Loading summary
Transcript62 lines
- [00:00]
A
Foreign.
- [00:04]
B
Welcome to the 404 Media podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a Jones family company and needs your support. To subscribe, go to 404 Media Co as well as bonus content every single week. Subscribers also get access to additional episodes where we respond to their best comments. And they get early access to our interview series too. Just like this episode, gain access to that content. Media Co this week I'm speaking to Craig Silverman. He runs Indicator Media along with his co founder. And I followed Craig's work for years. At this point, he started back at BuzzFeed News, which was really one of the best investigations, especially for technology news on the Internet. He then moved to ProPublica before launching indicator. And he's really good at at OSINT stuff. But beyond sort of geolocating photos, which you usually might associate with osint, I follow him because he does a lot of stuff around advertising fraud or digital forensics. There's all of this data and information out there about domains and websites and advertising, all of this thing that is perfectly accessible to journalists or researchers. It's just knowing where to look, essentially. So in this conversation we talk about how he got started in that, maybe some tips on OSINT newsletters for you to check out as well, and of course, what he's doing now as well. So I hope you enjoy this conversation. Craig, thank you so much for joining us on the show. Really, really appreciate it.
- [01:55]
A
Yeah, it's good to be here. Thanks.
- [01:57]
B
Absolutely. So listeners will have just heard some context about how I came across your work and how I've been following it for, I mean, years, obviously, at this point. I first came across it when you were, I believe, at BuzzFeed News. There was a lot of scams and then disinformation, of course, around, I think, 2016, I imagine, and sort of that election and the Russian stuff, all of that. Am I remembering that correctly? Is that what you were mostly focused on back then, sort of scams and disinfo?
- [02:28]
A
Yeah, yeah. So I originally joined BuzzFeed News actually as the founding editor of BuzzFeed Canada. So the first year I was there, I was doing like Canadian news and managing a team of about nine other people. But then as we actually got into the spring of 2016, as New York bosses sometimes do, they're like, I don't know if we need all this Canada stuff. You know, we kind of. We like your team and you guys are good, but you're doing a lot About Canada. Can we. Can we do a little about, you know, America and the world? And so everybody sort of got rejigged. And it's funny because, I mean, when I first started talking to BuzzFeed, it was about doing the sort of debunking and Internet viral hoaxes stuff that I was doing before I joined BuzzFeed. And then the spring of 2016, that's what I went back to. I went back on to like hoaxes and viral fakes and trying to figure out how to make debunkings of false stuff go viral, which no one has still figured out. The debunks always lose.
- [03:26]
B
Yeah. And it's funny because I don't mean to date this interview too much. I try not to do that because this will come out later. But today I was just reading a very interesting philosophical blog post from an academic who said, we have this epistemological problem where there are people just living in another reality that leads to January 6th, it leads to Covid misinformation, all of this sort of thing. And he's like, we've tried the epistemological solution, which is fact checking people, calling people out. And he believes, and I think this is obvious to a lot of people, he's just saying it in a slightly different way. People link their epistemological beliefs and their knowledge very much to their social identities. Now, I'm not going to make a whole philosophical discussion, but that's just front of mind for me. About fact checking and debunking. When you were focused on that, did you feel debunking and fact checking changed people's minds? Was that the point? Do you think it did that?
- [04:27]
A
No. And I think actually that's the biggest problem that sort of fact checkers have, is that people think that's their goal. And granted, I'm sure some of them aspire to that and would like to see that happen, but it's in a scenario where someone's mind is actually made up and relatively firm, it's very, very hard to dislodge that. And we're not even talking about fact checking, like, to your point of the larger things, this is tied. It gets anything tied up into identity, beliefs, self image, the way we present ourselves, the in groups that we're a part of, those factors are tremendously powerful on the information we will accept or not. And so for me, fact checking, when it came to really, really big, deep questions that related to someone's identity, like, that's not going to do it. You're not going to read one thing that's laid out in a sort of factual way and be like, oh, my God, I've been so wrong. How could I have thought that? You know? And so, like any fact checkers that went into doing that, who thought of that, they were quickly realized like, oh, that's never going to happen. But, you know, where it was actually shown to be effective very early on. If we're talking like before 2015, probably like before 2014. Studies that were done of the classic type of fact checking of fact checking claims from politicians found that they did a study where the Academic Senate, a note out to a bunch of politicians who were running in a race and said, some of them got a letter saying there will be fact checkers working during your race, just letting you know. And some of them didn't get it. And what they found was that it appeared to have an effect where the politicians who had known that fact checkers might be watching and sort of checking their claims did seem to have. It seemed to have an effect. It seemed to make them maybe a little bit more cautious. And so what has destroyed the universe was kind of Trump and then others like him basically being like, I'm not gonna feel any shame. I'm not gonna change what I say. I am actually gonna double down and I'm gonna flood the zone with shit. And there's nothing these fact checkers can do about it. And so when the personal shame element or the sense of the norms disappeared in the political realm, that whole element of the political fact checking to actually get the politicians to change their behavior got smashed. And that was a very effective thing initially. But it can work where people don't have a deeply held opinion or view about something. They'll read a fact check and they might be receptive to it. And so fortunately, that's still a somewhat decent amount of stuff. But it's not the things that are like, deep, deep, deep, you know.
- [06:57]
B
Yeah. And. Well, I don't think you stopped that maybe suddenly or anything like that. I mean, we'll get to it. But you just moved to other outlets and of course you launched your own one that we'll talk about as well. But was there a particular reason? Maybe you did fewer of those sort of debunking or fat checks, or was it more? Well, I'm in a different employer and they're interested in something else.
- [07:20]
A
Yeah, well, the big change really was. So before I joined Buzzfeed, I was running a research project that also had its called Emergent, where we would identify claims that were being covered by news websites. And we would look and watch over time as it was disproven or proved what were the social sharing trends. And also who was getting it right, who was getting it wrong, who was amplifying BS and who was doing good debunking. And so I was interested in that model and trying to figure out ways of tracking and making it work. And then when I got sort of put back on that beat at Buzzfeed in 2016, I did a bunch of those viral debunkings. There was a lot of stuff spreading. There was still good money to be made spreading hoaxes for profit on Facebook. And there is again now, strangely, which we can talk about, but at a certain point, we get to the end of 2016 and everything has blown up. Trump has won. And it's like the Macedonian teens caused Trump to win. It was fake news. All this stuff that I wrote about, didn't think people went crazy. And. And that's when actually I realized, like, we have to shift. I have to shift. Because all of a sudden, Facebook, now called Meta, decided to pay fact checkers. And so it said, we're going to work with third party fact checkers. We're going to pay them to tamp down the viral 100% false stuff. And so I was like, oh, well, we're not going to take Facebook's money. But now they're paying people to fact check and do debunking. So I need to do things other than debunking. That was the big moment for me.
- [08:50]
B
That they had almost, well, not taking a job. That's far. That's exaggerating it. But like, oh, they filled some sort of vacuum there, which was ironically, of their own creation, probably, but they've done that. So then you can move on to other stuff. And I guess that would bring us to. What I primarily follow your work for is that you're really on top of osint, open source intelligence. But I would also say even more on the digital forensics side, when people hear osint, they think of plain data or geolocating photos or something like that. Whereas a lot of your work is stuff on, I don't know, tracking pixels on websites, WHOIS information, PDNs, all of this technical Internet infrastructure stuff, which I dabble in when I need to. But you're definitely more on top of it than me. Absolutely. How did you get into sort of that digital infrastructure? So not beat, but sort of a collection of techniques. How did you get into that?
- [09:56]
A
You know, it's funny to hear you say that, because I look at your work and what you do, and I often think of you as being more technical than me. So it's interesting to hear you see that as the reverse. So, you know, that comes up a.
- [10:07]
B
Lot, I think, oh, wow, I really admire this. But. And then, oh, no, it's just the imposter syndrome coming out, I guess. But, yeah, how did you get into it?
- [10:14]
A
You know, I mean, it's. It's funny because. So I promise I won't make it a really long story, but, you know, it started in 2004 for me. So in 2004, it's like, blogging is kind of emerging and Gawker's around and I'm following it, and I'm. I'm a freelance journalist just doing, like, anything I can to make money in Montreal, Canada. And I was like, well, I'd like to start a blog. I've always had kind of a little bit of an entrepreneurial streak. And so I started a blog, and I ended up starting a blog about media. And. And it was about errors and corrections and accuracy. So, like, I would read, literally six days a week, the online corrections pages of every English language outlet I had found and find the biggest, the most hilarious, worst corrections. And that was the initial content was just curating those. And it started doing really well. And then I was like, well, I guess I should understand more about, like, fact checking and verification and accuracy. And so I started sort of doing research and writing about that. And before I knew it.
- [11:11]
B
Within a.
- [11:12]
A
Year, I was suddenly kind of the expert on that, because nobody was doing it, which is the beauty of niche stuff. And so it's just been a line from there of me figuring out what are the practices for verification in newsrooms right now that we can decide when to publish a fact or not. And then when looking at how the Internet, and particularly as social media emerged and smartphones merged, how that completely destroyed the old model of facts, would come into a newsroom, and they would have time to sort of deal with them and call around and decide what to do and then decide what to put out. And it completely changed because now most of the information was already out there in some form. Not most of it, but, like, a lot. And it was getting traction, and it was getting more engagement and more views than the traditional journalism might ever be able to get. And so when you have potentially false stuff spreading, you know, stuff that's in the gray zone, that changed the whole dynamics of verification. And so I just became obsessed with. So how the Hell, do we do verification now? And in those early years, you know, from like 2010, 2012 on, it was like user generated content of people posting stuff. And like how do you verify user generated content? How do you look at a photo and figure out if it's what the person claims it is?
- [12:27]
B
And so it almost seems quaint now. Yeah, yeah, like, oh, how do we verify this one single photo that maybe somebody posted maliciously or maybe it was just an accident or something. It's like, that's like nothing compared to now.
- [12:42]
A
Yeah. And if you think of like Hurricane Sandy, which I think was like 2012, that was a moment where people realized, oh man, you know, we have a natural disaster and there's like photos, people claiming there's a shark in the streets of New Jersey.
- [12:56]
B
The perfect example.
- [12:57]
A
Yeah, the street shark, which basically became its own meme. There's like a guy, there was a guy with a pretty well followed Twitter account in New York who I think put out a false claim. I know there was a claim about the New York Stock Exchange flooding, but I don't know if he was the one who said that. And so a bunch of publications like the Atlantic and other people's started trying to do real time debunking. And it is quaint because if you look back on it and people were writing about it like, oh, there's this deluge on Twitter and on Facebook of this false information. And if you compare that to what we deal with in the span of a few hours today, it is quaint. And it's like, man, I would love to go back to that.
- [13:35]
B
You know, it'd be so much easier, like I could have a coffee, figure this thing out, you know, rather than there just being a constant bombardment of AI slob basically. So you're doing that and you're doing the verification, but then how does that move into, I think the more technical stuff, the whois, data, all of that sort of thing.
- [13:56]
A
Yeah, it's just like trying to learn and you know, and that's like the simple answer of it is there was this emerging discipline that I initially, I started sort of trying to document and write about the people that were doing it. So there was Storyful, a company that was very early in like gathering and verifying user generated content and then licensing it to clients. So. And verifying real time feeds. There was Andy Carvin around the Arab Spring, who was sort of doing real time, some people called like news DJing. He was like grabbing stuff on Twitter and like helping getting people to verify. And so I was sort of, like, studying that and trying to understand what they were doing. And then we tried to formalize it. In 2014, we published with the European Journalism Center, I edited a free book called the Verification Handbook. And that was the first time anybody had sort of put this stuff down on paper. And we just basically recruited a bunch of people from Storyful and BBC and other places that were doing this and tried to lay down some standards. And so from there, then, because of that book, I was like, okay, this is my thing now, so I better stay on top of it. And I just am always trying to find new skills and new things to learn. And now the nice thing is I learn new stuff and so I can teach it. And I'm trying to create a little bit of a flywheel on that.
- [15:08]
B
Yeah, I'll try to remember to come back to this question, but as you say, stuff changes very, very rapidly. And I'll try to remember to come back to that. But how do you stay on top of things? Because everything is changing so quickly. I guess I'll just give the example where years ago, all of the OSINT journalists and the bellingcats of the world and people on Twitter, that sort of thing, were big on Facebook graph, which was a way that you could basically find these undocumented APIs in Facebook so you could map out someone's friend list or find the connections or whatever. I mean, I remember I went to a bellingcat training years and years ago, and you could just do that, or you could figure it out yourself and you read blogs or whatever, blah, blah, blah. Or you just probe it and you get all these techniques that gets shut down. And then, because Facebook, I think after Cambridge Analytica, right, they were kind of like, we need to close some of this shit down. Then there's a gap. How do you, as a journalist, stay on top of what's next? How do you go about that?
- [16:13]
A
Yeah, I mean, the Facebook graph example is the perfect one. And I think part of doing this work is you have to have lived through examples like that to remind yourself of the fundamental thing, which is that tools are not actually the same sustainable way to do this. It is your creativity and your thinking and your willingness to kind of poke and try a bunch of different stuff. Because Facebook Graph was amazing. Like, as you said, you get somebody's Facebook account id, you popped it in, and you could literally see every public comment they had ever made.
- [16:43]
B
It was awesome. It was awesome. Journalistically.
- [16:47]
A
Yes. Well, this is the thing. So many of these tools and approaches are Double edged swords. It's like when I teach it, like I teach people today what you can do with a phone number or an email address and the eyes, like when they realize what's possible. And so then usually the next exercise is like, yes, now you should be putting your own email address in and realizing what you have out there. Because this can be used by people for journalistic purposes and for others. And so staying on top of it, I always felt like it's part of my job and part of it is I just try to like read and sign up to as many newsletters and follow people in the area as possible and just sort of see what they're seeing and that kind of thing. And then I also, you know, I try to sort of. Sometimes there's just stories that you find because you're interested in an area. And like, you know, I do a lot of ongoing monitoring of the things I care about. Like skeezy marketing is something I really am interested in. So I'm always like, I follow and reading tons about that. And one of the ways I stay on top of it is you gotta figure out what the people who are like on the line or beyond the line are doing because they're actually the most innovative and they're the ones who know and figured out the new techniques to get this out of a social profile or to do that. And so one of the ways is just there's now this whole world of OSINT and people who work in this area. And then there's also like, what are the sort of bad guys or the people that are like in the gray doing? Because they actually have a lot to teach, even if you're just trying to figure out what their new nasty techniques are for you to potentially stay on top of.
- [18:19]
B
Yeah, I find today that OSINT is just, if you don't have the foundational understanding and the methodologies and all of that sort of thing, which I don't think I always do to be perfectly honest. But if you don't have that, OSINT feels so much more fickle now, like it feels delicate that you may find an interesting tool or a technique one day. Maybe. I don't know. There's some discord stuff going around at the moment where you can see servers, somebody's in potentially that sort of thing that's going to get shut down soon. I'm pretty sure I've shut down OSINT techniques because I've reported on them because there is a public interest in. Well, there's a privacy issue here and we have to wear two hats at the same time. Could I use this for journalism? And on the other side, there's a public interest in covering this, because this is fucking wild. Maybe it should be shut down. How do you think about that sort of dichotomy in your head when you're using these tools or these techniques?
- [19:20]
A
Yeah, I mean, I think inevitably, because a lot of times I'm reporting on misuse or abuse of things. Inevitably, my first idea when I discover something new is I do think about the abuse potential on that. And then, you know, while also maybe thinking like, oh, wow, I could do this thing I always kind of wanted to do or try to do. And so I feel like there's always those two minds that are sort of battling it out a little bit of like, man, I would really like to use this, but holy crap, maybe this shouldn't exist, you know? Yeah, that's. And it's funny because actually there's a very smaller example of this. But, you know, you guys reported on Archive today, the archive service getting subpoenaed, or it didn't speed it, but its host got subpoenaed by the FBI trying to identify who runs that service. And when I first read that, my first reaction was like, oh, crap. Because this is one of the better archiving tools for social media. Like, the Internet Archive isn't as good at archiving a Facebook account or other things, but Archive today does. And so my initial thought was, oh, man, if that went away, that would suck because there's a repository of archive things. But also, I often use use it so I can link to it. But the 404 story, when I read it, it reminded me, like, oh, yeah, that's right. Tons of people use this to archived paywalled material and other stuff that isn't supposed to be accessible. And then I remembered, like, yes, that's right. This is another use that this tool has too.
- [20:41]
B
Yeah. And we didn't put this in the piece because it's speculating, but me and Jason, as in Jason, wrote the piece and I edited it and we're talking amongst ourselves. And when I see a subpoena like that, honestly, my first thought goes to, that's probably a child abuse imagery investigation. Just like I've read so many indictments around csam, unfortunately, because I actually used to cover that a lot because the FBI was doing very interesting stuff around that horrible, horrible world. When I see a raid on an academic's house or I see a subpoena against a web service, and this I'm pretty sure that's going to be csam. But again that was just us speculating amongst ourselves. We couldn't pull it in. But yeah, there was a trade off in. Do you report on that or not? But as you say, we do. And then oh yeah, that was used by 4chan to horribly harass people for years and years and years. So the tools do that. Yeah, basically.
- [21:35]
A
Yeah, yeah. And I mean the CSAM point, I can totally imagine why your mind went there too. Because it's also sort of like, well, why would the FBI care about this service? And I don't think that copyright infringement because this like the most active stuff around copyright infringement is like mass pirating of live streams and pay per view. Like that's where law enforcement actually will get involved because the NFL is screaming at them to do something. Whereas an archiving service where like you can read a Wall Street Journal article, you know, that's the FBI. I feel like probably not. So I think you're right. Like there's something larger and I don't think it's because, you know, the FBI or the Trump administration is like, we need to shut down archive today. God damn it, let's get them. You know, there's something else going on that sort of put them in the crosshairs.
- [22:22]
B
Yeah, I think so. And you know, maybe I'm wrong and we'll see, but that's just sort of what we see at the moment. Well, I guess actually just before moving on to the next step of your career, how do you think the OSINT industry has changed? It's kind of in the question. It's become an industry. Yeah, right.
- [22:57]
A
Yeah, yeah, 100%. I guess I'm old enough that I do remember when it was like a very small universe and it definitely wasn't industry and there were like a few journalists and there were some academics and then there were some weird nerds who did this in their spare time. Like the most famous being Elliot Higgins who turned it into Bell and Cat, which is incredible. And it was a small sort of known universe and had some intersection with people who did like threat hunting and information security. But it was sort of cleaved off a little bit. The first thing I saw was the debunking and sort of anti disinformation became its own little, much bigger community. Maybe not a full on industry, but suddenly money flushed into that at the end of 2016. And it was weird to watch that happen because again it was a very small community. And the same thing has kind of happened with OSINT I feel like there's a new OSINT newsletter like every other week or two. There are companies now who OSINT tools, a wide range of those. And so, you know, I think that's one of the big trends is there was a spirit of this is open source information, but also a lot of open source tools and approaches where it was shared and it was in the community and built for the community. And now there's, you know, there, understandably there is a business opportunity there. But there are a lot of companies, you know, building paid products and in some cases they're building paid products on things that started as open source, you know, things around, like I mentioned, investigating emails, I mean some of the open source stuff to kind of check where emails are registered on different platforms. That started as a very open thing in the community and now, you know, there are companies that are built on top of that. But the biggest trend I think over the last few years is just like the fake OSINT world where I think, you know, there are some governments and then there are some bad actors who've looked at sort of OSINT people in OSINT accounts doing like geolocation and saw that these often establish credibility on platforms as like a ground source of truth for people. And so we saw this emergence, particularly after the full scale invasion of Ukraine of just these total bullshit accounts on X and tons and tons on telegram calling themselves like oh sent this or oh sent that. And they would, you know, it wasn't necessarily 100% false stuff they were putting out, but man, like they were really playing with context and they were really leaving stuff out and they were, they would share an image and they would make a gigantic leap of logic from it. And so that is kind of undermining it as it's being established more and more throughout militaries, throughout all these places. There's also this undercurrent of fake OSINT and bullshit OSINT that is sort of undermining what it means to actually do the work.
- [25:29]
B
Yeah, I mean it became a massive grift basically on X where you would, as you say, call yourself OSINT Insider. Sorry, if that's actually the name of.
- [25:37]
A
The newsletter, it actually is a thing.
- [25:40]
B
Well, I literally just made that up. So who knows the name of the.
- [25:43]
A
Newsletter of the guy you wrote about who used Steeler logs?
- [25:46]
B
Oh, there you go. That's a very, very funny coincidence. I guess we all, it comes to mind when you're in this industry and space enough. But somebody uses a name like that, let's say not exactly that genuine, very funny coincidence. But you'll do that and you'll do like the alarm emoji breaking or whatever and then look at this photo, blah, blah, blah. And I don't know these people, I'm not in their head, but it looks like they just look to the people like Bellingcat and yourself and others doing it and being like, well, that doesn't look too hard. I just, I tweet this photo and I get a shit ton of retweets and potentially, you know, some grifter money from musk on x.com and I can do that and it seems pretty straightforward. Totally agree with that. I, I don't want to put you on the spot because maybe you don't and I wouldn't say this is an endorsement or anything, but is there a newsletter or two you think people should check out beyond your own website when it comes to like learning new OSINT techniques? Because I'm signed up to a bunch and my problem is I feel like I don't have time to read them.
- [26:54]
A
Oh yeah. Yeah. In fact, I was thinking for us I should do a regular feature where I actually sit down, I read all the things that I haven't read and like try to distill. Here's the 20 tips from 60 unread OSINT newsletters that I got for you guys.
- [27:09]
B
You can be the newsletter for the newsletter. It's like a meta newsletter. I mean that would actually be genuinely helpful. I'm not even joking.
- [27:15]
A
Considered it. So thank you for that feedback. So actually I'm going to mention one that's very new. So there's a guy named Benjamin Strick who people might know. He's already on YouTube. So he has, I believe it's Ben do Brown on YouTube. He does a lot of tutorial videos. Benjamin is amazing at geolocation and a lot of the visual stuff that is actually like not my strength. So I like to see what he's up to. But he just launched his own monthly substack called Field Notes and he walks through a bunch of techniques and things he's been working on. He works at the center for Information Resilience, which has done a lot of amazing reporting on conflict zones of mapping out what's going on with military and in some cases civilian massacres and things like that. So I think his newsletter is a really nice, useful entry because there's a bunch that are just repeating what everybody else is linking to and that's a difficult thing to get through. There's also a guy named Jake Kreps this newsletter tends to be a little more technical. It's called the OSINT Newsletter. The technical parts are paid, but he does decent quick roundups of tools and tips. But if you also want to learn about sort of stuff, if you have some programming skills, he puts that in there and he's been at it for a little while. So that one is I think, a well established newsletter. And Ben's, which is a new one, I think is really, really good. Ben's is free, but you also get some of the OSINT Newsletter for free as well. And they've just started actually every second week they're doing a series of kind of intro to OSINT posts on the OSINT newsletter because the obviously the regular stuff is a little more advanced. So if you are trying to get into this, I would go read some of those recent kind of free versions of the OSINT Newsletter which have some sort of basic practices and tips.
- [28:54]
B
Yeah, that's great. I'm actually going to do that as well. I was aware of one of those, but I don't think the second one you mentioned. So you're doing that work again, as we said, at Buzzfeed and then you eventually move to ProPublica for a few years and I feel like there you focused a lot more on advertising fraud, if I'm remembering correctly, like a lot of ad fraud, that sort of thing. How did you start paying attention to and maybe you did it buzzfeed. I just didn't see it. But how did you start paying attention to the ad fraud sort of ecosystem?
- [29:27]
A
Yeah, so it actually it did start at buzzfeed and I was totally clueless about this whole world for a long time. And then what happened is at the end of 2016, as everything is like going crazy with this world of fake news and what have you. I read an article in the New York Times about this really huge advertising fraud scheme where they sort of pretended to be legitimate outlets and stole millions and millions and millions of dollars. And I was just like, I don't understand this. What, how can you do that? And so I just sort of like put a pin in that. And I said if I'm moving away from this viral debunking and we want to broaden the lens of manipulation overall, you know, this maybe this whole ad stuff is part of it. And so I spent a lot of 2017 actually just talking to people in digital advertising because I didn't understand it at all. And I started to find the handful of people, I guess it's like the story of finding that small community again, I found a handful of people in digital advertising who really cared about fraud and really cared that this massive business, which at that time was like, I guess, hundreds of billions of dollars, it's about around a trillion now. Digital advertising, they were sort of the early people saying this is crazy, like people are 100% just stealing millions and maybe even like billions of dollars every year. And this was the big distinction I sort of came to understand about digital advertising is there's always been the thing of waste where I know that half my ad budget is wasted. I just don't know where you would buy and you would hope it worked and you wouldn't know for sure. And then digital came along and the promise was we're going to get the right message to the right person in the right moment. You're going to know exactly how long they looked at it. You're going to know as much as you might be possibly able to know about this person. It's going to be so well targeted that there's no more waste and you're going to get incredible performance. And that was all the promise. But what ended up getting built was a completely opaque, fraud filled, criminal filled, insane piece of shit system, pardon my language, that's like. And I couldn't believe it when people started explaining to me how easy it was for people to just pretend, tend to be a publication and steal ads for people who knew how the ad system works to go in and just come up with a clever little ruse and literally just steal millions of dollars. And so I started in 2017, I published my first articles in 2017 and sort of continued on it. But when I was at ProPublica, I was given. And that's the nice thing about ProPublica is like you're given a lot of time to work on something. And so my first big project there was basically like looking into Google's ad business, which I had sort of been pawing around at the outside. And so we look and we did a bunch of like large scale data collection and some other things to try and just understand what was going on with it. And in particular to understand the websites that Google was monetizing through its third party sort of partnership program. Like it's got the largest ad network in the world. And one part of that is millions and millions of websites are partnered with Google to get ads on them. And Google partners with tons and tons of websites that completely break its rules about the kind of content that ads and should never be appearing. And so I was able to spend many months on that with a couple of data journalists looking into that and understanding the types of sites that Google was monetizing. And also just that Google had helped create an industry standard for transparency and then decided to just not adhere to it, which was such a weird, strange thing to see.
- [32:54]
B
What do you mean by that switch?
- [32:55]
A
Yeah. So first of all around, investigating ad data, one of the most awesome things that happened was to get rid of that spoofing where people would pretend to be the Wall Street Journal and would get ads that people thought were appearing on WSJ.com, so there was a spoofing problem. And the industry solution to that was, okay, every web publisher needs to have a list on their website of all of their ad accounts so that when somebody goes to buy ads, they'll know exactly which ad accounts really belong to the Wall Street Journal and which ones don't. And so they created a transparency standard for the publisher is called ads. Txt and there was a sort of one on the side of ad networks like Google, where the publisher listed all the ad networks they worked with and their account IDs and the ad networks would have a master list of all the publishers they worked with and they were supposed to match. And so this was the solution and I loved it because now I could look at a website and see all of its ad partners and IDs. So thank you.
- [33:50]
B
And you can do that. And I've done this with another. I think I did it with Wired where we collaborate on something and some of my own work as well. But it's also for apps as well. Like apps Ads. Txt as well.
- [34:02]
A
Yes, App Ads. Txt. That's right. And you know, so if you're on a website and you're wondering if you see a bunch of ads and you think they're programmatic ads, you know, created through this auction process. You can just add adds txt to the end of it and you can see the list. And so what we did was we actually tried to de anonymize Google's list of all the publishers that it worked with. And this is where Google had sort of flouted this transparency thing. Every other major ad network actually would list the domain or the person or the company that was associated with each ad ID in their. It was called a sellers JSON file. And Google's list was, I think, about 80% anonymous. So they supported these programs, they supported ads. Txt. They told publishers, if you don't have an ads txt, you're not going to earn as much money. They help those standards get implemented and then they just decided, right, but that whole thing about ad networks identifying, no, we're not doing that. And they gave reasons for it. They said, well, there are small publishers, it might be risky for them to be identified, but literally no other ad network had an issue with this. And so we just tried through some scraping through accessing some databases, we tried to sort of match up and de anonymize Google's list and we got further than anybody did, but it still wasn't 100%. And so there is still just a total lack of transparency of just who is earning money from Google Ads. And there's lots of pretty shady and probably some criminal folks hiding within that.
- [35:32]
B
Yeah, I always wanted to get into the ad fraud bit, but I ended up covering much more like the privacy bit. And that is also just a complete opaque box. Like these companies we cover, like one called Patterns from Israel and various other ones where they participate in this advertising process to get location data from phones and then you can use that to track people. It's mostly through the advertisements and apps and that sort of thing. But a similar issue where it's like, how the hell do I penetrate this? And it sounds like you did a lot more, as you say, scraping a sort of osint. For me at the end I was just like, I just need some leaks. Leaks from companies like, oh my God, that saved me so much work. That was so much easier. So you do all that work and then I guess we'll just fast forward to your publication now. You have your own outlet. You launched it very, very recently. Give us the name, give us the domain that people can check out and we'll go into more detail in a second. But why did you decide to go independent?
- [36:34]
A
Yeah, well, yes, thank you for giving me the chance for a quick plug after 35 minutes.
- [36:40]
B
We've built up to it.
- [36:42]
A
No, no, you got to earn it. You got to earn pay the toll. I get it. But you know, it's. Yes, it's nice for indie media, supporting indie media. And I think, you know, you guys, when you launched yours, I think that played a role in me sort of thinking about this. So the website I launched with my partner Alexios Manzarlis is Indicator Media. So it's called Indicator. And we basically, we do investigations into all different forms of digital deception. So kind of continuing the beat I've been on for a long time. But also it brings in all this OSINT stuff where I publish really deep dives guides, tutorials, talk to people in this area about the latest techniques and things like that to try and help give people the knowledge they want, but also hopefully to expand the field even more. For me, I had probably one of the best jobs in journalism, which I was a national reporter at ProPublica. And not only that, I live in Canada and they didn't make me move to the U.S. no offense us but it's like I'm Canadian. I wanted to stay here and so I had a great gig there. But I also, I did a lot of, you know, I had my fingers in different pies. Like, you know, I teach a digital investigations course and I would do trainings every now and then. And it just came to a point where it was clear like there was no way for me to continue to really do all these things. And at ProPublica the deal is we give you the opportunity to spend months or even a year or more on a story and give you all the resources you need and for you to deliver the best possible thing you can. And you know, the deal is like you, you've got to be, you gotta make it as good as possible. And I realized like, I think my attention is starting to wander and but I also had this.
- [38:21]
B
Is that because. Yeah, that makes sense. And then just finish that in a second. But when you say so your attention was wandering. Was, was it also, do you have teaching and all of that? But is it also the lead time of writing an article at an outlet like ProPublica or I guess you could compare it also definitely to investigations units in New York Times or Washington Post. It is so long and I don't know if I could do it. Basically.
- [38:47]
A
Yeah, it's a be careful what you wish for scenario in that at BuzzFeed News I could work on longer things but I was always knocking out shorter term stuff in the interim. And so when I had the opportunity to work at ProPublica, I was like, oh man, amazing. I could just like focus and really get down on something. And then when I got into that I was like, oh, but look how much I'm missing. Like there's, there's a million stories I'm passing up. And so I think the metabolism thing you're mentioning like that I think I realized at a certain point that maybe wasn't the right fit. Even though I will say like at ProPublica they are trying to get the journalists to think less about it has to be one big honkin story you spent six months on. And maybe it's actually four stories that you publish over a span because the problem is nobody reads. So if you're publishing a 5,000 word article you spent six months on, literally you might have absolutely no one who reads all the way to the end. And is that actually the way to make this work live? And so that's something they're naturally thinking about and doing some interesting work around. But yes, I think the cadence of it and, and the feel like I was really getting separated because I wasn't kind of in the dirt of doing a lot of stories and digging into different areas. I had to pick and I had to choose. And so I just wanted to be greedy again and try to do as many things as I could and frankly, the ability to launch an outlet because I've run blogs over the years, I've been involved in startups and we got to a point where the stack was very doable for an indie outlet where you, you know, you didn't need to buy and have 10 different products. You didn't need to really dig into your own like hosting stuff. A lot of stuff could be done by a platform. And so that just made it appealing as well.
- [40:31]
B
Yeah, yeah. I mean, I remember we had a quick call, I think shortly before you launched something like that and I think we were just talking about sort of that, that tech aspect because you're right, there are so many more options for journalists or researchers now. It's not just substack anymore, obviously. We're on Ghost, which we're very happy with. It's a newsletter, but also a website. You have Beehive, which I think is more newsletter than start a newsletter.
- [40:58]
A
They're building out more website. Everybody's trying to do everything at this point now.
- [41:01]
B
Yes, that makes sense. And what are you on? I can't remember what you landed on.
- [41:05]
A
We are on Beehive. We actually. And this is one of the things that made it possible I think to make the leap was we got into the Beehive media collective where they, they're giving us free access to the platform for two years. We have a certain number of hours per month with the lawyer, we have access to Getty Images and they're just like, here, have these things and go do your thing. And so that's pretty amazing to have that ability. And then there's also a bit of a community of other publications that are on it as well. Like Oliver Darcy's status, which is a media newsletter, is probably their biggest success story. It's like he's publicly, you know, said that he's going to do like a million in revenue in a year. And he got to that with pretty much just him before he even hired anybody. So that's incredible.
- [41:50]
B
Pretty much just him. I know he's hired a couple people now. I. I do pay for status.
- [41:56]
A
So do I.
- [41:57]
B
But I will admit I. I don't read the website. It's so funny, like when I first learned, and I mentioned this a few times on podcast, but there are some people who listen to our podcast and don't read the website. And to me that's. What are you talking about? You're not even reading our articles. You only listen to our annoying voices. And then it turns out I actually do that for several independent publications, so it totally tracks. But, yeah, they've been a great success. So you launch on Beehive and yes, you send these regular emails and posts and it's not just, as you say, your own investigations, but it's sort of the training stuff as well. What sort of things have you been showing people how to do? Exactly.
- [42:39]
A
Yeah. So the most recent guide I published actually this week, it was a guide to finding documents and files and other things that are supposed to be private and kept within a company's servers or a government server, but for whatever reason have accidentally been made publicly available. So it's a very kind of pure OSINT thing. It's like information that should be confidential or internal has been made open. And so it's really a question of do you know where and how to look to find documents and files that have been kind of left out in the open. And so I wrote a guide where I sort of talked about some of the fundamentals of, like, how this happens and why. And then we started with like, search queries of Google, Dorking of the different big kind of hosting services like Amazon or Microsoft, where a lot of people have their documents and governments have their documents and sometimes they leave them open. And so there are ways to just do searches to find them. And then there are also tools out there that have basically been indexing and aggregating as many of these open what are often called buckets out there for people to be able to search through and look through. So that's, you know, that's one example. And I also, I did one recently that people really liked where I just looked at. I think it was like four or five either free or very affordable tools for social media monitoring. Like, we've had a lot of tools die, you know, which happens. CrowdTangle is dead. TweetDeck is. You gotta Pay Elon Musk to use it now. And so it's kind of rare. It feels in the social media world that there are actually new tools that can help you do research and dig into stuff. And so yeah, it's a mix of really like step by step, do this, do this, do this, and like, hey, are you aware of these five approaches or these five tools that you may want to know about?
- [44:23]
B
Yeah, that makes sense. Well, I actually think that's a good place to leave it there. Again, it's indicator media. People definitely go check it out. Even if you're not an OSINT practitioner, you will. You both, sorry. You cover similar stuff to us sometimes, especially around the AI nudify apps and all that sort of thing. So people listening definitely go check it out. But Craig, thank you so much for joining us.
- [44:48]
A
Yeah, listen, thank you for having me. I am a happy paying subscriber to 404, so it was really nice to get a chance to come on and chat and appreciate it.
- [44:57]
B
Yeah, absolutely. All right, we'll leave it there. Thank you so much. As a reminder, 404 Media is journalist founded and supported by subscribers. If you do wish to subscribe to 404 Media and directly support our work, please go to 404 Media co. You'll get unlimited limited access to our articles and an ad free version of this podcast. You'll also get to listen to the subscribers only section where we talk about a bonus story each week. This podcast is made in partnership with Kaleidoscope. Another way to support us is by leaving a five star rating and review for the podcast. That stuff really helps out. And honestly, tell a friend to listen as well. That's actually probably even more beneficial. This has been 404 Media. We'll see you again next time.