WEBVTT

00:00:02.029 --> 00:00:04.629
You're listening to a Bellingcat Discord server

00:00:04.629 --> 00:00:07.870
stage talk titled Getting Started in Open Source

00:00:07.870 --> 00:00:10.929
Research. This week we were joined on stage by

00:00:10.929 --> 00:00:14.310
OSINT analyst Sophia Santos. Sophia works at

00:00:14.310 --> 00:00:16.890
the Center for Information Resilience, an independent

00:00:16.890 --> 00:00:20.250
non -profit social enterprise dedicated to exposing

00:00:20.250 --> 00:00:23.309
human rights abuses and war crimes, countering

00:00:23.309 --> 00:00:26.109
disinformation and combating online behavior

00:00:26.109 --> 00:00:29.379
harmful to women and minorities. During the talk,

00:00:29.460 --> 00:00:31.859
she walked us through her route into open source

00:00:31.859 --> 00:00:34.619
research and shared some invaluable tips on how

00:00:34.619 --> 00:00:37.479
to focus your efforts in order to gain a job

00:00:37.479 --> 00:00:40.880
in the industry. You can find all the links mentioned

00:00:40.880 --> 00:00:43.600
in the talk in the description of this podcast.

00:00:44.119 --> 00:00:46.840
The talk was hosted by me, Charlotte Ma, on Wednesday

00:00:46.840 --> 00:00:49.939
the 5th of June in the Bellycat Discord server.

00:00:51.259 --> 00:00:52.920
It's worth mentioning that during the course

00:00:52.920 --> 00:00:55.679
of the podcast, there was some explicit language

00:00:55.679 --> 00:01:01.520
used. Welcome to this week's Bellingcat Stage

00:01:01.520 --> 00:01:04.680
Talk. This week, we're joined by Sophia Santos,

00:01:05.079 --> 00:01:08.159
an OSINT expert and longtime Bellingcat Discord

00:01:08.159 --> 00:01:11.079
member who currently works as an analyst at the

00:01:11.079 --> 00:01:13.980
Center for Information Resilience. Sophia is

00:01:13.980 --> 00:01:16.760
also the owner and author of the blog website,

00:01:17.159 --> 00:01:20.959
grailix .com. Grailix is a useful resource for

00:01:20.959 --> 00:01:23.959
those looking to practice open source research

00:01:23.959 --> 00:01:27.659
skill sets. Sophia posts regular exercises challenging

00:01:27.659 --> 00:01:30.000
strangers to have a go at the puzzles. You can

00:01:30.000 --> 00:01:32.359
then find the answers in helpful guide videos.

00:01:33.280 --> 00:01:35.640
Sophia also writes and records video tutorials

00:01:35.640 --> 00:01:38.659
for basic research skills, teaching you how to

00:01:38.659 --> 00:01:40.939
do geolocation, for example, to even knowing

00:01:40.939 --> 00:01:43.920
how to embrace your own mistakes. Today, Sophia

00:01:43.920 --> 00:01:45.920
is here to share some advice for people who are

00:01:45.920 --> 00:01:47.680
new to the industry and want to get involved.

00:01:47.959 --> 00:01:50.260
We'll be discussing routes into research and

00:01:50.260 --> 00:01:53.359
what traps to avoid. And yes, you'll get a chance

00:01:53.359 --> 00:01:56.420
to ask your questions too. As we talk, please

00:01:56.420 --> 00:01:58.560
put your questions in the chat and I'll ask them

00:01:58.560 --> 00:02:02.400
as we move into the Q &A section. Sofia, it's

00:02:02.400 --> 00:02:05.900
your turn. Please take the mic and I'll pop back

00:02:05.900 --> 00:02:08.039
in in a little bit to ask you some questions.

00:02:08.500 --> 00:02:11.319
Thank you. Okay, so hello everyone. My name is

00:02:11.319 --> 00:02:14.770
Sofia. I am Portuguese. and I work for the Center

00:02:14.770 --> 00:02:17.449
for Information Resilience as DOC and team lead

00:02:17.449 --> 00:02:21.310
on one of their many, many projects. I investigate

00:02:21.310 --> 00:02:23.789
human rights violations, security incidents,

00:02:24.129 --> 00:02:26.750
armed conflict and terrorist activity, among

00:02:26.750 --> 00:02:30.810
many other exciting things. I focus on a very

00:02:30.810 --> 00:02:33.669
specific area of the globe, which shall remain

00:02:33.669 --> 00:02:35.949
unidentified for security reasons. Sorry about

00:02:35.949 --> 00:02:38.830
that. In addition to working on my own investigations,

00:02:39.050 --> 00:02:42.050
I also lead the extremely talented OSINT team

00:02:42.050 --> 00:02:45.629
within that project. Right. So how did I get

00:02:45.629 --> 00:02:47.870
you to OSINT in the first place? I hope you're

00:02:47.870 --> 00:02:50.009
ready for this because I'm not sure if I am.

00:02:50.710 --> 00:02:54.550
So the story begins in the late 90s, early 2000s,

00:02:54.569 --> 00:02:57.810
the early stages of the internet. Like any cool

00:02:57.810 --> 00:03:00.569
teenager at the time, I was spending a lot of

00:03:00.569 --> 00:03:03.330
my free time online. The internet was this amazing

00:03:03.330 --> 00:03:06.419
new thing. But the internet from 20 odd years

00:03:06.419 --> 00:03:08.860
ago was very different from what we have now.

00:03:09.219 --> 00:03:11.939
Security was almost non -existent, which was

00:03:11.939 --> 00:03:14.180
very good or very bad, depending on what you're

00:03:14.180 --> 00:03:16.939
trying to do. Things were less connected and

00:03:16.939 --> 00:03:19.319
information was hard to find and even harder

00:03:19.319 --> 00:03:22.569
to piece together. So everything felt scattered

00:03:22.569 --> 00:03:24.909
and unorganized if that makes sense. It was,

00:03:25.310 --> 00:03:27.449
however, a very exciting time to be a teenager.

00:03:27.849 --> 00:03:31.590
I talked to a lot of people, I met a few, I learned

00:03:31.590 --> 00:03:34.270
loads of new things and I was having a blast.

00:03:35.229 --> 00:03:37.689
Unfortunately, this was also the time that I

00:03:37.689 --> 00:03:40.830
met a person who later became my stalker. So

00:03:40.830 --> 00:03:43.689
I'm not sure what I did to trigger his obsession

00:03:43.689 --> 00:03:46.530
or if I did anything at all, but he remained

00:03:46.530 --> 00:03:48.969
a continuous presence in my life for about five

00:03:48.969 --> 00:03:52.080
years. He knew where I lived, he knew my friends,

00:03:52.300 --> 00:03:54.860
he knew my family, and he held a gun to my head.

00:03:55.340 --> 00:03:57.360
And I was too young to know how to handle it,

00:03:57.360 --> 00:03:59.819
so I tried telling my friends, but no one really

00:03:59.819 --> 00:04:02.419
believed me because he was a very charming person.

00:04:02.740 --> 00:04:04.599
They thought he was, you know, I was perhaps

00:04:04.599 --> 00:04:07.840
overreacting or misunderstanding his good intentions,

00:04:08.360 --> 00:04:10.979
but his intentions were not good and I knew that.

00:04:12.180 --> 00:04:14.699
So I did what I had to do, you know, I cut everyone

00:04:14.699 --> 00:04:17.439
off and I stayed indoors for almost two years.

00:04:17.740 --> 00:04:19.980
You know, I just, that's what I had to do to

00:04:19.980 --> 00:04:22.480
survive. And because I was a minor, sometimes

00:04:22.480 --> 00:04:24.579
I was still forced to leave the house to do things

00:04:24.579 --> 00:04:26.699
with my family, you know, like everyone else.

00:04:27.180 --> 00:04:29.399
But in general, for those two first years, the

00:04:29.399 --> 00:04:32.740
internet became the only safe way for me to interact

00:04:32.740 --> 00:04:35.620
with the outside world. But it wasn't completely

00:04:35.620 --> 00:04:38.180
safe because my stalker also knew how to find

00:04:38.180 --> 00:04:41.410
me online. So over time, I figured that the best

00:04:41.410 --> 00:04:44.930
way to keep myself safe was to first be very

00:04:44.930 --> 00:04:47.350
good at hiding my online presence and second,

00:04:47.709 --> 00:04:50.170
to track down his movements. Because if I knew

00:04:50.170 --> 00:04:52.449
where he was going to be or what he was planning

00:04:52.449 --> 00:04:55.709
to do before he found out what I was doing, I

00:04:55.709 --> 00:04:58.550
could avoid him and stay safe. So the hunter

00:04:58.550 --> 00:05:01.709
becomes the hunted. And that's how I got myself

00:05:01.709 --> 00:05:05.240
into OSINT without realizing. I became very good

00:05:05.240 --> 00:05:07.939
at finding information, tracking movements, analyzing

00:05:07.939 --> 00:05:10.220
patterns, and making informed decisions based

00:05:10.220 --> 00:05:13.360
on that data. At that time, I did not know it

00:05:13.360 --> 00:05:15.459
was OSINT, of course. I was just trying to stay

00:05:15.459 --> 00:05:18.839
alive. Eventually, those two first years went

00:05:18.839 --> 00:05:21.399
by. I started getting confident enough. I left

00:05:21.399 --> 00:05:23.860
the house, I enrolled in uni, and as soon as

00:05:23.860 --> 00:05:26.779
I completed my degree, I was out. I left my country.

00:05:27.040 --> 00:05:29.579
I moved a lot, lived in many countries, maintained

00:05:29.579 --> 00:05:32.480
a very low online presence, you know, just in

00:05:32.480 --> 00:05:35.779
case. I had many jobs. I did a lot of very cool

00:05:35.779 --> 00:05:38.100
things, but nothing to do with computers, nothing

00:05:38.100 --> 00:05:40.160
to do with security, nothing to do with open

00:05:40.160 --> 00:05:42.740
source investigation. I was kind of a hermit,

00:05:42.839 --> 00:05:45.899
honestly. I went from mostly living online those

00:05:45.899 --> 00:05:48.439
first two years to barely being online the moment

00:05:48.439 --> 00:05:51.279
I left my country. In fact, I lived in a few

00:05:51.279 --> 00:05:54.379
areas of the globe with none or very limited

00:05:54.379 --> 00:05:56.800
internet access for a while, but that was fine

00:05:56.800 --> 00:05:59.600
because I was safe. And that was my life for

00:05:59.600 --> 00:06:03.600
a very long time. But the story obviously doesn't

00:06:03.600 --> 00:06:07.339
end here, does it? So we're going to fast forward

00:06:07.339 --> 00:06:10.259
a lot to three years ago, more or less. We're

00:06:10.259 --> 00:06:13.160
in the middle of the pandemic, there's lockdowns

00:06:13.160 --> 00:06:18.040
and there's boredom. I was so bored and somehow

00:06:18.040 --> 00:06:20.680
I found myself stuck at home again. But this

00:06:20.680 --> 00:06:22.620
time it wasn't just me, it was all of us, so

00:06:22.620 --> 00:06:25.920
it's fine. The world outside was a bit scary

00:06:25.920 --> 00:06:28.139
again for a completely different reason this

00:06:28.139 --> 00:06:31.259
time. And so during my boredom, I once again

00:06:31.259 --> 00:06:33.720
had to resort to go online to experience the

00:06:33.720 --> 00:06:36.660
world. We all did it in this time. But what I

00:06:36.660 --> 00:06:39.540
was yet to find out is that my experiences with

00:06:39.540 --> 00:06:42.980
my stalker 20 years earlier had conditioned how

00:06:42.980 --> 00:06:45.759
I interacted with the internet because during

00:06:45.759 --> 00:06:49.370
those First years online, I almost obsessively

00:06:49.370 --> 00:06:52.629
explored gathered info and analyzed everything

00:06:52.629 --> 00:06:55.490
because the internet was a tool that allowed

00:06:55.490 --> 00:06:58.110
me to feel in control of my life, but I had to

00:06:58.110 --> 00:07:01.209
have full control of that tool. So during lockdown,

00:07:01.350 --> 00:07:04.990
I got really, really into ethical hacking because

00:07:04.990 --> 00:07:07.589
it was something I had already done back in the

00:07:07.589 --> 00:07:10.290
day. Although I'm not even going to pretend that

00:07:10.290 --> 00:07:12.810
what I was doing back in the early 2000s was

00:07:12.810 --> 00:07:14.889
ethical. It was most definitely not ethical.

00:07:15.129 --> 00:07:17.649
I was just a bit naughty then. But that's fine.

00:07:17.850 --> 00:07:21.389
I did what I had to do. However, whilst looking

00:07:21.389 --> 00:07:24.310
into ethical hacking this time, I came across

00:07:24.310 --> 00:07:27.490
the concept of OSINT and everything felt very

00:07:27.490 --> 00:07:30.029
familiar. I had done this before and I loved

00:07:30.029 --> 00:07:32.629
it because like I said, it gave me a sense of

00:07:32.629 --> 00:07:35.509
control. So I started exploring more about this

00:07:35.509 --> 00:07:39.139
new found concept and got absolutely hooked on

00:07:39.139 --> 00:07:42.980
geolocation specifically. I was fascinated and

00:07:42.980 --> 00:07:46.040
terrified by how much information you could get

00:07:46.040 --> 00:07:48.600
from a single image, which is why my camera is

00:07:48.600 --> 00:07:50.699
off. I'm sorry about that. I'm not giving you

00:07:50.699 --> 00:07:54.139
that data. And I enjoyed solving geolocation

00:07:54.139 --> 00:07:56.740
and hosting challenges online and then reading

00:07:56.740 --> 00:07:59.160
people's walkthroughs. I also felt there were

00:07:59.160 --> 00:08:02.939
not that many around. So I decided to create

00:08:02.939 --> 00:08:05.220
a blog and start writing my own walkthroughs

00:08:05.220 --> 00:08:07.490
so other people could also learn. I had written

00:08:07.490 --> 00:08:11.410
about eight of them when one day I was on Twitter

00:08:11.410 --> 00:08:14.129
and I saw Nina, the then vice president for the

00:08:14.129 --> 00:08:16.550
Center for Information Resilience, asking for

00:08:16.550 --> 00:08:19.009
volunteers to help geolocate and verify data

00:08:19.009 --> 00:08:21.870
showing the Russian military buildup by the Ukrainian

00:08:21.870 --> 00:08:26.230
border. This was the 23rd February 2022, the

00:08:26.230 --> 00:08:28.959
day before the full -scale invasion. The tweet

00:08:28.959 --> 00:08:31.199
said they were looking for people with Ukrainian

00:08:31.199 --> 00:08:34.500
and Russian language skills and women and I thought

00:08:34.500 --> 00:08:37.639
to myself I cannot speak any language but I am

00:08:37.639 --> 00:08:40.519
a woman so fuck it I'm doing this so I sent an

00:08:40.519 --> 00:08:43.759
email to CR with a short message offering my

00:08:43.759 --> 00:08:46.200
services a link to my LinkedIn to prove I was

00:08:46.200 --> 00:08:48.360
a real person and a woman that's the only thing

00:08:48.360 --> 00:08:51.039
I get a head going for me at a time and a link

00:08:51.039 --> 00:08:53.460
to my blog to show I was at least capable of

00:08:53.460 --> 00:08:56.980
geolocating stuff I was full of undeserving confidence.

00:08:57.240 --> 00:08:59.899
That's just how I live life anyway. So somehow

00:08:59.899 --> 00:09:02.919
they replied, they got me in and I started working

00:09:02.919 --> 00:09:05.700
through the already massive database of the Eyes

00:09:05.700 --> 00:09:08.279
on Russia project. I did this for about two days.

00:09:08.960 --> 00:09:11.700
On my third day, I was offered a full -time position

00:09:11.700 --> 00:09:14.539
as an OSINT analyst working on a different project.

00:09:14.580 --> 00:09:17.259
So I'm still on that same project now, but over

00:09:17.259 --> 00:09:19.519
the past two and a half years, I rose up to be

00:09:19.519 --> 00:09:22.860
the OSINT team lead. So for the first year, however,

00:09:22.980 --> 00:09:25.360
I worked on the two projects at the same time,

00:09:25.659 --> 00:09:28.419
my full -time paid job and then my free time

00:09:28.419 --> 00:09:30.659
on the Eyes on Russia project as a volunteer.

00:09:31.059 --> 00:09:33.299
So I was doing eight hours a day on my normal

00:09:33.299 --> 00:09:36.179
one, plus a minimum of three hours each evening

00:09:36.179 --> 00:09:38.779
and four weekends on the Eyes on Russia project

00:09:38.779 --> 00:09:40.980
from the moment I woke up to the moment I went

00:09:40.980 --> 00:09:44.059
to bed. It was intense. It was very, very intense.

00:09:44.360 --> 00:09:48.440
So I went from casually geolocating random pictures

00:09:48.440 --> 00:09:51.299
online to verify data from a warzone to then

00:09:51.299 --> 00:09:53.659
get hired as a no -scene analyst in a matter

00:09:53.659 --> 00:09:56.539
of three days. And to give you an even better

00:09:56.539 --> 00:09:59.139
sense of perspective on the timeline of these

00:09:59.139 --> 00:10:02.460
events, I had done my first geolocation ever

00:10:02.460 --> 00:10:06.110
two months before I got a job offer. And I feel

00:10:06.110 --> 00:10:09.029
like I was possibly on the right place at the

00:10:09.029 --> 00:10:11.169
right time with the right set of skills. I'm

00:10:11.169 --> 00:10:13.029
not even going to pretend I was some sort of

00:10:13.029 --> 00:10:15.570
prodigy. It was most definitely a combination

00:10:15.570 --> 00:10:19.309
of luck, lots of confidence and a lot of dedication.

00:10:20.090 --> 00:10:22.610
So during my first year as an official hosting

00:10:22.610 --> 00:10:25.429
analyst, I kept writing geolocation walkthroughs

00:10:25.429 --> 00:10:28.169
and tutorials on my blog. Honestly, I have no

00:10:28.169 --> 00:10:30.210
idea how I even found time for that. I probably

00:10:30.210 --> 00:10:32.169
wasn't sleeping much, but I was having lots of

00:10:32.169 --> 00:10:34.779
fun, so it's fine. I started getting people messaging

00:10:34.779 --> 00:10:37.440
me, asking how to get into OSINT, how do you

00:10:37.440 --> 00:10:39.320
start, how do you learn, how to do all these

00:10:39.320 --> 00:10:41.759
cool things. And I kept answering them because

00:10:41.759 --> 00:10:43.980
I just answer everyone, which is very bad. But

00:10:43.980 --> 00:10:46.679
anyway, I kept telling people to just go for

00:10:46.679 --> 00:10:49.720
it, explore the internet, find images, analyze

00:10:49.720 --> 00:10:52.779
them, notice the details, connect dots. Everything

00:10:52.779 --> 00:10:55.519
made sense in my head because that's how I always

00:10:55.519 --> 00:10:58.419
interacted with the internet. I observed everything.

00:10:58.700 --> 00:11:01.620
I analyzed everything. I had to, wasn't it? I

00:11:01.620 --> 00:11:03.759
didn't even know how to do it in any other way.

00:11:04.320 --> 00:11:06.840
But I felt people weren't really understanding

00:11:06.840 --> 00:11:10.779
what I was trying to convey and just do it wasn't

00:11:10.779 --> 00:11:13.279
enough. And I wasn't sure how to explain it better

00:11:13.279 --> 00:11:16.960
because it was just so obvious to me. So now

00:11:16.960 --> 00:11:19.279
I look back, I understand that this was due to

00:11:19.279 --> 00:11:21.620
how I learned how to interact with the internet

00:11:21.620 --> 00:11:24.399
back in the early 2000s when I had a stalker.

00:11:24.659 --> 00:11:27.059
Most people didn't go through that. So the internet

00:11:27.059 --> 00:11:29.899
was a completely different space for them. They

00:11:29.899 --> 00:11:32.480
interacted with it in a more casual, relaxed

00:11:32.480 --> 00:11:35.679
way, which if I'm honest, I kind of envy. The

00:11:35.679 --> 00:11:37.779
internet was a battleground for me. It was not

00:11:37.779 --> 00:11:41.539
a place to relax. So, like I said, I kept answering

00:11:41.539 --> 00:11:44.639
people, working on both projects, a lot, and

00:11:44.639 --> 00:11:47.539
creating content. And by the end of that first

00:11:47.539 --> 00:11:51.139
year, I was completely and utterly burned down.

00:11:51.580 --> 00:11:55.200
I was physically and mentally done. I was a complete

00:11:55.200 --> 00:11:58.200
wreck. But by then, the Eyes on Russia project

00:11:58.200 --> 00:12:00.940
was well established, had funding, wasn't relying

00:12:00.940 --> 00:12:03.320
on volunteers. So I decided I had to step back.

00:12:03.519 --> 00:12:06.450
I need a break. I couldn't do it anymore. And

00:12:06.450 --> 00:12:08.990
that's how I found myself with a lot of free

00:12:08.990 --> 00:12:11.710
time that I hadn't even realized existed. And

00:12:11.710 --> 00:12:14.269
because I still kept getting messages from people

00:12:14.269 --> 00:12:16.850
wanting to learn about OSINT, I thought to myself,

00:12:16.929 --> 00:12:19.389
you know what? Let me show you what I mean. Because

00:12:19.389 --> 00:12:22.009
just to explore the internet advice was clearly

00:12:22.009 --> 00:12:25.070
not enough. I now had the free time to do it,

00:12:25.090 --> 00:12:26.950
so I did. You know, fuck sleep, right? Who needs

00:12:26.950 --> 00:12:31.610
to sleep anyway? So in January, 2023, I created

00:12:31.610 --> 00:12:34.450
my first five exercises and released them on

00:12:34.450 --> 00:12:37.429
my website in short succession. They all have

00:12:37.429 --> 00:12:40.149
the exact same format. They start with a very

00:12:40.149 --> 00:12:42.509
small briefing, providing some basic context.

00:12:43.029 --> 00:12:45.429
Then there's some initial data to analyze. This

00:12:45.429 --> 00:12:48.409
can be a photo, a video, a link, or just text.

00:12:49.169 --> 00:12:51.629
Then you get a small list of tasks to complete

00:12:51.629 --> 00:12:54.799
at that rate based on difficulty level. People

00:12:54.799 --> 00:12:57.299
can solve the tasks however they want it. None

00:12:57.299 --> 00:12:59.480
of them are impossible, but they do vary a lot

00:12:59.480 --> 00:13:02.820
in difficulty. I mark them as either easy, medium

00:13:02.820 --> 00:13:05.799
or hard and separate them by beginner or expert

00:13:05.799 --> 00:13:08.360
level. So you can choose to start with tasks

00:13:08.360 --> 00:13:10.639
that I deem easy for beginners, for example,

00:13:10.759 --> 00:13:12.840
and work your way up until you're comfortable

00:13:12.840 --> 00:13:14.980
enough to start tackling the ones that are harder,

00:13:15.360 --> 00:13:17.700
or you could just jump straight to the more challenging

00:13:17.700 --> 00:13:20.159
ones aimed at the experts. You call whatever

00:13:20.159 --> 00:13:23.350
floats your boat, really. The exercises are all

00:13:23.350 --> 00:13:26.029
centered on the three main skills I believe are

00:13:26.029 --> 00:13:28.409
fundamental for someone to become a good hosting

00:13:28.409 --> 00:13:31.570
analyst. How to find data, how to verify data

00:13:31.570 --> 00:13:35.049
and how to analyze data. Everything on my website

00:13:35.049 --> 00:13:37.990
is free. I don't even have ads. I hate ads. None

00:13:37.990 --> 00:13:40.870
of the exercises requires people to use any paid

00:13:40.870 --> 00:13:43.669
tools or spend any money on anything. It's just

00:13:43.669 --> 00:13:46.230
using your brain and open source data. That's

00:13:46.230 --> 00:13:49.360
it. So within the first 24 hours of publishing

00:13:49.360 --> 00:13:51.779
and exercise, I released a full video walkthrough

00:13:51.779 --> 00:13:54.759
on my YouTube channel showing how I solved all

00:13:54.759 --> 00:13:57.340
tasks. I feel like when you're a beginner watching

00:13:57.340 --> 00:14:00.320
someone do it in front of you, step by step is

00:14:00.320 --> 00:14:03.299
extremely helpful. So I show everything, no cuts,

00:14:03.480 --> 00:14:05.240
apart from when I swear too much and I think

00:14:05.240 --> 00:14:07.299
to myself, well, let me just edit this one out.

00:14:07.800 --> 00:14:10.600
But the most important thing for me in my videos

00:14:10.600 --> 00:14:13.480
is just I explain why I'm doing things. It's

00:14:13.480 --> 00:14:15.360
not just a click here, then there, and voila,

00:14:15.480 --> 00:14:18.399
you get the answer. I narrate out loud what is

00:14:18.399 --> 00:14:20.559
going on in my head, which is a very dangerous

00:14:20.559 --> 00:14:21.980
thing sometimes, but it's also very helpful.

00:14:22.679 --> 00:14:25.600
So if people tried and failed to solve a task,

00:14:25.700 --> 00:14:28.159
they can watch me do it and then try to replicate.

00:14:28.460 --> 00:14:30.639
Afterwards, when they're faced with a similar

00:14:30.639 --> 00:14:33.879
situation, they'll know what to do. I also urge

00:14:33.879 --> 00:14:37.080
people to write walkthroughs explaining how they

00:14:37.080 --> 00:14:40.019
solve the challenges. I then link them on the

00:14:40.019 --> 00:14:42.519
corresponding exercise page so others can read

00:14:42.519 --> 00:14:44.740
and learn alternative methods. Because there's

00:14:44.740 --> 00:14:47.200
never just one way to do things, I'm not like

00:14:47.200 --> 00:14:49.759
the ultimate OSINT person there's many people

00:14:49.759 --> 00:14:52.500
to learn from. And because people still kept

00:14:52.500 --> 00:14:55.379
messaging me, I created a frequently asked questions

00:14:55.379 --> 00:14:57.740
page on my website with some guidelines on how

00:14:57.740 --> 00:15:00.980
to get into OSINT as a career. In the past years,

00:15:01.019 --> 00:15:03.720
I have advised many people on what to do to break

00:15:03.720 --> 00:15:06.159
into the field. Some of them I'm very, very proud

00:15:06.159 --> 00:15:08.460
to report already work as OSINT analysts, so

00:15:08.460 --> 00:15:12.259
well done for them. So what is my general advice?

00:15:12.820 --> 00:15:15.259
First thing you need to do is to figure out exactly

00:15:15.259 --> 00:15:17.960
what you would like to do, because OSINT is an

00:15:17.960 --> 00:15:20.480
umbrella term to refer to intelligence obtained

00:15:20.480 --> 00:15:23.419
through open source. It can be used on a number

00:15:23.419 --> 00:15:26.919
of fields such as human rights, like I do, cybersecurity,

00:15:27.419 --> 00:15:31.000
private investigation, journalism, etc. And the

00:15:31.000 --> 00:15:33.179
skills required can be very different from each

00:15:33.179 --> 00:15:35.580
other. You'll be working with open source data,

00:15:35.860 --> 00:15:38.240
but using different methods for different goals.

00:15:38.740 --> 00:15:41.299
Once you have decided what type of OSINT you're

00:15:41.299 --> 00:15:44.379
drawn to, I suggest finding organizations or

00:15:44.379 --> 00:15:46.539
people who work in that field and see what they

00:15:46.539 --> 00:15:49.679
are doing. Many will have public profiles and

00:15:49.679 --> 00:15:51.559
you can see what sort of things they discuss,

00:15:51.720 --> 00:15:54.360
they share and they gauge with. This will enable

00:15:54.360 --> 00:15:57.100
you to understand what skills they possess and

00:15:57.100 --> 00:15:59.799
what skills you should aim to develop. Then you

00:15:59.799 --> 00:16:02.120
can start working on those skills. I think my

00:16:02.120 --> 00:16:04.299
exercises are a good resource once you get to

00:16:04.299 --> 00:16:06.879
this stage, especially if you're someone who

00:16:06.879 --> 00:16:09.179
needs a bit of structure in their learning. I

00:16:09.179 --> 00:16:11.080
still think that the best way to learn Austin

00:16:11.080 --> 00:16:14.100
skills is just to observe and analyze everything,

00:16:14.620 --> 00:16:17.379
but having some structured tasks might be quite

00:16:17.379 --> 00:16:19.240
useful as well. And that's why I created them.

00:16:19.990 --> 00:16:22.909
So explore the exercises. I would advise if you

00:16:22.909 --> 00:16:25.450
are a beginner to start with the easy ones. Don't

00:16:25.450 --> 00:16:28.070
try to be a hero and go for the hard tasks as

00:16:28.070 --> 00:16:30.169
you may end up frustrated. It's best to build

00:16:30.169 --> 00:16:32.970
up the skills and the confidence alongside them.

00:16:33.190 --> 00:16:35.070
You don't need to prove anything to anyone. This

00:16:35.070 --> 00:16:38.070
is not a race. Once you get to a point where

00:16:38.070 --> 00:16:40.570
you're capable of solving the tasks without any

00:16:40.570 --> 00:16:43.429
help, whether they're easy or hard ones, write

00:16:43.429 --> 00:16:46.009
about it. Create a blog, a website, a Twitter

00:16:46.009 --> 00:16:48.460
thread, whatever floats your boat. Learning to

00:16:48.460 --> 00:16:51.120
transfer your thoughts into words is extremely

00:16:51.120 --> 00:16:53.639
helpful in this field of work. A great OSINT

00:16:53.639 --> 00:16:56.500
analyst has to be able to write great reports

00:16:56.500 --> 00:16:59.440
and you don't need to just write exercise walkthroughs.

00:16:59.440 --> 00:17:01.600
You can write about anything you want. It's a

00:17:01.600 --> 00:17:04.039
matter of showcasing what you're capable of.

00:17:04.319 --> 00:17:07.059
That's what you'll want to do. You want to advertise

00:17:07.059 --> 00:17:10.480
your skills. However, there is quite a difference

00:17:10.480 --> 00:17:13.299
between writing a walkthrough and writing an

00:17:13.299 --> 00:17:16.039
OSINT report and I want to highlight this. On

00:17:16.039 --> 00:17:18.339
a walkthrough, the goal is to explain your process,

00:17:18.500 --> 00:17:21.299
how you solve the challenge, how you unveil identities,

00:17:21.660 --> 00:17:24.380
how are you geolocating something. The aim is

00:17:24.380 --> 00:17:26.619
to explain your thought process step by step

00:17:26.619 --> 00:17:29.640
from beginning to end. On the other hand, in

00:17:29.640 --> 00:17:32.599
an OSINT report, the focus is on the intelligence

00:17:32.599 --> 00:17:36.119
behind it. What does it all mean? Yes, you got

00:17:36.119 --> 00:17:38.779
the answers, you unveil identities, you geolocated

00:17:38.779 --> 00:17:41.529
everything and so what? How does that information

00:17:41.529 --> 00:17:44.450
help you, the client or the public? What conclusions

00:17:44.450 --> 00:17:47.089
can you draw from it and what measures can potentially

00:17:47.089 --> 00:17:50.410
be taken based on this intelligence? So this

00:17:50.410 --> 00:17:53.089
second type of report is obviously a bit hard

00:17:53.089 --> 00:17:55.529
to master. It requires the analyst to take a

00:17:55.529 --> 00:17:58.490
step back and see the bigger picture after spending

00:17:58.490 --> 00:18:01.269
possibly a considerable amount of time analyzing

00:18:01.269 --> 00:18:05.329
the small details of it all. So for beginners,

00:18:05.660 --> 00:18:08.380
Wanting to start doing research, I would suggest

00:18:08.380 --> 00:18:10.740
starting with just explaining simple things.

00:18:11.099 --> 00:18:13.400
Write about how you geolocated something, how

00:18:13.400 --> 00:18:15.799
you verified an image that turned out to be old,

00:18:15.940 --> 00:18:18.640
misleading, or plain old propaganda. Then you

00:18:18.640 --> 00:18:21.259
start adding more complexity to it all. That

00:18:21.259 --> 00:18:23.940
is also something I aim to do with my exercises

00:18:23.940 --> 00:18:27.109
when preparing them. especially the ones aimed

00:18:27.109 --> 00:18:29.309
at beginners, the first question will always

00:18:29.309 --> 00:18:32.210
be the easiest one. Afterwards, I request something

00:18:32.210 --> 00:18:34.710
a bit more challenging to force people to keep

00:18:34.710 --> 00:18:37.430
exploring instead of just stopping there. On

00:18:37.430 --> 00:18:39.769
the other hand, the hard tasks, especially the

00:18:39.769 --> 00:18:42.210
ones aimed at experts, will throw you immediately

00:18:42.210 --> 00:18:44.750
in the deep end. Often you just have one task

00:18:44.750 --> 00:18:46.950
and you need to be able to figure out where and

00:18:46.950 --> 00:18:49.269
how to start, where to move from there and how

00:18:49.269 --> 00:18:51.849
to keep going until you reach your goal. That

00:18:51.849 --> 00:18:54.210
is not an easy task for beginners, not that's

00:18:54.210 --> 00:18:57.009
impossible. It's just a lot harder because the

00:18:57.009 --> 00:18:59.049
OSINT mindset is still developing, but you'll

00:18:59.049 --> 00:19:01.509
get there. It's fine. Don't rush it. So once

00:19:01.509 --> 00:19:04.390
you're comfortable writing about your OSINT investigations,

00:19:04.509 --> 00:19:07.009
you can start sharing them online in whatever

00:19:07.009 --> 00:19:09.710
platform of your choice. The goal is to be seen.

00:19:09.829 --> 00:19:12.670
Remember, people like me will find people like

00:19:12.670 --> 00:19:14.970
you. If you're writing about something that I'm

00:19:14.970 --> 00:19:17.750
monitoring, I will find you. That sounds very

00:19:17.750 --> 00:19:20.599
creepy. Not to say that you should just sit and

00:19:20.599 --> 00:19:23.380
wait, definitely not. But if you keep on producing

00:19:23.380 --> 00:19:26.220
good content, people will notice. And that's

00:19:26.220 --> 00:19:28.720
especially true if that content is very niche

00:19:28.720 --> 00:19:31.559
and no one else is investigating it. You shouldn't

00:19:31.559 --> 00:19:33.779
pick something based on what you think will look

00:19:33.779 --> 00:19:36.220
good or how much intention you'll get from it.

00:19:36.599 --> 00:19:38.680
Go for something that's close to your heart,

00:19:38.839 --> 00:19:40.880
something that drives you, the sort of topic

00:19:40.880 --> 00:19:44.009
that you just cannot stay away from. Because

00:19:44.009 --> 00:19:46.569
it's very clear to me when I'm reading or reviewing

00:19:46.569 --> 00:19:49.369
OSINT reports if the investigation was something

00:19:49.369 --> 00:19:52.609
the analyst deeply cared about, or it was something

00:19:52.609 --> 00:19:54.450
they were just writing because they were assigned

00:19:54.450 --> 00:19:57.930
to that topic, you can feel someone's passion

00:19:57.930 --> 00:20:00.069
shining through their writing. As a team lead,

00:20:00.069 --> 00:20:02.730
I always try to match analysts with their favorite

00:20:02.730 --> 00:20:04.970
topics because it's a huge difference in the

00:20:04.970 --> 00:20:07.549
quality of their work. You cannot feign passion.

00:20:08.170 --> 00:20:11.470
Once you find what drives you and start investigating

00:20:11.470 --> 00:20:14.519
and writing about it, start looking for collaborations

00:20:14.519 --> 00:20:17.140
with other like -minded people working on similar

00:20:17.140 --> 00:20:20.440
things. I know that the Bellingcat Discord server

00:20:20.440 --> 00:20:22.980
is great for that. I actually often advise people

00:20:22.980 --> 00:20:25.500
to come here, share their ideas, their work,

00:20:25.619 --> 00:20:27.440
their progress, and see if they can find others

00:20:27.440 --> 00:20:30.140
to collaborate with. Because when you're starting,

00:20:30.740 --> 00:20:33.140
your goal is to build a good OSINT portfolio,

00:20:33.480 --> 00:20:36.039
especially if you have no background in a field

00:20:36.039 --> 00:20:39.460
related to OSINT. At this point, your CV will

00:20:39.460 --> 00:20:42.400
be relevant. Your new website, your blog, your

00:20:42.400 --> 00:20:44.819
social media account, they will be your new CV,

00:20:45.000 --> 00:20:48.359
your skills portfolio. It will show prospective

00:20:48.359 --> 00:20:51.759
employees what you can do, how dedicated you

00:20:51.759 --> 00:20:55.059
are and your writing skills. And this will all

00:20:55.059 --> 00:20:57.619
be public. It's your evidence. So it's your job

00:20:57.619 --> 00:21:00.740
to make it as brilliant as possible. And yes,

00:21:00.740 --> 00:21:03.240
and I get asked this many, many times, you can

00:21:03.240 --> 00:21:05.779
absolutely get a job in Austin with zero professional

00:21:05.779 --> 00:21:09.359
experience in this field. I know many truly amazing

00:21:09.359 --> 00:21:11.500
analysts who seem to have come from nowhere,

00:21:11.720 --> 00:21:14.500
a bit like me. No experience, no background knowledge,

00:21:14.640 --> 00:21:17.599
just pure passion and dedication. They always,

00:21:17.599 --> 00:21:20.960
always stand out. They're honestly the best professionals

00:21:20.960 --> 00:21:23.900
I work with. Nothing matches their drive to learn

00:21:23.900 --> 00:21:26.559
and improve. So find your passion and go for

00:21:26.559 --> 00:21:29.200
it. I hope this was helpful. Thank you for listening.

00:21:29.579 --> 00:21:32.900
Up to you, Charlie. Thank you so much, Xavier,

00:21:33.099 --> 00:21:37.380
for such a clear and... friendly explanation

00:21:37.380 --> 00:21:41.039
of how to get into this kind of industry and

00:21:41.039 --> 00:21:43.660
for explaining the different types of things

00:21:43.660 --> 00:21:45.740
you can do with these skill sets as well. Stephanie

00:21:45.740 --> 00:21:48.180
in the chat said, thank you for sharing a personal

00:21:48.180 --> 00:21:51.079
situation, a terribly good way to learn about

00:21:51.079 --> 00:21:53.720
OBSEC and how to spot traces on the internet.

00:21:55.740 --> 00:21:59.099
I also shared, sorry, go ahead. Sorry. No, I

00:21:59.099 --> 00:22:02.089
was going to say that You know, it's one of these

00:22:02.089 --> 00:22:04.309
things that I thought for a while whether or

00:22:04.309 --> 00:22:06.789
not I wanted to reveal that information, but

00:22:06.789 --> 00:22:10.190
I thought I cannot explain how I got into OSINT

00:22:10.190 --> 00:22:13.230
without explaining why I had to go into OSINT,

00:22:13.289 --> 00:22:16.710
if it makes sense. So that's it. It's out now.

00:22:17.230 --> 00:22:19.250
Yeah. So many people in the chat are saying,

00:22:19.470 --> 00:22:22.109
Mina says, this was amazing. Thank you. Shucky

00:22:22.109 --> 00:22:24.390
Ducky, which I love the name, says, so helpful

00:22:24.390 --> 00:22:28.349
and encouraging. Thank you. Biggie Cheese says,

00:22:28.490 --> 00:22:30.490
this was definitely the clearest and most friendly

00:22:30.490 --> 00:22:32.789
advice I've gotten for getting into OSINT, so

00:22:32.789 --> 00:22:34.529
thank you. While you were talking, I also put

00:22:34.529 --> 00:22:38.829
some links in the chat, which I'll share with

00:22:38.829 --> 00:22:41.750
the podcast recording as well, which is the link

00:22:41.750 --> 00:22:45.150
to your organization Center for Information Resilience,

00:22:46.269 --> 00:22:50.670
the link to Bellingcat's coverage of the Eye

00:22:50.670 --> 00:22:55.380
of Russia. project that you worked on, and also

00:22:55.380 --> 00:22:58.960
a link to a recent Bellingcat report where we

00:22:58.960 --> 00:23:01.920
listed seven deadly sins of bad open source research.

00:23:02.380 --> 00:23:03.799
Because as you mentioned, when you're writing

00:23:03.799 --> 00:23:06.579
up those initial conclusions, when you're first

00:23:06.579 --> 00:23:09.019
writing up those reports, it's really, really

00:23:09.019 --> 00:23:11.890
important to make sure that you're checking your

00:23:11.890 --> 00:23:14.029
own work and making sure that you're staying

00:23:14.029 --> 00:23:16.769
accurate to kind of what you found and not kind

00:23:16.769 --> 00:23:19.430
of making assumptions. Because that tends to

00:23:19.430 --> 00:23:23.109
be something that we see a lot of people who

00:23:23.109 --> 00:23:27.230
are getting into OSINT do, because they're excited

00:23:27.230 --> 00:23:30.589
by the information they've found. But sometimes

00:23:30.589 --> 00:23:34.089
you can kind of jump to conclusions without realizing

00:23:34.089 --> 00:23:37.930
that you've kind of made that jump. So I just

00:23:37.930 --> 00:23:44.309
wanted to flag that as well. I wanted to ask

00:23:44.309 --> 00:23:46.009
while people are putting their questions in the

00:23:46.009 --> 00:23:50.369
chat, I wanted to ask why you feel people should

00:23:50.369 --> 00:23:52.910
train in open source techniques in comparison

00:23:52.910 --> 00:23:58.049
to training in coding language or perhaps even

00:23:58.049 --> 00:24:02.190
just traditional journalism. Why did you feel

00:24:02.190 --> 00:24:05.089
like open source research was the way forward

00:24:05.089 --> 00:24:09.009
for you and why do you think it's such an attractive

00:24:09.579 --> 00:24:12.779
kind of set of skills for employers and also

00:24:12.779 --> 00:24:17.480
for people in general. I think OSIN kind of employs

00:24:17.480 --> 00:24:20.960
these basic skills of challenging what is being

00:24:20.960 --> 00:24:24.640
said to you on a very fundamental level. And

00:24:24.640 --> 00:24:29.859
in a world full of misinformation, disinformation,

00:24:30.440 --> 00:24:32.460
propaganda, those are very valuable skills in

00:24:32.460 --> 00:24:35.000
all. I mean, you can be just a student writing

00:24:35.000 --> 00:24:38.579
your thesis, but it's useful to check that. to

00:24:38.579 --> 00:24:40.519
check that the information you're getting is

00:24:40.519 --> 00:24:43.819
from a reputable source, for example. So I found

00:24:43.819 --> 00:24:50.779
that it's just a very fundamental skill to have

00:24:50.779 --> 00:24:53.960
in anything. I think that, obviously, learning

00:24:53.960 --> 00:24:57.180
coding, for example, is useful. I would say that

00:24:57.180 --> 00:25:00.119
most authentic analysts I work with do not know

00:25:00.119 --> 00:25:06.759
coding. I feel like it's interesting that It's

00:25:06.759 --> 00:25:09.180
sometimes useful because I know some of it, just

00:25:09.180 --> 00:25:13.799
a bit, but I know enough to read, for example,

00:25:14.440 --> 00:25:17.079
the HTML code of website or read the code and

00:25:17.079 --> 00:25:19.460
figure out what this is supposed to be doing.

00:25:19.920 --> 00:25:23.819
But I think on my line of work, it's mostly to

00:25:23.819 --> 00:25:27.380
analyze things like the HTML. For example, I

00:25:27.380 --> 00:25:31.369
have an exercise on that specifically. on, you'd

00:25:31.369 --> 00:25:35.170
have like three links to articles and these are

00:25:35.170 --> 00:25:37.869
articles that were published in countries that

00:25:37.869 --> 00:25:40.670
do not use the Gregorian calendar. So it's a

00:25:40.670 --> 00:25:42.230
bit of a challenge. If you're writing an Austin

00:25:42.230 --> 00:25:45.369
report and you want to say on this date, this

00:25:45.369 --> 00:25:47.509
was published, but you do not know the date,

00:25:47.650 --> 00:25:50.049
then it's one of those things. You can just go

00:25:50.049 --> 00:25:52.750
to the HTML. I'm kind of spoiling it a bit now.

00:25:53.009 --> 00:25:55.869
You can just go and it'll give you some information.

00:25:56.309 --> 00:25:59.430
So You know, it's, it's useful to have some basic

00:25:59.430 --> 00:26:02.009
knowledge. I don't think it's very, um, you know,

00:26:02.009 --> 00:26:04.390
it's not fundamental, but it's, you know, it's

00:26:04.390 --> 00:26:08.390
useful anyway. Hope that makes sense. Definitely.

00:26:08.470 --> 00:26:10.890
Definitely makes sense. Yeah. I always surprised

00:26:10.890 --> 00:26:14.089
actually how much, uh, coding comes up in conversations,

00:26:14.130 --> 00:26:16.549
but how, how many researchers don't need it.

00:26:16.549 --> 00:26:19.690
And I just posted a link in the chat to, uh,

00:26:19.690 --> 00:26:23.130
one of our more recent videos where we were,

00:26:23.130 --> 00:26:26.130
uh, Agnes from our team. who's on our tech team,

00:26:26.430 --> 00:26:29.369
who definitely knows how to code, was talking

00:26:29.369 --> 00:26:31.690
you through how to use Jupyter Notebooks and

00:26:31.690 --> 00:26:34.349
Google collab as well, which is a way of using

00:26:34.349 --> 00:26:37.410
open source research tools without knowing coding

00:26:37.410 --> 00:26:40.130
language, which can be useful for people as well.

00:26:41.089 --> 00:26:44.029
We have so many questions coming, floating in

00:26:44.029 --> 00:26:47.670
now. Lumos asks, thank you. Can you tell us more

00:26:47.670 --> 00:26:50.769
about how you felt in your first role in the

00:26:50.769 --> 00:26:53.670
Eyes on Russia project? How did you feel when

00:26:53.670 --> 00:26:58.490
you first got involved with that? Oh, okay. Okay.

00:26:58.509 --> 00:27:01.990
So that was overwhelming. That was insane overwhelming

00:27:01.990 --> 00:27:04.970
because I went from being, you know, just geolocating

00:27:04.970 --> 00:27:09.670
cool pictures I found online to now, my job was

00:27:09.670 --> 00:27:11.990
mostly to geolocate because we had a massive

00:27:11.990 --> 00:27:15.970
database by then. And, you know, there's so much

00:27:15.970 --> 00:27:19.430
content coming that had to be verified, geolocated,

00:27:19.430 --> 00:27:22.289
you know, added to the map eventually. So it

00:27:22.289 --> 00:27:26.789
was very overwhelming. It was definitely a trial

00:27:26.789 --> 00:27:31.789
by fire, if that makes sense. But yeah, there's

00:27:31.789 --> 00:27:34.009
some good aspects of it because I definitely

00:27:34.009 --> 00:27:37.329
learned a lot of it. And there were some bad

00:27:37.329 --> 00:27:40.869
aspects of it because I was forced to experience

00:27:40.869 --> 00:27:43.049
things that I was most definitely not ready to

00:27:43.049 --> 00:27:45.849
be experienced if that makes sense. And I'll

00:27:45.849 --> 00:27:49.180
tell you a story. So, you know, the two databases,

00:27:49.240 --> 00:27:51.920
so I have my normal job and the Eyes on Russia

00:27:51.920 --> 00:27:56.079
project, and both of them have a database. And

00:27:56.079 --> 00:27:59.319
the database is where we collect all the information

00:27:59.319 --> 00:28:01.079
that we want to archive. So everything that's

00:28:01.079 --> 00:28:04.000
photos, videos, you know, any audio goes there,

00:28:04.119 --> 00:28:06.460
gets archived. So it's not lost. If it gets deleted

00:28:06.460 --> 00:28:09.500
from the online, you know, social media, then

00:28:09.500 --> 00:28:14.880
it's just archived. And so all entries have a

00:28:14.880 --> 00:28:18.099
rating. on violence level and this rating varies

00:28:18.099 --> 00:28:20.980
from one to five being one everything's fine

00:28:20.980 --> 00:28:24.000
there's nothing horrendous on this picture two

00:28:24.000 --> 00:28:26.380
you might see some threats verbal threats or

00:28:26.380 --> 00:28:29.240
something like that maybe some damage on three

00:28:29.240 --> 00:28:32.539
you're going to see maybe some beating perhaps

00:28:32.539 --> 00:28:36.180
blood bruises some sort of aggression on four

00:28:36.180 --> 00:28:38.579
you're going to see a body and on five that body

00:28:38.579 --> 00:28:42.930
is going to be in a very bad condition so I thought,

00:28:42.970 --> 00:28:44.910
you know what, I'm going to be very sensible

00:28:44.910 --> 00:28:48.329
on my normal job. And I am just going to look

00:28:48.329 --> 00:28:50.470
at the ones and the twos. I'm not taking care

00:28:50.470 --> 00:28:52.730
of anything else until I'm comfortable enough

00:28:52.730 --> 00:28:55.990
to move up and then more, you know, horrible

00:28:55.990 --> 00:28:58.769
content. And that was great. I was, I was so

00:28:58.769 --> 00:29:00.470
good. I was so proud of myself. I was like, Oh

00:29:00.470 --> 00:29:02.569
yeah, I can, I'm going to be so good at this.

00:29:02.930 --> 00:29:05.430
And then I go to the Eyes on Russia project and

00:29:05.430 --> 00:29:09.569
this was during the weekend. And I was going

00:29:09.569 --> 00:29:11.529
through the database again. I was just clicking,

00:29:11.710 --> 00:29:14.329
geolocating, clicking, geolocating. And there

00:29:14.329 --> 00:29:17.710
was something that felt wrong. I'm not sure if

00:29:17.710 --> 00:29:20.990
wrong is the word because suddenly there were

00:29:20.990 --> 00:29:23.730
dozens of links entered on the database and there

00:29:23.730 --> 00:29:25.490
was nothing else. They didn't have a rating.

00:29:25.930 --> 00:29:27.849
They didn't have description, didn't have category.

00:29:28.130 --> 00:29:32.420
And it felt like someone just had to dump all

00:29:32.420 --> 00:29:35.019
these things because something very big had happened

00:29:35.019 --> 00:29:37.799
and there was just like the need to quickly archive

00:29:37.799 --> 00:29:40.900
this. So, you know, I completely understand it

00:29:40.900 --> 00:29:44.059
had to be done. And I was alone. I was completely

00:29:44.059 --> 00:29:46.420
alone on that day on that database, because it

00:29:46.420 --> 00:29:48.140
was probably like a Sunday and I was just working

00:29:48.140 --> 00:29:51.099
because why wouldn't I? And I just start clicking

00:29:51.099 --> 00:29:53.559
and I start geolocating and I start clicking

00:29:53.559 --> 00:29:56.890
and I start geolocating. And at the time, I didn't

00:29:56.890 --> 00:29:59.210
realize how much that was affecting me because

00:29:59.210 --> 00:30:00.970
I'm not going to describe what I was watching,

00:30:01.490 --> 00:30:03.650
obviously, but it was something that happened

00:30:03.650 --> 00:30:10.009
that had a lot of civilian casualties. It was

00:30:10.009 --> 00:30:12.150
something that made international news everywhere.

00:30:12.970 --> 00:30:15.349
It was a very bad incident and it was covered

00:30:15.349 --> 00:30:19.170
everywhere. I was the first person, well, technically

00:30:19.170 --> 00:30:21.549
the second after whoever put those links there.

00:30:22.240 --> 00:30:24.579
go through all of it and I was looking frame

00:30:24.579 --> 00:30:27.259
by frame, video by video, picture by picture

00:30:27.259 --> 00:30:31.299
and it was very, very bad. And when I finally

00:30:31.299 --> 00:30:34.779
stopped, it was time to go to bed and I was like,

00:30:35.000 --> 00:30:38.660
I am done. I realized how much that had affected

00:30:38.660 --> 00:30:41.339
me and I had a completely breakdown, completely.

00:30:42.880 --> 00:30:46.779
It was horrible. It was such an enormous thing

00:30:46.779 --> 00:30:50.359
to experience. And I feel like that was something

00:30:50.359 --> 00:30:53.579
that I was not prepared to deal with. And now

00:30:53.579 --> 00:30:55.700
obviously there's been a lot of policies put

00:30:55.700 --> 00:31:01.279
into place and also I know when to stop. But

00:31:01.279 --> 00:31:04.480
I think there's something that when I think of

00:31:04.480 --> 00:31:06.319
the Eyes on Russia project at the beginning,

00:31:06.500 --> 00:31:10.859
that is what I think about that trauma that I

00:31:10.859 --> 00:31:13.299
had to deal with. Well, I tell it, not like I

00:31:13.299 --> 00:31:16.279
had to, I just did it anyway. So there you go.

00:31:16.329 --> 00:31:18.329
Lot of information. I was just like sharing everything

00:31:18.329 --> 00:31:22.569
now. Next question. Yeah, I mean, we talk about

00:31:22.569 --> 00:31:25.950
it a lot in these stage talks, actually, keeping

00:31:25.950 --> 00:31:30.130
yourself mentally healthy and mentally sane when

00:31:30.130 --> 00:31:31.529
viewing these things. And especially if you're

00:31:31.529 --> 00:31:34.730
thinking about going into a niche that involves

00:31:34.730 --> 00:31:39.329
human rights or conflict, you need to kind of

00:31:39.329 --> 00:31:43.650
be aware that this kind of material might come

00:31:43.650 --> 00:31:47.220
across your plate and how to deal with it. I'll

00:31:47.220 --> 00:31:51.660
share a few resources in the chat as well. Meryl's

00:31:51.660 --> 00:31:54.559
already done it. My colleague Meryl's just shared

00:31:54.559 --> 00:31:57.420
a guide for mental health hygiene in the chat.

00:31:58.380 --> 00:32:03.279
It's really, really important that you kind of

00:32:03.279 --> 00:32:05.519
keep that. in the forefront of your mind. And

00:32:05.519 --> 00:32:07.839
there's some really useful tools online as well

00:32:07.839 --> 00:32:11.339
that can help kind of obscure some of the image

00:32:11.339 --> 00:32:13.240
for you while you're looking at different parts

00:32:13.240 --> 00:32:16.460
of the image, for example, or mute the sound,

00:32:16.500 --> 00:32:19.119
which can also be highly triggering. But we've

00:32:19.119 --> 00:32:22.079
got a lot of other stage talks on our sound card

00:32:22.079 --> 00:32:24.920
that you can listen back to, specifically on

00:32:24.920 --> 00:32:28.000
mental health while doing open source research.

00:32:28.619 --> 00:32:30.900
We have so many questions. So if you don't mind,

00:32:30.960 --> 00:32:35.660
I'll keep going. Bishti has asked, and I hope

00:32:35.660 --> 00:32:38.039
I've pronounced that right, Bishti has asked,

00:32:38.099 --> 00:32:43.220
how do you pick images for your geolocation challenges?

00:32:43.400 --> 00:32:47.539
How do you select them? Okay. So there's many

00:32:47.539 --> 00:32:50.680
ways I do that depending. So the first thing

00:32:50.680 --> 00:32:53.599
is that when I come up with exercise ideas, I

00:32:53.599 --> 00:32:56.759
base based on specific skills I want to talk

00:32:56.759 --> 00:32:59.599
about. So my goal is always to have an educational

00:32:59.599 --> 00:33:03.980
side of it. So then I think of something and

00:33:03.980 --> 00:33:07.519
for example, it could be, I want to do a geolocation

00:33:07.519 --> 00:33:09.980
that just requires satellite image. You cannot

00:33:09.980 --> 00:33:12.960
use Google street view. You cannot use anything

00:33:12.960 --> 00:33:15.460
like that. That's it. Like the first one, my

00:33:15.460 --> 00:33:18.240
first exercise is like that. So in that case,

00:33:18.420 --> 00:33:21.579
honestly, I would just go to a random place on

00:33:21.579 --> 00:33:24.339
the map and I was like, this is a good one. And

00:33:24.339 --> 00:33:26.980
then I, you know, try to find the name of whatever

00:33:26.980 --> 00:33:30.420
next village nearby is. And then I start using

00:33:30.420 --> 00:33:33.039
keywords about that village could be the name

00:33:33.039 --> 00:33:35.079
of the village. And the first one would be the

00:33:35.079 --> 00:33:38.660
name of the village. It could be, I'll try to

00:33:38.660 --> 00:33:42.700
find geotagged content like on YouTube. And then

00:33:42.700 --> 00:33:46.519
I'll like do a screenshot of someone or a location

00:33:46.519 --> 00:33:50.319
somewhere. Sometimes if I want to be a bit more

00:33:50.319 --> 00:33:53.799
challenging, I have one where it's the It was

00:33:53.799 --> 00:33:58.380
a photo of a military aircraft from the U .S.

00:33:59.079 --> 00:34:01.880
And so I went to the U .S. State Department.

00:34:02.039 --> 00:34:03.900
I think I'm not sure if it was that one or not.

00:34:04.039 --> 00:34:06.500
And I just tried to find something that just

00:34:06.500 --> 00:34:08.679
said undisclosed location. So I would just put

00:34:08.679 --> 00:34:11.440
that in brackets and disclose location, not brackets,

00:34:11.619 --> 00:34:14.159
sorry, quotation marks. And I just see, let's

00:34:14.159 --> 00:34:16.900
see what kind of photos are undisclosed. Well,

00:34:16.960 --> 00:34:19.039
until I come to them, then it will be disclosed.

00:34:19.309 --> 00:34:22.690
and so on. So it really varies. Sometimes my

00:34:22.690 --> 00:34:25.570
focus is on the area. So I have a very specific

00:34:25.570 --> 00:34:29.050
area. I try to have as many areas of the globe

00:34:29.050 --> 00:34:31.489
as possible. So I don't want it to be too centered

00:34:31.489 --> 00:34:33.690
on Europe, too centered on the US, too centered

00:34:33.690 --> 00:34:37.590
on Russia. I want everything because all countries

00:34:37.590 --> 00:34:40.150
have their issues. And it's interesting to just

00:34:40.150 --> 00:34:42.730
look at them, especially when you have no idea

00:34:42.730 --> 00:34:44.530
what's going on them. And sometimes that happens

00:34:44.530 --> 00:34:47.159
to me. I'll be like, let me just come up with

00:34:47.159 --> 00:34:50.079
a random country and see what's happening there.

00:34:50.159 --> 00:34:52.940
And then I'll go and check pictures from the

00:34:52.940 --> 00:34:56.119
news and so on. So it's a bit chaotic. It's a

00:34:56.119 --> 00:35:00.199
bit random because I feel like adding that randomness

00:35:00.199 --> 00:35:03.099
creates an extra challenge that I enjoy because

00:35:03.099 --> 00:35:05.400
I also need to solve them in the first place,

00:35:05.480 --> 00:35:08.340
isn't it? Yeah. I think it's great that you're

00:35:08.340 --> 00:35:10.440
thinking about trying to cover different areas

00:35:10.440 --> 00:35:13.639
of the world as well, particularly as when you're

00:35:13.639 --> 00:35:15.780
first starting into your location, you might

00:35:15.780 --> 00:35:20.559
not be aware of the limitations to some regions

00:35:20.559 --> 00:35:23.519
of the world in terms of satellite mapping and

00:35:23.519 --> 00:35:26.400
image access. I also want to shout out that your

00:35:26.400 --> 00:35:28.719
colleague, Bender and Strick, also does a really

00:35:28.719 --> 00:35:32.260
great YouTube series as well called Bender Brown,

00:35:32.860 --> 00:35:36.820
which also showcases a lot of useful tips and

00:35:36.820 --> 00:35:39.940
tricks for open source researchers, so also worth

00:35:39.940 --> 00:35:43.090
checking that out. as well as Sophia's fantastic

00:35:43.090 --> 00:35:47.510
exercises. CR has asked, excited to try these

00:35:47.510 --> 00:35:50.289
challenges. When it comes to a portfolio, is

00:35:50.289 --> 00:35:53.730
there an ideal format that seems to be most popular,

00:35:54.030 --> 00:35:57.889
blog posts versus a plain site? I get it depends

00:35:57.889 --> 00:36:00.369
on your audience too, but what would you advise?

00:36:01.739 --> 00:36:04.219
How would you advise creating your portfolio?

00:36:04.480 --> 00:36:06.320
What would you make it look like? That's a tough

00:36:06.320 --> 00:36:09.960
question because I am not involved in any hiring

00:36:09.960 --> 00:36:12.539
so I'm not sure what other people are looking

00:36:12.539 --> 00:36:18.460
at. I feel like I tend to prefer blog entries.

00:36:18.840 --> 00:36:21.280
It could be on a website. You can just have a

00:36:21.280 --> 00:36:25.539
blog on your own or sometimes people put on LinkedIn

00:36:25.539 --> 00:36:30.800
as a post. I'm not sure how you call that. I

00:36:30.800 --> 00:36:34.159
tend to not prefer, I don't enjoy too much Twitter

00:36:34.159 --> 00:36:37.099
threads. I find it very hard to read them, if

00:36:37.099 --> 00:36:39.159
it makes sense. And they're also very focused

00:36:39.159 --> 00:36:41.559
on the images. And I think when you're writing,

00:36:42.079 --> 00:36:45.460
you want to be explaining things. So limiting

00:36:45.460 --> 00:36:49.920
the character is not ideal. So I think blog posts,

00:36:49.920 --> 00:36:52.320
I would say they're the best thing because you

00:36:52.320 --> 00:36:54.619
can make them as big or as small. You can make

00:36:54.619 --> 00:36:57.599
a series if you want to. So they give you, you

00:36:57.599 --> 00:36:59.320
know, a lot of allowances. You can do whatever

00:36:59.320 --> 00:37:01.579
you want, you know, once you have it, it's yours.

00:37:02.159 --> 00:37:04.300
So I think those are quite good. At least that's

00:37:04.300 --> 00:37:06.460
what I've been using and that's what I see other

00:37:06.460 --> 00:37:08.679
people using. And I think they, they're quite,

00:37:09.219 --> 00:37:11.719
you know, they're very nice. Thank you. Moving

00:37:11.719 --> 00:37:14.300
swiftly on. Bishti has also asked another question

00:37:14.300 --> 00:37:17.940
about limiting yourself while writing reports,

00:37:17.980 --> 00:37:21.840
because often people tend to find themselves

00:37:21.840 --> 00:37:26.110
writing too much. How long or short should intelligence

00:37:26.110 --> 00:37:29.530
reports be? And then CR has added on top of that,

00:37:29.889 --> 00:37:32.889
is there a good place to ask for feedback when

00:37:32.889 --> 00:37:36.670
you do write such a report? Where did you go

00:37:36.670 --> 00:37:39.510
in the early days for feedback on some of your

00:37:39.510 --> 00:37:42.610
early reports? Okay, so yeah, how long? Okay,

00:37:42.710 --> 00:37:45.590
I feel like that is a problem that all us internalists

00:37:45.590 --> 00:37:48.110
have because we just know so much when investigating

00:37:48.110 --> 00:37:49.909
something, you know everything, you know all

00:37:49.909 --> 00:37:52.210
the details and you want to explain all the tiny

00:37:52.210 --> 00:37:55.719
details. And most of the times, the reader does

00:37:55.719 --> 00:37:58.059
not care about the details. They just want the

00:37:58.059 --> 00:38:01.679
information. They wanted the digested information.

00:38:02.860 --> 00:38:07.000
So I would say in terms of number of pages, if

00:38:07.000 --> 00:38:10.639
that makes sense, I would say two. Two is how,

00:38:10.960 --> 00:38:13.300
well, to be fair, I tend to aim at two and end

00:38:13.300 --> 00:38:16.019
up with four anyway. But that's pictures, so

00:38:16.019 --> 00:38:19.239
that's fine. I can do that. But yeah, just try

00:38:19.239 --> 00:38:21.900
to keep it as clear as possible. What you usually

00:38:21.900 --> 00:38:24.579
do is that you'll explain things and then you

00:38:24.579 --> 00:38:26.840
link to the sources. So you don't have to, you

00:38:26.840 --> 00:38:28.760
know, describe everything. You can just say,

00:38:28.760 --> 00:38:31.820
oh, this is what, you know, there's a photo that

00:38:31.820 --> 00:38:33.659
showed this and then you just link to that photo

00:38:33.659 --> 00:38:36.440
without having to, you know, put everything on

00:38:36.440 --> 00:38:38.659
it. If people want more information, they can

00:38:38.659 --> 00:38:41.300
click the link and then, you know, get, you know,

00:38:41.400 --> 00:38:43.280
the information of where you got that information,

00:38:43.480 --> 00:38:47.980
that source and so on. So I would say keep it

00:38:47.980 --> 00:38:50.380
short -ish and that's mostly because you want

00:38:50.380 --> 00:38:52.820
to make sure that the people will keep on reading

00:38:52.820 --> 00:38:55.360
until halfway through because otherwise they'll

00:38:55.360 --> 00:38:59.739
just... Most people that will read your reports

00:38:59.739 --> 00:39:02.139
are probably going to be people that do not have

00:39:02.139 --> 00:39:06.019
much time to read too much information. So they

00:39:06.019 --> 00:39:07.760
want intelligence, that's it. They don't want

00:39:07.760 --> 00:39:11.010
how you got it. They don't want to learn about

00:39:11.010 --> 00:39:13.730
all the steps and that tiny detail and that video

00:39:13.730 --> 00:39:15.610
and then you found this person and then you did

00:39:15.610 --> 00:39:17.389
this thing. They don't care about any of that.

00:39:17.730 --> 00:39:20.409
They want intelligence. If you're writing a blog

00:39:20.409 --> 00:39:23.030
post and you want to showcase your skills, then

00:39:23.030 --> 00:39:25.570
definitely explain how you got there because

00:39:25.570 --> 00:39:28.590
when someone like a prospective employee is looking

00:39:28.590 --> 00:39:31.090
at it, they want to see that you're capable of

00:39:31.090 --> 00:39:34.920
making those steps and do this analysis. and

00:39:34.920 --> 00:39:37.139
find these identities, do you locate these things?

00:39:37.340 --> 00:39:39.480
So these are skills that you'll be looking for.

00:39:39.780 --> 00:39:42.739
But in terms of the reader, that's why I explain

00:39:42.739 --> 00:39:45.320
the difference between an oath and report and

00:39:45.320 --> 00:39:47.400
a walkthrough. They're quite different things.

00:39:47.960 --> 00:39:49.760
I'm sure there was a second and a third question,

00:39:49.800 --> 00:39:52.480
but I didn't write it down. Yeah, the second

00:39:52.480 --> 00:39:54.699
question actually relates to the question I was

00:39:54.699 --> 00:39:57.510
going to ask now. A lot of people are asking

00:39:57.510 --> 00:40:00.750
where they can find examples of good practice

00:40:00.750 --> 00:40:04.070
reports and where they can get feedback on their

00:40:04.070 --> 00:40:09.090
reports. Have you got any tips on that? Okay.

00:40:10.150 --> 00:40:13.849
So good practice reports. Well, there are many

00:40:13.849 --> 00:40:16.289
reports being written online. Bellinghat has

00:40:16.289 --> 00:40:19.349
reports or articles. I'm not sure how you describe

00:40:19.349 --> 00:40:22.710
it. You know, they are there. CR has, there's

00:40:22.710 --> 00:40:25.349
a few projects that publish reports, the High

00:40:25.349 --> 00:40:27.829
Zone Russia project, the Afghan witness project,

00:40:28.010 --> 00:40:30.869
the Myanmar witness project. So all of them have

00:40:30.869 --> 00:40:34.010
reports and then you can read and see more or

00:40:34.010 --> 00:40:36.730
less what style they are. And I guess you can

00:40:36.730 --> 00:40:39.550
guide yourself through with that. In terms of

00:40:39.550 --> 00:40:41.969
feedback, that is harder because obviously when

00:40:41.969 --> 00:40:44.150
you're working, you'll have someone to give feedback.

00:40:44.389 --> 00:40:46.389
I'm the person that gives feedback to other people.

00:40:46.780 --> 00:40:50.739
when you're not working, then that's obviously

00:40:50.739 --> 00:40:54.079
makes it harder. I usually, I would suggest getting

00:40:54.079 --> 00:40:57.500
other hosting people to read your articles because

00:40:57.500 --> 00:41:00.420
I feel like I have that problem at work as well.

00:41:00.679 --> 00:41:02.840
Cause I review everyone's reports, but who's

00:41:02.840 --> 00:41:04.820
reviewing mine, right? Like, you know, who watches

00:41:04.820 --> 00:41:08.400
the watchman. So I tend to ask other analysts

00:41:08.400 --> 00:41:10.260
who's like, can you look at my own reports? Which

00:41:10.260 --> 00:41:12.219
I hate. I hate when people commenting on it.

00:41:12.219 --> 00:41:14.079
I'm like, no, it was perfect. What are you doing?

00:41:14.460 --> 00:41:16.179
But no, sometimes it's not perfect and I need

00:41:16.179 --> 00:41:19.239
to change it. So it's always good to have an

00:41:19.239 --> 00:41:21.300
extra pair of eyes and it doesn't even have to

00:41:21.300 --> 00:41:23.179
be an awesome person. You can just give it to

00:41:23.179 --> 00:41:25.579
your mom or dad and be like, if you were to read

00:41:25.579 --> 00:41:29.030
this, do you understand? Because Again, there's

00:41:29.030 --> 00:41:32.210
different types of OSINT, and if your article

00:41:32.210 --> 00:41:36.090
is for public, it could be anyone. Anyone could

00:41:36.090 --> 00:41:38.510
just pick it up and read it and it needs to be

00:41:38.510 --> 00:41:40.710
understandable. People will be reading it and

00:41:40.710 --> 00:41:42.409
you're like, what do you mean by this? I've never

00:41:42.409 --> 00:41:44.730
heard this concept before because it could be

00:41:44.730 --> 00:41:47.849
something that everyone knows in OSINT, but out

00:41:47.849 --> 00:41:49.989
of OSINT, no one knows about it. So it's very

00:41:49.989 --> 00:41:53.849
useful to have extra pair of eyes from all walks

00:41:53.849 --> 00:41:57.230
of life, not just OSINT. That's it. That would

00:41:57.230 --> 00:42:00.599
make sense. Definitely, and I would just like

00:42:00.599 --> 00:42:03.079
to plug that in the Bellingcat Discord server,

00:42:03.340 --> 00:42:08.480
we have channels like publication preparation,

00:42:08.860 --> 00:42:12.179
cries for help, show your work, where you can

00:42:12.179 --> 00:42:17.760
kind of ask for that kind of last checks or help

00:42:17.760 --> 00:42:20.500
with those kinds of things as well. I'm not encouraging

00:42:20.500 --> 00:42:25.210
you to all post all of your 60 page works. in

00:42:25.210 --> 00:42:28.030
the channels, but asking people for help there

00:42:28.030 --> 00:42:31.469
is definitely encouraged. So please do reach

00:42:31.469 --> 00:42:35.170
out. So Tansa has asked a very common question

00:42:35.170 --> 00:42:37.809
that Bellingcat often face, actually, which is

00:42:37.809 --> 00:42:40.929
without cyber security expertise, how do you

00:42:40.929 --> 00:42:43.530
protect yourself while researching potentially

00:42:43.530 --> 00:42:48.030
dangerous topics or organizations? Any advice

00:42:48.030 --> 00:42:52.389
on that? So, yes, I do understand that. Like

00:42:52.389 --> 00:42:54.369
in my case, I feel like I kind of learned that

00:42:54.369 --> 00:42:57.829
the hard way before cybersecurity was even a

00:42:57.829 --> 00:43:00.630
topic I knew about. So it's hard for me to understand.

00:43:00.789 --> 00:43:03.730
I feel like there's a few ways to protect yourself,

00:43:03.730 --> 00:43:08.369
obviously. I feel like people as well exaggerate

00:43:08.369 --> 00:43:11.860
how much protection they need. Sometimes, the

00:43:11.860 --> 00:43:14.420
keyword being sometimes, because I see people

00:43:14.420 --> 00:43:19.880
like you need a virtual machine with whatever

00:43:19.880 --> 00:43:24.800
super exciting operating system and some crazy

00:43:24.800 --> 00:43:27.280
tools. And if you're just going to check Twitter,

00:43:27.500 --> 00:43:29.719
you don't need that. That's a bit too much, isn't

00:43:29.719 --> 00:43:33.503
it? If then you're going to, for example, investigate...

00:43:34.340 --> 00:43:36.900
extremist terrorist, you know, extremist organization

00:43:36.900 --> 00:43:39.260
propaganda, and you need to get into this very

00:43:39.260 --> 00:43:43.019
specific channels, which I shall not name, then

00:43:43.019 --> 00:43:45.179
definitely, you definitely need some sort of

00:43:45.179 --> 00:43:47.199
protection because you just never know what's

00:43:47.199 --> 00:43:49.619
going to happen. So there's a few things. that

00:43:49.619 --> 00:43:53.300
if you are going to go into places that will

00:43:53.300 --> 00:43:55.679
possibly get you on a list, you should definitely

00:43:55.679 --> 00:43:58.260
do. So things like you have a burner phone and

00:43:58.260 --> 00:44:01.119
you have a burner SIM card. And I have that just

00:44:01.119 --> 00:44:03.880
like an old phone that I don't use anymore. Cleaned

00:44:03.880 --> 00:44:06.900
everything. Everything just reset. Buy a SIM

00:44:06.900 --> 00:44:10.480
card from like for 20 P from eBay. It's not associated

00:44:10.480 --> 00:44:13.619
with me in any way. And that is just used to

00:44:13.619 --> 00:44:17.130
register. on websites that require. So like,

00:44:17.130 --> 00:44:19.170
for example, Facebook, they need your phone number.

00:44:19.369 --> 00:44:21.829
That's my phone number now. They need a new email.

00:44:21.889 --> 00:44:24.829
I'll create a new email. So I'll have a browser

00:44:24.829 --> 00:44:27.429
that's my working browser and nothing on that

00:44:27.429 --> 00:44:30.530
browser can connect to me in any way whatsoever.

00:44:31.969 --> 00:44:34.190
And, you know, that gets cleaned all the time.

00:44:34.309 --> 00:44:36.710
If I click, you know, close the browser, everything

00:44:36.710 --> 00:44:39.610
gets purged and everything has to be logged in

00:44:39.610 --> 00:44:43.599
again. So there's a few basic things. I don't

00:44:43.599 --> 00:44:45.900
think people need to go overboard again if they're

00:44:45.900 --> 00:44:48.760
doing investigation that just requires social

00:44:48.760 --> 00:44:52.500
media, geolocations, analyzing pictures. But

00:44:52.500 --> 00:44:57.440
if you do then get into more deeper rabbit holes,

00:44:57.820 --> 00:45:00.340
then definitely you need to read into how to

00:45:00.340 --> 00:45:02.340
stay safe. But you don't need a cybersecurity

00:45:02.340 --> 00:45:06.179
course. just some basic knowledge. And also once

00:45:06.179 --> 00:45:08.480
you start getting into OSINT and you can see

00:45:08.480 --> 00:45:11.480
how much information you can get from very specific

00:45:11.480 --> 00:45:14.579
things like, you know, in photo, then you start

00:45:14.579 --> 00:45:17.500
getting very careful about what you post online.

00:45:17.920 --> 00:45:20.699
And also I would suggest every so often just

00:45:20.699 --> 00:45:23.820
do OSINT on you, see how much you can find about

00:45:23.820 --> 00:45:26.480
yourself, anything that you left behind, a blog

00:45:26.480 --> 00:45:29.619
post, some social media profile that you forgot

00:45:29.619 --> 00:45:33.280
existed, go back, purge everything, delete everything,

00:45:33.820 --> 00:45:36.599
and that's it. It doesn't require too much, I

00:45:36.599 --> 00:45:41.699
think. Have you ever worked on a dark or deep

00:45:41.699 --> 00:45:44.900
web OSINT? Somebody in the chat is asking a question

00:45:44.900 --> 00:45:50.420
about that. No, I don't do that. There are a

00:45:50.420 --> 00:45:52.900
few members of my team that do that, but that

00:45:52.900 --> 00:45:55.360
is not my department, so I do not do that now.

00:45:56.239 --> 00:46:00.420
Great. Thank you so much for that really important

00:46:00.420 --> 00:46:02.880
advice. And yeah, just making sure that you're

00:46:02.880 --> 00:46:05.719
using kind of research profiles when you're searching

00:46:05.719 --> 00:46:08.500
anybody on social media as well is really important.

00:46:08.880 --> 00:46:11.460
Keeping it away from your personal profiles as

00:46:11.460 --> 00:46:14.579
much as possible. Stephanie asked a really interesting

00:46:14.579 --> 00:46:17.000
question. How can you tell the difference between

00:46:17.000 --> 00:46:19.920
passion and work and thinking about your sleep

00:46:19.920 --> 00:46:22.340
and about trauma and also the large number of

00:46:22.340 --> 00:46:24.159
people who are looking for a job in open source

00:46:24.159 --> 00:46:26.940
research? because they love investigating and

00:46:26.940 --> 00:46:31.079
analyzing this or that field. And of the recruiters

00:46:31.079 --> 00:46:33.099
who ask, what are your salary expectations as

00:46:33.099 --> 00:46:36.280
a junior? So how do you tell the difference between

00:46:36.280 --> 00:46:41.139
passion and work? Okay. I think for me, it's

00:46:41.139 --> 00:46:43.920
very clear at the end of the day is like 6 p

00:46:43.920 --> 00:46:47.000
.m. I'm done for the day. Do I walk away from

00:46:47.000 --> 00:46:49.260
it or do I just open another tab and I'm looking

00:46:49.260 --> 00:46:51.610
at something else? So that is the difference

00:46:51.610 --> 00:46:54.550
for me. If I just keep on going, it doesn't matter

00:46:54.550 --> 00:46:57.190
if it's weekend. It doesn't matter if it's, you

00:46:57.190 --> 00:46:59.889
know, 6 a .m. and I'm like, you know what I should

00:46:59.889 --> 00:47:02.550
do? I should look at that location. I should

00:47:02.550 --> 00:47:05.090
look at that picture. I need to solve that. I

00:47:05.090 --> 00:47:07.550
feel like that is passion. If you're just doing

00:47:07.550 --> 00:47:10.929
it because you have to, then that's a job. And,

00:47:11.050 --> 00:47:12.809
you know, it's fine. Sometimes you can have one

00:47:12.809 --> 00:47:15.250
without the other. But, you know, when you have

00:47:15.250 --> 00:47:17.989
them combined, that's just heaven. I love it.

00:47:20.529 --> 00:47:22.230
As we're running out of time, we've only got

00:47:22.230 --> 00:47:24.530
10 minutes left. So please put your final questions

00:47:24.530 --> 00:47:28.090
in the chat now. Shuky Ducky actually asked a

00:47:28.090 --> 00:47:30.829
question that I wanted to ask as well, which

00:47:30.829 --> 00:47:33.909
is based on your experience and observations.

00:47:34.210 --> 00:47:35.909
Sophia, what areas or topics do you think are

00:47:35.909 --> 00:47:38.489
currently undeserved or in high demand for open

00:47:38.489 --> 00:47:42.869
source researchers? Oh, God, that is a very hard

00:47:42.869 --> 00:47:47.070
question. I don't know. That is my answer. I

00:47:47.070 --> 00:47:49.820
just do not know because I feel like Whenever

00:47:49.820 --> 00:47:54.440
I go and I want to look at some random country

00:47:54.440 --> 00:47:59.360
for an idea for an exercise, I just come across

00:47:59.360 --> 00:48:02.239
so much that I had no idea what was going on

00:48:02.239 --> 00:48:04.579
there. And that's always a surprise to me. I

00:48:04.579 --> 00:48:06.659
was just like, oh, well, I had never come across

00:48:06.659 --> 00:48:09.420
this. I didn't know there was an issue going

00:48:09.420 --> 00:48:12.139
on in this country or this region of the world.

00:48:12.619 --> 00:48:16.510
And I feel like Maybe the best way is to find

00:48:16.510 --> 00:48:18.090
something, like I said, that's close to your

00:48:18.090 --> 00:48:20.090
heart. Maybe it could be, you know, where you

00:48:20.090 --> 00:48:23.110
live or where you're from, could be different

00:48:23.110 --> 00:48:26.590
things. Something that, you know, when you go

00:48:26.590 --> 00:48:29.210
to Twitter or when you go to Facebook or whatever,

00:48:29.429 --> 00:48:31.409
the things that you just keep on checking, you

00:48:31.409 --> 00:48:33.389
keep on Googling, you keep on wanting to know

00:48:33.389 --> 00:48:36.909
more about it. Because again, like I said, when

00:48:36.909 --> 00:48:39.969
I was speaking, it's best to do something that

00:48:39.969 --> 00:48:43.610
drives you than to try to find something that

00:48:43.610 --> 00:48:46.650
you feel will get attention or is not getting

00:48:46.650 --> 00:48:49.750
enough attention, just find something that you

00:48:49.750 --> 00:48:53.469
want to do. Yeah, passion is definitely important

00:48:53.469 --> 00:48:55.289
because you're going to be staring at the same

00:48:55.289 --> 00:48:57.610
piece of information or the same set of information

00:48:57.610 --> 00:49:04.219
for a while. But a lot of people fall into things

00:49:04.219 --> 00:49:07.099
that are familiar to them as well. So covering

00:49:07.099 --> 00:49:09.099
countries, for example, where they speak the

00:49:09.099 --> 00:49:11.239
language, where they're familiar with the landscape,

00:49:12.159 --> 00:49:16.239
because it's often easier for geolocation purposes,

00:49:16.480 --> 00:49:21.239
at least. Zal Dastix earlier asked, if you're

00:49:21.239 --> 00:49:23.480
doing that kind of thing, if you're kind of falling

00:49:23.480 --> 00:49:26.179
into familiar territory for yourself, how do

00:49:26.179 --> 00:49:32.139
you avoid getting your biases in the way. How

00:49:32.139 --> 00:49:35.559
do you investigate something and make sure that

00:49:35.559 --> 00:49:38.820
you're not harming anybody with biases when doing

00:49:38.820 --> 00:49:42.559
open source reporting? It's very hard because

00:49:42.559 --> 00:49:45.539
I do investigate the same area of the globe every

00:49:45.539 --> 00:49:48.960
single day, but I also do as part of a team.

00:49:49.619 --> 00:49:52.940
So, you know, we all keep each other in check,

00:49:53.079 --> 00:49:54.860
if that makes sense. And sometimes I'll write

00:49:54.860 --> 00:49:56.340
something and be like, no, no, that's wrong.

00:49:56.420 --> 00:50:00.739
Kind of like, damn it. So I think it's always

00:50:00.739 --> 00:50:02.860
best if you can collaborate with other people

00:50:02.860 --> 00:50:07.239
because they do provide a different perspective

00:50:07.239 --> 00:50:11.119
than yours. And I feel like that is also so valuable.

00:50:11.900 --> 00:50:15.000
And most of my, sorry, most of my reports, I

00:50:15.000 --> 00:50:17.849
do them alone. I write them alone. But, you know,

00:50:17.849 --> 00:50:20.610
it's just so important to have that someone else

00:50:20.610 --> 00:50:24.570
to just come in and look at it. So, like I said,

00:50:24.690 --> 00:50:27.130
the Bellingcat server is a good one. So you can

00:50:27.130 --> 00:50:29.389
go and it's divided in like topics, isn't it?

00:50:29.409 --> 00:50:31.449
And you can go and see what other people are

00:50:31.449 --> 00:50:33.289
talking about because maybe, yeah, you are stuck

00:50:33.289 --> 00:50:38.630
in our biases. And also, I would suggest, like

00:50:38.630 --> 00:50:40.969
I said, I have a different browser for work.

00:50:41.449 --> 00:50:45.510
So that browser. It gets purged every day, like

00:50:45.510 --> 00:50:48.530
all cookies go, everything. So it kind of resets.

00:50:49.030 --> 00:50:51.349
So anything that I was looking for or looking

00:50:51.349 --> 00:50:54.789
around the previous day is no longer impacting,

00:50:54.789 --> 00:50:57.929
hopefully, my results. And I think that's important

00:50:57.929 --> 00:51:00.389
to just get the clear slate, you know, because

00:51:00.389 --> 00:51:06.690
we get a lot, you know, search engines and platforms

00:51:06.690 --> 00:51:09.730
try to track what you like and try to give you

00:51:09.730 --> 00:51:12.630
more of that. So my suggestion, just don't give

00:51:12.630 --> 00:51:14.769
them that. Just purge everything. Just like give

00:51:14.769 --> 00:51:17.170
me the clean slate and let's see what you got.

00:51:17.869 --> 00:51:20.730
Exactly. Algorithms try to box you in and this

00:51:20.730 --> 00:51:24.230
can sometimes leave you blind. I wanted to ask,

00:51:24.550 --> 00:51:26.869
is there any tools that you found more useful

00:51:26.869 --> 00:51:30.349
when you were a beginner that you now perhaps

00:51:30.349 --> 00:51:33.869
no longer use as an expert or any that have become

00:51:33.869 --> 00:51:37.469
a staple as part of your research that you think

00:51:37.469 --> 00:51:42.440
are worth shouting out? So the short answer is

00:51:42.440 --> 00:51:45.699
no. I feel like tools come and go and I tend

00:51:45.699 --> 00:51:47.679
to not get attached to them too much because

00:51:47.679 --> 00:51:49.480
you just never know. Next time I'm going to search

00:51:49.480 --> 00:51:52.099
for it, they're just gone. It's however, something

00:51:52.099 --> 00:51:54.460
I see a lot in the online hosting community.

00:51:54.760 --> 00:51:57.639
They just need to find and collect hosting tools

00:51:57.639 --> 00:52:00.079
for everything. There's list of this and top

00:52:00.079 --> 00:52:03.079
five and top 10 tools for whatever. And I'm sure

00:52:03.079 --> 00:52:05.079
some of them are very useful, but I tend to not

00:52:05.079 --> 00:52:08.059
just bother with any of them. I like to stick

00:52:08.059 --> 00:52:10.900
to the basics and try to use search engines to

00:52:10.900 --> 00:52:13.340
find information. You have Google Yandex Bing

00:52:13.340 --> 00:52:17.199
Maps alongside Google Earth Pro for satellite

00:52:17.199 --> 00:52:19.920
imagery, because I spend a lot of my time looking

00:52:19.920 --> 00:52:22.719
at photos and videos and noticing the tiny details

00:52:22.719 --> 00:52:25.900
of it all. So it's mostly what I do. I also feel

00:52:25.900 --> 00:52:29.179
like the most important thing about any tools

00:52:29.179 --> 00:52:32.280
is to master them, to learn in depth what they

00:52:32.280 --> 00:52:37.340
can or cannot do because That's it. You learn

00:52:37.340 --> 00:52:40.760
how to do things that most people probably don't

00:52:40.760 --> 00:52:44.320
know about. I'll give a quick example. I did

00:52:44.320 --> 00:52:46.880
a geolocation that I wrote about a while ago.

00:52:46.960 --> 00:52:50.800
I think it was last year. It was at a time where

00:52:50.800 --> 00:52:53.280
a Wagner convoy was heading to Moscow. It was

00:52:53.280 --> 00:52:56.219
a big thing and everyone was just in a big brouhaha.

00:52:57.019 --> 00:53:01.119
There was a video of excavators digging a road.

00:53:01.360 --> 00:53:05.519
I apparently was to stop this convoy from reaching

00:53:05.519 --> 00:53:08.480
Moscow and I was tasked to find this geolocation

00:53:08.480 --> 00:53:12.280
thing. What I used at the time was that I went

00:53:12.280 --> 00:53:15.719
to Google Maps and I knew more or less the area

00:53:15.719 --> 00:53:19.039
that they were heading in a specific direction.

00:53:19.039 --> 00:53:21.320
They were heading towards Moscow. I knew where

00:53:21.320 --> 00:53:24.039
they were before, so I kind of had a more general

00:53:24.039 --> 00:53:26.519
idea and I was looking for big roads because

00:53:26.519 --> 00:53:28.679
there were tanks and stuff, they needed space.

00:53:28.969 --> 00:53:33.030
And I end up using the traffic option on Google

00:53:33.030 --> 00:53:36.050
Maps, which is not used that often. So people

00:53:36.050 --> 00:53:38.409
will use it if they need to navigate, for example,

00:53:38.409 --> 00:53:40.610
and they want to see how much traffic is in a

00:53:40.610 --> 00:53:44.050
specific area. But because when I saw that video,

00:53:44.110 --> 00:53:47.110
I saw that when the excavators were digging the

00:53:47.110 --> 00:53:49.349
road, there was a queue of cars forming behind

00:53:49.349 --> 00:53:54.510
them. So I thought, if I put this live thing

00:53:54.510 --> 00:53:59.340
that shows the traffic of this area, I would

00:53:59.340 --> 00:54:02.599
say that the red bits is where the traffic is

00:54:02.599 --> 00:54:05.260
forming. That's where this likely to play. So

00:54:05.260 --> 00:54:08.000
I went straight to that area, check Google street

00:54:08.000 --> 00:54:10.059
view because apparently they did have it, which

00:54:10.059 --> 00:54:13.320
was great. And I just relocated. So that's what

00:54:13.320 --> 00:54:15.559
I mean. Like, you know, everyone knows how to

00:54:15.559 --> 00:54:17.619
use Google maps, but not everyone will know how

00:54:17.619 --> 00:54:20.880
to use this very specific. option of Google Maps.

00:54:21.199 --> 00:54:24.119
And so I would suggest people to just play with

00:54:24.119 --> 00:54:25.880
everything, click everything. I'm always clicking

00:54:25.880 --> 00:54:29.380
everything. And I keep up with any changes to

00:54:29.380 --> 00:54:32.860
this. So I follow things about Google News and

00:54:32.860 --> 00:54:36.360
Maps. So whenever anything is introduced or removed,

00:54:36.400 --> 00:54:39.599
I'm aware of it and I can just make sure that

00:54:39.599 --> 00:54:43.019
I can either use it or stop using and find an

00:54:43.019 --> 00:54:45.599
alternative. So it's less about the tools and

00:54:45.599 --> 00:54:49.960
more about your expertise in using them. That's

00:54:49.960 --> 00:54:53.119
really, really good advice. Just on that topic

00:54:53.119 --> 00:54:56.739
then, as we're wrapping up, what kind of barriers

00:54:56.739 --> 00:55:00.179
should people expect to face when trying to get

00:55:00.179 --> 00:55:02.440
into this industry and trying to get into open

00:55:02.440 --> 00:55:06.360
source research? And how might you advise they

00:55:06.360 --> 00:55:10.340
overcome them? I think that there's a few barriers

00:55:10.340 --> 00:55:14.420
in terms of skills, obviously. So if you're investigating

00:55:14.420 --> 00:55:17.820
something, like I said, I applied for the Eyes

00:55:17.820 --> 00:55:19.980
on Russia project and they wanted someone who

00:55:19.980 --> 00:55:22.139
spoke the language. That's the barrier for me

00:55:22.139 --> 00:55:27.760
specifically. Language is definitely a very high

00:55:27.760 --> 00:55:31.420
demand skill. But I think the biggest barrier

00:55:31.420 --> 00:55:35.059
that I see nowadays is that there's so many organizations

00:55:35.059 --> 00:55:37.699
hiring based on CV and that is not how you get

00:55:37.699 --> 00:55:40.179
the talent. The talent is not coming from the

00:55:40.179 --> 00:55:42.019
CV. At most, you'll get someone that can write

00:55:42.019 --> 00:55:45.980
CVs very well. The talent are the people that

00:55:45.980 --> 00:55:50.380
dedicate and do things. And I feel like that

00:55:50.380 --> 00:55:53.380
is an overall thing. But I think the problem

00:55:53.380 --> 00:55:57.139
is if you have a small organization, then it's

00:55:57.139 --> 00:55:58.880
likely that the people that will be doing the

00:55:58.880 --> 00:56:01.280
hiring will be people that know about OSINT.

00:56:01.579 --> 00:56:04.159
If you have a big organization, chances are the

00:56:04.159 --> 00:56:06.539
people hiring are the people that are like HR

00:56:06.539 --> 00:56:09.380
or something like that or management. And those

00:56:09.380 --> 00:56:11.019
will be looking at CV because they don't know

00:56:11.019 --> 00:56:13.440
what skills they need. And I feel like that is

00:56:13.440 --> 00:56:17.380
a problem in any organization, in any industries,

00:56:17.460 --> 00:56:20.400
not just this one. But I think in OSINT specifically,

00:56:21.039 --> 00:56:24.099
the best, absolutely the best analyst I ever

00:56:24.099 --> 00:56:28.650
worked with. were people that didn't have the

00:56:28.650 --> 00:56:31.090
ideal CV. They didn't have anything to do with

00:56:31.090 --> 00:56:34.190
OSINT. And I feel like if they were looking at

00:56:34.190 --> 00:56:36.090
their CV at the beginning, they would not have

00:56:36.090 --> 00:56:38.849
a job. No one even looked at my CV. I never sent

00:56:38.849 --> 00:56:40.889
my CV to anyone. They were just like, hey, yeah,

00:56:40.989 --> 00:56:44.389
you can join in. And that's it. So I was happy

00:56:44.389 --> 00:56:46.230
for that. I'm very happy for that. But I feel

00:56:46.230 --> 00:56:51.539
like we need to let more people in. based on

00:56:51.539 --> 00:56:54.300
the skills rather than what they have done so

00:56:54.300 --> 00:56:59.300
far. Absolutely. Absolutely. I cannot agree more.

00:57:00.039 --> 00:57:03.780
And that's part of the reason why I was so desperate

00:57:03.780 --> 00:57:07.059
to chat to you today. And thank you so, so much

00:57:07.059 --> 00:57:10.440
for today's talk. It's been fascinating. We've

00:57:10.440 --> 00:57:14.070
learned a few things. We've learned not to depend

00:57:14.070 --> 00:57:18.730
on tools, practice, practice, practice, identify

00:57:18.730 --> 00:57:21.429
your niche, identify your passion, and that the

00:57:21.429 --> 00:57:24.030
industry needs to recognize all the hard people

00:57:24.030 --> 00:57:26.409
working out there on these kinds of things. So

00:57:26.409 --> 00:57:29.710
thank you so much, Sophia, for a fantastic talk.

00:57:30.309 --> 00:57:33.250
Is there any other resources that you want to

00:57:33.250 --> 00:57:35.730
kind of highlight quickly other than your own

00:57:35.730 --> 00:57:39.480
fantastic website? Yes. Yes, I want that. Yes,

00:57:39.559 --> 00:57:41.639
I'm very excited about that. Okay. So one of

00:57:41.639 --> 00:57:44.940
the things that I've told already is that I ask

00:57:44.940 --> 00:57:48.579
people to, when they solve my exercises and when

00:57:48.579 --> 00:57:51.480
they write walkthroughs to please give me the

00:57:51.480 --> 00:57:55.179
links. And so then I put them on my page. So,

00:57:55.239 --> 00:57:58.219
you know, like on my page, each exercise has

00:57:58.219 --> 00:58:02.000
a page and on them, I will list everyone that

00:58:02.000 --> 00:58:06.039
has written a walkthrough. And I feel like that

00:58:06.039 --> 00:58:10.219
is a gold mine of knowledge. I love reading those

00:58:10.219 --> 00:58:12.320
walkthroughs because very often they come from

00:58:12.320 --> 00:58:16.280
people that have no experience in OSINT and somehow

00:58:16.280 --> 00:58:18.739
they're thinking, they're using methods, they

00:58:18.739 --> 00:58:22.159
use strategy that would never occur to me. And

00:58:22.159 --> 00:58:24.900
it's brilliant. And I'll get people from all

00:58:24.900 --> 00:58:27.699
walks of life, people from all sides of this

00:58:27.699 --> 00:58:31.440
planet, all corners. And they just solve the

00:58:31.440 --> 00:58:33.980
exact same thing that I've done and many others

00:58:33.980 --> 00:58:36.179
have done, but they use the technique that no

00:58:36.179 --> 00:58:39.039
one else has used. And I think this is just brilliant.

00:58:39.340 --> 00:58:42.159
I absolutely invite people to read other people's

00:58:42.159 --> 00:58:46.539
work. And some of them are honestly, they're

00:58:46.539 --> 00:58:49.119
just their raw talent. And I keep telling them

00:58:49.119 --> 00:58:53.559
and I am always so sad when sometimes they message

00:58:53.559 --> 00:58:55.599
me and they're like here's my walkthrough please

00:58:55.599 --> 00:58:57.639
don't publish I'm not comfortable I'm not confident

00:58:57.639 --> 00:58:59.900
enough and I read it and it's like the most brilliant

00:58:59.900 --> 00:59:03.119
piece of work and I was like why wouldn't I publish

00:59:03.119 --> 00:59:05.239
this is brilliant please keep writing please

00:59:05.239 --> 00:59:06.860
if you ever change your mind just let me know

00:59:06.860 --> 00:59:09.199
I want to publish this you should be very proud

00:59:09.199 --> 00:59:13.920
of it and that's it that's a good resource. Fantastic

00:59:13.920 --> 00:59:17.639
so Safiya wants to know if you've tried her exercises

00:59:17.639 --> 00:59:20.449
and please do get in touch. All right. Thank

00:59:20.449 --> 00:59:22.929
you, everybody, for listening. I'm going to end

00:59:22.929 --> 00:59:24.909
the recording here. But thank you so much for

00:59:24.909 --> 00:59:27.309
your time today. And in two weeks time, we'll

00:59:27.309 --> 00:59:30.090
be back with another stage talk. My colleague

00:59:30.090 --> 00:59:32.329
Meryl will be presenting it. Thank you so much,

00:59:32.449 --> 00:59:38.250
everybody. Thank you. Bye bye. Thank you for

00:59:38.250 --> 00:59:41.050
listening to the stage talk. If you'd like to

00:59:41.050 --> 00:59:43.949
catch a stage talk live where you can ask the

00:59:43.949 --> 00:59:46.710
guest questions, join the Bellingcat Discord

00:59:46.710 --> 00:59:53.369
server by visiting www .discord .gg slash Bellingcat.

00:59:53.849 --> 00:59:56.969
The music you've heard is titled Dawn by Newer

00:59:56.969 --> 00:59:59.429
Self and is courtesy of Artlist.