the gjn website um so the topic of this webinar is very timely because uh during during this year thousands of journalists from all over the world uh have been and will be reporting on and investigating the impact of growing digital threats like disinformation spyware trolling digital violence um happening in elections all over the world and so we're here to share ideas strategies and Techni te for investigation which is particularly critical given that there are more than 60 countries having elections this year which is pretty unprecedented um so in this webinar we have leading journalists and

experts who will share tips and tools about how to better expose the individuals and organizations behind disinformation campaigns uh I'm going to introduce today's speakers um but again just to note Gan has a digital threats train training program uh it is free you can apply and it is open right now for applications um this is our third group of fellows that we will welcome from around the world and you have until March 24th in order to apply um so we're going to put the link to do that into the chat box so have a look

for that um and we will continue on uh by introducing today's speakers um so I'm going to introduce them in the order that they will be speaking um each of our presenters will have about 10 minutes to kind of take you through um some examples some case studies some tools and then we will have some discussion and we will also open things up for questions at the end um our first speaker will be prian Jana benani who is the to computational journalism fellow at Columbia's Columbia University's to Center for digital journalism um her work focuses

on using computational techniques to research the digital media landscape this includes partisan local news and the intersection of platform companies with the media um second we have Malik hrawi he is a journalist trainer and publication director of inif a Tunisian magazine dedicated to investigative and long form journalism he's also the executive director of alcat a nonprofit organization that supports independent journalism and provide solutions for creating impactful journalistic content um he's also a consultant for several National and international organizations working in the field of training and media support and our third speaker will be Maria Teresa

rondos she is director and co-founder of the Latin American Center for investigative journalism um she has coordinated crossb investigations in the region on issues including migration corruption disinformation and religious organizations uh she has been a reporter and editor for several Colombian media Outlets and has published her stories in Brazil Argentina Mexico chile and Spain um so before we get started obviously we are hosted and brought here today by GN the global investigative journalism network if you're not familiar with it it is the largest global Network for nonprofit investigative journalism organizations there are 250 member organizations

in 91 countries it also works with journalists everywhere in nonprofits in commercial organizations and also with Freelancers and G has an extensive range of resources and tip sheets to help journalists worldwide which you can check out on g.org and that again is also where you can apply for the digital threads fellowship or take a look in the chat or the link to do that um we are very lucky today because we have live interpretation that's uh we're going to be speaking in English but it's going to be available also with inter interpretation in French Russian

and Spanish um and back so if you would like to use these services please click on the interpretation button which is at the bottom of the zoom screen and just select the language that you prefer and you will start to hear the interpretation and as I mentioned earlier we want to hear from you um so there is a Q&A box that you can also see in the zoom menu so please use that not the chat use Q&A box and you can submit your questions in writing um these questions will be read out by gan's uh

Andrea araba she will moderate the questions and bring them to the speaker so you do not have to go on camera you do not have to read out your question you can use that Q&A box um and submit it and the last thing for housekeeping is just please note that we are recording this session it will be posted later on YouTube okay so that's all the information for you um so let's get started uh prian Jan why don't you kick us off and please go ahead thanks cig hi everyone it's nice to be here today

I'm going to share my screen and hope technology works because what I'm going to do today is promly focus on a version of a presentation I recently gave with John Keegan of the markup at Nar a couple of weeks back which focuses on who's behind the website and want to kind of talk at the high level about a bunch of things and then kind of look at a case study in terms of how these tools work want to kick it off with just basically saying that a lot of the tools that we've been using for

a few years now are either breaking or they no longer exist or we have to find alternatives to them Google cash being one of them I don't know if everyone over here has noticed but Google search or Google Docs in general are less reliable and by DS I mean like the search operators you can use like and or or site specific searches they just don't work as well as they used to Facebook Scout tangle is going to be retired on August 14th about 12 weeks before the US election so I'm sure everybody's really looking forward

to that um some really useful DNS litics tools and we'll talk about what some of these tools are further down they've been moved to Legacy um and through all of that what you kind of have is more platforms conversations migrating to you know closed channels like or Whatsapp which especially true in Brazil and India and it's also just easy to conceal identities I only recently learned that it's really easy to create a company with a false identity and no one will know so you know it's just like it just makes our work a lot harder

and because of this it's just really important to think that actually this should be the other way around it's techniques over to it's not tools over technique sorry about that but yeah it's like there too many tools that'll overpromise they underd deliver they they're expensive and lot of these tools kind of just literally do contribute to the erosion of privacy and you know it's like hey maybe we should be investigating some of these tools and how they get data not like using them and being underwhelmed by the results they return um before we kind of

just get started really quickly every investigation you're going to have a different threat model um and you don't you need to have like different levels of paranoia for different investigation sometimes you just don't want to expose your IP address if that's the case use a VPN but keep in mind that vpns can also use your track your activity and some VPN pretty nefarious about selling your data and you can use tore but you know T is really slow and it can be like some websites are just going to keep giving you captures if you're trying

to look them up through T um and then if and yeah so it's just like just keep in mind that there are times you're going to be want to be more private than other times and just create your threat model and figure out how to protect yourself online accordingly if you're in doubt reach out to somebody who's you know a cyber security expert or something who'll be able to hold your hand through it document everything I'm not going to go over through all of these points in detail but it's like if website investigations are typically

not a moment in time they're over a length of time so set up monitoring set up screenshots get screenshot to timestamp you might just go for lunch and by the time you come back the post has disappeared the website has disappeared to just keep taking screenshots and keep archiving everything in real time as you're doing things um when it comes to website like broadly you just kind of want to ask who why when how and when you're looking at a website try to answer these questions as you're going through them um go through all the

pages look at the Privacy policies look to see what the payment options are some of this is going to be influence influencer Ops some of this is just going to be ad FS who want to make money and they're all going to have like different types of network set up so to kind of establish the scope of a network you're going to want to really hold in on why this exists and how it exists and create a timeline of the website because what we seeing recently is a lot of old websites that have not either

been renewed or the media organization has died is being swept up by like malicious actors who want to use their history to basically take advantage of all the buil-in TR they have so try to see when things changed and how they changed and with all of that let's quickly kind of get into one quick case study which is something I've been working on on and off for a few years now and every year something new comes up and the only reason I can monitor it is because lots of archiving and also honestly just relying a

lot on dumb luck because you never know when you find something and sometimes you just don't know what you're looking for so so kind of give you a broad idea of the tools I used to do this investigation and the various types of ways we did it like we looked at domains we tried to find matching Antics IDs I which website Shar the same Google Antics ID or Facebook pixel ID or any kind of tracking identifier we follow the money using a bunch of different like open Secrets FC filing just like public records basically and

when we tried to figure out who they were working with and who some of their collaborators or big money Partners were we looked at ad libraries as well as use something called gnv flexible search it all started when the Lancing State Journal broke a story that there were dozens of new websites that appeared in Michigan but they appeared to have a political Bend and when you looked at the about us They said hey they're going to be thousands of this eventually and I was left wondering are there already thousands how do I know and so

what I did was I started off by using a simple tool called dnsb and what that does is it matches an IP address to a website think of the relationship between an IP address and a website as the same as a contact in your phone book you call up a number there's a person at the other end it's the same thing with a domain you go to google.com there's an IP address behind that you go to any random website there's an IP address behind that it's a many to many relationship ship when I plugged in

one of the domains that The laning State Journal had identified in their investigation I immediately found about a thousand results just using this one tool by plugging in the domain and looking for all the other domains that sit on the same IP address I then used another tool called risk IQ to try and find out which domains shared the same analytics ID this could be Google analytics it could be New Relic and in some cases I even found that different website were using different Google Antics ID but they were still part of the same network

so what you eventually have to do is keep kind of find domains find all the digital identifiers you can and look through each of them one by one like it's kind of like a Snowball Effect to kind of find the entire range of what you're going to be looking at more recently when and effectively like that's how we kind of had our first story which is just kind of continuously going through the same thing over and over again more recently I found I saw that one of the entities that they had had a new director

on it that didn't exist before and it was somebody called Tim dun who's a West Texas oil and gas billionaire and I was like wait hang on when did this happen and how do you even confirm that it's the same Tim done you know there could just be somebody else with the same name just because you have a name Clash doesn't mean the same person so at that point you do kind of have to resort to more traditional means of trying to identify hey is it the same one is it not and then the other

question was when did he actually get involved in this and the only reason why I was able to determine that it was new is because through all my previous investigations I had kept screenshots of this screen to be like oh wait there's a new entry now right okay so this would have happened sometime in the last 3 six 12 months and this is just one more quick example of another part of this where when I was clicking around their website I saw something called Community newsmaker show up and I'm like wait what is community newsmaker

and why do I care and should I care and I couldn't really find out much about it the who details were blank couldn't really find anything with IP address I threw it into Twitter search to see what came up and I found like a tea party aligned group that was advertising it and what I saw was that it was using a subdomain called interview desk and I was like huh interesting I wonder if there other things on this subdomain that might show me who their collaborators are and so again I was just able to put

that into DNS DB flexible search and I eventually effectively found about I don't know like a dozen of the collaborators who I wasn't able to find through any other means and eventually like this one network I've written about them extensively at this point now first story 2019 but almost every year since a story or two come up just because every now and again like if you're just continuously Ming something new things are happening new Partnerships and collaborations and influence operations are being created and the only way to identify is to keep an eye on it

at all times I've thrown in some resources here including Craig's wonderful newsletter which I read every like anytime it comes out I read it and I've also kind of put our original nikar slides who's behind the website as well as the checklist that John Keegan and I have created which just kind of helps you create a little bit more structure to your investigation because it's often really easy to go down a rabbit hole and not know how to find your way out that's about it for me thank you thank you PRI um just a quick

followup to sort of underline I mean you talked specifically about websites but this approach of kind of monitoring And archiving I mean would you say that that applies for whatever kind of platform you might be looking at absolutely and I think social media platforms you especially have to screen short archive or even download videos because everything's really Epal and you don't know when things get taken down and the other thing is a lot of social media it's hard to Archive on archive.org or archive.is or whatever which again means that you have to be very very

diligent because if you're not then before like you it's sometimes really hard to find what you found when you found it I and you mentioned some of the tools that have sort of helped with monitoring or going away like crowd tangle which was amazing for being able to watch Facebook pages and groups and Instagram accounts so for you like what are you doing um when you have you know when you're monitoring and you're building lists of Facebook pages like if crowd tangle is going away what are you using to just sort of build your lists

and and keep track of them so I am lucky in that um in Academia so I get access to the meta Content Library however my experience with the Content Library so far has been that it's incomplete compared to crowd tangle and that not only does give you far fewer results but also doesn't have tools like location sensitive searches that Crow tangle used to have I think the next year is going to be really interesting for all of us as we figure out better ways to run Facebook investigations without access to Crow tangle but I feel

like it's still very early stages now and we all I think we all just kind of blindly relied on proud tangle and most of us hoped that hey maybe it'll just survive this year but in the absence of that I think we just I think there's going to be a lot of creativity and I really do hope that it's going to be an opportunity for academics researchers and journalists to get together and create tool set so that people aren't repeating each other's efforts because that's just wasted time for everyone and I suppose you know if

uh if you don't have a specific tool to use just put the things you're monitoring in a spreadsheet and click on the links I guess right absolutely absolutely awesome all right well thank you so much PRI so uh our next speaker is uh Malik Malik please go ahead and uh take it away yeah thank you Greg uh so yeah I'm um I'm gonna talk specifically about Tunisia as um as all you remember maybe in 2011 Tunisia um faced Uprising that tle dictator that been running the country for 23 years and it was a start of

what we call the the Arab um and one of the major player in this Uprising or you can it Revolution uh was social media and specifically Facebook so it was like a tool used by activists by people demonstrating in the street and the dictatorship was completely enable to stop this uh from happening and enable to control this uh this uh platforms um now we are 14 years after uh this this this period and Facebook today is still a major player in the political scene in Tunisia but at the same time is became also one of

the biggest threat in term of um democracy in the country by um all this new group and new companies that are using this uh platform especially Facebook as is the biggest one used in Tunisia and still um they they they are um using this this this platforms to spread fake news organizing like campaign against political opponents and and sometime even deating a specific uh category or or category of person recently the subsaharan Mig migrants in Tunisia faced a huge campaigns uh in in in social media and specifically in Facebook uh the first the first time

that we we we started at least looking to how those Behavior are impacting political debate and uh uh how they are threatening uh the the the the ongoing or the the the the the yeah the Democratic process in the country was in 2019 during very disputed presidential election uh with a lot of Outsiders uh arriving uh uh finalist at the second second round of the presidential election and this period just few weeks before the the face shut down uh 265 accounts and they just stated that in in a very short uh communicate and uh what

most of the pages or a big part of those pages was related to one single company and part of the pages was uh concerning Tunisia uh this information we get it from our part friends and partner from dfr Lab which is a a think tank um related to the Atlantic ccer that was contacted by Facebook few hours before down those pages and allow allowing them to uh download the content of this those pages and uh document this uh uh um the content and the behavior of those pages and with collaboration with with dfr we get

we granted access to those document and we start to dig uh on them uh and our our our our reaction was at beginning with we start to see what kind of impact and what is the reach of this kind of pages so are talking specifically about 11 pages related directly to the Tunisian election and we are talking more more half a million half a million of followers and more than seven seven million of uh content views by digging more using some uh information about uh available on the um available on the about um website page

um we we discovered that most of those pages uh was running ads sponsored content this content is political saer or sometime defam mating certain candidate um talking about different uh different uh topics but heavily sponsored uh through all those pages unfortunately Facebook don't give us the possibility in Tunisia to go more in detail and see how much all those campaign are casting how many how much money is put in this these campaigns but at least we can know that those pages and what kind of content they are sponsoring and what kind of AD they are

uh uh running by doing this this analysis of the content we we're trying to see who are the people who are targeted by this pages and what are the main topics uh related to those pages and we we we we see that they are targeting mainly all the political uh seen the main candidate for the election u in 2019 um talking about politics freedom of speech corruption poverty trying to emphas trying to um criticize the the the work of the actual government and and so on and attacking sometime personally those uh those political figures but

uh uh what we discover also that there is one only person one only political person who was completely uh um uh nobody talks about in these pages and there is no any content targeting this guy and and even when we find some content targeting him it it was more like positive content as we see uh uh the pages are sharing positive information about this candidate n kwi who owning um very important TV station and also an um sh charity foundation and targeting all his opponents so uh it became more and more clear that those pages

are attacking all the opponents of this guy and and and highlighting uh his action as a political leader but also as his his U TV and his foundations and what also uh we communication with Facebook we discovered that all those pages was connected to one single company which is arimed group which an Israeli based company run by ex mosad officers who are running an industrial scale uh Farm of pages fake pages and fake websites and involved in many different um uh presidential election and election worldwide and focusing on Africa and they are very clear in

their presentation that the website is shut was shut it down and I emphasize is the fact that we need to take screenshot for everything and try to archive all our uh findings because website are are are sh shut down regularly and some time in purpose so we can this case of 2019 election was a trigger like for us in Ina to say that we need to uh TR start to track this kind of behavior and try to document document all these pages that are sharing political content unfortunately as it's already was already said that social

media platform and Facebook especially don't share a lot of information they are closing all their apis or make them very expensive for a small media outlet and even for research center with whom sometime we can collaborate make it very uh difficult for us to um do the job and at least follow this kind of um unauthentic Behavior or at this kind of fake Pages created to create uh uh debate or discussion about candidate or a political party so what so what we start to do is uh uh uh using a very simple spreadsheet and starting

putting all the link of pages group following some hashtags and from there starting to or trying to reconstruct the web um around some of the promin prominent pages that they are supporting or spreading some uh fake news again uh uh on the opponent of the actual president uh the actual president was the one who won the election in 2019 against the guy who was running campaigns uh on attenting campaigns against him today he's using another kind of patterns we we we we discovered it for one specific uh um incident happened last year when the president

called for uh the foreign the subsaharian African as Invaders and and um gave them like evil plans to to to to attack Tunisia uh we discovered that a whole bunch of new pages and new group was created to at least propagate and promote those ideas the ideas that promoted by the actual president but and and creating like a big debate and a big conversation around the topic that the president was imposing on the political debate those pages are uh uh often related by the admins uh they are not uh they are like few ones managing

a bunch a big number of of of pages and groups and to give just a an example of how those uh Network working um it start in general by uh creating and spreading um attacks um fake news information against a category of uh political opponent or a category of intermediary bodies uh as the Judiciary System for example in January 2022 and a week after that the president just took all those ideas about the the fact that all the are corrupt that the judges need to be to be uh um stopped in the corruption and dismiss

54 judges uh based on this conversation or this debate created fakely by this those pages uh those 55 uh judges 54 judges uh most of them as we in investigate each cases of those judges most of them uh was one of these judges who are refusing to um to accept orders from the from from the presidency and from the ministry of Justice they are the ones who are trying to com to to to uh yeah to stop this uh um U um radicalization of the of of the political power in term of uh acquiring all

the the power in the country uh and we so this was like a pattern for us we see that the campaign start on those pages and those groups the debate is is installed in the virtual sphere in Facebook mainly a a few days or week after that the president take action in the direction of what those pages are are spreading um uh is the same was done with subaran African the same also was done with political opponent most of them are jailed now for more than a year and it's quite the same pattern that is

um repeating itself again and again so just to finish for how we are preparing uh the coming election the coming president presidential election which are very important to see how the the the the the the the society will react to four years of dictatorial uh Power we are starting by doing it with very basic tools as I as I said the the the access to data from apis are already restricted so uh uh trying to be ready and uh taking springshot documenting all the interaction disc following new tags at to be ready at least to

find some pattern or some behavior that can impact or can influence the next election I think that's it for the Tunisian case to do awesome thank you Malik um just a a quick followup I mean so obviously you were able to identify this kind of new network for the president and I'm curious how did you sort of come to see these groups in these Pages as part of uh you know part of a new sort of uh operation you know what were you sort of doing to be able to find them in the first place

uh yeah it's it's a very lowkey method it's it's it's it's being on the social media following all the new tags that they can be used as we are all with the president the president is our leader or something like that and follow the tags and see where what what other pages are using the same tags in general there is pattern on how they are using phrases commands or some sometime even some GIF or photos uh that they and by following that every time we discover the new new page we we took the the link

we tried to take some screenshot and and so on and and and the the list is becoming bigger and bigger by by connecting the dots like this way that's great yeah and I mean you know with thank you very much with you know with PR's presentation she talked about some of the technical methods where you can connect websites and things together and with Malik he's talking about content about hashtags about the topics and so these are you know some of the options you have to be watching and monitoring to sort of build things together and

at the end of the day you know you end up with a big spreadsheet like like Malik just showed and you know that's what you're building and watching over time um it's also interesting to see the interplay between the digital campaign and then the roll out by the government of the related sort of policy and discussion as well and that's sort of brings us to um Maria Teresa and your presentation um so please uh take it away and uh the floor is yours yeah okay so what we're what what I would like to share with

you it's um it's um a big project we did last year which was called digital mercenaries and as you can see I left the whole list of people I'm not going to read it but it was media from all over Latin America but also some uh Digital Labs uh like the dfr lab tool like U um laborator Sudan from Honduras and other Laboratories that are investigating um inauthentic Behavior so I'm just going to explain how we did the investigation because this was many many many people investigating so I'm not going to go into the detail

but what I wanted to show you how we did on the digital side and at the same time we did on the reporting traditional side so on the digital side we started by analyzing all the public data on reports of uh inauthentic coordinated Behavior like for example from uh Facebook from the reports by Oxford by Stanford we took all of these data and we analyzed it and started to um find names of companies a patterns in different countries so we can follow them um the also because we worked with a lot of fact Checkers that

their day-to-day work is to look at uh you know they can spot suspicious activities very easily because that's the day-to-day work you know as they are factchecking Pony information so they brought all their knowledge into the into the into the investigation and they had already spotted a lot of um suspicious activities what we were looking was who is behind a a very Vicious Kind of Campa political campaign against a lot of either public officials or government officials or to defend government officials we wanted to unearth who were the the the big players behind we had

the feeling that it was a few companies that it wasn't going to be lots of people we also of course use the social listening tools that you've already mentioned like crowd tangle medw and uh Bland 24 and we also research the digital footprint you know IP addresses H Google analytic codes domain registrations and then from all of these we've basically if we did all these big spreadsheets database and we identify the companies and persons in several countries and we realized we had an actual physical meeting of all these people and it was very exciting where

we had all of these everybody sort of H shared what they had found and then we started to find the same companies in different countries and then we found that there was actually a lot of companies working in the same places at the same time we attended two political congresses of con political con consultants and election gurus because they are amazingly open they talk a lot so they they they were actually saying how they did this and they admitted publicly to a lot of um irregular Behavior or or or or bypassing laws or and so

we did that and we also visited their courses they have courses online and we downloaded a lot of their talks and and analyze them um and also look for their names connected to companies the difficulty we had is that we had these political cons consultancies Consultants or consultancy firms almost confessing what they were doing and we had all the information about the inauthentic Behavior but it was very difficult to connect one with the other and that's how we started to follow the companies on the one side and then the the what they said on the

other uh we interviewed real world people who cover who are working for elections and that was key we found some deep throats that were disgruntled because they you know they were they had been mistreated or something like that in a campaign especially people who worked for big uh you know uh these uh centers where they hire lots of people to do this um and they um and they talked a lot of them especially in Honduras we had a very good deep throat that sort of explained how the whole system worked um and and then we

did traditional reporting on people behind the companies their trajectories we found a lot of information and from that we found these uh basic things one of the tools we used was Clips Nina it's a new tool that we developed in clip which is uh it actually when you looked at a company there uh it will uh give you results of a loss of public Contracting all over Latin America because we have uploaded and Tross a lot of the Latin American um Contracting uh companies so I I just wanted to share with you some of the

keys that may help you also uh investigate um so investigating in parallel the digital world and the real world really helps a lot talk with these granted employees of these called centers and trolling centers a lot of them get fights and they just leave and they want to talk um find the beneficial owners of some of these companies that you go down to you can find them in their in their in their financial um uh Records or in their uh filings to their local Registries or to the FC or to the SEC or whatever it

is um public procurement contracts is a great source to find who pays for this information we found a lot of public procurement contracts with uh companies that were part of this disinformation s of ecosystem follow lives of people ER lying is a constant in their lives we found for example two two guys goal and ser Meo both of some of these companies that were working in several countries and when we Dig Dug their lives that like if they had any judicial proceedings against them or anything we found you know they had all kinds of problems

in their whole life uh pay attention to the ads on Facebook sometimes these ads over phone addresses domains and other valuable information and also you can see how much money they've paid on the Google and on the Facebook ads and then see how much they declared officially in their campaign and you see sometimes it's completely not not it doesn't match political as we say you know political advisers talk a lot too much so sometimes even talking to them one of our reporters just approached them in one of these congresses and talked to them and they

were very open about what they do link traditional reporting to digital reporting um now the findings also give you an idea where to look we found seven companies Distributing massive political disinformation in favor in favor of their clients some of them were candidates and some of them were governments uh we found the same accounts for example promoting um and that's how we found goal uh company um some of them same accounts uh promoting uh a candidate in Panama and promoting governmental candidates in Venezuela so we could see there were a fake uh company uh fake

accounts or or you know paid accounts uh we also found hundreds of fake Pages created by to promot a party in Mexico by another company called neona which was also working in several countries we found H we also did some analysis of of of speech and narratives and we found identical narratives and this was more traditional reporting um of right-wing candidates it was almost by the book uh uh of what was The Narrative of this Foundation created by box the Spanish party the in Spain and and and they had all rightwing uh same thing like

erasing past history alleging fraud election fraud Americans know a little bit about that exaggerating violence and spreading fear um influential um you know disinform in several countries Sero for example we find him in Chile Argentina and Brazil aako was in Brazil and was being prosecuted for disinformation in Brazil and he moved to Paraguay to support another candidate who actually won and Eduardo bolsonaro the son of the president was all over we counted 1420 something visits to in Latin America and he had also set up companies in the US um sending uh selling merchandise basically for

this information um a lot of P private Consultants paid by public funds uh promoting this information on the personal image of public officials so we found in Colombia this guy who was hired by public officials with public money to uh inflate their their image and and make them look good uh also lying a lot and and we also found party fun Finance disinformation it was a very big story in Costa Rica that the team in Costa Rica broke which was this uh this uh company in the in the contracts of of the because these are

public contracts uh um of political consultants for the campaign of the actual president of Costa Rica they said uh we're going to hire this guy for leftand operations and when we asked for leth operations everybody said oh that was basically disinformation so even they even put it on on writing um we found Public Service app used to gather data ER for voters in Venezuela um we found resurrected profiles that had been eliminated by Twitter or or or Facebook had been taken down but they reappeared even with the same names but sometimes with different names in

Nicaragua we found the Supreme Court of Nicaragua Distributing this information uh and also um even Russian disinformation in Bolivia uh to improve the the the the image of mining companies but very tied to a a candidate that probably they they thought would approve their their beaing for to to manage some lithium lithium product production Minds in B so that's more or less the kinds of things we found and the kinds of things that probably will give you an idea where to look amazing thank you I mean this is I really encourage everyone to check out

this project there is so many stories so much work that was done and you can see lots of different approaches and sort of a Playbook we're looking at the these kinds of paid influence operations um so so Maria Tesa I'm going to ask you a followup but I also want free and Malik to prepare I'm going to put a question to all of you after which is you know what are you kind of looking for in terms of sort of new trends around digital threats and manipulation the things you might be watching for this year

in different elections so uh PRI and Malik and also Maria Teresa I'll come back to you after uh for that but just want to get everybody thinking about that question and for you uh Maria Teresa I mean this was obviously a very big partnership and collaboration and so if any of the folks here are thinking about how do they put together a partnership how might they sort of do a collaboration I'm wondering as you know an organization that does these as a core part of what you do like what would you what would you give

us some advice for people who want to try and find Partners to do a larger scale investigation like this well I think I think the advice is to get together of course have the will to do it you know think about a lot of this work is transnational I I was looking at at what Malik was showing and he shows Archimedes and there's a lot of work at this our our colleagues in Salvador have done about Archimedes too and their work because these are transnational companies doing work everywhere so it's worth doing it because you

can find the bigger players and I think it's good the other thing that might what we do is we do are kind of put together all the knowledge everybody you have to be super collaborative and super open so people really have to trust each other and say you know we're going to do this together and we just put on the table everything we know and and then what we do is we clarify very clear rules of the game so there's no confusion that we're going to be like radical sharing we're going to be publishing all

together either in different dates or in the dates we all agree if somebody needs to publish before because there's a political circumstance that forces them to publish then they have to be open about it if you have very clear rules you can really work together and and also my advice is bring on some experts by experts I mean on the one hand fact Checkers because they're on this world all day looking at what's happening of course political reporters that have been covering politics in and they have access to campaigns to elections and not just the

digital world but the real world and the last thing I think you know people who have some uh forensic digital uh investigation sort of expertise that would be my advice amazing thank you very much okay so PRI I'm gonna put you on the spot now um you know what do you sort of what are you thinking about as you know emerging threats or things that you you would be paying attention to this year when it comes to election I think two things specifically come to mind one is I mean this isn't really new but it's

kind of happening again with um new websites come up that adopts the Aesthetics of existing legitimate websites and it's being able to actively monitor when those come up how those come up and then try to trace what those networks are like and the other thing is new like sites or whatever that's come up that specific groups of candidates end up promoting because usually when you find one or two if those you it's it's not just one or two great thank you um Malik for you I mean what are you what are you thinking about in

terms of emerging threats and uh you know things that you're paying attention to closely this year oh you got to unmute sorry I I I think one of the trends for this year uh as as as I see it in Tunisia as Facebook was really looking for an authentic Behavior shutting down a lot of pages uh he also shut down another agency in Tunisia called you reputation working on farming more than 400 uh pages in Tunisia I think now that the new meod is more grassroot movement it's more like individuals uh political AFF affiliate to

the all political supporters and they are creating this unauthentic Behavior but in a very lowkey with very low meod in way creating physical group of people creating content and spreading it this is I think one of the specific to Tunisia I don't know elsewhere I think the EI generated audios and and and videos will be one of the big challenges for all the journalists in the coming elections especially audios now now then for example when we can buy blue badges in in in in Facebook or in Twitter and created fake authentic account uh we had

an example in Tunisia with like some audio leaks uh spread by a fake uh uh certif certified account uh it will be I think also one of the ma the major um challenge in the coming elections yeah that makes sense and I'm going to mention it uh at the end of the webinar but there is an upcoming webinar from GN about dealing with um you know Ai and synthetic generated content I think that's something everybody is looking for uh Maria tereso what's on your radar in terms of Elections this year and things you you folks

are watching for yes we are getting together more or less the same team I don't know if that big because obviously it's going to be only those who have elections this year like republicana and Panama and Brazil uh and Mexico um but what we want to do we we have a big challenge because Tik Tok has become huge in L America and a lot of the disinformation is going through that and it's not so easy to investigate uh and to track so that's one of the big challenges we have together but we're going to be

looking at that and and particularly our Brazilian colleagues are looking at also voice fakes uh with with the artificial intelligence um and we are also looking at a couple of countries where there are very massive campaigns that are not in elections but you can see a very strong campaign going on one is Argentina basically supporting the new president but the other one which is very terrible in in Peru which is against a journalist it's basically a massive campaign Against One single outlet and one single journalist and so we want to really dig up of course

with our colleagues there um and and try to find those patterns there that's more or less what we're looking at yeah great yeah I mean I think I think that also raises the point that we're talking about elections here today but of course these kinds of campaigns and operations they run them all year round um sometimes things are stood up and are a little more intense around elections but you know the company that do this are looking for business all year round and you know the parties and the supporters are also looking to keep people

engaged as well so you don't want to only turn it on during an election but be watching and seeing um you know the existing operations and how they adapt so um we're going to go in a moment to take the questions from you folks who've been watching so please if you have a question now is the time to put it in the Q&A box and I'm going to throw one more out to our panel which is that we've talked a lot about public face content um websites social media platforms like Facebook and Tik Tok um

private messaging is obviously um a big factor in many countries around the world when we talk about WhatsApp and things like that and so I just would love to hear um you know from any or all of you in terms of you know your thinking around trying to investigate what are often very you know difficult more closed platforms like say WhatsApp and and PR I know you've looked at this a little bit so maybe I can start with you and throw it to you first and just see what your thoughts are on on that yeah

um so I had done I had worked on WhatsApp in the context of the Indian elections in 2019 so it's been a while but it was effectively trying to join a lot of WhatsApp groups so I think I joined over a thousand politically aligned WhatsApp groups in India to try to monitor the activity and see what was going on but doing any of this stuff techn logically is really really combersome and even like from what I hear the philosophy on WhatsApp investigations have fundamentally changed now in that these public groups and things just don't get

the same kind of traction things are becoming a lot more localized so you almost have to find local groups to join or even and there there um folks in the US who are doing this even effectively request people to donate their data so that you can analyze them in near real time um I think closed groups and finding the like kind of like the you know sifting through the signal and the noise in closed groups is really hard especially if they're like chat apps because there's so much colloquialism there's so much just random stuff and

in the middle of that you suddenly have like a Google doc which has instructions on how to run an influence campaign today so it's very much involved and you know you take like hours to find two things that are interesting uh Maria Teresa Malik uh do either of you want to weigh in on sort of the the private more private messaging platforms I think it's super difficult in any case it's um uh so we also when we've done things like that it's more going one by one getting into the groups uh I think Brazilians have

developed some kind of libraries of groups that to to watch for but these are very fluid it changes a lot it's time it's time consuming and and and slow yeah um I think there is no other solution than do it by getting you know join different group I think also you can see some of the pages or groups on Facebook can share or can put the WhatsApp group or Whatsapp number on the pages can be a good a good uh uh a link to follow uh and yeah follow all the groups and join all the

suggestion for join new groups and and so on great well um just Greg do it do it in a in a separate uh phone because it can be it can be a nightmare now we did we did you know we found something very useful was when we were tracking migrants because you know uh WhatsApp groups have become huge to push migrants to offer services and sometimes terrible things to to people pushing them to leave their countries it's easy to go to the us all of these things and and and that that's a little bit easier

because they advertise it so much that you can come in as a as any other migrant so you can get into those groups and sort of see what they're talking about quickly add to what sorry I was just going to quickly add to what Malik had said which is please use a different phone because because of the number of WhatsApp groups I had joined I think there were many admins and I kind of said that I'm at the toenter ETC but I think many admins reported me so I literally got kicked out of WhatsApp on

like three or four numbers because they're like yep too much activity or to reporting you so just don't use your personal number for that yes and I I think we do have a couple questions related to digital security as well in the Q&A but you definitely need to think about that and and in pri's presentation she talked a little bit about you know vpns um but if you are joining in Telegram in WhatsApp and those kinds of things your phone number is viewable and available in most cases to the people running those those groups and

so you need to think about that and you know talk with your Newsroom and colleagues about whether you can have a you know a phone and a designated number for joining these things um so thank you for the presentations and for our initial kind of discussion here I'm going to now pass it to uh Andrea araba from GN we've got a bunch of questions that have come in from our viewers and the audience here and so she's going to now uh throw some of those at our panel as well um so thank you everybody for

submitting those and there's still time to get some in if you want to as well thank you so much Craig thank you Brianna Maria terz and Malik for the wonderful presentations um and I'm going to read some questions I'm GNA read three by3 and I would also love to invite Craig to answer them since you know you also have a lot of experience and a lot to share for audience um so I'm going to start with uh tips and tools so people are asking archiving is important but it is becoming increasingly difficult to Archive social

media posts even paid tools fail quite quite often can you share any tips techniques or tools so that would be the first question um the second question um what tools do you recommend for social media monitoring espe especially now that tweet deck crowd tangle and other tools are disappearing so not sure if you have any any comment on that and the third question is have you also found open-source tools that can fact check AI generated videos and pictures so that's the first round of three questions um I'm going to ask maybe bana if you could

answer I can try um so for archiving social media I think what I've ended up relying a lot more on is screenshots with proper timestamps because I mean what you end up also have having with internet archive and things is that sometimes things youve archived disappear either because of request from somebody or copyright claims or whatever so screenshot Everything download videos maintain the original time stamps of things um but yeah un for there aren't any good answers here um archive. is pH work sometimes but it's all a little bit sporadic and it also depends on

whether you're archiving things for retrospective analysis or whether you're archiving them for public viewing and I think tools for monitoring social media I think I'm resorting a lot more to computation techniques right now because like the mark like I think people are still trying to Fig figure out what the tools are and what tools are available to them and lastly on AI generated content the folks that we verify have created a to Kit which is pretty good but it's um it's still relatively new it doesn't do all the models and I think the one thing

that's worth highlighting is AI generated like any tools for AI generated content detection none of them are going to be 100% food proof you're always going to have a margin of errors it's just worth being cogn of that thank you so much um Maria Teresa would you like to continue I think I will pass on this one I think that uh the the the actual specifics about the the tools I I'm not so familiarized with those thank you uh Malik yeah for social media really I don't I don't know things are are changing every time

Facebook shutting down application that allow to screenshot Pages for for a for a web page uh um archive.org can be a solution if you create your own archive putting the link and create an archive so I think it's it's more uh uh relevant to do it this way and you can Al always use your print uh function from your browser and use print to PDF you will be you will printing the a whole web page on a PDF it can it can serve for for social media we we we do it um manually generally and

uh starting every week for example uh uh copy pasting the content taking screenshot for the publication and and building our data set this way uh this is the most effective but very time consuming uh way to do it but if there is any tools I will be also taken that I just wanted to say something I just remember one I don't know if it's useful but H for example uh Hunley is a very good uh tool to to do uh archiving of the pages I think and you can annotate and all of this this is

super good the other one that we used is melt water uh for to investigate uh Facebook it really allows you to to to filter information by dates by countries and really find patterns so that one is expensive but it's it's super good um those two that I just remember thank you mik and Maria Teresa and now we go with Craig um yeah so uh I just dropped in the chat uh I did a my my most recent edition of my news newsletter I looked at some approaches around using AI pardon me in investigations and I

do have a section where I list some of the detection tools that are out there um but I want to emphasize what PRI said which is that you can't rely on these 100% like you should not be writing a story saying oh this is you know a deep fake video or a deep fake audio because of the score of one of these tools it's just an indicator it's another signal that you can take into account and uh and I would encourage you to you know reach out to the companies or people Behind These detection tools

to see if they can assist you with you know more more involved um investigation on that so on that front you know uh I think your core verification techniques are still really important you know where was this video shot and you know where is this audio recorded from did anybody hear it was anybody else there fundamental verification approaches are still really important around AI um and when it comes to archiving yeah it's just look there is no perfect social media archiving tool some will work some won't on a given time you need to think about

making sure you have a good personal archive with your own screenshots if you can afford a tool like Hunley um it's it's very good for creating archives it also puts a hash on every uh screenshot you take which would actually stand up in court or other areas like that to show like yes this is an authentic representation of it but screenshots on a most basic level uh will work um and just the last you know on monitoring I really encourage you to like do the old school method of build spreadsheets create lists that will not

that will not go away um and the more that you are involved in the manual work of this the more you can think about it and connect the dots um and just the last little link I'll drop in is um you know I I think people don't often get the most out of the Wayback machine archive.org they have a wonderful browser extension that you should install and use and you should make sure uh that you are also creating an account there so that all of your archive pages are stored in one place for you um

so that's you know that other Link in there sort of walks you through using the great uh Chrome browser extension that they have thank you so much um Craig then we're going to go to security because that was a big concern so I'm going to ask everyone if you could share you know what digital safety steps do you take to protect yourselves what did you take to do the investigations you talked about and you know just anything related to digital security that you can share now I'm goingon to go back so the last person was

correct so could you could you be the first one sure um and and you know I will defer to some of the other folks on this I mean I think you know you you need to be using a good VPN be very wary of free vpns they're often who ing up your data uh in very insecure ways and so if you're going to pay money for something you should really think about a good quality VPN and keep it running as you're doing your investigations you would be surprised how easily it is for someone to actually

fingerprint your particular signature of your IP address the the the computer you use the browser you use all of that so if you are particularly working in very sensitive or authoritarian environments you know you need to be thinking about this um I would also do a very basic thing which is you know sort of Google your own name Google your own address Google your own personal details see how much is out there that people could find if they wanted to Target you and do the the best you can to limit your personally identifiable details um

you know hide your friends on Facebook publicly maybe you want to have a private Instagram account think about also you know the attacks that could come through your family members maybe don't link publicly to your spouses your partners you know these kinds of things if they can't get at you they're going to go through and pivot through a family member or someone close to you so just thinking about you know searching and seeing what's available out there and doing your best to minimize the amount of information you're sharing about sensitive things like location family members

your activities I wouldn't be you know sharing where you are at any given moment these are all just you know good practices I'd say thank you Craig Malik in addition to Greg it it will be difficult but yeah I I will I will also recommend to double authenic all your accesses even to your Facebook pages your social uh media account uh and and and your sensitive um as as your email account or your website or your access the profile to your the website of your organization for example yeah think have a also a very low

print on social media in general and on internet try to be the most invisible possible uh disconnecting your personal life from from your journalist life it's it's very important um and and also don't um don't uh put yourself don't don't don't talk about your work don't talk about your about what you are doing what you are investigating what are which which group are you looking at so be very careful I remember when we preparing the the the the webinar Greg said there is some information that you can say about 2014 it's okay because I I

I will not say exactly what I'm I'm I'm gonna do and it's it's important to not publicize it thank you Malik uh Maria Teresa yes what what we did in that big big thing because we were a little bit worried because it was going to be so we created a committee a security committee and so and sort of drafted a protocol so we would know how to respond in case of an attack or in case somebody was being uh you know all the the heat would go against a person or a group so we we

had like a a way of monitoring if if activity was going you know off the sharts or something against one of the websites we also looked at the websites would be the the most secure they were all of the websites of the team uh the other thing we use a lot is encryption you know we do have you know veracrypt or one of these encryption things that are easy to use and you put your really sensitive work there or and and also copy it because you might have lots of work and then something happens and

then you lose everything so keep backups even if it's on a separate um unit um and the other thing that's very easy but I I found that's very useful is update your phone you know your software of your phone so a lot of these malware they put in your thing like Pegasus and things um the the updates of the software will will will uh protect you um so don't leave your it's it's healthy to turn your phone off and put it on in the morning so it would update it s all the time um and

yeah that's more or less what some some of the basic things we do and and basically be ready if there's an attack or there's really un Mutual activity against you you have to be aware of what you should do next what would be the kinds of things that you how would you respond to that have that Clarity when you're okay not when you're the middle of the crisis thank you so much Maria Teresa hi so to kind of buildt upon one of the things that Craig said about you know Googling yourself or making sure you're

not exposing too many piis the New York Times has a really handy guide called how to dox yourself and it's worth doing that just to kind of see because you don't know where your information leak you don't know what data Brokers have in you you don't know what what's gone where so it's worth kind of just going through through all the steps even kind of doing it as next leue where you guys docks each other just to see what um you know what's out there about you um different investigations have different threat models so I

think it's you know you have different levels of paranoia at every point but the one thing I would say is that don't use your primary browser especially not like Chrome where you signed into Google or something when you're running investigation just have like a clean almost sandboxed browser like maybe a completely different browser or something you're doing that it's also worth noting that if you have like ad blockers and stuff on your primary browser sometimes you might want to kind of for invest for things you're investigating you know like have the real experience which is

going to be a truly awful experience but it's worth kind of having a secluded space to do that where it's not intermingling with the you know with anything that's personal thank you so much now I'm going to ask the last question because unfortunately un we're running out of time um so just very briefly what open databases do you recommend when investigating cyber threats in an election context not sure if you can share some of of the databases that you have used and I'm going to start once again now I'm going to go back so please

Preen Jenna if you could share sure so um open corporates is obviously the big one the easy one uh I don't know if you'll know this but open corporate you can even search by address and if you can do that you can find the other companies that might be related or other shell companies or whatever um anything campaign Finance related um for anything you want to do around digital forensics or DNS there are a handful of tools DN Athletics is parts of it are free part parts of it are paid um security Trails is free

but you have to have an account um hookie which gives you historic Hest data that is free um sorry that's justop my head no that is great thank you so much uh Maria Teresa well you can use um for example uh the open reg the Registries in the different countries they these are usually open also some of the legal you know if people have a legal record there's also payer in the US but in the rest of the world there are local you know open databases of know courts or that kind of thing um um

I think that's more or less what I'm thinking of course we use Nina a lot which is and also the ocrp ALF is really good to to track people and to track a um to track H companies um also some of the operations databases like for web domains or the the Facebook ads the Google ads these are very good they give you lots of addresses and things and and they're also open thank you Mar Teresa before I go to Malik someone asked if Nina is a public repository like if you could not yet we are

developing it but if they write two clip we will give them access it's it's for Latin America most I mean old um but yeah great thank you so much Malik yeah I will site um of corporate I think it's important ocrp database but also ICI as we our partner also and we work a lot in a lot of those Leakes and in general it it also can uh can create can allow us to find connection between uh political paries or personalities and and and businessmen uh it it was efficient um I will also check uh

into Wikileaks cables and wikileak document in general there is a lot of information on political actors people maybe who was completely uh on the background of the story but they are important today and you can find a lot of information there uh so yeah that's it um mainly um those those public databases thank you mik Craig yeah lots of uh great great ones there uh I would remind people that archive.org is not just for archiving your own stuff but you can search through that archive um so keep that in mind as an option um you

know there are also some telegram directories out there so if you're trying to find telegram channels uh tgat is one that's um you know that's pretty helpful and I did earlier share a link to the meta ad Library where you can search through ads on Tik Tok Facebook uh I just dropped a link into the Google ad library and there is also a Tik Tock ad Library um so these can be really helpful for you as well when you're looking into things um and if you want to go really deep on the ad side of

stuff there's a website called wellknown dodev which Aggregates advertising data about websites I can't really go into details on how you might use it now but um you know but that's a helpful one and I think just the last one I'll mention is there's a great collection of tools on Intel techniques um where if you are trying to do some searches on social networks if you have trying to do username searches email searches phone number searches um some of this data is a little more biased towards us numbers and data um so keep that in

mind but there's often um some decent International results that you can get as well Belling CAD also has pretty amazing tools and techniques in their page thank you thank you Maria Teresa thank you Craig and before I um I ask Craig to close the webinar I just want to invite once again everyone H watching this this webinar to apply to our digital investigations course where you will learn uh you will have more time to to develop this kind of knowledge and to know more about how to better investigate digital threats um I just share the

link in the chat and please Craig go ahead thank you so much awesome well thank you I mean I think this was a really great webinar uh I'm grateful to gii Jan and to our speakers today and you know as I'm closing things folks the webinar is going to end so if you're trying to grab some links that have been shared in the chat now is the time to go in there and copy and paste those because this was recorded so you can sort of you know watch the video again but if you're trying to

grab the tools and links that have been shared there now is the time to do that um because we have uh run out of time um so GN as I mentioned earlier they have a second webinar coming up it's about um you know focusing on how to identify and investigate AI audio deep fakes I know I get a lot of questions from people about AI audio deep fakes this is something that's spreading in a lot of countries um so this is going to be held on April 9th at 9:00 a.m. eastern so same start time

as today and the link has been shared multiple times in the chat box it's in there um sign up this is a free webinar um and I want to really want to thank the global investigative journalism Network and all of you for coming in today for asking some great questions and a huge thank you to our speakers uh PRI Malik and Maria Teresa um and so keep an eye on gn's Twitter feed at GN and its website for details on future events and that's also where you can go to apply to be part of our

digital threats cohort um so that's it we're going to say thank you and goodbye and hopefully you grabbed all the links you needed because we are ending the webinar now so thanks everybody