You're listening to a Bellingcat Discord server
stage talk titled Getting Started in Open Source
Research. This week we were joined on stage by
OSINT analyst Sophia Santos. Sophia works at
the Center for Information Resilience, an independent
non -profit social enterprise dedicated to exposing
human rights abuses and war crimes, countering
disinformation and combating online behavior
harmful to women and minorities. During the talk,
she walked us through her route into open source
research and shared some invaluable tips on how
to focus your efforts in order to gain a job
in the industry. You can find all the links mentioned
in the talk in the description of this podcast.
The talk was hosted by me, Charlotte Ma, on Wednesday
the 5th of June in the Bellycat Discord server.
It's worth mentioning that during the course
of the podcast, there was some explicit language
used. Welcome to this week's Bellingcat Stage
Talk. This week, we're joined by Sophia Santos,
an OSINT expert and longtime Bellingcat Discord
member who currently works as an analyst at the
Center for Information Resilience. Sophia is
also the owner and author of the blog website,
grailix .com. Grailix is a useful resource for
those looking to practice open source research
skill sets. Sophia posts regular exercises challenging
strangers to have a go at the puzzles. You can
then find the answers in helpful guide videos.
Sophia also writes and records video tutorials
for basic research skills, teaching you how to
do geolocation, for example, to even knowing
how to embrace your own mistakes. Today, Sophia
is here to share some advice for people who are
new to the industry and want to get involved.
We'll be discussing routes into research and
what traps to avoid. And yes, you'll get a chance
to ask your questions too. As we talk, please
put your questions in the chat and I'll ask them
as we move into the Q &A section. Sofia, it's
your turn. Please take the mic and I'll pop back
in in a little bit to ask you some questions.
Thank you. Okay, so hello everyone. My name is
Sofia. I am Portuguese. and I work for the Center
for Information Resilience as DOC and team lead
on one of their many, many projects. I investigate
human rights violations, security incidents,
armed conflict and terrorist activity, among
many other exciting things. I focus on a very
specific area of the globe, which shall remain
unidentified for security reasons. Sorry about
that. In addition to working on my own investigations,
I also lead the extremely talented OSINT team
within that project. Right. So how did I get
you to OSINT in the first place? I hope you're
ready for this because I'm not sure if I am.
So the story begins in the late 90s, early 2000s,
the early stages of the internet. Like any cool
teenager at the time, I was spending a lot of
my free time online. The internet was this amazing
new thing. But the internet from 20 odd years
ago was very different from what we have now.
Security was almost non -existent, which was
very good or very bad, depending on what you're
trying to do. Things were less connected and
information was hard to find and even harder
to piece together. So everything felt scattered
and unorganized if that makes sense. It was,
however, a very exciting time to be a teenager.
I talked to a lot of people, I met a few, I learned
loads of new things and I was having a blast.
Unfortunately, this was also the time that I
met a person who later became my stalker. So
I'm not sure what I did to trigger his obsession
or if I did anything at all, but he remained
a continuous presence in my life for about five
years. He knew where I lived, he knew my friends,
he knew my family, and he held a gun to my head.
And I was too young to know how to handle it,
so I tried telling my friends, but no one really
believed me because he was a very charming person.
They thought he was, you know, I was perhaps
overreacting or misunderstanding his good intentions,
but his intentions were not good and I knew that.
So I did what I had to do, you know, I cut everyone
off and I stayed indoors for almost two years.
You know, I just, that's what I had to do to
survive. And because I was a minor, sometimes
I was still forced to leave the house to do things
with my family, you know, like everyone else.
But in general, for those two first years, the
internet became the only safe way for me to interact
with the outside world. But it wasn't completely
safe because my stalker also knew how to find
me online. So over time, I figured that the best
way to keep myself safe was to first be very
good at hiding my online presence and second,
to track down his movements. Because if I knew
where he was going to be or what he was planning
to do before he found out what I was doing, I
could avoid him and stay safe. So the hunter
becomes the hunted. And that's how I got myself
into OSINT without realizing. I became very good
at finding information, tracking movements, analyzing
patterns, and making informed decisions based
on that data. At that time, I did not know it
was OSINT, of course. I was just trying to stay
alive. Eventually, those two first years went
by. I started getting confident enough. I left
the house, I enrolled in uni, and as soon as
I completed my degree, I was out. I left my country.
I moved a lot, lived in many countries, maintained
a very low online presence, you know, just in
case. I had many jobs. I did a lot of very cool
things, but nothing to do with computers, nothing
to do with security, nothing to do with open
source investigation. I was kind of a hermit,
honestly. I went from mostly living online those
first two years to barely being online the moment
I left my country. In fact, I lived in a few
areas of the globe with none or very limited
internet access for a while, but that was fine
because I was safe. And that was my life for
a very long time. But the story obviously doesn't
end here, does it? So we're going to fast forward
a lot to three years ago, more or less. We're
in the middle of the pandemic, there's lockdowns
and there's boredom. I was so bored and somehow
I found myself stuck at home again. But this
time it wasn't just me, it was all of us, so
it's fine. The world outside was a bit scary
again for a completely different reason this
time. And so during my boredom, I once again
had to resort to go online to experience the
world. We all did it in this time. But what I
was yet to find out is that my experiences with
my stalker 20 years earlier had conditioned how
I interacted with the internet because during
those First years online, I almost obsessively
explored gathered info and analyzed everything
because the internet was a tool that allowed
me to feel in control of my life, but I had to
have full control of that tool. So during lockdown,
I got really, really into ethical hacking because
it was something I had already done back in the
day. Although I'm not even going to pretend that
what I was doing back in the early 2000s was
ethical. It was most definitely not ethical.
I was just a bit naughty then. But that's fine.
I did what I had to do. However, whilst looking
into ethical hacking this time, I came across
the concept of OSINT and everything felt very
familiar. I had done this before and I loved
it because like I said, it gave me a sense of
control. So I started exploring more about this
new found concept and got absolutely hooked on
geolocation specifically. I was fascinated and
terrified by how much information you could get
from a single image, which is why my camera is
off. I'm sorry about that. I'm not giving you
that data. And I enjoyed solving geolocation
and hosting challenges online and then reading
people's walkthroughs. I also felt there were
not that many around. So I decided to create
a blog and start writing my own walkthroughs
so other people could also learn. I had written
about eight of them when one day I was on Twitter
and I saw Nina, the then vice president for the
Center for Information Resilience, asking for
volunteers to help geolocate and verify data
showing the Russian military buildup by the Ukrainian
border. This was the 23rd February 2022, the
day before the full -scale invasion. The tweet
said they were looking for people with Ukrainian
and Russian language skills and women and I thought
to myself I cannot speak any language but I am
a woman so fuck it I'm doing this so I sent an
email to CR with a short message offering my
services a link to my LinkedIn to prove I was
a real person and a woman that's the only thing
I get a head going for me at a time and a link
to my blog to show I was at least capable of
geolocating stuff I was full of undeserving confidence.
That's just how I live life anyway. So somehow
they replied, they got me in and I started working
through the already massive database of the Eyes
on Russia project. I did this for about two days.
On my third day, I was offered a full -time position
as an OSINT analyst working on a different project.
So I'm still on that same project now, but over
the past two and a half years, I rose up to be
the OSINT team lead. So for the first year, however,
I worked on the two projects at the same time,
my full -time paid job and then my free time
on the Eyes on Russia project as a volunteer.
So I was doing eight hours a day on my normal
one, plus a minimum of three hours each evening
and four weekends on the Eyes on Russia project
from the moment I woke up to the moment I went
to bed. It was intense. It was very, very intense.
So I went from casually geolocating random pictures
online to verify data from a warzone to then
get hired as a no -scene analyst in a matter
of three days. And to give you an even better
sense of perspective on the timeline of these
events, I had done my first geolocation ever
two months before I got a job offer. And I feel
like I was possibly on the right place at the
right time with the right set of skills. I'm
not even going to pretend I was some sort of
prodigy. It was most definitely a combination
of luck, lots of confidence and a lot of dedication.
So during my first year as an official hosting
analyst, I kept writing geolocation walkthroughs
and tutorials on my blog. Honestly, I have no
idea how I even found time for that. I probably
wasn't sleeping much, but I was having lots of
fun, so it's fine. I started getting people messaging
me, asking how to get into OSINT, how do you
start, how do you learn, how to do all these
cool things. And I kept answering them because
I just answer everyone, which is very bad. But
anyway, I kept telling people to just go for
it, explore the internet, find images, analyze
them, notice the details, connect dots. Everything
made sense in my head because that's how I always
interacted with the internet. I observed everything.
I analyzed everything. I had to, wasn't it? I
didn't even know how to do it in any other way.
But I felt people weren't really understanding
what I was trying to convey and just do it wasn't
enough. And I wasn't sure how to explain it better
because it was just so obvious to me. So now
I look back, I understand that this was due to
how I learned how to interact with the internet
back in the early 2000s when I had a stalker.
Most people didn't go through that. So the internet
was a completely different space for them. They
interacted with it in a more casual, relaxed
way, which if I'm honest, I kind of envy. The
internet was a battleground for me. It was not
a place to relax. So, like I said, I kept answering
people, working on both projects, a lot, and
creating content. And by the end of that first
year, I was completely and utterly burned down.
I was physically and mentally done. I was a complete
wreck. But by then, the Eyes on Russia project
was well established, had funding, wasn't relying
on volunteers. So I decided I had to step back.
I need a break. I couldn't do it anymore. And
that's how I found myself with a lot of free
time that I hadn't even realized existed. And
because I still kept getting messages from people
wanting to learn about OSINT, I thought to myself,
you know what? Let me show you what I mean. Because
just to explore the internet advice was clearly
not enough. I now had the free time to do it,
so I did. You know, fuck sleep, right? Who needs
to sleep anyway? So in January, 2023, I created
my first five exercises and released them on
my website in short succession. They all have
the exact same format. They start with a very
small briefing, providing some basic context.
Then there's some initial data to analyze. This
can be a photo, a video, a link, or just text.
Then you get a small list of tasks to complete
at that rate based on difficulty level. People
can solve the tasks however they want it. None
of them are impossible, but they do vary a lot
in difficulty. I mark them as either easy, medium
or hard and separate them by beginner or expert
level. So you can choose to start with tasks
that I deem easy for beginners, for example,
and work your way up until you're comfortable
enough to start tackling the ones that are harder,
or you could just jump straight to the more challenging
ones aimed at the experts. You call whatever
floats your boat, really. The exercises are all
centered on the three main skills I believe are
fundamental for someone to become a good hosting
analyst. How to find data, how to verify data
and how to analyze data. Everything on my website
is free. I don't even have ads. I hate ads. None
of the exercises requires people to use any paid
tools or spend any money on anything. It's just
using your brain and open source data. That's
it. So within the first 24 hours of publishing
and exercise, I released a full video walkthrough
on my YouTube channel showing how I solved all
tasks. I feel like when you're a beginner watching
someone do it in front of you, step by step is
extremely helpful. So I show everything, no cuts,
apart from when I swear too much and I think
to myself, well, let me just edit this one out.
But the most important thing for me in my videos
is just I explain why I'm doing things. It's
not just a click here, then there, and voila,
you get the answer. I narrate out loud what is
going on in my head, which is a very dangerous
thing sometimes, but it's also very helpful.
So if people tried and failed to solve a task,
they can watch me do it and then try to replicate.
Afterwards, when they're faced with a similar
situation, they'll know what to do. I also urge
people to write walkthroughs explaining how they
solve the challenges. I then link them on the
corresponding exercise page so others can read
and learn alternative methods. Because there's
never just one way to do things, I'm not like
the ultimate OSINT person there's many people
to learn from. And because people still kept
messaging me, I created a frequently asked questions
page on my website with some guidelines on how
to get into OSINT as a career. In the past years,
I have advised many people on what to do to break
into the field. Some of them I'm very, very proud
to report already work as OSINT analysts, so
well done for them. So what is my general advice?
First thing you need to do is to figure out exactly
what you would like to do, because OSINT is an
umbrella term to refer to intelligence obtained
through open source. It can be used on a number
of fields such as human rights, like I do, cybersecurity,
private investigation, journalism, etc. And the
skills required can be very different from each
other. You'll be working with open source data,
but using different methods for different goals.
Once you have decided what type of OSINT you're
drawn to, I suggest finding organizations or
people who work in that field and see what they
are doing. Many will have public profiles and
you can see what sort of things they discuss,
they share and they gauge with. This will enable
you to understand what skills they possess and
what skills you should aim to develop. Then you
can start working on those skills. I think my
exercises are a good resource once you get to
this stage, especially if you're someone who
needs a bit of structure in their learning. I
still think that the best way to learn Austin
skills is just to observe and analyze everything,
but having some structured tasks might be quite
useful as well. And that's why I created them.
So explore the exercises. I would advise if you
are a beginner to start with the easy ones. Don't
try to be a hero and go for the hard tasks as
you may end up frustrated. It's best to build
up the skills and the confidence alongside them.
You don't need to prove anything to anyone. This
is not a race. Once you get to a point where
you're capable of solving the tasks without any
help, whether they're easy or hard ones, write
about it. Create a blog, a website, a Twitter
thread, whatever floats your boat. Learning to
transfer your thoughts into words is extremely
helpful in this field of work. A great OSINT
analyst has to be able to write great reports
and you don't need to just write exercise walkthroughs.
You can write about anything you want. It's a
matter of showcasing what you're capable of.
That's what you'll want to do. You want to advertise
your skills. However, there is quite a difference
between writing a walkthrough and writing an
OSINT report and I want to highlight this. On
a walkthrough, the goal is to explain your process,
how you solve the challenge, how you unveil identities,
how are you geolocating something. The aim is
to explain your thought process step by step
from beginning to end. On the other hand, in
an OSINT report, the focus is on the intelligence
behind it. What does it all mean? Yes, you got
the answers, you unveil identities, you geolocated
everything and so what? How does that information
help you, the client or the public? What conclusions
can you draw from it and what measures can potentially
be taken based on this intelligence? So this
second type of report is obviously a bit hard
to master. It requires the analyst to take a
step back and see the bigger picture after spending
possibly a considerable amount of time analyzing
the small details of it all. So for beginners,
Wanting to start doing research, I would suggest
starting with just explaining simple things.
Write about how you geolocated something, how
you verified an image that turned out to be old,
misleading, or plain old propaganda. Then you
start adding more complexity to it all. That
is also something I aim to do with my exercises
when preparing them. especially the ones aimed
at beginners, the first question will always
be the easiest one. Afterwards, I request something
a bit more challenging to force people to keep
exploring instead of just stopping there. On
the other hand, the hard tasks, especially the
ones aimed at experts, will throw you immediately
in the deep end. Often you just have one task
and you need to be able to figure out where and
how to start, where to move from there and how
to keep going until you reach your goal. That
is not an easy task for beginners, not that's
impossible. It's just a lot harder because the
OSINT mindset is still developing, but you'll
get there. It's fine. Don't rush it. So once
you're comfortable writing about your OSINT investigations,
you can start sharing them online in whatever
platform of your choice. The goal is to be seen.
Remember, people like me will find people like
you. If you're writing about something that I'm
monitoring, I will find you. That sounds very
creepy. Not to say that you should just sit and
wait, definitely not. But if you keep on producing
good content, people will notice. And that's
especially true if that content is very niche
and no one else is investigating it. You shouldn't
pick something based on what you think will look
good or how much intention you'll get from it.
Go for something that's close to your heart,
something that drives you, the sort of topic
that you just cannot stay away from. Because
it's very clear to me when I'm reading or reviewing
OSINT reports if the investigation was something
the analyst deeply cared about, or it was something
they were just writing because they were assigned
to that topic, you can feel someone's passion
shining through their writing. As a team lead,
I always try to match analysts with their favorite
topics because it's a huge difference in the
quality of their work. You cannot feign passion.
Once you find what drives you and start investigating
and writing about it, start looking for collaborations
with other like -minded people working on similar
things. I know that the Bellingcat Discord server
is great for that. I actually often advise people
to come here, share their ideas, their work,
their progress, and see if they can find others
to collaborate with. Because when you're starting,
your goal is to build a good OSINT portfolio,
especially if you have no background in a field
related to OSINT. At this point, your CV will
be relevant. Your new website, your blog, your
social media account, they will be your new CV,
your skills portfolio. It will show prospective
employees what you can do, how dedicated you
are and your writing skills. And this will all
be public. It's your evidence. So it's your job
to make it as brilliant as possible. And yes,
and I get asked this many, many times, you can
absolutely get a job in Austin with zero professional
experience in this field. I know many truly amazing
analysts who seem to have come from nowhere,
a bit like me. No experience, no background knowledge,
just pure passion and dedication. They always,
always stand out. They're honestly the best professionals
I work with. Nothing matches their drive to learn
and improve. So find your passion and go for
it. I hope this was helpful. Thank you for listening.
Up to you, Charlie. Thank you so much, Xavier,
for such a clear and... friendly explanation
of how to get into this kind of industry and
for explaining the different types of things
you can do with these skill sets as well. Stephanie
in the chat said, thank you for sharing a personal
situation, a terribly good way to learn about
OBSEC and how to spot traces on the internet.
I also shared, sorry, go ahead. Sorry. No, I
was going to say that You know, it's one of these
things that I thought for a while whether or
not I wanted to reveal that information, but
I thought I cannot explain how I got into OSINT
without explaining why I had to go into OSINT,
if it makes sense. So that's it. It's out now.
Yeah. So many people in the chat are saying,
Mina says, this was amazing. Thank you. Shucky
Ducky, which I love the name, says, so helpful
and encouraging. Thank you. Biggie Cheese says,
this was definitely the clearest and most friendly
advice I've gotten for getting into OSINT, so
thank you. While you were talking, I also put
some links in the chat, which I'll share with
the podcast recording as well, which is the link
to your organization Center for Information Resilience,
the link to Bellingcat's coverage of the Eye
of Russia. project that you worked on, and also
a link to a recent Bellingcat report where we
listed seven deadly sins of bad open source research.
Because as you mentioned, when you're writing
up those initial conclusions, when you're first
writing up those reports, it's really, really
important to make sure that you're checking your
own work and making sure that you're staying
accurate to kind of what you found and not kind
of making assumptions. Because that tends to
be something that we see a lot of people who
are getting into OSINT do, because they're excited
by the information they've found. But sometimes
you can kind of jump to conclusions without realizing
that you've kind of made that jump. So I just
wanted to flag that as well. I wanted to ask
while people are putting their questions in the
chat, I wanted to ask why you feel people should
train in open source techniques in comparison
to training in coding language or perhaps even
just traditional journalism. Why did you feel
like open source research was the way forward
for you and why do you think it's such an attractive
kind of set of skills for employers and also
for people in general. I think OSIN kind of employs
these basic skills of challenging what is being
said to you on a very fundamental level. And
in a world full of misinformation, disinformation,
propaganda, those are very valuable skills in
all. I mean, you can be just a student writing
your thesis, but it's useful to check that. to
check that the information you're getting is
from a reputable source, for example. So I found
that it's just a very fundamental skill to have
in anything. I think that, obviously, learning
coding, for example, is useful. I would say that
most authentic analysts I work with do not know
coding. I feel like it's interesting that It's
sometimes useful because I know some of it, just
a bit, but I know enough to read, for example,
the HTML code of website or read the code and
figure out what this is supposed to be doing.
But I think on my line of work, it's mostly to
analyze things like the HTML. For example, I
have an exercise on that specifically. on, you'd
have like three links to articles and these are
articles that were published in countries that
do not use the Gregorian calendar. So it's a
bit of a challenge. If you're writing an Austin
report and you want to say on this date, this
was published, but you do not know the date,
then it's one of those things. You can just go
to the HTML. I'm kind of spoiling it a bit now.
You can just go and it'll give you some information.
So You know, it's, it's useful to have some basic
knowledge. I don't think it's very, um, you know,
it's not fundamental, but it's, you know, it's
useful anyway. Hope that makes sense. Definitely.
Definitely makes sense. Yeah. I always surprised
actually how much, uh, coding comes up in conversations,
but how, how many researchers don't need it.
And I just posted a link in the chat to, uh,
one of our more recent videos where we were,
uh, Agnes from our team. who's on our tech team,
who definitely knows how to code, was talking
you through how to use Jupyter Notebooks and
Google collab as well, which is a way of using
open source research tools without knowing coding
language, which can be useful for people as well.
We have so many questions coming, floating in
now. Lumos asks, thank you. Can you tell us more
about how you felt in your first role in the
Eyes on Russia project? How did you feel when
you first got involved with that? Oh, okay. Okay.
So that was overwhelming. That was insane overwhelming
because I went from being, you know, just geolocating
cool pictures I found online to now, my job was
mostly to geolocate because we had a massive
database by then. And, you know, there's so much
content coming that had to be verified, geolocated,
you know, added to the map eventually. So it
was very overwhelming. It was definitely a trial
by fire, if that makes sense. But yeah, there's
some good aspects of it because I definitely
learned a lot of it. And there were some bad
aspects of it because I was forced to experience
things that I was most definitely not ready to
be experienced if that makes sense. And I'll
tell you a story. So, you know, the two databases,
so I have my normal job and the Eyes on Russia
project, and both of them have a database. And
the database is where we collect all the information
that we want to archive. So everything that's
photos, videos, you know, any audio goes there,
gets archived. So it's not lost. If it gets deleted
from the online, you know, social media, then
it's just archived. And so all entries have a
rating. on violence level and this rating varies
from one to five being one everything's fine
there's nothing horrendous on this picture two
you might see some threats verbal threats or
something like that maybe some damage on three
you're going to see maybe some beating perhaps
blood bruises some sort of aggression on four
you're going to see a body and on five that body
is going to be in a very bad condition so I thought,
you know what, I'm going to be very sensible
on my normal job. And I am just going to look
at the ones and the twos. I'm not taking care
of anything else until I'm comfortable enough
to move up and then more, you know, horrible
content. And that was great. I was, I was so
good. I was so proud of myself. I was like, Oh
yeah, I can, I'm going to be so good at this.
And then I go to the Eyes on Russia project and
this was during the weekend. And I was going
through the database again. I was just clicking,
geolocating, clicking, geolocating. And there
was something that felt wrong. I'm not sure if
wrong is the word because suddenly there were
dozens of links entered on the database and there
was nothing else. They didn't have a rating.
They didn't have description, didn't have category.
And it felt like someone just had to dump all
these things because something very big had happened
and there was just like the need to quickly archive
this. So, you know, I completely understand it
had to be done. And I was alone. I was completely
alone on that day on that database, because it
was probably like a Sunday and I was just working
because why wouldn't I? And I just start clicking
and I start geolocating and I start clicking
and I start geolocating. And at the time, I didn't
realize how much that was affecting me because
I'm not going to describe what I was watching,
obviously, but it was something that happened
that had a lot of civilian casualties. It was
something that made international news everywhere.
It was a very bad incident and it was covered
everywhere. I was the first person, well, technically
the second after whoever put those links there.
go through all of it and I was looking frame
by frame, video by video, picture by picture
and it was very, very bad. And when I finally
stopped, it was time to go to bed and I was like,
I am done. I realized how much that had affected
me and I had a completely breakdown, completely.
It was horrible. It was such an enormous thing
to experience. And I feel like that was something
that I was not prepared to deal with. And now
obviously there's been a lot of policies put
into place and also I know when to stop. But
I think there's something that when I think of
the Eyes on Russia project at the beginning,
that is what I think about that trauma that I
had to deal with. Well, I tell it, not like I
had to, I just did it anyway. So there you go.
Lot of information. I was just like sharing everything
now. Next question. Yeah, I mean, we talk about
it a lot in these stage talks, actually, keeping
yourself mentally healthy and mentally sane when
viewing these things. And especially if you're
thinking about going into a niche that involves
human rights or conflict, you need to kind of
be aware that this kind of material might come
across your plate and how to deal with it. I'll
share a few resources in the chat as well. Meryl's
already done it. My colleague Meryl's just shared
a guide for mental health hygiene in the chat.
It's really, really important that you kind of
keep that. in the forefront of your mind. And
there's some really useful tools online as well
that can help kind of obscure some of the image
for you while you're looking at different parts
of the image, for example, or mute the sound,
which can also be highly triggering. But we've
got a lot of other stage talks on our sound card
that you can listen back to, specifically on
mental health while doing open source research.
We have so many questions. So if you don't mind,
I'll keep going. Bishti has asked, and I hope
I've pronounced that right, Bishti has asked,
how do you pick images for your geolocation challenges?
How do you select them? Okay. So there's many
ways I do that depending. So the first thing
is that when I come up with exercise ideas, I
base based on specific skills I want to talk
about. So my goal is always to have an educational
side of it. So then I think of something and
for example, it could be, I want to do a geolocation
that just requires satellite image. You cannot
use Google street view. You cannot use anything
like that. That's it. Like the first one, my
first exercise is like that. So in that case,
honestly, I would just go to a random place on
the map and I was like, this is a good one. And
then I, you know, try to find the name of whatever
next village nearby is. And then I start using
keywords about that village could be the name
of the village. And the first one would be the
name of the village. It could be, I'll try to
find geotagged content like on YouTube. And then
I'll like do a screenshot of someone or a location
somewhere. Sometimes if I want to be a bit more
challenging, I have one where it's the It was
a photo of a military aircraft from the U .S.
And so I went to the U .S. State Department.
I think I'm not sure if it was that one or not.
And I just tried to find something that just
said undisclosed location. So I would just put
that in brackets and disclose location, not brackets,
sorry, quotation marks. And I just see, let's
see what kind of photos are undisclosed. Well,
until I come to them, then it will be disclosed.
and so on. So it really varies. Sometimes my
focus is on the area. So I have a very specific
area. I try to have as many areas of the globe
as possible. So I don't want it to be too centered
on Europe, too centered on the US, too centered
on Russia. I want everything because all countries
have their issues. And it's interesting to just
look at them, especially when you have no idea
what's going on them. And sometimes that happens
to me. I'll be like, let me just come up with
a random country and see what's happening there.
And then I'll go and check pictures from the
news and so on. So it's a bit chaotic. It's a
bit random because I feel like adding that randomness
creates an extra challenge that I enjoy because
I also need to solve them in the first place,
isn't it? Yeah. I think it's great that you're
thinking about trying to cover different areas
of the world as well, particularly as when you're
first starting into your location, you might
not be aware of the limitations to some regions
of the world in terms of satellite mapping and
image access. I also want to shout out that your
colleague, Bender and Strick, also does a really
great YouTube series as well called Bender Brown,
which also showcases a lot of useful tips and
tricks for open source researchers, so also worth
checking that out. as well as Sophia's fantastic
exercises. CR has asked, excited to try these
challenges. When it comes to a portfolio, is
there an ideal format that seems to be most popular,
blog posts versus a plain site? I get it depends
on your audience too, but what would you advise?
How would you advise creating your portfolio?
What would you make it look like? That's a tough
question because I am not involved in any hiring
so I'm not sure what other people are looking
at. I feel like I tend to prefer blog entries.
It could be on a website. You can just have a
blog on your own or sometimes people put on LinkedIn
as a post. I'm not sure how you call that. I
tend to not prefer, I don't enjoy too much Twitter
threads. I find it very hard to read them, if
it makes sense. And they're also very focused
on the images. And I think when you're writing,
you want to be explaining things. So limiting
the character is not ideal. So I think blog posts,
I would say they're the best thing because you
can make them as big or as small. You can make
a series if you want to. So they give you, you
know, a lot of allowances. You can do whatever
you want, you know, once you have it, it's yours.
So I think those are quite good. At least that's
what I've been using and that's what I see other
people using. And I think they, they're quite,
you know, they're very nice. Thank you. Moving
swiftly on. Bishti has also asked another question
about limiting yourself while writing reports,
because often people tend to find themselves
writing too much. How long or short should intelligence
reports be? And then CR has added on top of that,
is there a good place to ask for feedback when
you do write such a report? Where did you go
in the early days for feedback on some of your
early reports? Okay, so yeah, how long? Okay,
I feel like that is a problem that all us internalists
have because we just know so much when investigating
something, you know everything, you know all
the details and you want to explain all the tiny
details. And most of the times, the reader does
not care about the details. They just want the
information. They wanted the digested information.
So I would say in terms of number of pages, if
that makes sense, I would say two. Two is how,
well, to be fair, I tend to aim at two and end
up with four anyway. But that's pictures, so
that's fine. I can do that. But yeah, just try
to keep it as clear as possible. What you usually
do is that you'll explain things and then you
link to the sources. So you don't have to, you
know, describe everything. You can just say,
oh, this is what, you know, there's a photo that
showed this and then you just link to that photo
without having to, you know, put everything on
it. If people want more information, they can
click the link and then, you know, get, you know,
the information of where you got that information,
that source and so on. So I would say keep it
short -ish and that's mostly because you want
to make sure that the people will keep on reading
until halfway through because otherwise they'll
just... Most people that will read your reports
are probably going to be people that do not have
much time to read too much information. So they
want intelligence, that's it. They don't want
how you got it. They don't want to learn about
all the steps and that tiny detail and that video
and then you found this person and then you did
this thing. They don't care about any of that.
They want intelligence. If you're writing a blog
post and you want to showcase your skills, then
definitely explain how you got there because
when someone like a prospective employee is looking
at it, they want to see that you're capable of
making those steps and do this analysis. and
find these identities, do you locate these things?
So these are skills that you'll be looking for.
But in terms of the reader, that's why I explain
the difference between an oath and report and
a walkthrough. They're quite different things.
I'm sure there was a second and a third question,
but I didn't write it down. Yeah, the second
question actually relates to the question I was
going to ask now. A lot of people are asking
where they can find examples of good practice
reports and where they can get feedback on their
reports. Have you got any tips on that? Okay.
So good practice reports. Well, there are many
reports being written online. Bellinghat has
reports or articles. I'm not sure how you describe
it. You know, they are there. CR has, there's
a few projects that publish reports, the High
Zone Russia project, the Afghan witness project,
the Myanmar witness project. So all of them have
reports and then you can read and see more or
less what style they are. And I guess you can
guide yourself through with that. In terms of
feedback, that is harder because obviously when
you're working, you'll have someone to give feedback.
I'm the person that gives feedback to other people.
when you're not working, then that's obviously
makes it harder. I usually, I would suggest getting
other hosting people to read your articles because
I feel like I have that problem at work as well.
Cause I review everyone's reports, but who's
reviewing mine, right? Like, you know, who watches
the watchman. So I tend to ask other analysts
who's like, can you look at my own reports? Which
I hate. I hate when people commenting on it.
I'm like, no, it was perfect. What are you doing?
But no, sometimes it's not perfect and I need
to change it. So it's always good to have an
extra pair of eyes and it doesn't even have to
be an awesome person. You can just give it to
your mom or dad and be like, if you were to read
this, do you understand? Because Again, there's
different types of OSINT, and if your article
is for public, it could be anyone. Anyone could
just pick it up and read it and it needs to be
understandable. People will be reading it and
you're like, what do you mean by this? I've never
heard this concept before because it could be
something that everyone knows in OSINT, but out
of OSINT, no one knows about it. So it's very
useful to have extra pair of eyes from all walks
of life, not just OSINT. That's it. That would
make sense. Definitely, and I would just like
to plug that in the Bellingcat Discord server,
we have channels like publication preparation,
cries for help, show your work, where you can
kind of ask for that kind of last checks or help
with those kinds of things as well. I'm not encouraging
you to all post all of your 60 page works. in
the channels, but asking people for help there
is definitely encouraged. So please do reach
out. So Tansa has asked a very common question
that Bellingcat often face, actually, which is
without cyber security expertise, how do you
protect yourself while researching potentially
dangerous topics or organizations? Any advice
on that? So, yes, I do understand that. Like
in my case, I feel like I kind of learned that
the hard way before cybersecurity was even a
topic I knew about. So it's hard for me to understand.
I feel like there's a few ways to protect yourself,
obviously. I feel like people as well exaggerate
how much protection they need. Sometimes, the
keyword being sometimes, because I see people
like you need a virtual machine with whatever
super exciting operating system and some crazy
tools. And if you're just going to check Twitter,
you don't need that. That's a bit too much, isn't
it? If then you're going to, for example, investigate...
extremist terrorist, you know, extremist organization
propaganda, and you need to get into this very
specific channels, which I shall not name, then
definitely, you definitely need some sort of
protection because you just never know what's
going to happen. So there's a few things. that
if you are going to go into places that will
possibly get you on a list, you should definitely
do. So things like you have a burner phone and
you have a burner SIM card. And I have that just
like an old phone that I don't use anymore. Cleaned
everything. Everything just reset. Buy a SIM
card from like for 20 P from eBay. It's not associated
with me in any way. And that is just used to
register. on websites that require. So like,
for example, Facebook, they need your phone number.
That's my phone number now. They need a new email.
I'll create a new email. So I'll have a browser
that's my working browser and nothing on that
browser can connect to me in any way whatsoever.
And, you know, that gets cleaned all the time.
If I click, you know, close the browser, everything
gets purged and everything has to be logged in
again. So there's a few basic things. I don't
think people need to go overboard again if they're
doing investigation that just requires social
media, geolocations, analyzing pictures. But
if you do then get into more deeper rabbit holes,
then definitely you need to read into how to
stay safe. But you don't need a cybersecurity
course. just some basic knowledge. And also once
you start getting into OSINT and you can see
how much information you can get from very specific
things like, you know, in photo, then you start
getting very careful about what you post online.
And also I would suggest every so often just
do OSINT on you, see how much you can find about
yourself, anything that you left behind, a blog
post, some social media profile that you forgot
existed, go back, purge everything, delete everything,
and that's it. It doesn't require too much, I
think. Have you ever worked on a dark or deep
web OSINT? Somebody in the chat is asking a question
about that. No, I don't do that. There are a
few members of my team that do that, but that
is not my department, so I do not do that now.
Great. Thank you so much for that really important
advice. And yeah, just making sure that you're
using kind of research profiles when you're searching
anybody on social media as well is really important.
Keeping it away from your personal profiles as
much as possible. Stephanie asked a really interesting
question. How can you tell the difference between
passion and work and thinking about your sleep
and about trauma and also the large number of
people who are looking for a job in open source
research? because they love investigating and
analyzing this or that field. And of the recruiters
who ask, what are your salary expectations as
a junior? So how do you tell the difference between
passion and work? Okay. I think for me, it's
very clear at the end of the day is like 6 p
.m. I'm done for the day. Do I walk away from
it or do I just open another tab and I'm looking
at something else? So that is the difference
for me. If I just keep on going, it doesn't matter
if it's weekend. It doesn't matter if it's, you
know, 6 a .m. and I'm like, you know what I should
do? I should look at that location. I should
look at that picture. I need to solve that. I
feel like that is passion. If you're just doing
it because you have to, then that's a job. And,
you know, it's fine. Sometimes you can have one
without the other. But, you know, when you have
them combined, that's just heaven. I love it.
As we're running out of time, we've only got
10 minutes left. So please put your final questions
in the chat now. Shuky Ducky actually asked a
question that I wanted to ask as well, which
is based on your experience and observations.
Sophia, what areas or topics do you think are
currently undeserved or in high demand for open
source researchers? Oh, God, that is a very hard
question. I don't know. That is my answer. I
just do not know because I feel like Whenever
I go and I want to look at some random country
for an idea for an exercise, I just come across
so much that I had no idea what was going on
there. And that's always a surprise to me. I
was just like, oh, well, I had never come across
this. I didn't know there was an issue going
on in this country or this region of the world.
And I feel like Maybe the best way is to find
something, like I said, that's close to your
heart. Maybe it could be, you know, where you
live or where you're from, could be different
things. Something that, you know, when you go
to Twitter or when you go to Facebook or whatever,
the things that you just keep on checking, you
keep on Googling, you keep on wanting to know
more about it. Because again, like I said, when
I was speaking, it's best to do something that
drives you than to try to find something that
you feel will get attention or is not getting
enough attention, just find something that you
want to do. Yeah, passion is definitely important
because you're going to be staring at the same
piece of information or the same set of information
for a while. But a lot of people fall into things
that are familiar to them as well. So covering
countries, for example, where they speak the
language, where they're familiar with the landscape,
because it's often easier for geolocation purposes,
at least. Zal Dastix earlier asked, if you're
doing that kind of thing, if you're kind of falling
into familiar territory for yourself, how do
you avoid getting your biases in the way. How
do you investigate something and make sure that
you're not harming anybody with biases when doing
open source reporting? It's very hard because
I do investigate the same area of the globe every
single day, but I also do as part of a team.
So, you know, we all keep each other in check,
if that makes sense. And sometimes I'll write
something and be like, no, no, that's wrong.
Kind of like, damn it. So I think it's always
best if you can collaborate with other people
because they do provide a different perspective
than yours. And I feel like that is also so valuable.
And most of my, sorry, most of my reports, I
do them alone. I write them alone. But, you know,
it's just so important to have that someone else
to just come in and look at it. So, like I said,
the Bellingcat server is a good one. So you can
go and it's divided in like topics, isn't it?
And you can go and see what other people are
talking about because maybe, yeah, you are stuck
in our biases. And also, I would suggest, like
I said, I have a different browser for work.
So that browser. It gets purged every day, like
all cookies go, everything. So it kind of resets.
So anything that I was looking for or looking
around the previous day is no longer impacting,
hopefully, my results. And I think that's important
to just get the clear slate, you know, because
we get a lot, you know, search engines and platforms
try to track what you like and try to give you
more of that. So my suggestion, just don't give
them that. Just purge everything. Just like give
me the clean slate and let's see what you got.
Exactly. Algorithms try to box you in and this
can sometimes leave you blind. I wanted to ask,
is there any tools that you found more useful
when you were a beginner that you now perhaps
no longer use as an expert or any that have become
a staple as part of your research that you think
are worth shouting out? So the short answer is
no. I feel like tools come and go and I tend
to not get attached to them too much because
you just never know. Next time I'm going to search
for it, they're just gone. It's however, something
I see a lot in the online hosting community.
They just need to find and collect hosting tools
for everything. There's list of this and top
five and top 10 tools for whatever. And I'm sure
some of them are very useful, but I tend to not
just bother with any of them. I like to stick
to the basics and try to use search engines to
find information. You have Google Yandex Bing
Maps alongside Google Earth Pro for satellite
imagery, because I spend a lot of my time looking
at photos and videos and noticing the tiny details
of it all. So it's mostly what I do. I also feel
like the most important thing about any tools
is to master them, to learn in depth what they
can or cannot do because That's it. You learn
how to do things that most people probably don't
know about. I'll give a quick example. I did
a geolocation that I wrote about a while ago.
I think it was last year. It was at a time where
a Wagner convoy was heading to Moscow. It was
a big thing and everyone was just in a big brouhaha.
There was a video of excavators digging a road.
I apparently was to stop this convoy from reaching
Moscow and I was tasked to find this geolocation
thing. What I used at the time was that I went
to Google Maps and I knew more or less the area
that they were heading in a specific direction.
They were heading towards Moscow. I knew where
they were before, so I kind of had a more general
idea and I was looking for big roads because
there were tanks and stuff, they needed space.
And I end up using the traffic option on Google
Maps, which is not used that often. So people
will use it if they need to navigate, for example,
and they want to see how much traffic is in a
specific area. But because when I saw that video,
I saw that when the excavators were digging the
road, there was a queue of cars forming behind
them. So I thought, if I put this live thing
that shows the traffic of this area, I would
say that the red bits is where the traffic is
forming. That's where this likely to play. So
I went straight to that area, check Google street
view because apparently they did have it, which
was great. And I just relocated. So that's what
I mean. Like, you know, everyone knows how to
use Google maps, but not everyone will know how
to use this very specific. option of Google Maps.
And so I would suggest people to just play with
everything, click everything. I'm always clicking
everything. And I keep up with any changes to
this. So I follow things about Google News and
Maps. So whenever anything is introduced or removed,
I'm aware of it and I can just make sure that
I can either use it or stop using and find an
alternative. So it's less about the tools and
more about your expertise in using them. That's
really, really good advice. Just on that topic
then, as we're wrapping up, what kind of barriers
should people expect to face when trying to get
into this industry and trying to get into open
source research? And how might you advise they
overcome them? I think that there's a few barriers
in terms of skills, obviously. So if you're investigating
something, like I said, I applied for the Eyes
on Russia project and they wanted someone who
spoke the language. That's the barrier for me
specifically. Language is definitely a very high
demand skill. But I think the biggest barrier
that I see nowadays is that there's so many organizations
hiring based on CV and that is not how you get
the talent. The talent is not coming from the
CV. At most, you'll get someone that can write
CVs very well. The talent are the people that
dedicate and do things. And I feel like that
is an overall thing. But I think the problem
is if you have a small organization, then it's
likely that the people that will be doing the
hiring will be people that know about OSINT.
If you have a big organization, chances are the
people hiring are the people that are like HR
or something like that or management. And those
will be looking at CV because they don't know
what skills they need. And I feel like that is
a problem in any organization, in any industries,
not just this one. But I think in OSINT specifically,
the best, absolutely the best analyst I ever
worked with. were people that didn't have the
ideal CV. They didn't have anything to do with
OSINT. And I feel like if they were looking at
their CV at the beginning, they would not have
a job. No one even looked at my CV. I never sent
my CV to anyone. They were just like, hey, yeah,
you can join in. And that's it. So I was happy
for that. I'm very happy for that. But I feel
like we need to let more people in. based on
the skills rather than what they have done so
far. Absolutely. Absolutely. I cannot agree more.
And that's part of the reason why I was so desperate
to chat to you today. And thank you so, so much
for today's talk. It's been fascinating. We've
learned a few things. We've learned not to depend
on tools, practice, practice, practice, identify
your niche, identify your passion, and that the
industry needs to recognize all the hard people
working out there on these kinds of things. So
thank you so much, Sophia, for a fantastic talk.
Is there any other resources that you want to
kind of highlight quickly other than your own
fantastic website? Yes. Yes, I want that. Yes,
I'm very excited about that. Okay. So one of
the things that I've told already is that I ask
people to, when they solve my exercises and when
they write walkthroughs to please give me the
links. And so then I put them on my page. So,
you know, like on my page, each exercise has
a page and on them, I will list everyone that
has written a walkthrough. And I feel like that
is a gold mine of knowledge. I love reading those
walkthroughs because very often they come from
people that have no experience in OSINT and somehow
they're thinking, they're using methods, they
use strategy that would never occur to me. And
it's brilliant. And I'll get people from all
walks of life, people from all sides of this
planet, all corners. And they just solve the
exact same thing that I've done and many others
have done, but they use the technique that no
one else has used. And I think this is just brilliant.
I absolutely invite people to read other people's
work. And some of them are honestly, they're
just their raw talent. And I keep telling them
and I am always so sad when sometimes they message
me and they're like here's my walkthrough please
don't publish I'm not comfortable I'm not confident
enough and I read it and it's like the most brilliant
piece of work and I was like why wouldn't I publish
this is brilliant please keep writing please
if you ever change your mind just let me know
I want to publish this you should be very proud
of it and that's it that's a good resource. Fantastic
so Safiya wants to know if you've tried her exercises
and please do get in touch. All right. Thank
you, everybody, for listening. I'm going to end
the recording here. But thank you so much for
your time today. And in two weeks time, we'll
be back with another stage talk. My colleague
Meryl will be presenting it. Thank you so much,
everybody. Thank you. Bye bye. Thank you for
listening to the stage talk. If you'd like to
catch a stage talk live where you can ask the
guest questions, join the Bellingcat Discord
server by visiting www .discord .gg slash Bellingcat.
The music you've heard is titled Dawn by Newer
Self and is courtesy of Artlist.