Hi, everybody. My name is Xan North. I'm a member of Distributed Denial of Secrets, and you are here at Leak the Planet, or How You Learned to Stop Worrying and Love the Leak.
Who we are? Well, we are a bunch of cat lovers, as you can see, and dog lovers.
And then there are a bunch of humans that don't matter. We have Emma Best right here, and the rest of these are people that also work with Distributed Denial of Secrets.
But I all know you want us to bring back the pets.
So first of all, we have types of leaks and leakers. Leaking is as value-neutral as pharmacology. It comes down to intent and application.
We have insiders, hacktivists, spillage, state-affiliated actors.
And ransomware. And we'll go through all of those, what they are, what they mean.
Insiders. So cognitive dissonance addresses itself through leaks.
A lot of people, when they join an organization, they may have ideas about how that organization works that don't necessarily come to fruition.
Examples of insiders are Daniel Ellsberg, Chelsea Manning, Edward Snowden, Reality Winner, Natalie Mae Edwards, and Johanna Steffens.
Next, we have hacktivists. Not all whistleblowers are insiders. Some of them come in from the outside.
Good examples of that are Red Hack, Anonymous, Jeremy Hammond, Phineas Fisher, ACAP Gang, Cyber Partisans, and Donk Enby.
Next, we have spillage, which is pretty much when a stereo falls off a truck on the information superhighway.
This is typically an accidental release of data that's a result of user error.
Examples of spillage.
Our Heritage Foundation, Police Aerial Surveillance Footage, and GiveSendGo.
GiveSendGo particularly.
They were warned repeatedly that their S3 buckets were misconfigured.
They never took any action.
And, well, they got leaked.
Services like Grey Hat Warfare make misconfigured S3 buckets easy to find and search.
Many leaks are avoided by disclosure protocols.
Again, going back to GiveSendGo, they were warned repeatedly, and they did nothing.
And then when their leak finally did come out, they denounced it as fake news.
Nothing, they weren't really hacked.
So, next we have state-affiliated actors.
You probably love them when they're yours.
We have Cebu, Popov, Cyber Birkett, Guccifer 2, DC Leaks, IT Army, and Conti.
And then ransomware.
Very little of this data merits journalistic or academic review, but there are some gems.
Jones Day, Chicago City Hall, Metropolitan Police Department, DC, Illinois Attorney General, and Perceptix.
Some declared political stances following the Russian invasion of Ukraine.
And financial motives mean they can be hired by state actors.
Example of that would be Conti.
So, next we move on to publication models, which also serves as a brief, all too brief history of recent leaks and ways of leaking things.
First up, one of the oldest leaking institutions that's still active in the Western world, Cryptome.
Everybody's best friend.
They've been publishing censored and leaked material online since 1996 using basic HTTP listings and, for a time, an FTP server as well.
They helped found WikiLeaks.
They were on the initial advisory board, and they helped register the domain name.
But, like I said, they criticize freely, and that includes WikiLeaks.
Although they strongly oppose the extradition and prosecution of Hassan.
And, uh, gave testimony in one of the, uh, cases against him for the extradition attempt.
And, to this day, Cryptome continues to be active.
Which is a minor miracle considering it's been nearly 30 years.
And they've faced threats from multiple corporate entities as well as government agencies that have visited them.
And had all sorts of questions.
And we're often angry at them for making public documents too public.
Because what if people read them?
Cryptome very naturally brings us into WikiLeaks.
They wore every hat until they wore virtually none.
They were revolutionary at times.
A lot of debate was sparked.
And then they were used by Russian intelligence.
We know from exchanged messages that they received the DNI.
We can see emails from Guccifer too.
And, uh, they appear to have received the Podesta emails from DCLeaks.
Also based on messages that, uh, we know of.
Their last original leak was, I believe, late 2019.
And that was the, one of the OPCW leaks.
Which that series has been tied to Russian intelligence again.
By a series of articles written by Daily Beast.
New Lines Magazine and Bellingcat.
Those are all very worth reading.
Because Russian embassies and diplomats are directly involved.
And a sting operation was able to reveal quite a bit.
And, unfortunately, WikiLeaks throughout its history has suffered a lot of instability and periods of inoperability.
Um, there was the 2010 incident where their infrastructure was taken down.
There was 2011 or 2012.
2012 through 2015, I believe, where they had no submission portal.
They recently lost their submission portal again.
And only very recently launched a portal that almost works.
Um, it, it will upload files.
But sources will never know if it succeeded in uploading them.
Which brings us next to Anonymous's answer to WikiLeaks.
Launched during a feud in 2012 and 2013.
They called it Paranoia.
Short for Potentially Alarming Research from the Anonymous Intelligence Agency.
Anonymous was frustrated by WikiLeaks' slow releases.
And WikiLeaks, for their part of the feud, was accusing Anonymous of insecure methods.
And, at this time, WikiLeaks' submission system was offline.
While Paranoia was meant to be a quick, simple leak platform.
But, unfortunately, that was one of the problems with Paranoia.
As it was very easily exploited.
Uh, some of the release notes were highly inaccurate.
Um, and given the context of those inaccuracies, that certainly had an agenda with them.
And it wasn't particularly used by Maxim Popov to help launder some of his data.
Next, we have groups like The Intercept.
Where they are literally building journalism from the ground up around leaks.
And I know we all have thoughts about The Intercept.
And certain people that worked there and no longer do.
Mistakes that have been made by individuals there.
And, yeah, we could say that about any outlet.
But the lessons from The Intercept are still very useful.
Because they built it from the ground up to allow this kind of research.
And they even tried to extend it beyond their own borders a bit with the Snowden Archive.
Which, unfortunately, was closed.
But they continue to do that.
And they may be active and report on large leaks to this day.
Including partnering with regional outlets in some instances.
Such as data sets relating to the Russian invasion of Ukraine.
Which brings us to the consortium model.
Where we have groups like ARIJ, EIC, Forbidden Stories, ICIJ, and CCRP.
You can see on the slide a list of a number of high profile projects.
Most of them dealing with finance.
That the consortium model all dealt with.
And because of the international nature of these projects.
Consortiums are uniquely able to go after the data.
Because you need local experience for each realm.
You need multiple experts.
You need boots on the ground.
And no one outlet can realistically handle that.
They rarely publish raw data.
But sometimes they do publish relational data.
Which you see with ICIJ and some of their databases.
Which are publicly available.
And then there's these people called DDoS Secrets.
That's us.
In the last four years we've published leaks from over 50 countries.
And over 200 releases.
That number is a bit out of date.
But we're constantly trying to balance source protection with source transparency.
Which is a major issue.
Especially with things like the Russian-Ukrainian war.
We have people sending us data sets.
And there's a very obvious question.
When it's something that gets the cyber war tag that we created.
Alluding people to the context.
And that, you know, there's no specific suspicion for these data sets.
But it's still something that you should look at more closely.
And be more aware of.
We also strongly focus on separating editorial.
And what the meaning of the leak is.
From what we do.
Which is presenting the data.
We will help journalists interpret it as best we can.
But we don't tell them what to write.
We don't present our own analysis of it.
Because one, we have data from over 50 countries.
And over 200 organizations.
That range from topics of artificial intelligence.
To manufacture of nuclear power plants.
We are not and cannot ever be experts on all of these subjects.
Never mind the language barriers.
It is better left for people who are already experts in that.
Than for us to try to become everything.
Oh, I seem to have hit.
Sorry about that.
And this also helps prevent our biases from getting in the way of.
What the data says.
Because when you touch this much data.
And you bring it to the public.
It is very easy to infect it.
With your point of view.
And your messaging.
And it can't become an inherent part of the data.
One thing we witnessed with WikiLeaks.
And the Vault 7 releases.
Was they wrote about how certain devices could be exploited.
And how that could change.
And then be leveraged to get past.
The encryption on things like Signal and WhatsApp.
By making the encryption literally irrelevant.
But people took away the wrong message from that.
For several articles.
And a large number of people on Twitter.
Because of a imperfectly crafted tweet.
And so we have a great responsibility to not do that.
Our goal is to collect the data.
Review it.
And then entrust local reporters.
Investigators.
And activists.
And experts.
To follow through.
And in many situations.
To find the right consortium.
Moving on.
We get into actual state hackers.
DCLeaks was an exercise in persona and access management.
While some of the data was public.
Not all of it was.
Which was a way of playing favoritism.
A way of creating mystique.
And hiding some of.
The overlap between various releases.
DCLeaks was later linked to fake journalist personas.
By investigations.
And especially forensic ones.
Which followed different digital accounts.
And there were early and unclear.
And inconsistent ties to Guccifer 2.
Established publicly early on.
For instance the email in which Guccifer 2.
Said that DCLeaks was a WikiLeaks subprime.
Project.
And they provided restricted access.
To DCLeaks releases.
Thus we have Guccifer 2.
Selling the narrative.
Which was launched obviously to.
To counter the revelation.
That was then new.
Of Russian hacking of the DNC.
DCCC.
Etc.
They used a combination.
Of blog and social media posts.
With individual documents.
Some of which had been tampered.
And larger dumps.
We know from government investigations.
That Guccifer 2.
Communicated with over 12,000 Twitter accounts.
Exchanging over 15,000 messages.
We've only managed to identify so far.
About 10% of those messages.
And far fewer than 10% of the accounts.
That communicated with Guccifer 2.
But the known.
The known discussions.
Are part of the transcript.
Cited at the end of this.
Thus spoke Guccifer 2.
And we also know from the messages.
That they were active.
Nearly 24 hours a day.
When they were active.
Which is another giveaway.
So what does state affiliated.
Actually look like.
Because everyone has.
Ideas.
Of what they think it is.
Or what.
They think.
Other people think it is.
And what they don't.
And you especially see that.
As.
A political weapon.
Which is.
Nonsense.
And infuriating.
Pop off.
Maxim.
Igor.
Pop off.
Was a Russian contractor.
Who infiltrated.
Anonymous.
And before that.
The FBI.
He was arrested.
By the FBI.
And turned into an asset.
And on his first job.
He was sent after the people.
That he used to work with.
But the FBI.
Didn't actually watch.
Very closely.
What he said.
About.
What he said.
In Russian.
And by using.
Some unique.
Idioms.
That were a little.
You know.
Less known.
To the translators.
He warned them.
What was happening.
And.
They were able.
To get away.
Free.
But he then went on.
To help them.
With a number.
Of other things.
Before being.
Let go.
Under.
Questionable.
Circumstances.
And when I say.
Questionable.
I mean.
The FBI.
Agent.
Responsible.
For it.
He was involved.
In the 2004.
2005.
FBI.
Email.
Hack.
Didn't get a lot.
Of coverage.
At the time.
But.
They didn't hack.
The FBI.
Directly.
But rather.
The AT&T.
Servers.
That the FBI.
Used.
For.
A number.
Of their things.
Including.
Their emails.
And.
These were.
Sensitive.
Emails.
And.
Popoff.
Through.
That made.
Things happen.
He developed.
Relationships.
And.
He.
Monetized.
Things.
And.
So.
He got.
The FBI.
To pay.
Him.
And.
His.
People.
$10,000.
For.
A.
Meaningless.
Lead.
On.
The hack.
That they.
Had just.
Committed.
Against.
The FBI.
They.
Identified.
One of the.
People.
Involved.
Leonid.
Sokolov.
Who.
Cannot.
Be.
Indicted.
And.
Is.
Never.
Going.
To.
Leave.
To.
Go.
To.
Indictable.
Area.
Popoff.
Used.
Numerous.
False.
Personas.
And.
Some.
Of.
Them.
Are.
Linked.
To.
Some.
Very.
Interesting.
Other.
Hack.
And.
Leak.
Situations.
For.
Instance.
The.
Hack.
And.
Leak.
Of.
Ukrainian.
Prosecutor.
General.
Which.
Was.
Done.
By.
Popoff.
Overlaps.
Significantly.
With.
Cyber.
Recruits.
Similar.
Release.
Right.
Down.
To.
The.
Same.
Office.
And.
Timeline.
Although.
Their.
Release.
Was.
Much.
More.
Limited.
To.
A.
Few.
Documents.
Popoff.
Released.
On.
And.
As.
Implied.
To.
Other.
Journalists.
There.
Is.
The.
Fact.
That.
If.
You.
Are.
Living.
In.
Russia.
And.
You.
Hack.
The.
FBI.
And.
It.
Is.
That.
High.
Profile.
And.
You.
Do.
Not.
Pay.
Patronage.
To.
Mother.
Russia.
You.
Lose.
All.
Protection.
It.
Is.
Exceedingly.
Unlikely.
Simply.
Based.
On.
That.
But.
Also.
The.
Reward.
There's.
No.
Reason.
They.
Wouldn't.
Have.
Pursued.
That.
Which.
Brings.
Us.
To.
Cebu.
Everyone's.
Favorite.
American.
State.
Sponsored.
Hacker.
A.
Member.
Of.
Anonymous.
Turned.
To.
An.
FBI.
Asset.
While.
He.
Was.
Active.
Through.
Their.
Observation.
Control.
And.
Failure.
To.
Stop.
They.
Directed.
Him.
That.
Is.
Beyond.
A.
Doubt.
And.
Those.
Directions.
Included.
Having.
Cebu.
Direct.
Cyber.
Attacks.
On.
Foreign.
Government.
And.
Commercial.
But.
Cebu.
Was.
More.
Than.
Just.
A.
Criminal.
Informant.
By.
Doing.
These.
Things.
The.
FBI.
Was.
Using.
Them.
For.
Foreign.
And.
Domestic.
Intelligence.
Gathering.
For.
The.
FBI.
So.
What.
About.
The.
Links.
Between.
People.
Like.
Popov.
And.
Cebu.
When.
The.
Lines.
Blur.
These.
People.
Enable.
Each.
Other.
And.
That's.
Not.
Just.
Have.
Popov.
And.
Cebu.
That's.
A.
General.
Trend.
Cebu.
And.
Paranoia.
Both.
Laundered.
Popov's.
Leaks.
We.
Can.
See.
In.
Chats.
Where.
Popov.
Literally.
Gives.
Them.
To.
Cebu.
And.
Cebu.
Puts.
Them.
Forth.
Saying.
It's.
Anti.
Sec.
Early.
Access.
To.
The.
Syria.
Emails.
Released.
By.
WikiLeaks.
And.
That's.
Significant.
As.
Well.
Because.
Not.
Only.
Was.
The.
One.
Banking.
Transfer.
Email.
Listening.
Missing.
From.
The.
WikiLeaks.
Release.
But.
Over.
One.
Million.
Of.
The.
Two.
Point.
Four.
Million.
Emails.
Is.
Not.
Been.
Published.
By.
WikiLeaks.
You.
Can.
Review.
This.
On.
The.
WikiLeaks.
Website.
Or.
I.
Wrote.
About.
It.
On.
My.
Site.
Emma.
Best.
Where.
You.
Can.
Also.
Download.
A.
Script.
And.
Manually.
Verify.
It.
Yourself.
And.
That.
Is.
One.
Mystery.
That.
They.
Have.
Failed.
To.
Follow.
Up.
On.
Or.
Comment.
On.
But.
Maybe.
It's.
The.
Secret.
Lizards.
Thing.
That.
They.
Commented.
About.
The.
Clinton.
Leaks.
It's.
A.
True.
Story.
You.
Can.
Find.
It.
In.
The.
Way.
Back.
Machine.
While.
They.
Were.
Working.
Together.
Popov.
And.
Sabu.
Actively.
Discussed.
Using.
Cyber.
Attacks.
On.
Government.
Systems.
And.
Using.
False.
Flag.
Cyber.
Attacks.
To.
Quote.
Create.
Real.
Conflict.
And.
Pop.
Off.
Activities.
Included.
Faking.
Um.
Funding.
Of.
Terrorism.
By.
One.
Country.
He.
Is.
Actually.
One.
Of.
The.
Only.
People.
Who.
In.
The.
Modern.
Era.
Can.
Say.
He.
Truth.
And.
You.
Are.
The.
The only.
One.
There.
Is.
That.
There.
History.
Abundance.
Degenerate.
In.
to an American hacktivist who is then convicted for doing those things.
And these are the kinds of state-sponsored actions that are never looked at.
They are not understood, and why would they be looked at?
There's already a scapegoat.
Jeremy Hammond did the fucking thing.
And we don't need accountability beyond that,
because that would just make everyone look bad.
And no one could stand that.
Looking bad is worse than people dying,
at least in the eyes of the government.
We move on to Gooch for Two.
One of the most telling quotes about Gooch for Two comes from Julian Assange,
where he said,
These look very much like they're from the Russians.
They almost look too much like them.
They're Russians.
It was, of course, a persona managed by Russian intelligence services.
They were the source of the DNC emails.
We know this from public statements as well as private statements
they made in their chats with WikiLeaks.
The transcript shows the communications with and submissions to WikiLeaks,
discussion about timeline,
and WikiLeaks, of course, explicitly stating,
we want to do this in time for the DNC
so we can have this specific political impact.
But despite the overwhelming amount of evidence about Gooch for Two,
there are still truthers out there who insist on
Seth Rich this or Vips that or
Forensicator something or other.
And that is one of the things that happens when there's a failure to communicate beyond
thick, incomprehensible reports,
which are also, unfortunately, very easy to manipulate
in terms of media.
A much more recent example that I think many of you may not have heard of
is Free Civilian, the data merchant that was a terrorist.
They claimed to sell data, but they posted it freely,
including Ukrainian medical data
and about one million government emails from Ukraine
for their internal development.
They used Cloudflare to protect their Swiss servers for distribution,
and after the servers were, the company was notified,
the private layer Inc. took their servers offline.
However, Cloudflare, last I checked, continued to protect the now defunct domain,
despite being told explicitly what it was, being provided proof of what it was,
and outside analysis that confirmed that,
yes, this was almost certainly Russian state-affiliated actors,
and it was almost certainly a hack-and-leak psyop to create fear as part of the Russian invasion of Ukraine,
and it was almost certainly a hack-and-leak psyop to create fear as part of the Russian invasion of Ukraine,
and it was almost certainly a hack-and-leak psyop to create fear as part of the Russian invasion of Ukraine,
making it not a criminal act, but an act of war.
Cloudflare simply responded,
we are not hosting the content,
we're simply helping them host it.
This brings us to the issue of misidentifications,
because it happens both ways,
where we either miss someone who was a state actor,
or we look at someone that wasn't a state actor,
and someone decides they were.
And for Sabu, the answer is simple.
Agent Brutus says he was a hero.
Agent Brutus is an honorable man,
and he has brought many captives home to Rome.
So when he said,
Sabu did great,
he prevented all these attacks,
I mean, he started them,
but he prevented them in the end,
that's so great.
He's the terrorist and the hero.
And, you know, normally, that's a crime.
But not this time.
And for the most part people,
especially in the mainstream,
especially mainstream outlets went with it.
They trusted Agent Brutus,
because he was an honorable man.
And he had arrested many people,
so surely he knew what he was talking about.
Then we have Popov,
he was simply missed,
because he was a con artist with too many fake IDs. That and the FBI agent
responsible kind of just stonewalled when he was asked to help solve what was
going on. And yeah. And then we have people like Donk Enby who are hit with
the worst kind of reasoning. Only a state actor could have done this. Which you
inevitably hear from the least educated people when it comes to how computers
and networks and hacks work. Because they will look at something big. Some big
accomplishment. And for Donk Enby it was the parlor stuff. And they'll say this
was big. So it had to be something equally big to do it. And this sort of
thinking is also what leads to a lot of conspiracy theory thinking. Like the
assassination of JFK was a big event. So something
big must have been behind it. It could not have been a crazy dude. To be way
overly brief. I've gone into that stuff a whole lot. Please don't think I'm
actually simplifying it that much for realsies. But yeah. People simply not
knowing what they're talking about. You'll see an article that says maybe
they did this with the help of whatever country. There was one article recently
about the Nauru Police Force leak. And they, a cyber firm, pointed out some
issues that they thought were inconsistent. And they mentioned me
several times in the report. Never, never reached out to me. Which I thought was an
interesting choice. But they did say I didn't appear to have any involvement in
anything. It's a very sloppy report. But it pointed out some things with time
stamps. And then a journalist saw that. Took that to someone who worked at a
think tank. And that person said it was probably China. Because China would want
to do something like that. And then that became the headline. And several other
people reported that headline. And there was zero evidence of China's
involvement. But that's how that sort of thing can get started.
It's, oh, this was a, this was a complicated leak. And, you know, things look a little
fishy. So it's got to be a state hacker. No, it's, it looks fishy because it's
complicated and you don't understand it. Which brings us to the big question. Or the
big questions. First off, are they, you know, spies? And it's a surprisingly broad question.
It's not actually even the right question. Because both sources can be exploited and
material can be exploited. And if the answer to either is yes, it's not necessarily an
emergency shutdown. It's a red flag. Because just, something just being exploited doesn't
make it untrue or dangerous. Soviet propaganda used to point out racism in the U.S. a lot.
And they were right.
It's not a problem if it is accurate. And not being embellished or twisted towards
foul ends. And there are ways you can, you can help make sure that it's not or that there
are counterbalancing forces. But usually the first clue is the source themselves. If you
have contact with the source at all, any questions without getting into their security
at all.
Can tell you a lot. One, are they trying to micromanage? Are they trying to tell you
what to do? How to handle things? When it needs to be released? How it, how it needs
to be labeled? You know, are, are they trying to turn you into their agent? If so, that's
a problem. Next up is can the source answer questions coherently and consistently? And it's amazing how often
bad actors are not able to do this. We had one source submit a group of e-mails allegedly from China.
And they were unable to tell us what e-mail accounts they were from. Or what agencies the e-mail
accounts were from. Or anything about the contents. Other than a lot of stuff. And while we don't
expect sources to necessarily have a total knowledge of every single thing that are in these datasets. Because
some of them are you know terabytes in size if if you are a leaker or a hacker you presumably know
the basics of what the information is when you got it you're not just picking up trash off the floor
and then bringing it to us and saying here and those kinds of failures often mean you're dealing
with a cutout or with someone who just there's some other red flag and again we come to the
question of are they trying to sell a narrative and that doesn't mean are they trying to shine a
light on an issue because there's a big difference between saying these refugees are being abused and
treated horrendously and denied their rights and the police are part of it and the government knows
about it
there's a big difference between that and the cia is is bad and needs to be turned into
something else because of these exact things that also further this person's political
narrative and goal and whatnot you know you could see a narrative being formed now not related to
leaks so much but the kind of narrative i'm talking about just by watching the fallout from
the mar-a-lago
raid it's the same it's the same kind of concept people trying to build a narrative
and once you publish that's going to be unavoidable you are releasing it into the world
either even if you restrict it to just journalists and researchers
which is one thing ddos secrets does on sensitive data sets
you're still letting go of how it's going to be interpreted and what they're going to do with it
but
if the source is clearly trying to sell or push a narrative you have a problem
other questions include timing does the situation or the timing force your hand
are you being given information three days before it becomes crucially relevant
and if so why right then what relevant external events are going on elections or armed conflicts
and
what is the goal for those things is it to shed light on it or is it to intervene
because both can be valid intervention through freedom of information is absolutely a fair way
of participating in the world that's that's what journalism is that's what
academia is that's how the world gets changed by people who don't carry guns
the next question brings us to counterbalances is there time for it because
one of the things we saw with the dnc leaks and the macron leaks was no they were purposely
released right before an event that they would have maximum shock impact on and
they would have very little time for one second
they would have very little time for anyone to then go
through and review the initial findings or critique them or get a better understanding
of what's going on because you're you're just giving people the tiniest bit of of
information and time to analyze it and it will naturally always go to the most shocking things
and things that are devoid of context next question is why now which is pretty self-explanatory
so now
the really big question how the hell were they caught chat logs is going to be a recurring
theme here for most of them cebu caught by chat logs he kept trying to entrap people and the chat
logs you know if you're a participant in things it's a bad idea to keep chat logs but if you're a
defendant in things they're useful to have but they started communicating with each other different
and they noticed patterns and they shared it within the larger community
and then later leaked files confirmed the allegations and and what was going on
for popov again we have chat logs but this time reviewed in hindsight several years after
popov had stopped using those those targets his big problem that got him noticed most recently was
extorting too many not most recently there were other things since then but one of the
things that caused some real progress problems and as well as his former fbi handler was he
began extorting simultaneous targets that he wanted revenge on and when the
when the fbi was trying to get at the bottom of this and in particular the
u.s attorney at boston wanted to get into it they were asking for information on his
pseudonym dad
pin house which agent Hilbert Popov's former handler knew what that was and
who he was and Hilbert refused to cooperate Popov was also identified by
looking in the footnotes of certain DOJ filings he just seemed connected to
something and so good journalists just started following up on that and found a
very interesting story it's also identified through his posting to Jeff
Carr and simply the Russian operating environment again if you are in Russia
and you hack the FBI you give that to the government and you have a very nice
life how were Guccifer 2 and DC leaks identified and combined this because
they share a lot chat logs again the money and Bitcoin trail was a huge
portion of the story and it was a very interesting story and it was a very
interesting discussion linguistic analysis stylometry forensic analysis
provided more confirmation with as at least once Guccifer 2 mistakenly logged
in without a VPN and analysis of files shows overlap between Guccifer 2 and DC
leaks in their files and that one of the first documents that Guccifer 2
published came from an attachment to one of the Podesta emails
free civilians identification was fairly straightforward given the
circumstances the inconsistent behavior being more interested in selling proof
then in selling data posting already sold repute already sold data for
reputation as well as the timing their attacks began right around the beginning
of the Russian invasion of Ukraine within a day or two and they all that was never
exfiltrated the data just prior to the wiper attacks so now it's the part where
I get to yell at you I'll be gentle hopefully most of this will come across
as constructive constructive criticism and not actual aggression newsrooms you
won't need to get ready for the next big leak now there's a lot happening a
lot more is going to happen and most of you are not equipped to deal with any
sizable leak DDoS secrets thankfully is is relaunching Hunter Memorial Library
and we'll be making it available to journalists and researchers
you
but that is not a full replacement for newsrooms investing in themselves because
you need the proper staff the technology and the training and it
is lacking on all three in pretty much every major newsroom that goes for
Associated Press the New York Times the Washington Post the list is pretty hard
to come up with an end point you need to focus on the long-view
you because I'm tired of seeing articles that examine leaked data for two weeks
because you're looking at emails from the last month y'all are better than
that y'all have data that's better than that you have a hundred terabytes of
leaked data that a lot of it overlaps dozens of mining companies of agencies
that work with them that enable that stuff the world is literally on fire and
the data sets behind the people who are doing it are open and available but
where's the investment I I see I see newsrooms with climate teams climate
data teams of three maybe four people and none of them are real tech experts
and
remember that a collaboration that makes the cut is worth two exclusives that get
shelved and way too much of your nonsense stuff just gets shelved anyway
American newsrooms have definitely trended toward the wrong column in them
in the last year we've seen a lot of reporting on fake hacks with no proof
very little reporting on the trial of the largest CIA leak in history which
revealed a lot of information about the leak about WikiLeaks about how CIA works
y'all dropped the ball on that and there's no there's no goddamn excuse I've seen a lot of
reporting on and promoting worthless nfts but not much following the money beyond it went somewhere
and that is not useful reporting I see a lot of emotional headlines being made out of the opinions
of inherently biased people the mother of so-and-so the father of so-and-so they have
opinions that doesn't matter you need to focus on recent infirm sorry I skipped ahead a number what
you need to focus on is informing people what they need to know before they need to know it
because otherwise when the next thing comes they won't know what to make of it and they'll be
playing catch up and that's a problem for everyone that's a problem for your outlets too because if
people are trying to play catch up
reading your articles or watching your video presentations they're already going away because
they you didn't give them the tools to understand it and follow it see a lot of people confusing
news with stories instead of reporting on non-breaking news that might not have closure
even though it has crucial data in context and way too much investing in production instead of
investing in the newsroom itself
it's absurd
cable news is absurd print news is becoming worse and yet there are so many talented people stop
shooting yourselves in the foot and editors rethink your government hi
come see the cognitive dissonance inherent in the system
y'all love to look at security and address that but the incongruences are what cause and amplify
violence everyone is uh say very impressed with the size of your legal case against Assange go ahead
and drop the publication charges because it's I'm a critic of his do not like him he hates me
but I'm up here saying it's and it seems like y'all are compensating for something
do better also just pardon all whistleblowers and uh never let anyone hear you say that talking
to journalists and selling t-shirts is a part of a cfaa violation again ever ever I don't know how
you can look at yourself in the mirror after writing that or filing it with the with with whoever
um that's that's bananas
industry you just need to own your own security theater is going to get your companies
killed it is going to get people wrecked it is going to destroy personal data and
not even in a way that lets journalists use leaks productively be someone who isn't worth leaking
and never pay the ransom one area I actually agree with FBI on for a lot of reasons that we
don't have time to get into here but it's not just because I want that data
leakers and leaks publishers real quick study mosaic theory stay focused on results not
Splash or ego learn what the law actually lets journalists do and what it doesn't because a lot
of sources seem to want to ask like publishers to do things that they can't do and you need to
understand that state actors can and will look to exploit you and your leaks whether you want
them to or not talk to a lawyer listen to your conscience and honestly leak the planet
there's no way that we're going to be saved through secrecy recent report from cia found
that something like 90 of classified documents could be safely released to the public
that absurd it's the same with corporate
there is no reason why we can't turn to leaks as a vital source when the world is literally on fire
and we don't have enough data to figure out well what's causing it specifically
in these areas and what's making it worse at this rate we don't have enough data to refine
the projections except we do and people aren't fully engaging with it and that's a problem
because leaks are only as valuable as you let them be people have risked their lives and their
freedom to bring us this data
and it would be
irresponsible and unconscionable if we let them down by just oh yeah this came out there's i found
i found an interesting document and now that's it so leak the planet magic is real have fun
thanks for listening