1 00:00:00,300 --> 00:00:02,190 - Hi everybody, my name is Xan North, 2 00:00:02,190 --> 00:00:04,530 I'm a member of Distributed Denial of Secrets, 3 00:00:04,530 --> 00:00:07,023 and you are here at Leak The Planet, 4 00:00:07,900 --> 00:00:11,883 or How You Learned To Stop Worrying And Love The Leak. 5 00:00:15,990 --> 00:00:19,713 Who we are, well, we are a bunch of cat lovers, 6 00:00:21,420 --> 00:00:26,223 as you can see, and dog lovers. 7 00:00:33,090 --> 00:00:34,950 And then there are a bunch of humans that don't matter, 8 00:00:34,950 --> 00:00:37,650 we have Emma Best right here, 9 00:00:37,650 --> 00:00:39,720 and the rest of these are people 10 00:00:39,720 --> 00:00:42,303 that also work with Distributed Denial of Secrets, 11 00:00:43,170 --> 00:00:45,470 but I all know you want us to bring back pets. 12 00:00:47,220 --> 00:00:49,620 So first of all, we have Types of Leaks and Leakers, 13 00:00:49,620 --> 00:00:52,650 leaking is as value neutral as pharmacology, 14 00:00:52,650 --> 00:00:55,680 it comes down to intent and application. 15 00:00:55,680 --> 00:00:58,680 We have Insiders, Hactivists, Spillage, 16 00:00:58,680 --> 00:01:00,780 State Affiliated Actors, and Ransomware, 17 00:01:00,780 --> 00:01:02,670 and we'll go through all of those, 18 00:01:02,670 --> 00:01:04,833 what they are, what they mean. 19 00:01:06,060 --> 00:01:08,910 Insiders, so cognitive dissidence addresses itself 20 00:01:08,910 --> 00:01:11,200 through leaks, a lot of people when they join 21 00:01:12,038 --> 00:01:15,180 an organization, they may have ideas 22 00:01:15,180 --> 00:01:17,160 about how that organization works 23 00:01:17,160 --> 00:01:20,313 that don't necessarily come to fruition. 24 00:01:21,480 --> 00:01:25,440 Examples of insiders are Daniel Ellsberg, Chelsea Manning, 25 00:01:25,440 --> 00:01:28,890 Edward Snowden, Reality Winner, Natalie May Edwards, 26 00:01:28,890 --> 00:01:30,693 and Johanna Stefansson. 27 00:01:32,250 --> 00:01:34,410 Next we have hactivists, not all whistleblowers 28 00:01:34,410 --> 00:01:37,470 are insiders, some of them come in from the outside. 29 00:01:37,470 --> 00:01:40,230 Good examples of that are RedHack, Anonymous, 30 00:01:40,230 --> 00:01:43,290 Jeremy Hammond, Phineas Fisher, ACABGang, 31 00:01:43,290 --> 00:01:45,333 Cyber Partisans, and donk_enby. 32 00:01:47,550 --> 00:01:49,740 Next we have spillage, which is pretty much 33 00:01:49,740 --> 00:01:51,240 when a stereo falls off a truck 34 00:01:51,240 --> 00:01:52,863 on the information superhighway. 35 00:01:54,480 --> 00:01:56,640 This is typically an accidental release of data 36 00:01:56,640 --> 00:01:59,370 that's a result of user error. 37 00:01:59,370 --> 00:02:01,320 Examples are Heritage Foundation, 38 00:02:01,320 --> 00:02:03,950 Police aerial surveillance footage, and GiveSendGo, 39 00:02:03,950 --> 00:02:08,010 GiveSendGo, particularly, they were warned repeatedly 40 00:02:08,010 --> 00:02:10,050 that their S3 buckets were misconfigured, 41 00:02:10,050 --> 00:02:11,670 they never took any action, 42 00:02:11,670 --> 00:02:15,690 and well, they got leaked. 43 00:02:15,690 --> 00:02:17,430 Services like Grayhat Warfare make misconfigured 44 00:02:17,430 --> 00:02:20,640 S3 buckets easy to find in search. 45 00:02:20,640 --> 00:02:24,240 Many leaks are avoided by disclosure protocols, 46 00:02:24,240 --> 00:02:26,945 again, going back to GiveSendGo, 47 00:02:26,945 --> 00:02:29,820 they were warned repeatedly and they did nothing. 48 00:02:29,820 --> 00:02:32,730 And then when their leak finally did come out, 49 00:02:32,730 --> 00:02:34,893 they denounced it as fake news, 50 00:02:36,690 --> 00:02:39,720 nothing, they weren't really hacked. 51 00:02:39,720 --> 00:02:43,320 So, next we have state affiliated actors, 52 00:02:43,320 --> 00:02:46,080 you probably love them when they're yours. 53 00:02:46,080 --> 00:02:50,880 We have Sabu, Popov, CyberBerkut, Guccifer 2.0, 54 00:02:50,880 --> 00:02:53,523 DC Leaks, IT ARMY, and Conti. 55 00:02:55,170 --> 00:02:58,800 And then ransomware, very little of this data 56 00:02:58,800 --> 00:03:00,990 merits journalistic or academic review, 57 00:03:00,990 --> 00:03:03,690 but there are some gems, example, Jones Day, 58 00:03:03,690 --> 00:03:08,280 Chicago City Hall, Metropolitan Police Department DC, 59 00:03:08,280 --> 00:03:10,743 Illinois Attorney General, and Perceptics. 60 00:03:12,540 --> 00:03:14,610 Some declared political stances following 61 00:03:14,610 --> 00:03:16,890 the Russian invasion of Ukraine, 62 00:03:16,890 --> 00:03:19,920 and financial motives mean they can be hired 63 00:03:19,920 --> 00:03:23,223 by state actors, example of that would be Conti. 64 00:03:32,250 --> 00:03:34,500 - So next we move on to Publication Models, 65 00:03:34,500 --> 00:03:38,760 which also serves as a brief, all too brief history 66 00:03:38,760 --> 00:03:43,760 of recent leaks and ways of leaking, thanks. 67 00:03:44,310 --> 00:03:47,280 First up, one of the oldest leaking institutions 68 00:03:47,280 --> 00:03:49,860 that's still active in the Western world, 69 00:03:49,860 --> 00:03:53,910 Cryptome, everybody's best friend. 70 00:03:53,910 --> 00:03:58,110 They've been publishing censored and leaked material 71 00:03:58,110 --> 00:04:03,000 online since 1996, using basic HTTP listings, 72 00:04:03,000 --> 00:04:06,210 and for a time an FTP server as well. 73 00:04:06,210 --> 00:04:08,970 They helped found WikiLeaks, they were on the initial 74 00:04:08,970 --> 00:04:13,620 advisory board and they helped register the domain name, 75 00:04:13,620 --> 00:04:15,810 but like I said, they criticize freely, 76 00:04:15,810 --> 00:04:18,300 and that includes WikiLeaks, 77 00:04:18,300 --> 00:04:21,420 although they strongly oppose the extradition 78 00:04:21,420 --> 00:04:25,800 and prosecution of Assange and gave testimony 79 00:04:25,800 --> 00:04:29,430 in one of the cases against him 80 00:04:29,430 --> 00:04:32,100 for the extradition attempt. 81 00:04:32,100 --> 00:04:35,700 And to this day, Cryptome continues to be active, 82 00:04:35,700 --> 00:04:39,930 which is a minor miracle considering it's been 83 00:04:39,930 --> 00:04:43,920 nearly 30 years, and they've faced threats 84 00:04:43,920 --> 00:04:46,890 from multiple corporate entities, 85 00:04:46,890 --> 00:04:50,610 as well as government agencies that have visited them 86 00:04:50,610 --> 00:04:53,190 and had all sorts of questions, 87 00:04:53,190 --> 00:04:55,080 and were often angry at them 88 00:04:55,080 --> 00:04:58,650 for making public documents too public, 89 00:04:58,650 --> 00:05:01,713 because what if people read them. 90 00:05:04,470 --> 00:05:07,650 Cryptome very naturally brings us into WikiLeaks, 91 00:05:07,650 --> 00:05:11,550 they wore every hat until they wore virtually none. 92 00:05:11,550 --> 00:05:13,470 They were revolutionary at times, 93 00:05:13,470 --> 00:05:15,360 a lot of debate was sparked, 94 00:05:15,360 --> 00:05:19,260 and then they were used by Russian intelligence. 95 00:05:19,260 --> 00:05:22,260 We know from exchanged messages that they received 96 00:05:22,260 --> 00:05:25,410 the DNC emails from Guccifer 2.0, 97 00:05:25,410 --> 00:05:29,280 and they appear to have received the Podesta emails 98 00:05:29,280 --> 00:05:33,240 from DC Leaks, also based on messages 99 00:05:33,240 --> 00:05:35,670 that we know of. 100 00:05:35,670 --> 00:05:39,720 Their last original leak was, I believe, late 2019, 101 00:05:39,720 --> 00:05:44,310 and that was one of the OPCW leaks, 102 00:05:44,310 --> 00:05:47,880 which that series has been tied to Russian intelligence, 103 00:05:47,880 --> 00:05:51,690 again, by a series of articles written by Daily Beast, 104 00:05:51,690 --> 00:05:53,610 New Lines Magazine, and Bellingcat, 105 00:05:53,610 --> 00:05:55,590 those are all very worth reading, 106 00:05:55,590 --> 00:05:58,650 because Russian embassies and diplomats 107 00:05:58,650 --> 00:06:02,310 are directly involved, and a sting operation 108 00:06:02,310 --> 00:06:04,620 was able to reveal quite a bit. 109 00:06:04,620 --> 00:06:07,500 And unfortunately, WikiLeaks throughout its history 110 00:06:07,500 --> 00:06:10,560 has suffered a lot of instability 111 00:06:10,560 --> 00:06:12,513 and periods of inoperability. 112 00:06:13,650 --> 00:06:16,710 There was the 2010 incident where their infrastructure 113 00:06:16,710 --> 00:06:20,767 was taken down, there was 2011 or 2012 114 00:06:22,170 --> 00:06:26,280 through 2015, I believe where they had no submission portal, 115 00:06:26,280 --> 00:06:28,740 they recently lost their submission portal again, 116 00:06:28,740 --> 00:06:33,413 and only very recently launched a portal that almost works. 117 00:06:36,060 --> 00:06:38,910 It will upload files, but sources will never know 118 00:06:38,910 --> 00:06:40,683 if it succeeded in uploading them. 119 00:06:42,150 --> 00:06:46,050 Which brings us next to Anonymous' answer to WikiLeaks, 120 00:06:46,050 --> 00:06:49,950 launched during a feud in 2012 and 2013, 121 00:06:49,950 --> 00:06:53,610 they called it Paranoia, short for Potentially Alarming 122 00:06:53,610 --> 00:06:57,630 Research from the Anonymous Intelligence Agency. 123 00:06:57,630 --> 00:07:01,020 Anonymous was frustrated by WikiLeaks' slow releases, 124 00:07:01,020 --> 00:07:03,420 and WikiLeaks for their part of the feud, 125 00:07:03,420 --> 00:07:07,353 was accusing Anonymous of insecure methods. 126 00:07:08,340 --> 00:07:11,070 And at this time, WikiLeaks' submission system 127 00:07:11,070 --> 00:07:14,910 was offline while Paranoia was meant to be a quick, 128 00:07:14,910 --> 00:07:17,880 simple leak platform, but unfortunately, 129 00:07:17,880 --> 00:07:20,160 that was one of the problems with Paranoia 130 00:07:20,160 --> 00:07:23,700 as it was very easily exploited. 131 00:07:23,700 --> 00:07:27,450 Some of the release notes were highly inaccurate, 132 00:07:27,450 --> 00:07:29,850 and given the context of those inaccuracies, 133 00:07:29,850 --> 00:07:32,970 that certainly had an agenda with them, 134 00:07:32,970 --> 00:07:36,810 and it was in particularly used by Maksym Popov 135 00:07:36,810 --> 00:07:38,703 to help launder some of this data. 136 00:07:40,500 --> 00:07:42,210 Next we have groups like the Intercept 137 00:07:42,210 --> 00:07:44,580 where they're literally building journalism 138 00:07:44,580 --> 00:07:46,530 from the ground up around leaks, 139 00:07:46,530 --> 00:07:50,220 and I know we all have thoughts about the Intercept, 140 00:07:50,220 --> 00:07:54,450 and certain people that worked there and no longer do, 141 00:07:54,450 --> 00:07:57,450 mistakes they've been made by individuals there, 142 00:07:57,450 --> 00:08:00,810 and yeah, we could say that about any outlet, 143 00:08:00,810 --> 00:08:05,010 but the lessons from the Intercept are still very useful, 144 00:08:05,010 --> 00:08:07,950 because they built it from the ground up 145 00:08:07,950 --> 00:08:10,500 to allow this kind of research. 146 00:08:10,500 --> 00:08:14,820 And they even tried to extend it beyond their own borders 147 00:08:14,820 --> 00:08:16,440 a bit with the Snowden archive, 148 00:08:16,440 --> 00:08:19,020 which unfortunately was closed, 149 00:08:19,020 --> 00:08:21,780 but they continue to be active and report on large leaks 150 00:08:21,780 --> 00:08:24,780 to this day, including partnering with regional outlets 151 00:08:24,780 --> 00:08:27,810 in some instances, such as data sets relating 152 00:08:27,810 --> 00:08:30,393 to the Russian invasion of Ukraine. 153 00:08:31,950 --> 00:08:33,960 Which brings us to the Consortium Model, 154 00:08:33,960 --> 00:08:38,000 where we have groups like ARIJ, EIC, Forbidden Stories, 155 00:08:38,000 --> 00:08:42,060 ICIJ, and OCCRP, you can see on the slide 156 00:08:42,060 --> 00:08:44,430 a list of a number of high profile projects, 157 00:08:44,430 --> 00:08:46,920 most of them dealing with finance 158 00:08:46,920 --> 00:08:49,620 that the consortium model all dealt with, 159 00:08:49,620 --> 00:08:53,190 and because of the international nature of these projects, 160 00:08:53,190 --> 00:08:56,940 consortiums are uniquely able to go after the data, 161 00:08:56,940 --> 00:09:00,360 because you need local experience for each realm, 162 00:09:00,360 --> 00:09:03,750 you need multiple experts, you need boots on the ground, 163 00:09:03,750 --> 00:09:07,533 and no one outlet can realistically handle that. 164 00:09:08,610 --> 00:09:10,560 They rarely publish raw data, 165 00:09:10,560 --> 00:09:13,770 but sometimes they do publish relational data, 166 00:09:13,770 --> 00:09:18,570 which you see with ICIJ, and some of their databases, 167 00:09:18,570 --> 00:09:20,163 which are publicly available. 168 00:09:21,300 --> 00:09:25,593 And then there's these people called DDoSecrets, 169 00:09:29,310 --> 00:09:32,340 that's us, in the last four years, 170 00:09:32,340 --> 00:09:34,890 we've published leaks from over 50 countries 171 00:09:34,890 --> 00:09:39,890 and over 200 releases, that number's a bit out of date, 172 00:09:40,320 --> 00:09:44,610 but we're constantly trying to balance 173 00:09:44,610 --> 00:09:46,830 source protection with source transparency, 174 00:09:46,830 --> 00:09:50,580 which is a major issue, especially with things like 175 00:09:50,580 --> 00:09:52,770 the Russian Ukrainian war, we have people 176 00:09:52,770 --> 00:09:56,850 sending us data sets, and there's a very obvious 177 00:09:56,850 --> 00:10:00,510 question when it's something that gets the cyber war tag 178 00:10:00,510 --> 00:10:03,330 that we created, awarding people to the context 179 00:10:03,330 --> 00:10:07,770 and that there's no specific suspicion for these data sets, 180 00:10:07,770 --> 00:10:10,170 but it's still something that you should look at 181 00:10:10,170 --> 00:10:11,973 more closely and be more aware of. 182 00:10:13,290 --> 00:10:17,550 We also strongly focus on separating editorial 183 00:10:17,550 --> 00:10:22,260 and what the meaning of the leak is, 184 00:10:22,260 --> 00:10:25,140 from what we do, which is presenting the data 185 00:10:25,140 --> 00:10:28,770 we will help journalists interpret it as best we can, 186 00:10:28,770 --> 00:10:30,480 but we don't tell them what to write, 187 00:10:30,480 --> 00:10:35,347 we don't present our own analysis of it, because one, 188 00:10:36,330 --> 00:10:38,430 we have data from over 50 countries 189 00:10:38,430 --> 00:10:41,820 and over 200 organizations that range from topics 190 00:10:41,820 --> 00:10:46,310 of artificial intelligence to manufacture 191 00:10:47,250 --> 00:10:51,570 of nuclear power plants, we are not, 192 00:10:51,570 --> 00:10:56,040 and cannot ever be experts on all of these subjects, 193 00:10:56,040 --> 00:10:58,230 nevermind the language barriers. 194 00:10:58,230 --> 00:11:01,260 It is better left for the people who are already experts 195 00:11:01,260 --> 00:11:05,010 in that than for us to try to become everything. 196 00:11:05,010 --> 00:11:07,443 Oh, I seem to have hit, sorry about that. 197 00:11:09,240 --> 00:11:11,310 And this also helps prevent our biases 198 00:11:11,310 --> 00:11:15,210 from getting in the way of what the data says, 199 00:11:15,210 --> 00:11:17,040 because when you touch this much data 200 00:11:17,040 --> 00:11:18,840 and you bring it to the public, 201 00:11:18,840 --> 00:11:22,860 it is very easy to infect it with your point of view 202 00:11:22,860 --> 00:11:26,550 and your messaging, and it can't become 203 00:11:26,550 --> 00:11:29,250 an inherent part of the data. 204 00:11:29,250 --> 00:11:32,250 One thing we witnessed with WikiLeaks and the Vault 7 205 00:11:32,250 --> 00:11:36,660 releases was, they wrote about 206 00:11:36,660 --> 00:11:41,340 how certain devices could be exploited 207 00:11:41,340 --> 00:11:43,920 and how that could then be leveraged 208 00:11:43,920 --> 00:11:48,540 to get past the encryption on things like 209 00:11:48,540 --> 00:11:51,270 Signal and WhatsApp, by making the encryption 210 00:11:51,270 --> 00:11:54,990 literally irrelevant, but people took away 211 00:11:54,990 --> 00:11:57,510 the wrong message from that for several articles 212 00:11:57,510 --> 00:11:59,520 and a large number of people on Twitter, 213 00:11:59,520 --> 00:12:04,080 because of a imperfectly crafted tweet. 214 00:12:04,080 --> 00:12:07,830 And so we have a great responsibility to not do that, 215 00:12:07,830 --> 00:12:12,600 our goal is to collect the data, review it, 216 00:12:12,600 --> 00:12:15,810 and then entrust local reporters, investigators, 217 00:12:15,810 --> 00:12:19,050 and hactivists, and experts to follow through, 218 00:12:19,050 --> 00:12:23,073 and in many situations to find the right consortium. 219 00:12:25,470 --> 00:12:29,400 Moving on, we get into actual state hackers. 220 00:12:29,400 --> 00:12:33,480 DC Leaks was an exercise in Persona and Access Management, 221 00:12:33,480 --> 00:12:36,060 while some of the data was public, not all of it was, 222 00:12:36,060 --> 00:12:38,460 which was a way of playing favoritism, 223 00:12:38,460 --> 00:12:41,700 a way of creating mystique, and hiding 224 00:12:41,700 --> 00:12:45,540 some of the overlap between various releases. 225 00:12:45,540 --> 00:12:47,400 DC Leaks was later linked to fake 226 00:12:47,400 --> 00:12:50,550 journalist personas by investigations 227 00:12:50,550 --> 00:12:54,840 and especially forensic ones, 228 00:12:54,840 --> 00:12:58,110 which followed different digital accounts, 229 00:12:58,110 --> 00:13:00,930 and there were early, and unclear, 230 00:13:00,930 --> 00:13:03,200 and inconsistent ties to Guccifer 2.0 231 00:13:03,200 --> 00:13:06,870 established publicly early on, for instance, 232 00:13:06,870 --> 00:13:10,860 the email in which Guccifer 2.0 said that DC Leaks 233 00:13:10,860 --> 00:13:14,370 was a WikiLeaks sub-project, and they provided 234 00:13:14,370 --> 00:13:18,243 restricted access to DC Leaks' releases. 235 00:13:20,850 --> 00:13:24,360 Thus, we have Guccifer 2.0 selling the narrative, 236 00:13:24,360 --> 00:13:26,390 which was launched obviously to 237 00:13:33,480 --> 00:13:36,060 counter the revelation that was then 238 00:13:36,060 --> 00:13:40,800 new of Russian hacking of the DNC, DCCC, et cetera. 239 00:13:40,800 --> 00:13:43,890 They used a combination of blog and social media posts 240 00:13:43,890 --> 00:13:47,130 with individual documents, some of which had been tampered, 241 00:13:47,130 --> 00:13:49,020 and larger dumps. 242 00:13:49,020 --> 00:13:52,740 We know from government investigations that Guccifer 2.0 243 00:13:52,740 --> 00:13:56,853 communicated with over 12,000 Twitter accounts, 244 00:13:57,990 --> 00:14:01,080 exchanging over 15,000 messages. 245 00:14:01,080 --> 00:14:03,360 We've only managed to identify so far 246 00:14:03,360 --> 00:14:07,110 about 10% of those messages, and far fewer 247 00:14:07,110 --> 00:14:09,674 than 10% of the accounts 248 00:14:09,674 --> 00:14:12,600 that communicated with Guccifer 2.0, 249 00:14:12,600 --> 00:14:17,160 but the known discussions are part of the transcript 250 00:14:17,160 --> 00:14:21,690 cited at the end of this, thus spoke Guccifer 2.0, 251 00:14:21,690 --> 00:14:24,720 and we also know from the messages that they were active 252 00:14:24,720 --> 00:14:27,420 nearly 24 hours a day when they were active, 253 00:14:27,420 --> 00:14:28,720 which is another giveaway. 254 00:14:30,180 --> 00:14:33,210 So what does State-Affiliated actually look like? 255 00:14:33,210 --> 00:14:37,710 Because everyone has ideas of what they think it is 256 00:14:37,710 --> 00:14:41,370 or what they think other people think it is, 257 00:14:41,370 --> 00:14:44,910 and you especially see that as a political weapon, 258 00:14:44,910 --> 00:14:47,553 which is nonsense and infuriating. 259 00:14:49,650 --> 00:14:53,550 Popov, Maksym Igor Popov was a Russian contractor 260 00:14:53,550 --> 00:14:57,993 who infiltrated Anonymous, and before that, the FBI. 261 00:14:59,040 --> 00:15:02,730 He was arrested by the FBI and turned into an asset, 262 00:15:02,730 --> 00:15:06,000 and on his first job, he was sent after the people 263 00:15:06,000 --> 00:15:08,790 that he used to work with, but the FBI 264 00:15:08,790 --> 00:15:10,950 didn't actually watch very closely 265 00:15:10,950 --> 00:15:14,550 what he said in Russian, and by using some unique 266 00:15:14,550 --> 00:15:19,550 idioms that were a little less known to the translators, 267 00:15:19,890 --> 00:15:21,570 he warned them what was happening 268 00:15:21,570 --> 00:15:25,470 and they were able to get away free, 269 00:15:25,470 --> 00:15:27,360 but he then went on to help them with a number 270 00:15:27,360 --> 00:15:29,790 of other things before being let go 271 00:15:29,790 --> 00:15:33,540 under questionable circumstances, 272 00:15:33,540 --> 00:15:35,933 and when I say questionable, 273 00:15:35,933 --> 00:15:38,130 I mean the FBI agent responsible 274 00:15:38,130 --> 00:15:41,973 was investigated and nearly indicted over it. 275 00:15:43,380 --> 00:15:48,150 He was involved in the 2004, 2005 FBI email hack, 276 00:15:48,150 --> 00:15:49,980 didn't get a lot of coverage at the time, 277 00:15:49,980 --> 00:15:53,010 but they didn't hack the FBI directly, 278 00:15:53,010 --> 00:15:57,270 but rather the AT&T servers that the FBI used 279 00:15:57,270 --> 00:16:00,750 for a number of their things, including their emails, 280 00:16:00,750 --> 00:16:03,630 and these were sensitive emails. 281 00:16:03,630 --> 00:16:08,430 And Popov was never so much a technical 282 00:16:08,430 --> 00:16:11,850 hacker himself, but he was the person on the crew 283 00:16:11,850 --> 00:16:14,760 that made things happen, he developed relationships 284 00:16:14,760 --> 00:16:19,410 and he monetized things, and so he got the FBI 285 00:16:19,410 --> 00:16:22,890 to pay him and his people $10,000 286 00:16:22,890 --> 00:16:27,870 for a meaningless lead on the hack 287 00:16:27,870 --> 00:16:30,990 that they had just committed against the FBI. 288 00:16:30,990 --> 00:16:33,210 They identified one of the people involved, 289 00:16:33,210 --> 00:16:36,900 Leonid Sokolov, who cannot be indicted 290 00:16:36,900 --> 00:16:41,130 and is never going to leave to go to an indictable area. 291 00:16:41,130 --> 00:16:44,070 Popov used numerous false personas, 292 00:16:44,070 --> 00:16:48,270 and some of them are linked to some very interesting 293 00:16:48,270 --> 00:16:52,350 other hack and leak situations, for instance, 294 00:16:52,350 --> 00:16:56,040 the hack and leak of Ukrainian Prosecutor-General, 295 00:16:56,040 --> 00:17:00,390 which was done by Popov, overlaps significantly 296 00:17:00,390 --> 00:17:02,940 with CyberBerkut's similar release, 297 00:17:02,940 --> 00:17:05,733 right down to the same office and timeline, 298 00:17:06,600 --> 00:17:09,420 although, their release was much more limited 299 00:17:09,420 --> 00:17:13,050 to a few documents, Popov released several 300 00:17:13,050 --> 00:17:16,890 gigabytes from that office and several others. 301 00:17:16,890 --> 00:17:20,040 And he's obviously financially motivated, 302 00:17:20,040 --> 00:17:22,380 but aside from his own admissions 303 00:17:22,380 --> 00:17:25,890 to being a state contractor for Russia, 304 00:17:25,890 --> 00:17:27,900 which he said to Jeffrey Carr, 305 00:17:27,900 --> 00:17:30,330 and has implied to other journalists, 306 00:17:30,330 --> 00:17:33,900 there is the fact that if you are living in Russia 307 00:17:33,900 --> 00:17:38,250 and you hack the FBI, and it is that 308 00:17:38,250 --> 00:17:41,820 high profile, and you do not pay patronage 309 00:17:41,820 --> 00:17:46,773 to mother Russia, you lose all protection. 310 00:17:48,720 --> 00:17:52,410 It is exceedingly unlikely, simply based on that, 311 00:17:52,410 --> 00:17:56,490 but also the reward, there's no reason 312 00:17:56,490 --> 00:17:58,090 they wouldn't have pursued that. 313 00:17:59,670 --> 00:18:02,040 Which brings us to Sabu, everyone's favorite 314 00:18:02,040 --> 00:18:04,233 American state sponsored hacker. 315 00:18:05,280 --> 00:18:08,400 A member of Anonymous turned to an FBI asset, 316 00:18:08,400 --> 00:18:11,010 while he was active, the FBI closely monitored 317 00:18:11,010 --> 00:18:13,170 and controlled him after his arrest, 318 00:18:13,170 --> 00:18:15,150 they watched what was on his monitor, 319 00:18:15,150 --> 00:18:19,260 they took pictures of it, they were involved every day, 320 00:18:19,260 --> 00:18:21,690 and they had the opportunity to direct him 321 00:18:21,690 --> 00:18:24,603 to do things differently, or to stop entirely. 322 00:18:26,100 --> 00:18:28,740 Through their observation, control, 323 00:18:28,740 --> 00:18:32,043 and failure to stop, they directed him. 324 00:18:33,750 --> 00:18:37,500 That is beyond a doubt, and those directions 325 00:18:37,500 --> 00:18:40,680 included having Sabu direct cyber attacks 326 00:18:40,680 --> 00:18:43,650 on foreign government and commercial systems, 327 00:18:43,650 --> 00:18:47,040 as well as orchestrating the Stratfor hack and leak, 328 00:18:47,040 --> 00:18:50,043 and his unwitting collaboration with Popov, 329 00:18:51,279 --> 00:18:53,430 which is a very fun thing to discover 330 00:18:53,430 --> 00:18:56,400 when you're going through leaked chats. 331 00:18:56,400 --> 00:18:59,190 But Sabu was more than just a criminal informant, 332 00:18:59,190 --> 00:19:01,710 by doing these things, the FBI was using him 333 00:19:01,710 --> 00:19:05,163 for foreign and domestic intelligence gathering for the FBI. 334 00:19:06,750 --> 00:19:08,220 So what about the links between 335 00:19:08,220 --> 00:19:09,663 people like Popov and Sabu? 336 00:19:10,830 --> 00:19:15,090 When the lines blur, these people enable each other, 337 00:19:15,090 --> 00:19:18,330 and that's not just Popov and Sabu, 338 00:19:18,330 --> 00:19:20,730 that's a general trend. 339 00:19:20,730 --> 00:19:24,720 Sabu and Paranoia both laundered Popov's leaks, 340 00:19:24,720 --> 00:19:28,690 we can see in chats where Popov literally gives them 341 00:19:30,039 --> 00:19:32,947 to Sabu, and Sabu puts them forth saying, 342 00:19:32,947 --> 00:19:35,820 "It's an AntiSec release, it's a LulzSec release," 343 00:19:35,820 --> 00:19:39,150 and they're the most shady ones, and in several instances, 344 00:19:39,150 --> 00:19:41,640 people who were actually involved in those groups 345 00:19:41,640 --> 00:19:43,680 then became very concerned afterwards 346 00:19:43,680 --> 00:19:47,130 about issues with those data sets. 347 00:19:47,130 --> 00:19:49,740 Sabu also offered Popov early access 348 00:19:49,740 --> 00:19:53,400 to the Syria emails released by WikiLeaks, 349 00:19:53,400 --> 00:19:54,960 and that's significant as well, 350 00:19:54,960 --> 00:19:58,350 because not only was the one banking transfer 351 00:19:58,350 --> 00:20:01,800 email missing from the WikiLeaks release, 352 00:20:01,800 --> 00:20:05,790 but over 1 million of the 2.4 million emails 353 00:20:05,790 --> 00:20:09,750 is not been published by WikiLeaks. 354 00:20:09,750 --> 00:20:12,690 You can review this on the WikiLeaks website, 355 00:20:12,690 --> 00:20:17,280 or I wrote about it on my site, emma.best, 356 00:20:17,280 --> 00:20:18,750 where you can also download a script 357 00:20:18,750 --> 00:20:20,703 and manually verify it yourself. 358 00:20:22,890 --> 00:20:25,050 And that is one mystery that they have 359 00:20:25,050 --> 00:20:28,503 failed to follow up on or comment on, 360 00:20:29,490 --> 00:20:31,950 but maybe it's the same secret lizards thing 361 00:20:31,950 --> 00:20:35,010 that they commented about the Clinton leaks, 362 00:20:35,010 --> 00:20:37,910 it's a true story, you can find it in the Wayback Machine. 363 00:20:40,140 --> 00:20:41,370 While they were working together, 364 00:20:41,370 --> 00:20:44,730 Popov and Sabu actively discussed using cyber attacks 365 00:20:44,730 --> 00:20:48,390 on government systems, and using false flag cyber attacks 366 00:20:48,390 --> 00:20:51,420 to quote, create real cyberwar. 367 00:20:51,420 --> 00:20:54,840 Keep in mind, during this time, 368 00:20:54,840 --> 00:20:58,230 Sabu was under the FBI's control. 369 00:20:58,230 --> 00:21:01,110 He was having ongoing discussions with people 370 00:21:01,110 --> 00:21:03,570 about false flag cyber attacks, 371 00:21:03,570 --> 00:21:06,240 with the goal of creating, not just chaos, 372 00:21:06,240 --> 00:21:11,240 but conflict, and Popov's activities 373 00:21:11,520 --> 00:21:16,520 included faking funding of terrorism, 374 00:21:16,571 --> 00:21:21,060 by one country he is actually one of the only people who, 375 00:21:21,060 --> 00:21:23,880 in the modern era can say he has pissed off 376 00:21:23,880 --> 00:21:28,140 both the FBI and the KGB, because Belarus 377 00:21:28,140 --> 00:21:31,740 does not like him after some of the shit he pulled. 378 00:21:31,740 --> 00:21:34,500 And Popov even gave Sabu targets, 379 00:21:34,500 --> 00:21:36,600 targets and credentials, and we know that those 380 00:21:36,600 --> 00:21:38,610 were passed on, some of them were even given 381 00:21:38,610 --> 00:21:42,240 to Jeremy Hammond, and if you look at the unredacted 382 00:21:42,240 --> 00:21:44,460 paperwork for his court case, 383 00:21:44,460 --> 00:21:47,280 some of which was leaked to me as part of his discovery, 384 00:21:47,280 --> 00:21:49,410 you'll see that those are in fact, 385 00:21:49,410 --> 00:21:52,053 the same ones that Popov gave to Sabu. 386 00:21:53,190 --> 00:21:57,480 So we have a former FBI asset and a Russian contractor 387 00:21:57,480 --> 00:22:02,480 giving a FBI asset, who is under FBI control, 388 00:22:02,520 --> 00:22:06,360 credentials to attack foreign government systems 389 00:22:06,360 --> 00:22:09,300 to an American hactivist who is then convicted 390 00:22:09,300 --> 00:22:13,740 for doing those things, and these are the kinds of state 391 00:22:13,740 --> 00:22:18,240 sponsored actions that are never looked at, 392 00:22:18,240 --> 00:22:23,070 they are not understood, and why would they 393 00:22:23,070 --> 00:22:26,580 be looked at, there's already a scapegoat, 394 00:22:26,580 --> 00:22:29,163 Jeremy Hammond did the fucking thing, 395 00:22:30,210 --> 00:22:34,320 and we don't need accountability beyond that, 396 00:22:34,320 --> 00:22:38,940 because that would just make everyone look bad, 397 00:22:38,940 --> 00:22:43,830 and no one could stand that, looking bad 398 00:22:43,830 --> 00:22:47,043 is worse than people dying, 399 00:22:48,330 --> 00:22:50,280 at least in the eyes of the government. 400 00:22:52,350 --> 00:22:55,080 We move on to Guccifer 2.0, one of the most 401 00:22:55,080 --> 00:22:56,850 telling quotes about Guccifer 2.0 402 00:22:56,850 --> 00:22:59,497 comes from Julian Assange, where he said, 403 00:22:59,497 --> 00:23:02,280 "These look very much like they're from the Russians, 404 00:23:02,280 --> 00:23:05,370 they almost look too much like the Russians." 405 00:23:05,370 --> 00:23:07,710 It was of course, a persona managed by Russian 406 00:23:07,710 --> 00:23:09,930 intelligence services, they were the source 407 00:23:09,930 --> 00:23:12,750 of the DNC emails, we know this from public statements, 408 00:23:12,750 --> 00:23:15,750 as well as private statements they made in their chats 409 00:23:15,750 --> 00:23:20,100 with WikiLeaks, the transcript shows the communications 410 00:23:20,100 --> 00:23:22,320 with and submissions to WikiLeaks' discussion 411 00:23:22,320 --> 00:23:26,010 about timeline, and WikiLeaks, of course, 412 00:23:26,010 --> 00:23:28,780 explicitly stating we want to do this 413 00:23:30,079 --> 00:23:32,670 in time for the DMC, so we can have this specific 414 00:23:32,670 --> 00:23:35,670 political impact, but despite the overwhelming 415 00:23:35,670 --> 00:23:38,460 amount of evidence about Guccifer 2.0, 416 00:23:38,460 --> 00:23:41,430 there are still truthers out there who insist 417 00:23:41,430 --> 00:23:45,780 on Seth Rich this or VIPS that, 418 00:23:45,780 --> 00:23:50,250 or Forensicator, something or other, 419 00:23:50,250 --> 00:23:52,590 and that is one of the things that happens 420 00:23:52,590 --> 00:23:54,270 when there's a failure to communicate 421 00:23:54,270 --> 00:23:59,220 beyond thick incomprehensible reports, 422 00:23:59,220 --> 00:24:01,530 which are also unfortunately very easy 423 00:24:01,530 --> 00:24:04,233 to manipulate in terms of media. 424 00:24:05,730 --> 00:24:08,850 A much more recent example that I think many of you 425 00:24:08,850 --> 00:24:11,250 may not have heard of is Free Civilian, 426 00:24:11,250 --> 00:24:15,060 the data merchant that was a terrorist. 427 00:24:15,060 --> 00:24:18,210 They claim to sell data, but they posted it freely, 428 00:24:18,210 --> 00:24:21,690 including Ukrainian medical data and about 1 million 429 00:24:21,690 --> 00:24:23,460 government emails from Ukraine 430 00:24:23,460 --> 00:24:25,083 for their internal development. 431 00:24:26,580 --> 00:24:29,280 They used Cloudflare to protect their Swiss servers 432 00:24:29,280 --> 00:24:31,803 for distribution, and after the servers, 433 00:24:32,820 --> 00:24:36,210 the company was notified, the Private Layer Inc 434 00:24:36,210 --> 00:24:39,330 took their servers offline, however, Cloudflare, 435 00:24:39,330 --> 00:24:43,500 last I checked, continued to protect the now defunct domain, 436 00:24:43,500 --> 00:24:47,040 despite being told explicitly what it was, 437 00:24:47,040 --> 00:24:49,440 being provided proof of what it was, 438 00:24:49,440 --> 00:24:52,830 and outside analysis that confirmed that, yes, 439 00:24:52,830 --> 00:24:56,340 this was almost certainly Russian state-affiliated actors, 440 00:24:56,340 --> 00:25:00,120 and it was almost certainly a hack and leak psyop 441 00:25:00,120 --> 00:25:03,870 to create fear as part of the Russian invasion of Ukraine, 442 00:25:03,870 --> 00:25:08,283 making it not a criminal act, but an act of war. 443 00:25:10,140 --> 00:25:11,767 Cloudflare simply responded, 444 00:25:11,767 --> 00:25:14,250 "We are not hosting the content, 445 00:25:14,250 --> 00:25:16,977 we're simply helping them host it." 446 00:25:19,350 --> 00:25:22,380 This brings us to the issue of Misidentifications, 447 00:25:22,380 --> 00:25:24,750 because it happens both ways, where we either 448 00:25:24,750 --> 00:25:27,420 miss someone who was a state actor, 449 00:25:27,420 --> 00:25:30,360 or we look at someone that wasn't a state actor, 450 00:25:30,360 --> 00:25:34,200 and someone decides they were. 451 00:25:34,200 --> 00:25:36,753 And for Sabu, the answer is simple, 452 00:25:37,620 --> 00:25:39,930 agent Brutus says he was a hero, 453 00:25:39,930 --> 00:25:41,640 agent Brutus is an honorable man, 454 00:25:41,640 --> 00:25:45,210 and he has brought many captives home to Rome. 455 00:25:45,210 --> 00:25:49,140 So when he said Sabu did great, 456 00:25:49,140 --> 00:25:52,080 he prevented all these attacks, 457 00:25:52,080 --> 00:25:55,413 I mean, he started them, but he prevented them in the end, 458 00:25:56,280 --> 00:26:00,690 that's so great, he's the terrorist and the hero. 459 00:26:00,690 --> 00:26:05,690 And normally that's a crime, but not this time. 460 00:26:07,590 --> 00:26:11,400 And for the most part, people, especially in the mainstream, 461 00:26:11,400 --> 00:26:13,860 especially mainstream outlets, went with it, 462 00:26:13,860 --> 00:26:18,860 they trusted agent Brutus, because he was an honorable man, 463 00:26:20,100 --> 00:26:23,310 and he had arrested many people, so surely 464 00:26:23,310 --> 00:26:25,503 he knew what he was talking about. 465 00:26:29,220 --> 00:26:32,070 Then we have Popov, he was simply missed 466 00:26:32,070 --> 00:26:36,540 because he was a con artist with too many fake IDs, 467 00:26:36,540 --> 00:26:41,380 that and the FBI agent responsible 468 00:26:43,020 --> 00:26:45,720 kind of just stonewalled when he was asked 469 00:26:45,720 --> 00:26:47,793 to help solve what was going on. 470 00:26:51,545 --> 00:26:53,700 And then we have people like donk_enby 471 00:26:53,700 --> 00:26:57,127 who are hit with the worst kind of reasoning. 472 00:26:57,127 --> 00:27:01,380 "Only a state actor could have done this." 473 00:27:01,380 --> 00:27:03,510 Which you inevitably hear from the least 474 00:27:03,510 --> 00:27:06,510 educated people when it comes to how computers 475 00:27:06,510 --> 00:27:09,210 and networks and hacks work, 476 00:27:09,210 --> 00:27:12,000 because they will look at something big, 477 00:27:12,000 --> 00:27:14,310 some big accomplishment, and for donk_enby 478 00:27:14,310 --> 00:27:17,760 it was the Parler stuff, and they'll say this was big, 479 00:27:17,760 --> 00:27:21,280 so it had to be something equally big 480 00:27:22,170 --> 00:27:25,470 to do it, and this sort of thinking is also what leads 481 00:27:25,470 --> 00:27:28,440 to a lot of conspiracy theory thinking, 482 00:27:28,440 --> 00:27:31,320 like the assassination of JFK was a big event, 483 00:27:31,320 --> 00:27:33,660 so something big must have been behind it, 484 00:27:33,660 --> 00:27:37,800 it could not have been a crazy dude, 485 00:27:37,800 --> 00:27:41,670 to be way overly brief, I've gone into that stuff 486 00:27:41,670 --> 00:27:43,890 a whole lot, please don't think I'm actually 487 00:27:43,890 --> 00:27:46,233 simplifying it that much for realsies. 488 00:27:50,610 --> 00:27:53,370 But yeah, people simply not knowing 489 00:27:53,370 --> 00:27:55,260 what they're talking about, you'll see an article 490 00:27:55,260 --> 00:27:57,180 that says maybe they did this with the help 491 00:27:57,180 --> 00:28:00,570 of whatever country, there was one article 492 00:28:00,570 --> 00:28:03,960 recently about the NAIRU police force league, 493 00:28:03,960 --> 00:28:08,910 and a cyber firm pointed out some issues 494 00:28:08,910 --> 00:28:13,910 that they thought were inconsistent, 495 00:28:14,070 --> 00:28:17,730 and they mentioned me several times in the report, 496 00:28:17,730 --> 00:28:19,920 never reached out to me, 497 00:28:19,920 --> 00:28:23,160 which I thought was an interesting choice, 498 00:28:23,160 --> 00:28:25,470 but they did say I didn't appear to have 499 00:28:25,470 --> 00:28:28,740 any involvement in anything, it was a very sloppy report, 500 00:28:28,740 --> 00:28:31,470 but it pointed out some things with timestamps, 501 00:28:31,470 --> 00:28:33,480 and then a journalist saw that, 502 00:28:33,480 --> 00:28:36,120 took that to someone who worked at a think tank, 503 00:28:36,120 --> 00:28:39,687 and that person said, "It was probably China," 504 00:28:40,740 --> 00:28:44,583 because China would want to do something like that. 505 00:28:46,230 --> 00:28:48,090 And then that became the headline, 506 00:28:48,090 --> 00:28:51,390 and several other people reported that headline, 507 00:28:51,390 --> 00:28:56,103 and there was zero evidence of China's involvement, 508 00:28:57,510 --> 00:29:00,660 but that's how that sort of thing can get started. 509 00:29:00,660 --> 00:29:05,580 It's, "Oh, this was a complicated leak 510 00:29:05,580 --> 00:29:08,400 and things look a little fishy, 511 00:29:08,400 --> 00:29:10,500 so it's gotta be a state hacker," 512 00:29:10,500 --> 00:29:15,000 no, it looks fishy because it's complicated 513 00:29:15,000 --> 00:29:16,443 and you don't understand it. 514 00:29:19,170 --> 00:29:21,240 Which brings us to the big question, 515 00:29:21,240 --> 00:29:23,940 or the big questions, first off, 516 00:29:23,940 --> 00:29:26,943 are they, you know, spies? 517 00:29:28,020 --> 00:29:30,120 And it's a surprisingly broad question, 518 00:29:30,120 --> 00:29:32,460 and it's not actually even the right question, 519 00:29:32,460 --> 00:29:35,220 because both sources can be exploited 520 00:29:35,220 --> 00:29:38,130 and material can be exploited. 521 00:29:38,130 --> 00:29:41,310 And if the answer to either is, yes, 522 00:29:41,310 --> 00:29:43,890 it's not necessarily an emergency shutdown, 523 00:29:43,890 --> 00:29:48,870 it's a red flag, because something 524 00:29:48,870 --> 00:29:53,010 just being exploited doesn't make it untrue or dangerous, 525 00:29:53,010 --> 00:29:55,890 Soviet propaganda used to point out racism 526 00:29:55,890 --> 00:30:00,273 in the US a lot, and they were right, 527 00:30:01,320 --> 00:30:05,670 it's not a problem if it is accurate, 528 00:30:05,670 --> 00:30:10,670 and not being embellished or twisted towards foul ends, 529 00:30:10,680 --> 00:30:13,980 and there are ways you can help make sure that it's not, 530 00:30:13,980 --> 00:30:16,353 or that there are counterbalancing forces, 531 00:30:17,490 --> 00:30:22,110 but usually the first clue is the source themselves. 532 00:30:22,110 --> 00:30:25,260 If you have contact with the source at all, 533 00:30:25,260 --> 00:30:30,260 any questions without getting into their security at all, 534 00:30:30,870 --> 00:30:35,610 can tell you a lot, one, are they trying to micromanage? 535 00:30:35,610 --> 00:30:37,260 Are they trying to tell you what to do, 536 00:30:37,260 --> 00:30:40,410 how to handle things, when it needs to be released, 537 00:30:40,410 --> 00:30:42,993 how it needs to be labeled? 538 00:30:45,260 --> 00:30:48,900 Are they trying to turn you into their agent? 539 00:30:48,900 --> 00:30:52,230 If so, that's a problem. 540 00:30:52,230 --> 00:30:55,050 Next up is, can the source answer questions 541 00:30:55,050 --> 00:30:57,576 coherently and consistently? 542 00:30:57,576 --> 00:31:01,710 And it's amazing how often 543 00:31:01,710 --> 00:31:05,280 bad actors are not able to do this, we had one source 544 00:31:05,280 --> 00:31:09,300 submit a group of emails, allegedly from China, 545 00:31:09,300 --> 00:31:12,720 and they were unable to tell us what email accounts 546 00:31:12,720 --> 00:31:16,260 they were from, or what agencies the email accounts 547 00:31:16,260 --> 00:31:19,500 were from, or anything about the contents, 548 00:31:19,500 --> 00:31:23,010 other than a lot of stuff. 549 00:31:23,010 --> 00:31:26,010 And while we don't expect sources to necessarily 550 00:31:26,010 --> 00:31:29,400 have a total knowledge of every single thing 551 00:31:29,400 --> 00:31:30,600 that are in these data sets, 552 00:31:30,600 --> 00:31:33,513 'cause some of them are terabytes in size, 553 00:31:35,938 --> 00:31:37,770 if you are a leaker or a hacker, 554 00:31:37,770 --> 00:31:41,700 you presumably know the basics 555 00:31:41,700 --> 00:31:46,170 of what the information is when you've got it, 556 00:31:46,170 --> 00:31:48,900 you're not just picking up trash off the floor 557 00:31:48,900 --> 00:31:51,753 and then bringing it to us and saying here, 558 00:31:53,130 --> 00:31:56,430 and those kinds of failures often mean 559 00:31:56,430 --> 00:31:59,220 you're dealing with a cutout or with someone 560 00:31:59,220 --> 00:32:03,843 who just, there's some other red flag. 561 00:32:04,710 --> 00:32:07,290 And again, we come to the question of, 562 00:32:07,290 --> 00:32:10,020 are they trying to sell a narrative? 563 00:32:10,020 --> 00:32:13,170 And that doesn't mean, are they trying to shine a light 564 00:32:13,170 --> 00:32:16,140 on an issue, because there's a big difference 565 00:32:16,140 --> 00:32:20,460 between saying, "These refugees are being abused, 566 00:32:20,460 --> 00:32:23,130 and treated horrendously, and denied their rights, 567 00:32:23,130 --> 00:32:24,540 and the police are part of it, 568 00:32:24,540 --> 00:32:26,517 and the government knows about it," 569 00:32:27,391 --> 00:32:30,547 there's a big difference between that and, 570 00:32:30,547 --> 00:32:35,547 "The CIA is bad and needs to be turned into 571 00:32:35,640 --> 00:32:38,820 something else because of these exact things 572 00:32:38,820 --> 00:32:42,750 that also further this person's political 573 00:32:42,750 --> 00:32:46,560 narrative and goal and whatnot," 574 00:32:46,560 --> 00:32:50,040 you know, could see a narrative being formed now, 575 00:32:50,040 --> 00:32:52,830 not related to leaks so much, but the kind of narrative 576 00:32:52,830 --> 00:32:54,870 I'm talking about just by watching 577 00:32:54,870 --> 00:32:57,333 the fallout from the Mar-a-Lago raid, 578 00:32:59,724 --> 00:33:02,160 it's the same kind of concept, 579 00:33:02,160 --> 00:33:04,260 people trying to build a narrative, 580 00:33:04,260 --> 00:33:07,740 and once you publish, that's going to be unavoidable, 581 00:33:07,740 --> 00:33:09,783 you are releasing it into the world, 582 00:33:12,870 --> 00:33:15,600 even if you restrict it to just journalists and researchers, 583 00:33:15,600 --> 00:33:17,340 which is one thing DDoSecrets does 584 00:33:17,340 --> 00:33:21,840 on sensitive data sets, you're still letting go 585 00:33:21,840 --> 00:33:24,210 of how it's going to be interpreted 586 00:33:24,210 --> 00:33:25,980 and what they're going to do with it, 587 00:33:25,980 --> 00:33:28,890 but if the source is clearly trying to sell 588 00:33:28,890 --> 00:33:31,353 or push a narrative, you have a problem. 589 00:33:33,420 --> 00:33:35,253 Other questions include timing, 590 00:33:36,210 --> 00:33:39,093 does the situation or the timing force your hand? 591 00:33:40,110 --> 00:33:42,840 Are you being given information three days 592 00:33:42,840 --> 00:33:45,600 before it becomes crucially relevant? 593 00:33:45,600 --> 00:33:48,840 And if so, why right then? 594 00:33:48,840 --> 00:33:52,380 What relevant external events are going on? 595 00:33:52,380 --> 00:33:55,200 Elections or armed conflicts. 596 00:33:55,200 --> 00:33:58,290 And what is the goal for those things? 597 00:33:58,290 --> 00:34:00,900 Is it to shed light on it, or is it to intervene? 598 00:34:00,900 --> 00:34:02,763 Because both can be valid, 599 00:34:04,530 --> 00:34:06,960 intervention through freedom of information 600 00:34:06,960 --> 00:34:11,960 is absolutely a fair way of participating in the world. 601 00:34:13,530 --> 00:34:18,210 That's what journalism is, that's what academia is, 602 00:34:18,210 --> 00:34:20,640 that's how the world gets changed by people 603 00:34:20,640 --> 00:34:22,623 who don't carry guns. 604 00:34:26,220 --> 00:34:28,770 The next question brings us to counterbalances, 605 00:34:28,770 --> 00:34:31,380 it's their time for it, because one of the things 606 00:34:31,380 --> 00:34:35,880 we saw with the DNC leaks and the Macron leaks was, 607 00:34:35,880 --> 00:34:39,360 no, they were purposely released right before 608 00:34:39,360 --> 00:34:43,770 an event that they would have maximum shock impact on, 609 00:34:43,770 --> 00:34:48,770 and they would have very little time for, one second, 610 00:34:52,080 --> 00:34:54,510 they would have very little time for anyone 611 00:34:54,510 --> 00:34:58,500 to then go through and review the initial findings, 612 00:34:58,500 --> 00:35:01,980 or critique them, or get a better understanding 613 00:35:01,980 --> 00:35:05,580 of what's going on, because you're just giving 614 00:35:05,580 --> 00:35:08,620 people the tiniest bit of 615 00:35:10,800 --> 00:35:14,310 information and time to analyze it, and it'll naturally 616 00:35:14,310 --> 00:35:16,920 always go to the most shocking things 617 00:35:16,920 --> 00:35:20,130 and things that are devoid of context. 618 00:35:20,130 --> 00:35:21,690 Next question is, why now? 619 00:35:21,690 --> 00:35:23,403 Which is pretty self explanatory. 620 00:35:24,810 --> 00:35:27,150 So now the really big question, 621 00:35:27,150 --> 00:35:29,013 how the hell were they caught? 622 00:35:30,420 --> 00:35:33,420 Chat logs is gonna be a recurring theme here 623 00:35:33,420 --> 00:35:38,250 for most of them, Sabu, caught by chat logs, 624 00:35:38,250 --> 00:35:43,250 he kept trying to entrap people and the chat logs, 625 00:35:43,560 --> 00:35:45,423 if you're a participant in things, 626 00:35:46,320 --> 00:35:48,150 it's a bad idea to keep chat logs, 627 00:35:48,150 --> 00:35:52,080 but if you're a defendant in things, they're useful to have, 628 00:35:52,080 --> 00:35:54,780 but they started communicating with each other, 629 00:35:54,780 --> 00:35:57,510 different hactivists, and they noticed patterns, 630 00:35:57,510 --> 00:35:59,850 and they shared it within the larger community, 631 00:35:59,850 --> 00:36:02,850 and then later leaked files confirmed 632 00:36:02,850 --> 00:36:07,850 the allegations and what was going on. 633 00:36:09,150 --> 00:36:12,150 For Popov, again, we have chat logs, 634 00:36:12,150 --> 00:36:14,460 but this time reviewed in hindsight, 635 00:36:14,460 --> 00:36:19,330 several years after Popov had stopped using those targets. 636 00:36:20,340 --> 00:36:23,700 His big problem that got him noticed 637 00:36:23,700 --> 00:36:27,000 most recently was extorting too many, not most recently, 638 00:36:27,000 --> 00:36:28,890 there were other things since then, 639 00:36:28,890 --> 00:36:31,620 but one of the things that caused him real problems, 640 00:36:31,620 --> 00:36:35,070 and as well as his former FBI handler, 641 00:36:35,070 --> 00:36:37,860 was he began extorting simultaneous targets 642 00:36:37,860 --> 00:36:40,050 that he wanted revenge on. 643 00:36:40,050 --> 00:36:43,273 And when the FBI 644 00:36:45,210 --> 00:36:47,550 was trying to get at the bottom of this, and in particular, 645 00:36:47,550 --> 00:36:50,880 the US attorney at Boston wanted to get into it, 646 00:36:50,880 --> 00:36:52,500 they were asking for information 647 00:36:52,500 --> 00:36:56,250 on his pseudonym Dennis Pinhouse, 648 00:36:56,250 --> 00:37:00,000 which agent Hilbert, Popov's former handler, 649 00:37:00,000 --> 00:37:03,300 knew what that was and who he was, 650 00:37:03,300 --> 00:37:05,763 and Hilbert refused to cooperate. 651 00:37:06,750 --> 00:37:09,450 Popov was also identified by looking 652 00:37:09,450 --> 00:37:12,243 in the footnotes of certain DOJ filings, 653 00:37:13,507 --> 00:37:15,649 he just seemed connected to something, 654 00:37:15,649 --> 00:37:18,990 and so a good journalist just started following up 655 00:37:18,990 --> 00:37:21,630 on that and found a very interesting story, 656 00:37:21,630 --> 00:37:25,020 was also identified through his posting to Jeff Carr, 657 00:37:25,020 --> 00:37:27,990 and simply the Russian operating environment, again, 658 00:37:27,990 --> 00:37:31,233 if you are in Russia and you hack the FBI, 659 00:37:32,610 --> 00:37:35,580 you give that to the government 660 00:37:35,580 --> 00:37:38,043 and you have a very nice life. 661 00:37:39,660 --> 00:37:42,690 How were Guccifer 2.0 and DC Leaks identified? 662 00:37:42,690 --> 00:37:45,300 I combined this, because they share a lot. 663 00:37:45,300 --> 00:37:48,447 Chat logs again, the money in Bitcoin trail 664 00:37:48,447 --> 00:37:53,447 was a huge portion, Linguistic analysis, Stylometry, 665 00:37:53,460 --> 00:37:57,060 forensic analysis provided more confirmation 666 00:37:57,060 --> 00:38:00,480 as at least once Guccifer 2.0 mistakenly logged in 667 00:38:00,480 --> 00:38:03,990 without a VPN, and analysis of files 668 00:38:03,990 --> 00:38:08,990 shows overlap between Guccifer 2.0 and DC Leaks 669 00:38:09,150 --> 00:38:12,630 and their files, and that one of the first documents 670 00:38:12,630 --> 00:38:15,540 that Guccifer 2.0 published came from 671 00:38:15,540 --> 00:38:18,123 an attachment to one of the Podesta emails. 672 00:38:20,820 --> 00:38:24,900 Free Civilians identification was fairly straightforward, 673 00:38:24,900 --> 00:38:27,930 given the circumstances, the inconsistent behavior, 674 00:38:27,930 --> 00:38:31,380 being more interested in selling proof than in selling data, 675 00:38:31,380 --> 00:38:36,150 posting already sold data for reputation, 676 00:38:36,150 --> 00:38:39,630 as well as the timing, their attacks began 677 00:38:39,630 --> 00:38:43,860 right around the beginning of the Russian 678 00:38:43,860 --> 00:38:46,500 invasion of Ukraine within a day or two, 679 00:38:46,500 --> 00:38:49,560 and they exfiltrated the data 680 00:38:49,560 --> 00:38:51,903 just prior to the wiper attacks. 681 00:38:52,800 --> 00:38:57,800 So now's the part where I get to yell at you. 682 00:39:01,080 --> 00:39:04,680 I'll be gentle, hopefully most of this 683 00:39:04,680 --> 00:39:08,040 will come across as constructive criticism, 684 00:39:08,040 --> 00:39:10,263 and not actual aggression. 685 00:39:11,730 --> 00:39:14,220 Newsrooms, you all need to get ready 686 00:39:14,220 --> 00:39:15,903 for the next big leak now. 687 00:39:17,670 --> 00:39:19,443 There's a lot happening, 688 00:39:20,970 --> 00:39:22,773 a lot more is going to happen, 689 00:39:23,790 --> 00:39:26,400 and most of you are not equipped 690 00:39:26,400 --> 00:39:31,400 to deal with any sizeable leak. 691 00:39:33,810 --> 00:39:38,310 DDoSecrets, thankfully is relaunching 692 00:39:38,310 --> 00:39:40,740 Hunter Memorial Library, and we'll be making it 693 00:39:40,740 --> 00:39:43,920 available to journalists and researchers, 694 00:39:43,920 --> 00:39:48,300 but that is not a full replacement for newsrooms 695 00:39:48,300 --> 00:39:51,300 investing in themselves, because you need the proper staff, 696 00:39:51,300 --> 00:39:53,040 the technology, and the training, 697 00:39:53,040 --> 00:39:55,590 and it is lacking on all three 698 00:39:55,590 --> 00:39:57,963 in pretty much every major newsroom, 699 00:39:58,950 --> 00:40:02,940 that goes for Associated Press, the New York Times, 700 00:40:02,940 --> 00:40:07,020 the Washington Post, the list is pretty 701 00:40:07,020 --> 00:40:10,890 hard to come up with an end point. 702 00:40:10,890 --> 00:40:12,723 You need to focus on the long view, 703 00:40:13,913 --> 00:40:16,020 because I'm tired of seeing articles 704 00:40:16,020 --> 00:40:20,253 that examine leaked data for two weeks, 705 00:40:21,630 --> 00:40:24,633 because you're looking at emails from the last month, 706 00:40:26,640 --> 00:40:29,010 y'all are better than that, 707 00:40:29,010 --> 00:40:31,563 y'all have data that's better than that, 708 00:40:33,330 --> 00:40:35,880 you have 100 terabytes of leaked data 709 00:40:35,880 --> 00:40:40,320 that a lot of it overlaps, dozens of mining companies, 710 00:40:40,320 --> 00:40:43,170 of agencies that work with them that enable that stuff, 711 00:40:43,170 --> 00:40:46,740 the world is literally on fire and the data sets 712 00:40:46,740 --> 00:40:51,740 behind the people who are doing it are open and available, 713 00:40:51,990 --> 00:40:55,833 but where's the investment? 714 00:40:59,370 --> 00:41:02,790 I see newsrooms with climate teams, 715 00:41:02,790 --> 00:41:07,110 climate data teams of three, maybe four people, 716 00:41:07,110 --> 00:41:10,650 and none of them are real tech experts. 717 00:41:10,650 --> 00:41:13,200 And remember that a collaboration that makes the cut 718 00:41:13,200 --> 00:41:15,480 is worth two exclusives that get shelved, 719 00:41:15,480 --> 00:41:18,150 and way too much of your nonsense stuff 720 00:41:18,150 --> 00:41:19,743 just gets shelved anyway. 721 00:41:21,780 --> 00:41:23,670 American newsrooms have definitely trended 722 00:41:23,670 --> 00:41:26,400 toward the wrong column in the last year, 723 00:41:26,400 --> 00:41:30,120 we've seen a lot of reporting on fake hacks with no proof, 724 00:41:30,120 --> 00:41:32,130 very little reporting on the trial 725 00:41:32,130 --> 00:41:34,200 of the largest CIA leak in history, 726 00:41:34,200 --> 00:41:36,600 which revealed a lot of information about the leak, 727 00:41:36,600 --> 00:41:40,983 about WikiLeaks, about how CIA works. 728 00:41:42,390 --> 00:41:45,750 Y'all dropped the ball on that, and there's no, 729 00:41:45,750 --> 00:41:47,583 there's no goddamn excuse. 730 00:41:48,600 --> 00:41:49,890 I've seen a lot of reporting on 731 00:41:49,890 --> 00:41:52,710 and promoting worthless NFTs, but not much 732 00:41:52,710 --> 00:41:56,910 following the money beyond, it went somewhere, 733 00:41:56,910 --> 00:41:59,043 and that is not useful reporting. 734 00:42:00,060 --> 00:42:02,700 I see a lot of emotional headlines being made out 735 00:42:02,700 --> 00:42:05,550 of the opinions of inherently biased people, 736 00:42:05,550 --> 00:42:09,390 the mother of so and so, the father of so and so, 737 00:42:09,390 --> 00:42:12,543 they have these opinions, that doesn't matter. 738 00:42:14,190 --> 00:42:16,353 You need to focus on recent inform, 739 00:42:18,780 --> 00:42:20,550 sorry, I skipped ahead a number, 740 00:42:20,550 --> 00:42:22,500 what you need to focus on is informing people 741 00:42:22,500 --> 00:42:24,720 what they need to know before they need to know it, 742 00:42:24,720 --> 00:42:27,570 because otherwise when the next thing comes, 743 00:42:27,570 --> 00:42:30,120 they won't know what to make of it, 744 00:42:30,120 --> 00:42:31,773 and they'll be playing catch up, 745 00:42:33,090 --> 00:42:35,490 and that's a problem for everyone, 746 00:42:35,490 --> 00:42:37,470 that's a problem for your outlets too, 747 00:42:37,470 --> 00:42:40,200 because if people are trying to play catch up 748 00:42:40,200 --> 00:42:41,670 when they're reading your articles 749 00:42:41,670 --> 00:42:44,013 or watching your video presentations, 750 00:42:45,210 --> 00:42:48,150 they're already going away, because you didn't give them 751 00:42:48,150 --> 00:42:50,253 the tools to understand it and follow it. 752 00:42:51,510 --> 00:42:54,570 See a lot of people confusing news with stories 753 00:42:54,570 --> 00:42:57,600 instead of reporting on non-breaking news 754 00:42:57,600 --> 00:42:59,220 that might not have closure, 755 00:42:59,220 --> 00:43:02,580 even though it has crucial data and context, 756 00:43:02,580 --> 00:43:04,650 and way too much investing in production, 757 00:43:04,650 --> 00:43:07,683 instead of investing in the newsroom itself. 758 00:43:09,750 --> 00:43:10,893 It's absurd. 759 00:43:12,300 --> 00:43:16,260 Cable news is absurd, print news is becoming worse, 760 00:43:16,260 --> 00:43:19,020 and yet there's so many talented people, 761 00:43:19,020 --> 00:43:21,330 stop shooting yourselves in the foot, 762 00:43:21,330 --> 00:43:25,023 and editors, rethink your shit. 763 00:43:27,120 --> 00:43:31,680 Government, hi, come see the cognitive 764 00:43:31,680 --> 00:43:33,723 dissonance inherent in the system. 765 00:43:34,830 --> 00:43:37,500 Y'all love to look at security and address that, 766 00:43:37,500 --> 00:43:39,540 but the incongruences are what cause 767 00:43:39,540 --> 00:43:43,383 and amplify leaks, everyone is, 768 00:43:44,280 --> 00:43:46,470 let's say, very impressed with the size 769 00:43:46,470 --> 00:43:51,470 of your legal case against Assange, 770 00:43:52,620 --> 00:43:54,960 go ahead and drop the publication charges, 771 00:43:54,960 --> 00:43:58,830 'cause it's bullshit. 772 00:43:58,830 --> 00:44:03,450 I'm a critic of his, do not like him, he hates me, 773 00:44:03,450 --> 00:44:06,090 but I'm up here saying it's bullshit, 774 00:44:06,090 --> 00:44:08,430 and it seems like y'all are compensating 775 00:44:08,430 --> 00:44:12,180 for something, do better. 776 00:44:12,180 --> 00:44:14,880 Also, just pardon all whistleblowers, 777 00:44:14,880 --> 00:44:18,510 and never let anyone hear you say 778 00:44:18,510 --> 00:44:21,450 that talking to journalists and selling t-shirts 779 00:44:21,450 --> 00:44:25,833 is a part of a CFAA violation again, ever, 780 00:44:26,910 --> 00:44:31,110 ever, I don't know how you can look at yourself 781 00:44:31,110 --> 00:44:36,110 in the mirror after writing that or filing it with whoever, 782 00:44:39,210 --> 00:44:41,430 that's bananas. 783 00:44:41,430 --> 00:44:44,250 Industry, you just need to own your own shit, 784 00:44:44,250 --> 00:44:48,750 security theater is going to get your companies killed, 785 00:44:48,750 --> 00:44:50,640 it is going to get people wrecked, 786 00:44:50,640 --> 00:44:54,240 it is going to destroy personal data, 787 00:44:54,240 --> 00:44:57,900 and not even in a way that lets journalists 788 00:44:57,900 --> 00:45:01,980 use leaks productively, be someone 789 00:45:01,980 --> 00:45:06,690 who isn't worth leaking, and never pay the ransom, 790 00:45:06,690 --> 00:45:09,300 one area I actually agree with FBI on, 791 00:45:09,300 --> 00:45:11,070 for a lot of reasons that we don't have time 792 00:45:11,070 --> 00:45:14,733 to get into here, but it's not just 'cause I want that data. 793 00:45:16,650 --> 00:45:19,110 Leakers and Leak Publishers, real quick, 794 00:45:19,110 --> 00:45:22,320 study mosaic theory, stay focused on results, 795 00:45:22,320 --> 00:45:24,150 not splash or ego. 796 00:45:24,150 --> 00:45:26,790 Learn what the law actually lets journalists do 797 00:45:26,790 --> 00:45:31,110 and what it doesn't, because a lot of sources 798 00:45:31,110 --> 00:45:34,170 seem to want to ask publishers 799 00:45:34,170 --> 00:45:37,650 to do things that they can't do, 800 00:45:37,650 --> 00:45:39,810 and you need to understand that state actors 801 00:45:39,810 --> 00:45:42,450 can and will look to exploit you and your leaks, 802 00:45:42,450 --> 00:45:45,030 whether you want them to or not. 803 00:45:45,030 --> 00:45:48,540 Talk to a lawyer, listen to your conscience, 804 00:45:48,540 --> 00:45:51,933 and honestly, 805 00:45:54,450 --> 00:45:57,510 leak the planet, there's no way 806 00:45:57,510 --> 00:46:00,213 that we're gonna be saved through secrecy, 807 00:46:01,140 --> 00:46:04,110 recent report from CIA found that something like 808 00:46:04,110 --> 00:46:07,710 90% of classified documents could be safely released 809 00:46:07,710 --> 00:46:11,550 to the public, that shit's absurd, 810 00:46:11,550 --> 00:46:13,233 it's the same with corporate. 811 00:46:17,340 --> 00:46:21,270 There is no reason why we can't turn 812 00:46:21,270 --> 00:46:24,570 to leaks as a vital source when the world 813 00:46:24,570 --> 00:46:29,310 is literally on fire, and we don't have enough data 814 00:46:29,310 --> 00:46:32,280 to figure out, well, what's causing it, 815 00:46:32,280 --> 00:46:35,310 specifically in these areas and what's making it worse, 816 00:46:35,310 --> 00:46:37,230 at this rate, we don't have enough data 817 00:46:37,230 --> 00:46:40,773 to refine the projections, except we do, 818 00:46:41,610 --> 00:46:46,610 and people aren't fully engaging with it, 819 00:46:46,800 --> 00:46:49,500 and that's a problem, because leaks 820 00:46:49,500 --> 00:46:52,653 are only as valuable as you let them be. 821 00:46:54,180 --> 00:46:57,300 People have risked their lives and their freedom 822 00:46:57,300 --> 00:46:58,743 to bring us this data. 823 00:47:01,860 --> 00:47:06,860 And it would be irresponsible and unconscionable 824 00:47:07,470 --> 00:47:11,813 if we let them down by just, oh yeah, this came out, 825 00:47:11,813 --> 00:47:14,763 I found an interesting document and now that's it. 826 00:47:16,320 --> 00:47:21,210 So leak the planet, magic is real, 827 00:47:22,080 --> 00:47:24,663 have fun, thanks for listening. 828 00:47:25,594 --> 00:47:28,594 (crowd applauding)