WEBVTT 00:00:04.179 --> 00:00:07.320 You're listening to a stage talk titled Tracing 00:00:07.320 --> 00:00:10.539 a Drug Cartel. This week we were joined by The 00:00:10.539 --> 00:00:13.240 Sunday Times crime, terrorism and national security 00:00:13.240 --> 00:00:16.600 reporter John Mooney and Bellingcat's financial 00:00:16.600 --> 00:00:19.670 researcher Connor Plunkett. They spoke about 00:00:19.670 --> 00:00:22.129 the considerations you need to make when reporting 00:00:22.129 --> 00:00:25.570 on big -scale crime operations, and how they 00:00:25.570 --> 00:00:28.469 found a hidden side to one of Ireland's most 00:00:28.469 --> 00:00:32.210 notorious cartel bosses. This talk was hosted 00:00:32.210 --> 00:00:35.090 by me, Charlotte Mar, on Thursday the 24th of 00:00:35.090 --> 00:00:38.710 April, 2025, in the Bellingcat Discord server. 00:00:47.049 --> 00:00:51.570 Thanks so much for coming. Thank you very much 00:00:51.570 --> 00:00:53.670 for joining us. I'm going to turn on my camera 00:00:53.670 --> 00:00:58.969 quickly. We're currently just waiting for John 00:00:58.969 --> 00:01:02.509 to jump in. But in the meantime, I just wanted 00:01:02.509 --> 00:01:07.370 to introduce Connor and the subject of our talk 00:01:07.370 --> 00:01:09.810 today. So welcome to this week's stage talk. 00:01:10.880 --> 00:01:13.239 When you think of crime reporting, you might 00:01:13.239 --> 00:01:16.340 be picturing undercover reporters, dodgy former 00:01:16.340 --> 00:01:19.340 criminals as sources and an unlucky journalist 00:01:19.340 --> 00:01:21.280 doggedly following the death and destruction 00:01:21.280 --> 00:01:24.280 that's often left behind in a major criminal's 00:01:24.280 --> 00:01:27.719 wake. But can you report on criminal groups without 00:01:27.719 --> 00:01:30.519 any of these old tropes? What does reporting 00:01:30.519 --> 00:01:33.099 on cartels look like when you're only using what 00:01:33.099 --> 00:01:35.900 you can find on the internet? What traces do 00:01:35.900 --> 00:01:39.150 these groups leave? Well, today's speakers will 00:01:39.150 --> 00:01:41.569 hopefully enlighten us a little on this subject. 00:01:41.849 --> 00:01:44.010 We're joined by my colleague, Bellingcat's Conor 00:01:44.010 --> 00:01:47.010 Plunkett, and hopefully, in a couple of minutes, 00:01:47.189 --> 00:01:49.629 we'll also be joined by The Sundae Hounds' John 00:01:49.629 --> 00:01:53.150 Mooney. Both have worked together following the 00:01:53.150 --> 00:01:55.629 Kinahan Cartel and the suspected associates. 00:01:56.430 --> 00:01:58.870 The Kinahan Cartel are a criminal gang that is 00:01:58.870 --> 00:02:01.170 suspected to have amassed profits of over $1 00:02:01.170 --> 00:02:04.819 billion through the trade of illegal narcotics, 00:02:05.120 --> 00:02:07.140 arms trafficking, and money laundering over the 00:02:07.140 --> 00:02:10.479 years. As I pass over to Connor and hopefully 00:02:10.479 --> 00:02:13.639 later John to tell us more, a short reminder, 00:02:13.860 --> 00:02:16.219 if you'd like to ask a question, please do so 00:02:16.219 --> 00:02:18.919 in the chat as we talk. You can see it, the little 00:02:18.919 --> 00:02:21.159 speech bubble in the corner of your screen. And 00:02:21.159 --> 00:02:23.800 please note that this is being audio recorded. 00:02:24.139 --> 00:02:27.240 So if you do not want me to read out your Discord 00:02:27.240 --> 00:02:29.599 username, please note that within your question. 00:02:30.259 --> 00:02:34.229 So I avoid doing that. Okay, Conor, I will pass 00:02:34.229 --> 00:02:37.189 over to you in the meantime to tell us a little 00:02:37.189 --> 00:02:39.930 bit more about the work that you've been up to. 00:02:42.030 --> 00:02:44.409 Thanks very much, Charlie. Yeah, I just want 00:02:44.409 --> 00:02:47.169 to say I'm delighted to be here. Before I was 00:02:47.169 --> 00:02:49.770 working at Bellingcat, I was an occasional poster 00:02:49.770 --> 00:02:52.889 on the Discord myself. I definitely learned a 00:02:52.889 --> 00:02:56.069 lot from the Discord community. So it's a privilege 00:02:56.069 --> 00:02:57.830 to be here talking to you all today. I'm a bit 00:02:57.830 --> 00:03:01.340 nervous, but yeah, it's great to be here. So 00:03:01.340 --> 00:03:04.819 anyway, I just thought I'd start by just giving 00:03:04.819 --> 00:03:06.659 you a little bit of background on the Kinehan 00:03:06.659 --> 00:03:09.979 Cartel and who Christie Kinehan is just for people 00:03:09.979 --> 00:03:14.539 who maybe aren't as familiar. So yeah, the Kinehan 00:03:14.539 --> 00:03:18.039 Cartel, they're a major Irish transnational organized 00:03:18.039 --> 00:03:21.180 crime group. It was founded by Christie Kinehan 00:03:21.180 --> 00:03:24.020 in the nineties. So he's in his mid sixties now, 00:03:24.020 --> 00:03:27.120 I believe. And it's now run from Dubai by Christie 00:03:27.120 --> 00:03:29.539 and his two sons, Daniel and Christopher Jr. 00:03:30.000 --> 00:03:33.219 So in 2022, Christie and his two sons were sanctioned 00:03:33.219 --> 00:03:37.759 by the US government and the government put a 00:03:37.759 --> 00:03:42.419 combined $15 million price for information leading 00:03:42.419 --> 00:03:46.939 to their arrest or financial disruption. So yeah, 00:03:47.020 --> 00:03:50.300 ever since then, you know, they've kind of gone 00:03:50.300 --> 00:03:52.300 to ground in a lot of ways. Because previously 00:03:52.300 --> 00:03:56.099 to that, Christie's son Daniel was involved pretty 00:03:56.099 --> 00:03:59.289 big time in the professional boxing world. So 00:03:59.289 --> 00:04:01.169 anyone who's into boxing might have heard of 00:04:01.169 --> 00:04:06.430 MTK Global. And I see John's here now. So I was 00:04:06.430 --> 00:04:08.569 originally going to let John talk about the Kinnins 00:04:08.569 --> 00:04:10.110 background because he's been covering this for 00:04:10.110 --> 00:04:13.030 decades. So I might pass it over to him now, 00:04:13.129 --> 00:04:16.269 John. John, can you hear me? I can hear you fine, 00:04:16.490 --> 00:04:18.769 Connor. Okay, brilliant. Great to have you here. 00:04:18.970 --> 00:04:21.189 Yeah. So I just was going to pass it over to 00:04:21.189 --> 00:04:23.430 you just to explain a little bit on the background 00:04:23.430 --> 00:04:26.910 of the Kinnins. So thanks very much to Bellingcat 00:04:26.910 --> 00:04:29.350 for offering me the opportunity to speak about 00:04:29.350 --> 00:04:32.149 this. I feel very old when Connor says that I've 00:04:32.149 --> 00:04:35.430 been reporting on these for decades. Unfortunately, 00:04:35.689 --> 00:04:39.170 it has been decades, but I'll give everyone a 00:04:39.170 --> 00:04:42.449 quick synopsis of this particular organized crime 00:04:42.449 --> 00:04:47.269 group. So Christopher Kinnahan is a very intelligent 00:04:47.269 --> 00:04:51.709 and highly entrepreneurial drug dealer. who emerged 00:04:51.709 --> 00:04:55.730 from the Irish underworld in the early 1980s. 00:04:56.230 --> 00:04:59.310 He came from a middle -class background. He'd 00:04:59.310 --> 00:05:03.730 be a relatively well -educated man and he would 00:05:03.730 --> 00:05:07.389 be also highly intelligent. These are character 00:05:07.389 --> 00:05:10.189 traits that became very obvious to anyone who 00:05:10.189 --> 00:05:14.550 encountered him back then. So he started out 00:05:14.550 --> 00:05:17.589 his criminal career involved in fraud and quickly 00:05:17.589 --> 00:05:21.589 moved into drug trafficking. In the course of 00:05:21.589 --> 00:05:24.649 the following decade, he became a very significant 00:05:24.649 --> 00:05:28.910 drug dealer in the Dublin area and was imprisoned 00:05:28.910 --> 00:05:33.029 on two separate occasions, one for a type of 00:05:33.029 --> 00:05:35.889 very sophisticated fraud and the other one for 00:05:35.889 --> 00:05:40.329 drug dealing. On his release from prison in the 00:05:40.329 --> 00:05:44.339 early 90s, He was a man who had used his time 00:05:44.339 --> 00:05:47.000 in prison well. He'd studied, he had obtained 00:05:47.000 --> 00:05:50.180 a degree and actually declined to leave prison 00:05:50.180 --> 00:05:53.579 early, although when he was nearing the completion 00:05:53.579 --> 00:05:55.860 of his sentence, on the basis that he wanted 00:05:55.860 --> 00:06:00.240 to finish his studies. He then became what could 00:06:00.240 --> 00:06:03.519 be best described as a criminal drug trafficker 00:06:03.519 --> 00:06:08.740 par excellence. insofar that he started making 00:06:08.740 --> 00:06:11.980 connections with big drug trafficking syndicates 00:06:11.980 --> 00:06:15.860 from around the world. He traveled extensively 00:06:15.860 --> 00:06:18.839 across Europe. He traveled into Central Asia, 00:06:19.480 --> 00:06:22.819 into the Americas as well, and forged connections 00:06:22.819 --> 00:06:27.399 with cartels, criminals across Europe, and he 00:06:27.399 --> 00:06:31.120 became a logistics expert. In the process of 00:06:31.120 --> 00:06:34.959 all of this, he also became a multi multi -millionaire. 00:06:35.379 --> 00:06:40.040 He became man that now has amassed a fortune 00:06:40.040 --> 00:06:44.279 put in the region of 1 .5 billion. So he is the 00:06:44.279 --> 00:06:47.560 figurehead of this criminal organization. Its 00:06:47.560 --> 00:06:51.779 tentacles now stretch across the world. He is 00:06:51.779 --> 00:06:54.699 very unusual in the criminal underworld in so 00:06:54.699 --> 00:06:58.040 far that they're not just drug traffickers anymore. 00:06:58.519 --> 00:07:03.300 They really are, they're experts at moving product 00:07:03.300 --> 00:07:07.319 across the world. They also have forged connections 00:07:07.319 --> 00:07:10.240 in with hostile states like Iran and Russia. 00:07:10.579 --> 00:07:15.220 And indeed he is very much involved with intelligence 00:07:15.220 --> 00:07:18.220 services. that would be involved in the various 00:07:18.220 --> 00:07:22.060 activities across Europe. So the cartel is many 00:07:22.060 --> 00:07:26.279 things to many men. It's a very organized kind 00:07:26.279 --> 00:07:29.459 of structure, hierarchical structure. He's been 00:07:29.459 --> 00:07:31.860 joined by his two sons, which is Christopher 00:07:31.860 --> 00:07:36.509 Jr. and Daniel Kinnigan. They have many different 00:07:36.509 --> 00:07:39.129 types of businesses. Some of these are legitimate 00:07:39.129 --> 00:07:42.170 and some of these are criminal in nature. And 00:07:42.170 --> 00:07:47.129 they are amongst now the top drug traffickers 00:07:47.129 --> 00:07:50.110 in the world. If you speak to an academic, they 00:07:50.110 --> 00:07:56.029 may describe them as a hybrid organization. They 00:07:56.029 --> 00:07:59.209 have the character traits of a terrorist group, 00:07:59.470 --> 00:08:02.370 but they have the outlook of criminals. They're 00:08:02.370 --> 00:08:05.459 also involved in legitimate industry. So they're 00:08:05.459 --> 00:08:09.399 fingers in many, many pies. They are wanted men 00:08:09.399 --> 00:08:11.920 by various governments across the world, but 00:08:11.920 --> 00:08:15.740 they live very openly in Dubai and so do their 00:08:15.740 --> 00:08:18.759 families and their extended network of associates. 00:08:19.160 --> 00:08:21.980 So these are not commoner garden criminals. They 00:08:21.980 --> 00:08:27.019 are venture capitalists in the international 00:08:27.019 --> 00:08:30.899 underworld. Thanks for that, John. So now I'm 00:08:30.899 --> 00:08:33.940 just kind of going to go into the, uh, the collaboration 00:08:33.940 --> 00:08:36.519 Bellingcat has done with, uh, John over at the 00:08:36.519 --> 00:08:38.899 Sunday Times, um, starting last year. So I'll 00:08:38.899 --> 00:08:43.120 just share my screen here. Just one second. Yeah. 00:08:43.159 --> 00:08:46.720 So basically, um, it started last year with the, 00:08:46.720 --> 00:08:49.720 uh, the joint investigation we did on Christie 00:08:49.720 --> 00:08:53.379 Kinnon's Google reviews. Um, so basically how 00:08:53.379 --> 00:08:57.960 this started was It had been reported that Kinnon 00:08:57.960 --> 00:09:02.799 had been posting online for some reason under 00:09:02.799 --> 00:09:05.740 an alias Christopher Vincent, which are his first 00:09:05.740 --> 00:09:08.320 and middle names. So not the most genius alias 00:09:08.320 --> 00:09:10.960 ever, but this had been reported by the Sunday 00:09:10.960 --> 00:09:13.240 World that he had a LinkedIn profile and a couple 00:09:13.240 --> 00:09:16.379 of Twitter profiles that he'd been posting under 00:09:16.379 --> 00:09:18.539 and one of which had a picture of his face on 00:09:18.539 --> 00:09:20.820 it. So they had come across this and this was 00:09:20.820 --> 00:09:24.720 the first time in 2022 that it had come out there 00:09:24.720 --> 00:09:27.940 that he'd been using this alias online. And then 00:09:27.940 --> 00:09:31.059 from that, it was like, I was just thinking to 00:09:31.059 --> 00:09:33.820 myself, maybe this has been used in other places. 00:09:34.240 --> 00:09:36.000 You know, I, you know, as a member of the discord 00:09:36.000 --> 00:09:38.580 server, I was into doing open source stuff. So 00:09:38.580 --> 00:09:40.840 I used to just do this kind of stuff in my free 00:09:40.840 --> 00:09:43.279 time. But I was just doing some Google searches 00:09:43.279 --> 00:09:47.220 with that alias. I was trying different keywords 00:09:47.220 --> 00:09:50.899 and one of them was Sharjah, which is a city 00:09:50.899 --> 00:09:55.710 next to Dubai in the UAE. And my idea there was 00:09:55.710 --> 00:09:59.370 that it could be a region they're also active 00:09:59.370 --> 00:10:02.149 in, but less publicized. Like if you search Christopher 00:10:02.149 --> 00:10:04.730 Vincent and Dubai in quotes, you're just going 00:10:04.730 --> 00:10:07.230 to get loads of news articles about the Kinnons. 00:10:07.809 --> 00:10:09.769 But if you search Sharji, you might find something 00:10:09.769 --> 00:10:12.110 that's gone under the radar. And also it effectively 00:10:12.110 --> 00:10:16.230 filters out all those news reports. So on the 00:10:16.230 --> 00:10:18.889 first page of results here, I saw one snippet 00:10:18.889 --> 00:10:22.399 of a Google review. which was on this third party 00:10:22.399 --> 00:10:24.679 website with the name Christopher Vincent. You 00:10:24.679 --> 00:10:27.860 can see it here. From those listening, it's just 00:10:27.860 --> 00:10:31.659 a screenshot of this Google review of a steak 00:10:31.659 --> 00:10:35.700 restaurant. And you could click through to the 00:10:35.700 --> 00:10:38.840 Google profile from that review and you could 00:10:38.840 --> 00:10:41.799 see that it had posted over a hundred reviews, 00:10:42.019 --> 00:10:44.980 over a thousand photos. And you could see all 00:10:44.980 --> 00:10:47.870 the places around the world that had that he 00:10:47.870 --> 00:10:50.730 had left reviews. So in the South of Africa, 00:10:50.909 --> 00:10:54.370 Europe, Asia, Middle East. And so at this point, 00:10:54.370 --> 00:10:56.490 you know, it could easily be just a coincidence. 00:10:56.690 --> 00:10:58.710 I mean, it's just the same name. You know, who 00:10:58.710 --> 00:11:01.490 knows? That's what I was thinking at this point. 00:11:01.529 --> 00:11:03.990 It's probably a coincidence. And then I was just 00:11:03.990 --> 00:11:05.730 scrolling down through the reviews to see what 00:11:05.730 --> 00:11:08.250 he was talking about. And there was one review 00:11:08.250 --> 00:11:11.250 that jumped out at me because I remembered from 00:11:11.250 --> 00:11:13.909 a report from the International Consortium of 00:11:13.909 --> 00:11:16.529 Investigative Journalists. They had said that 00:11:16.529 --> 00:11:19.850 Christie had gone to an aviation conference at 00:11:19.850 --> 00:11:24.169 a hotel in Egypt in 2019. And in one of these 00:11:24.169 --> 00:11:27.350 reviews is Christopher Vincent, Google reviewer, 00:11:27.370 --> 00:11:29.970 and explicitly said, I was here at this same 00:11:29.970 --> 00:11:33.769 hotel as reported by the ICIJ for the global 00:11:33.769 --> 00:11:36.350 humanitarian aviation conference. So this is 00:11:36.350 --> 00:11:39.009 the very same conference that Christie Kinnon 00:11:39.009 --> 00:11:42.629 was pictured at. So that's when I sat up and 00:11:42.629 --> 00:11:44.429 go, Oh God, this, this, you know, this has to 00:11:44.429 --> 00:11:48.549 be him. So then, um, that's, that's essentially 00:11:48.549 --> 00:11:51.250 when, when, when you got involved with Bancat 00:11:51.250 --> 00:11:53.389 and we did, we started this collaboration with 00:11:53.389 --> 00:11:56.350 John at the Sunday Times. We just dove into this 00:11:56.350 --> 00:11:59.610 profile and we tried to, uh, you know, get every 00:11:59.610 --> 00:12:01.889 detail we could out of it. So as I said, there 00:12:01.889 --> 00:12:03.789 was over a thousand photos. So one of the first 00:12:03.789 --> 00:12:05.769 things we wanted to do was go through all those 00:12:05.769 --> 00:12:09.919 photos. and see what we could find in them. Because 00:12:09.919 --> 00:12:13.759 in a lot of these reviews, he mentions a business 00:12:13.759 --> 00:12:16.720 meetings and things like that. So we were curious 00:12:16.720 --> 00:12:19.659 to see if we could spot any of the people he's 00:12:19.659 --> 00:12:21.960 potentially with, or you can see a reflection 00:12:21.960 --> 00:12:24.799 of the man himself. Just to further corroborate, 00:12:24.840 --> 00:12:27.559 this is the actual same guy. So there were a 00:12:27.559 --> 00:12:31.419 few reflections in the picture. because we're 00:12:31.419 --> 00:12:33.820 watching the stream. There's one where he's in 00:12:33.820 --> 00:12:36.299 a hotel in Spain and he's taken a picture of 00:12:36.299 --> 00:12:38.899 the bathroom for some reason. And you could see 00:12:38.899 --> 00:12:40.379 in the corner, there's a mirror and you could 00:12:40.379 --> 00:12:43.879 see just half of his face there. And another 00:12:43.879 --> 00:12:47.200 one at the end, at the end of a hall, there's 00:12:47.200 --> 00:12:49.019 a mirror. You can see, you can see him in the 00:12:49.019 --> 00:12:52.700 reflection again. And I think this one is the 00:12:52.700 --> 00:12:55.500 key one really, where you can kind of see his 00:12:55.500 --> 00:13:00.360 face. It's kind of faint on the picture, but 00:13:00.360 --> 00:13:02.259 if you look closely, you can see it's really 00:13:02.259 --> 00:13:05.580 him. So they were the first, uh, the first key 00:13:05.580 --> 00:13:08.200 things that we found those reflections that were 00:13:08.200 --> 00:13:10.279 corroborating. This was his accounts once it, 00:13:10.360 --> 00:13:13.720 once again. So then, uh, another thing we wanted 00:13:13.720 --> 00:13:17.000 to do was, uh, go through, we had the idea to 00:13:17.000 --> 00:13:19.519 go through, uh, the social media of these places 00:13:19.519 --> 00:13:21.799 he'd been visiting to see if anyone else had 00:13:21.799 --> 00:13:24.360 taken pictures on the same day he was there to 00:13:24.360 --> 00:13:27.090 maybe see again who he'd been meeting. And we 00:13:27.090 --> 00:13:29.090 didn't really have much luck with that except 00:13:29.090 --> 00:13:32.649 for this one restaurant in Dubai. This is one 00:13:32.649 --> 00:13:35.110 of the last places he reviewed on his profile 00:13:35.110 --> 00:13:40.370 in March, 2023. And yeah, so he said the food 00:13:40.370 --> 00:13:42.289 was good. I'm definitely, definitely going to 00:13:42.289 --> 00:13:45.610 come back. And then apparently he did because 00:13:45.610 --> 00:13:48.269 a couple of months later, the restaurant itself 00:13:48.269 --> 00:13:51.590 posted a picture onto its own social media. And 00:13:51.590 --> 00:13:53.870 in the background, you could see Christie talking 00:13:53.870 --> 00:13:57.889 to his son. Christopher Kinnon Jr. And I believe 00:13:57.889 --> 00:13:59.889 this is the first picture of Christopher Jr. 00:14:00.110 --> 00:14:04.370 that had come out since maybe 2016. So yeah, 00:14:04.370 --> 00:14:06.629 he was meeting with him on that day for whatever 00:14:06.629 --> 00:14:09.049 reason. And at this point, both of them were 00:14:09.049 --> 00:14:11.009 sanctioned by the US government and they had 00:14:11.009 --> 00:14:14.509 a $5 million reward on their heads. So yeah. 00:14:15.129 --> 00:14:18.490 And then just to further verify as much as possible 00:14:18.490 --> 00:14:21.110 that this account, this Google account was his. 00:14:21.970 --> 00:14:24.929 We thought it was important to somehow connect 00:14:25.100 --> 00:14:27.659 the email address behind that account to this 00:14:27.659 --> 00:14:30.960 Google review profile. And there's no way you 00:14:30.960 --> 00:14:33.340 can do that just from the profile itself. It's 00:14:33.340 --> 00:14:35.419 not public information, but if you already have 00:14:35.419 --> 00:14:38.720 the email address, there are ways to find the 00:14:38.720 --> 00:14:40.759 Google review account connected to that address. 00:14:41.580 --> 00:14:43.639 So what we, what we tried to do was find any 00:14:43.639 --> 00:14:46.360 possible address that was connected to Christopher, 00:14:46.399 --> 00:14:48.440 Christopher Kenyon, Christopher Vincent under 00:14:48.440 --> 00:14:51.100 his alias and see if they were attached to any 00:14:51.100 --> 00:14:53.309 review profiles. And the way we did this was 00:14:53.309 --> 00:14:56.549 by going through social media and all these websites 00:14:56.549 --> 00:14:58.809 he'd set up under his alias Christopher Vincent 00:14:58.809 --> 00:15:02.409 and finding any email address we could that we 00:15:02.409 --> 00:15:05.450 could then link to a potential Google review 00:15:05.450 --> 00:15:07.830 account. And there was one email address hidden 00:15:07.830 --> 00:15:10.450 in the source code of this particular website, 00:15:10.769 --> 00:15:13.529 ChristopherVincent .com. And we could run that 00:15:13.529 --> 00:15:18.269 through a tool called G Hunt, which is an open 00:15:18.269 --> 00:15:23.070 source tool. to find if a specific Gmail address 00:15:23.070 --> 00:15:25.870 is linked to a Google review account. There's 00:15:25.870 --> 00:15:27.669 other tools you can use for this like Epios, 00:15:28.710 --> 00:15:31.250 but this one I like to use it's open source. 00:15:32.070 --> 00:15:35.110 So that's what we did here. This Gmail address 00:15:35.110 --> 00:15:37.990 we found in the source code, put it through G 00:15:37.990 --> 00:15:41.090 Hunt and we found that it was connected to the 00:15:41.090 --> 00:15:44.529 Google review account. So then we had his Gmail 00:15:44.529 --> 00:15:46.750 address. So then another thing we could do with 00:15:46.750 --> 00:15:49.750 that was and search it through Whois records, 00:15:49.950 --> 00:15:52.649 which are basically website ownership records. 00:15:53.309 --> 00:15:56.250 And there are some tools you can use online to 00:15:56.250 --> 00:15:58.929 search for email addresses or specific keywords 00:15:58.929 --> 00:16:01.990 in Whois records to see if they've ever been 00:16:01.990 --> 00:16:05.470 attached to a website that was registered. And 00:16:05.470 --> 00:16:08.529 this Gmail address that we found was indeed attached 00:16:08.529 --> 00:16:12.509 to one website that was registered in 2013. And 00:16:12.509 --> 00:16:14.809 we found in the Whois details, the registrant 00:16:14.809 --> 00:16:17.639 name was Christopher Vincent Kinehan. And the 00:16:17.639 --> 00:16:20.419 address was an address in Spain, which was also 00:16:20.419 --> 00:16:22.600 listed in the sanctions from the United States. 00:16:23.220 --> 00:16:25.799 So that was kind of solidifying that link through 00:16:25.799 --> 00:16:29.440 open sources to this Google account, just to 00:16:29.440 --> 00:16:32.860 make sure that we had covered every avenue to 00:16:32.860 --> 00:16:34.539 make sure that this was actually his account. 00:16:35.340 --> 00:16:37.899 So yeah, that was basically it. Just the main 00:16:37.899 --> 00:16:40.240 resources we used during this was Outscraper. 00:16:40.840 --> 00:16:43.639 That's a service you can use to scrape Google 00:16:43.639 --> 00:16:46.539 reviews and get them into spreadsheet form, which 00:16:46.539 --> 00:16:52.320 was just incredibly useful for us. It's premium 00:16:52.320 --> 00:16:54.200 usually, but there's a free tier that you can 00:16:54.200 --> 00:16:57.320 use. Also some Python scripts that were used 00:16:57.320 --> 00:17:00.480 for scraping too. I'm terrible at coding, but 00:17:00.480 --> 00:17:05.079 I use Chat GPT for that. or the WhoisRecord searches, 00:17:05.400 --> 00:17:09.039 I used WhoisXNLAPI and then Gnont, of course. 00:17:10.539 --> 00:17:13.779 And so that was the first investigation we did 00:17:13.779 --> 00:17:19.500 last year. And then just last month, we did another 00:17:19.500 --> 00:17:22.079 collaboration with Bellingcat in the Sunday Times. 00:17:22.779 --> 00:17:27.599 So this was on a German businessman called Oliver 00:17:27.599 --> 00:17:32.269 Herrmann. So he had managed to get himself arrested 00:17:32.269 --> 00:17:36.609 in Australia just at the end of last year. Him 00:17:36.609 --> 00:17:39.750 and another guy were arrested in a hotel in Perth 00:17:39.750 --> 00:17:42.109 and they found 200 kilograms of cocaine in their 00:17:42.109 --> 00:17:45.049 hotel rooms, along with night vision goggles 00:17:45.049 --> 00:17:47.569 and aviation equipment. And according to police, 00:17:47.609 --> 00:17:50.789 what happened was this guy Oliver had gone to 00:17:50.789 --> 00:17:53.089 a remote airstrip about seven hours drive from 00:17:53.089 --> 00:17:56.089 Perth. The next day he came back and he was arrested 00:17:56.089 --> 00:17:59.670 with his with his companion with all the cocaine. 00:18:00.549 --> 00:18:03.329 So that was reported in the media in Australia. 00:18:03.549 --> 00:18:06.190 And this guy, Oliver, he had kind of come on 00:18:06.190 --> 00:18:08.450 our radar last year around the time of the Kenyan 00:18:08.450 --> 00:18:10.450 investigation, but it never really went anywhere. 00:18:11.390 --> 00:18:14.250 But then when the media reported about this in 00:18:14.250 --> 00:18:17.410 January in Australia, we kind of took notice. 00:18:17.750 --> 00:18:22.250 And then John over at the Times, he did an article 00:18:22.250 --> 00:18:25.390 on this as well in January, talking about his 00:18:25.390 --> 00:18:28.099 alleged links to the Kenyan cartel. And that 00:18:28.099 --> 00:18:30.500 he had close financial ties to Christie Kinnon. 00:18:31.220 --> 00:18:35.599 So after that, what we wanted to do in our companion 00:18:35.599 --> 00:18:38.980 piece with the only times and delicate was just 00:18:38.980 --> 00:18:42.220 map out his online footprint, the companies he's 00:18:42.220 --> 00:18:45.240 involved with and see if there's anything open 00:18:45.240 --> 00:18:47.980 source out there that lines up with anything 00:18:47.980 --> 00:18:51.019 related to the Canadian cartel. So yeah, just 00:18:51.019 --> 00:18:54.390 to So the key thing with that was his Strava 00:18:54.390 --> 00:18:56.769 profile, Oliver Herman's Strava profile. So he's 00:18:56.769 --> 00:19:00.210 an avid runner. He won the Munich marathon in 00:19:00.210 --> 00:19:04.670 2016 and we were able to find his Strava profile. 00:19:04.809 --> 00:19:07.269 This is my colleague Peter Barth found this actually. 00:19:08.269 --> 00:19:12.690 And yeah, so, you know, he even logged his Munich 00:19:12.690 --> 00:19:15.829 marathon winning run on Strava and we were able 00:19:15.829 --> 00:19:17.549 to confirm it was his because there was pictures 00:19:17.549 --> 00:19:21.710 of him on it. And so yeah, over a 10 year period, 00:19:21.809 --> 00:19:25.630 he had logged like 5 ,000 runs all over the world. 00:19:27.470 --> 00:19:31.990 Like in New York, in South of Africa, Asia, lots 00:19:31.990 --> 00:19:33.890 of them in Dublin as well, because he was involved 00:19:33.890 --> 00:19:38.450 in an Irish company called Levers. And yeah, 00:19:38.509 --> 00:19:40.930 so what we did was we mapped out all these runs 00:19:40.930 --> 00:19:45.309 on a custom Google map. And then we also put 00:19:45.309 --> 00:19:48.490 Christy Kinnahan's Google review points on the 00:19:48.490 --> 00:19:50.990 same map. So we could basically see at a glance 00:19:50.990 --> 00:19:54.329 if any of these places lined up. So that's what 00:19:54.329 --> 00:19:56.109 we probably did to start with. I'm trying a couple 00:19:56.109 --> 00:20:00.529 of places that did. So this is one example. In 00:20:00.529 --> 00:20:04.029 2019, Christy Kinnahan said in a Google review 00:20:04.029 --> 00:20:09.309 that he went to a business conference in Harare. 00:20:09.589 --> 00:20:13.289 on a specific date. And just the day before this 00:20:13.289 --> 00:20:17.269 conference was happening, Herman was doing it. 00:20:17.289 --> 00:20:19.230 He logged the Strava run just five kilometers 00:20:19.230 --> 00:20:22.369 away. So like he's in the same vicinity as Kinnon 00:20:22.369 --> 00:20:25.990 at this point. Another one was in Dubai. He logged 00:20:25.990 --> 00:20:28.369 a run just that started and ended outside this 00:20:28.369 --> 00:20:31.630 specific hotel. And just a few days later, Daniel 00:20:31.630 --> 00:20:34.789 Kinnon was pictured in a tweet at the exact same 00:20:34.789 --> 00:20:37.789 hotel. But we were able to relocate this picture 00:20:37.789 --> 00:20:41.049 that was posted on social media. of Daniel Kenham 00:20:41.049 --> 00:20:43.670 meeting someone else and ensure that it was the 00:20:43.670 --> 00:20:46.109 same hotel where Herman's run started and ended. 00:20:46.789 --> 00:20:49.089 So again, just two different things in different 00:20:49.089 --> 00:20:53.789 countries lining up. We were also able to identify 00:20:53.789 --> 00:20:56.589 his domestic partner through her Strava. We could 00:20:56.589 --> 00:20:59.609 see that their bonds overlapped over multiple 00:20:59.609 --> 00:21:03.289 years. And she herself was also involved in a 00:21:03.289 --> 00:21:06.829 series of companies. One of these was 247 Capital 00:21:06.829 --> 00:21:10.069 Group. This is a South African company. And, 00:21:10.150 --> 00:21:12.829 um, and then we could check and yeah, so on, 00:21:12.930 --> 00:21:15.509 on the website of this company, uh, one of the 00:21:15.509 --> 00:21:17.430 addresses, the office addresses was for this 00:21:17.430 --> 00:21:21.069 building in Johannesburg. Um, and, and bringing 00:21:21.069 --> 00:21:23.269 back into Google, Google reviews, once again, 00:21:23.549 --> 00:21:25.990 Christie Kinnon had reviewed this specific building 00:21:25.990 --> 00:21:28.750 and he'd taken multiple pictures inside. And 00:21:28.750 --> 00:21:30.730 the department also had logged a couple of runs 00:21:30.730 --> 00:21:33.710 starting and ending at this building. And so 00:21:33.710 --> 00:21:36.190 this is one of the pictures here. For those of 00:21:36.190 --> 00:21:38.210 you who are in the audience right now, this is 00:21:38.210 --> 00:21:40.890 one of the pictures that Kenan posted on this 00:21:40.890 --> 00:21:43.650 specific Google review. You can see in the reflection, 00:21:43.990 --> 00:21:47.670 he's in a floor of the building that's still 00:21:47.670 --> 00:21:50.750 in construction. And it looks like he's a reflection. 00:21:50.890 --> 00:21:52.690 You can see, it looks like a couple of other 00:21:52.690 --> 00:21:57.609 people. So yeah. And then apart from that, just 00:21:57.609 --> 00:21:59.549 to, I won't cut too much into the weeds, but. 00:22:00.650 --> 00:22:04.690 We did some IP address tracking between this 00:22:04.690 --> 00:22:07.750 South African company, 247 Capital, and two other 00:22:07.750 --> 00:22:11.069 companies, one of them based in the United States, 00:22:11.230 --> 00:22:14.670 another one based in Indonesia. And yeah, it 00:22:14.670 --> 00:22:17.569 turned out this company, Ryba LLC, that was on 00:22:17.569 --> 00:22:21.089 the same IP address, John Looney over at the 00:22:21.089 --> 00:22:24.049 Times, they reported that this was actually the 00:22:24.049 --> 00:22:26.930 same company that received a payment for a connect 00:22:26.930 --> 00:22:30.019 and linked transaction. So again, we're just 00:22:30.019 --> 00:22:32.279 finding open source things that are lining up 00:22:32.279 --> 00:22:36.619 with other reports. And then this is just a diagram 00:22:36.619 --> 00:22:39.940 showing the links between the websites and how 00:22:39.940 --> 00:22:42.500 we are kind of wrong rated. There wasn't some 00:22:42.500 --> 00:22:45.019 kind of coincidence because if you find websites 00:22:45.019 --> 00:22:47.440 on the same IP address, it doesn't necessarily 00:22:47.440 --> 00:22:49.920 mean they're linked, but what we thought was 00:22:49.920 --> 00:22:52.420 important that you just need to find that other 00:22:52.420 --> 00:22:55.200 data point that links them together. So we were 00:22:55.200 --> 00:22:57.299 able to do that through addresses on the websites 00:22:57.299 --> 00:23:00.480 and that were linked with other addresses on 00:23:00.480 --> 00:23:03.460 the different websites. Again, I won't get into 00:23:03.460 --> 00:23:06.720 the weeds with that. And then, yeah, so then 00:23:06.720 --> 00:23:09.680 the last thing was this third company that was 00:23:09.680 --> 00:23:12.319 on the same IP address. We found it listed on 00:23:12.319 --> 00:23:15.900 FAA records for an aircraft that was exported 00:23:15.900 --> 00:23:19.740 from the United States to Karari just last year. 00:23:20.240 --> 00:23:22.539 And it's been pretty active in the region since 00:23:22.539 --> 00:23:25.240 then, flying to a lot of minor airports in South 00:23:25.240 --> 00:23:28.799 Africa. I think it's been Completely complete 00:23:28.799 --> 00:23:31.079 radio silence since our articles come out, but 00:23:31.079 --> 00:23:34.859 yeah. Um, yeah, that's basically it. Uh, just 00:23:34.859 --> 00:23:38.200 to end on like with an investigation like this, 00:23:38.299 --> 00:23:40.859 there's a lot of, it's kind of hard to describe, 00:23:40.859 --> 00:23:43.720 uh, coherent thing because, um, there's a lot 00:23:43.720 --> 00:23:46.500 of levels to it. You know, there's kind of a 00:23:46.500 --> 00:23:48.779 middle man, there's, um, you know, addresses 00:23:48.779 --> 00:23:51.759 and IP addresses and it's probably by design. 00:23:52.349 --> 00:23:54.950 But so to keep track of this in investigation, 00:23:55.170 --> 00:23:58.230 I think it's good to use visualizations. And 00:23:58.230 --> 00:24:00.589 that's what we did with this. So the whole time 00:24:00.589 --> 00:24:04.950 we were doing this, we were using OCCRP's Aleph. 00:24:05.289 --> 00:24:08.730 It's a tool that allows you to make network visualizations. 00:24:09.250 --> 00:24:10.950 Unfortunately, it's only available for journalists, 00:24:11.170 --> 00:24:13.269 but there are other tools you can use like draw 00:24:13.269 --> 00:24:17.809 .io or Obsidian. But yeah, it's just good to 00:24:17.809 --> 00:24:19.690 do that, to just keep track of everything, because 00:24:19.690 --> 00:24:21.650 it's like when you see it written down, it's 00:24:21.650 --> 00:24:25.730 just like a wall of text. So yeah, that's it. 00:24:27.210 --> 00:24:30.150 So yeah, unless John has anything else to add, 00:24:31.190 --> 00:24:34.430 take some questions. Yeah, I think it's really 00:24:34.430 --> 00:24:38.150 important like that. But certainly my experience 00:24:38.150 --> 00:24:40.910 of the collaboration with Bellingcat is that 00:24:40.910 --> 00:24:43.190 I'm involved in a certain type of work. So I 00:24:43.190 --> 00:24:45.690 deal with a lot of people passing me information 00:24:45.690 --> 00:24:49.329 that are not permitted to do so. We deal with 00:24:49.329 --> 00:24:51.849 a lot of people with information who pass it 00:24:51.849 --> 00:24:55.410 on. And with Oliver Herman's story, it was really 00:24:55.410 --> 00:24:57.869 interesting. He was identified to me a number 00:24:57.869 --> 00:25:02.109 of years ago as someone who was potentially linked 00:25:02.109 --> 00:25:07.250 in to this type of activity with Kinnahan. And 00:25:07.250 --> 00:25:10.089 in our job, we have to be extraordinarily careful 00:25:10.089 --> 00:25:13.509 because people involved in crime meet people. 00:25:13.640 --> 00:25:16.519 that aren't involved in crime. And you have to 00:25:16.519 --> 00:25:19.480 be very careful to assess what you're being told 00:25:19.480 --> 00:25:21.839 to consider it and be very contemplative about 00:25:21.839 --> 00:25:25.200 it. Because sometimes people don't know who they're 00:25:25.200 --> 00:25:27.619 dealing with. They might know who they're dealing 00:25:27.619 --> 00:25:29.920 with, but they're not necessarily involved themselves. 00:25:30.079 --> 00:25:33.200 And there can be a multitude of reasons why people 00:25:33.200 --> 00:25:37.279 don't distance themselves from people like Christopher 00:25:37.279 --> 00:25:43.630 Kinnon. So we began After Oliver Herman was identified, 00:25:44.849 --> 00:25:48.369 we took the best approach, which is to do nothing, 00:25:48.869 --> 00:25:51.470 to examine him, look at him and take deep dives 00:25:51.470 --> 00:25:55.049 into this guy to see who he was. And the real 00:25:55.049 --> 00:25:58.490 point in doing an investigation is not just to 00:25:58.490 --> 00:26:01.150 prove someone's involvement in something, but 00:26:01.150 --> 00:26:03.690 it can also be to disprove their involvement 00:26:03.690 --> 00:26:07.180 or knowledge of certain events. So we looked 00:26:07.180 --> 00:26:10.819 at this guy, there's a team of us, it's about 00:26:10.819 --> 00:26:14.579 four people, three of those people are a Bellingcat 00:26:14.579 --> 00:26:17.839 and then there's me. And we just sat it out. 00:26:18.559 --> 00:26:22.539 And I think it was about Christmas time last 00:26:22.539 --> 00:26:27.720 year that the name Oliver Herman pinged from 00:26:27.720 --> 00:26:31.220 Australia. And the Australian federal police 00:26:31.220 --> 00:26:35.819 were describing this individual as a South African 00:26:35.819 --> 00:26:41.279 national. And I remember hearing this and the 00:26:41.279 --> 00:26:45.099 details matched the guy that we were interested 00:26:45.099 --> 00:26:47.299 in and there was a bit of discussion amongst 00:26:47.299 --> 00:26:49.559 ourselves, but we eventually had to get someone 00:26:49.559 --> 00:26:52.720 to walk into an arraignment hearing to make sure 00:26:52.720 --> 00:26:55.940 it was our guy. And I think at that stage, when 00:26:55.940 --> 00:26:58.180 we started making more inquiries, the Australian 00:26:58.180 --> 00:27:00.460 federal police discovered that this man that 00:27:00.460 --> 00:27:03.940 they had in custody who is, it should be stated, 00:27:04.299 --> 00:27:06.519 only facing charges, he hasn't been found guilty 00:27:06.519 --> 00:27:10.279 of anything, was actually a Swiss -German national 00:27:10.279 --> 00:27:13.420 and he wasn't South African. And we took it from 00:27:13.420 --> 00:27:16.640 there. But the real reason why I tell that story 00:27:16.640 --> 00:27:19.220 is that the real beauty of the collaboration 00:27:19.220 --> 00:27:23.039 is using every conceivable type of investigative 00:27:23.039 --> 00:27:27.970 method, such as old -fashioned intelligence collection 00:27:27.970 --> 00:27:32.450 by investigative journalists with open source 00:27:32.450 --> 00:27:34.970 investigation and analysis with the guys from 00:27:34.970 --> 00:27:38.029 Bellingcat. And certainly it's been my experience 00:27:38.029 --> 00:27:42.309 that that system and that way of going about 00:27:42.309 --> 00:27:47.009 things, it's a pretty lethal and effective technique 00:27:47.009 --> 00:27:50.250 when it gets going. I always kind of think of 00:27:50.250 --> 00:27:52.349 some of the guys from Bellingcat as being a bit 00:27:52.349 --> 00:27:56.069 like piranhas. that when they sent blood, it's 00:27:56.069 --> 00:27:58.990 like they'll really get down to the bones of 00:27:58.990 --> 00:28:01.230 everything and they do a really, really fine 00:28:01.230 --> 00:28:03.710 job. And if we could take this opportunity to 00:28:03.710 --> 00:28:07.349 yet again, thank the team from Bellingcat for 00:28:07.349 --> 00:28:10.210 this collaboration, but it really has been phenomenal 00:28:10.210 --> 00:28:13.849 from my point of view and the way we collaborate 00:28:13.849 --> 00:28:17.470 and the way we work against each other. and help 00:28:17.470 --> 00:28:20.390 each other and that kind of thing. It really 00:28:20.390 --> 00:28:24.789 is fantastic, but it is really also effective 00:28:24.789 --> 00:28:28.869 and it can really produce startling results. 00:28:29.289 --> 00:28:33.150 But I mean, I can't really overstate the security 00:28:33.150 --> 00:28:37.049 precautions that the Kinnon Cartel use. And yet 00:28:37.049 --> 00:28:41.569 Connor, with his pesky mind, was able to uncover 00:28:41.569 --> 00:28:44.829 this treasure trove of information about Christie 00:28:44.829 --> 00:28:48.980 Kinnon. which completely startled everyone, including, 00:28:48.980 --> 00:28:53.259 should I say, various elements of international 00:28:53.259 --> 00:28:57.480 policing who hadn't noticed this or they hadn't 00:28:57.480 --> 00:29:01.220 found this and whatever. So it's been really, 00:29:01.220 --> 00:29:05.660 really effective and it's made the cartel itself 00:29:05.660 --> 00:29:09.819 pause for thought in terms of the way they behave 00:29:09.819 --> 00:29:12.160 in their own infosec security and that kind of 00:29:12.160 --> 00:29:14.710 thing. And also the trail of evidence they've 00:29:14.710 --> 00:29:17.769 led behind, because all sorts of people have 00:29:17.769 --> 00:29:20.589 popped up in this. And I'm sure Connor won't 00:29:20.589 --> 00:29:23.589 mind me saying that that project is still running 00:29:23.589 --> 00:29:26.490 and we have meetings every so often about this 00:29:26.490 --> 00:29:29.789 and we chase down different leads and run down 00:29:29.789 --> 00:29:34.849 clues, et cetera. And that is continuing to produce 00:29:34.849 --> 00:29:37.710 quite startling results, which I hope that someday 00:29:37.710 --> 00:29:41.039 we'll be able to publish more about. Amazing. 00:29:41.200 --> 00:29:44.000 Thank you so much, both of you, for talking about 00:29:44.000 --> 00:29:46.339 the investigations. John, you actually touched 00:29:46.339 --> 00:29:48.579 on something I wanted to ask you about before 00:29:48.579 --> 00:29:51.980 we go to questions from the audience. I wanted 00:29:51.980 --> 00:29:55.019 to ask, because a lot of our community here are 00:29:55.019 --> 00:29:57.400 also interested in doing investigations themselves, 00:29:57.839 --> 00:30:01.539 how do you prepare to report on such a prolific 00:30:01.539 --> 00:30:05.380 criminal group like this? What precautions have 00:30:05.380 --> 00:30:09.069 you both taken? And what needs to be put into 00:30:09.069 --> 00:30:12.029 place when you start looking into criminal groups 00:30:12.029 --> 00:30:17.109 like this? So I think digitally it's not so much 00:30:17.109 --> 00:30:19.750 a problem unless they detect that someone's looking 00:30:19.750 --> 00:30:23.430 at them. So obviously if you're onto a social 00:30:23.430 --> 00:30:26.230 media account and you're looking at it continuously, 00:30:28.170 --> 00:30:31.490 algorithms can kind of disclose your interest 00:30:31.490 --> 00:30:34.769 in them if your own profile starts popping up. 00:30:34.950 --> 00:30:38.160 And it's my experience. is that when people see 00:30:38.160 --> 00:30:40.440 things like that, they become a little bit more 00:30:40.440 --> 00:30:45.460 wary. Dealing with people involved in this in, 00:30:45.460 --> 00:30:47.779 I suppose, real life and going out and meeting 00:30:47.779 --> 00:30:51.460 them. I personally, I've had problems in the 00:30:51.460 --> 00:30:55.380 past. I haven't had problems with this particular 00:30:55.380 --> 00:30:59.859 investigation, but I always kind of tell people 00:30:59.859 --> 00:31:03.359 when they're dealing with this, with these kinds 00:31:03.359 --> 00:31:07.259 of matters. to kind of act professionally, never 00:31:07.259 --> 00:31:11.519 get personal, never ever get personal, always 00:31:11.519 --> 00:31:14.720 greet people with respect. I think if, you know, 00:31:14.720 --> 00:31:18.539 I don't believe in, for example, you know, just 00:31:18.539 --> 00:31:20.819 kind of confronting people or something like 00:31:20.819 --> 00:31:25.119 that, that never type kinds of works. So I've 00:31:25.119 --> 00:31:30.940 always kind of taken a very pragmatic and just 00:31:30.940 --> 00:31:35.950 really open and transparent approach when we're 00:31:35.950 --> 00:31:39.069 looking at someone. It should be stated by the 00:31:39.069 --> 00:31:42.970 time it gets to the stage where we're approaching 00:31:42.970 --> 00:31:45.369 someone for comment. And indeed on these stories, 00:31:45.450 --> 00:31:48.309 we already know the answers to everything we're 00:31:48.309 --> 00:31:52.369 asking. I think there's a lot of misconceptions 00:31:52.369 --> 00:31:56.130 about investigative journalism and that kind 00:31:56.130 --> 00:31:58.190 of thing. I think that really when you're getting 00:31:58.190 --> 00:31:59.730 into the stage where you're seeking comment, 00:31:59.980 --> 00:32:02.599 You know, I'm always delighted to be able to 00:32:02.599 --> 00:32:05.160 approach solicitors. I'm always very polite. 00:32:05.380 --> 00:32:07.599 I always give people a lot of time to respond 00:32:07.599 --> 00:32:11.039 and engage with them. And, you know, like my 00:32:11.039 --> 00:32:14.900 own work is focused on organized crime, terrorism 00:32:14.900 --> 00:32:19.299 and national security threat actors. And, you 00:32:19.299 --> 00:32:23.920 know, you certainly will draw attention on yourself 00:32:23.920 --> 00:32:26.670 in so far as particularly if it's a a state actor, 00:32:26.849 --> 00:32:28.410 they have the ability to look at what you're 00:32:28.410 --> 00:32:31.569 doing in a way that other people can't. Some 00:32:31.569 --> 00:32:35.130 criminal groups can do, but I always think the 00:32:35.130 --> 00:32:37.430 best way of handling these things is really in 00:32:37.430 --> 00:32:40.390 an open and transparent way. And it should be 00:32:40.390 --> 00:32:46.559 stated that the team that looked at the Kinnon 00:32:46.559 --> 00:32:50.880 cartel for these investigations, we always operated 00:32:50.880 --> 00:32:55.220 in a way that would plaster if anyone lodged 00:32:55.220 --> 00:32:59.099 a legal complaint or complained about anything 00:32:59.099 --> 00:33:02.779 we wrote. And so far as that, even the Kinnon 00:33:02.779 --> 00:33:05.680 who are some of the most wanted people on the 00:33:05.680 --> 00:33:08.339 face of the planet, we went through enormous 00:33:08.339 --> 00:33:11.140 lengths to try to communicate with them, to give 00:33:11.140 --> 00:33:13.859 them an opportunity to respond to what we were 00:33:13.859 --> 00:33:19.150 saying. and went to great lengths to do that. 00:33:20.230 --> 00:33:23.769 And just in case there was something wrong or 00:33:23.769 --> 00:33:27.269 we had made an error or something like that. 00:33:27.470 --> 00:33:30.150 And that's a principle that if you stick to it, 00:33:30.390 --> 00:33:32.390 regardless of deadlines and everything else, 00:33:32.650 --> 00:33:36.269 it will serve you well in the long run. Absolutely. 00:33:36.470 --> 00:33:40.509 Right of replies are more important than just 00:33:40.509 --> 00:33:43.170 giving the person opportunity to respond. It's 00:33:43.170 --> 00:33:46.250 also saving your own back as well, a little bit. 00:33:47.049 --> 00:33:50.509 I wanted to ask some of the audience questions, 00:33:51.289 --> 00:33:53.410 and I'm going to combine the two of them because 00:33:53.410 --> 00:33:56.730 one's quite short. Primal Collective asks, how 00:33:56.730 --> 00:33:59.329 long did all of this research take? And then 00:33:59.329 --> 00:34:02.529 Connor, maybe you could answer. Pika Boodle's 00:34:02.529 --> 00:34:05.410 101's question, which is how do you both go about 00:34:05.410 --> 00:34:07.509 linking up together to work on this? Is it a 00:34:07.509 --> 00:34:09.570 case of reaching out to see if the times are 00:34:09.570 --> 00:34:12.030 interested in joining or what kind of steps are 00:34:12.030 --> 00:34:14.030 involved in the collaboration? So first, how 00:34:14.030 --> 00:34:16.690 long did all the research take and two, how did 00:34:16.690 --> 00:34:21.190 you end up collaborating? Yeah, so it took months. 00:34:22.570 --> 00:34:24.570 If we're talking about, yeah, each of the investigations 00:34:24.570 --> 00:34:30.789 took months, especially the Canon reviews. Initially, 00:34:31.210 --> 00:34:35.489 when I found the the review profile, I spent 00:34:35.489 --> 00:34:38.130 a good bit of time trying to verify it myself. 00:34:38.130 --> 00:34:41.349 And then when I approached Bellingcat at that 00:34:41.349 --> 00:34:43.869 point, I think it was about maybe six months 00:34:43.869 --> 00:34:46.469 or five or six months from that point until it 00:34:46.469 --> 00:34:48.949 was eventually published. So, yeah, it was it 00:34:48.949 --> 00:34:51.429 was months, months and months of work into this. 00:34:52.250 --> 00:34:55.900 And same with the The more recent one, it was 00:34:55.900 --> 00:34:59.099 also months. Yeah. So we put a lot of effort 00:34:59.099 --> 00:35:03.179 into just trying to make sure there was no stone 00:35:03.179 --> 00:35:06.940 unturned. And yeah, was there another question? 00:35:07.159 --> 00:35:09.980 I've forgotten. How do we meet up and how do 00:35:09.980 --> 00:35:12.460 we arrange this? Sorry. Yeah. Yeah. Yeah. So 00:35:12.460 --> 00:35:16.480 like, originally our work was I kind of pitched 00:35:16.480 --> 00:35:19.079 this to like, I was just like freelance at the 00:35:19.079 --> 00:35:22.139 time. I just pitched this to Bellingcat and then 00:35:22.139 --> 00:35:26.159 they, They reached out to John over the times 00:35:26.159 --> 00:35:31.320 because just to have someone with the incredible 00:35:31.320 --> 00:35:34.219 experience John does to work with this on us, 00:35:34.679 --> 00:35:38.500 because yeah, I think Benneke hadn't really done 00:35:38.500 --> 00:35:41.699 that much recent stuff on cartels in general. 00:35:42.019 --> 00:35:44.039 So they just wanted to have like a veteran in 00:35:44.039 --> 00:35:47.719 with us to work on the project together. So yeah, 00:35:47.860 --> 00:35:52.039 I believe that's how it started. There's Connor 00:35:52.039 --> 00:35:54.800 calling me a veteran again. I feel very uneasy 00:35:54.800 --> 00:36:00.500 with this. You're an expert. That's what you 00:36:00.500 --> 00:36:04.500 are. You're an expert. Don't worry. We've got 00:36:04.500 --> 00:36:08.380 another few questions coming through. Scoot asked, 00:36:08.719 --> 00:36:11.880 what first led you to the LinkedIn profile for 00:36:11.880 --> 00:36:14.039 Christopher Vincent? Did you have some hunch 00:36:14.039 --> 00:36:16.199 he was going by that name and thought you'd poke 00:36:16.199 --> 00:36:20.519 around? What kind of gave you that? Sorry. Yeah, 00:36:20.519 --> 00:36:23.280 that was, um, yeah, that was a report that was 00:36:23.280 --> 00:36:25.000 in the news. So that had already been found. 00:36:25.059 --> 00:36:27.039 That was out there and just, you know, I'm Irish 00:36:27.039 --> 00:36:30.079 myself. So I know of the Guinness sometimes I 00:36:30.079 --> 00:36:32.119 just read about this stuff and I just came across 00:36:32.119 --> 00:36:35.179 it one day and I just started Googling. And so, 00:36:35.320 --> 00:36:36.820 yeah, that was, that was originally reported 00:36:36.820 --> 00:36:38.940 that was out there. Like I didn't, I didn't find 00:36:38.940 --> 00:36:41.519 that particular thing myself. Um, that was kind 00:36:41.519 --> 00:36:45.199 of the starting point. The starting point to 00:36:45.199 --> 00:36:47.820 it all. Sarah asked, one of our lovely mods, 00:36:48.320 --> 00:36:50.320 she actually asked, what was the most entertaining, 00:36:50.659 --> 00:36:54.840 interesting review from the Kinahams? I'm sure 00:36:54.840 --> 00:37:01.539 John has his own as well, but the one that comes 00:37:01.539 --> 00:37:04.619 to mind for me is he went to, I think it was 00:37:04.619 --> 00:37:07.579 a cafe or something in Dubai and he starts getting 00:37:07.579 --> 00:37:10.320 annoyed because one of the waitress keeps calling 00:37:10.320 --> 00:37:13.260 him balds. But I actually have it open here and 00:37:13.260 --> 00:37:16.659 saying, um, yeah, uh, I did explain, I did not 00:37:16.659 --> 00:37:19.039 like to be called boss. He to please call me 00:37:19.039 --> 00:37:22.000 Chris, Mr. Vincent or sir. And then he says the 00:37:22.000 --> 00:37:24.539 wave, the waitress tattered. I thought nothing 00:37:24.539 --> 00:37:26.719 more of it until we were paying the bill. And 00:37:26.719 --> 00:37:30.079 she goes, thanks boss. So like just, yeah, it's 00:37:30.079 --> 00:37:32.400 just crazy to think like, um, someone in his 00:37:32.400 --> 00:37:35.059 position is talking to that way. And yeah, I 00:37:35.059 --> 00:37:38.059 don't know if you have any John's. Well, I was 00:37:38.059 --> 00:37:40.800 actually about to cite that one as well. And 00:37:40.800 --> 00:37:42.599 the reason why I would cite that one as well 00:37:42.599 --> 00:37:45.119 is that Christie Kinnon has spent his entire 00:37:45.119 --> 00:37:49.039 life trying to become the boss. He is the boss 00:37:49.039 --> 00:37:54.199 now. And secondly is that if you have dealt with 00:37:54.199 --> 00:37:57.260 the Kinnons and covered them and researched their 00:37:57.260 --> 00:38:02.019 activities, at the time that all of this was 00:38:02.019 --> 00:38:06.099 going on, the cartel was being held responsible. 00:38:06.320 --> 00:38:12.099 for a few murders on the streets of Ireland that 00:38:12.099 --> 00:38:16.179 resulted in 18 deaths. And to think that this 00:38:16.179 --> 00:38:18.880 individual was getting upset over some woman 00:38:18.880 --> 00:38:21.519 calling him boss while someone was paying for 00:38:21.519 --> 00:38:26.519 his food, comparing that to the kind of bloodshed 00:38:26.519 --> 00:38:28.840 that I was seeing on the streets of Dublin and 00:38:28.840 --> 00:38:32.960 elsewhere as a result of cartel violence was 00:38:32.960 --> 00:38:37.800 really, really... an outer body experience for 00:38:37.800 --> 00:38:40.880 me because it really, although these are kind 00:38:40.880 --> 00:38:43.599 of, you could turn around and sort of describe 00:38:43.599 --> 00:38:46.739 them as kind of comical interactions, they also 00:38:46.739 --> 00:38:49.619 provided a bit of an insight into the sky and 00:38:49.619 --> 00:38:53.599 into a psychology in so far that, you know, one 00:38:53.599 --> 00:38:56.099 moment they're involved in the most serious type 00:38:56.099 --> 00:38:58.599 of offending imaginable that is resulting in 00:38:58.599 --> 00:39:01.719 people's deaths, never mind the destruction they're 00:39:01.719 --> 00:39:04.679 wreaking on society through the provision of 00:39:04.679 --> 00:39:08.380 drugs across Europe and their smuggling network. 00:39:08.780 --> 00:39:11.079 And then you have them sort of given out about 00:39:11.079 --> 00:39:16.400 this. And it also was the ultimate paradox because 00:39:16.400 --> 00:39:20.300 Kinnigan has spent so much time trying to conceal 00:39:20.300 --> 00:39:23.139 everything about his own life and his personal 00:39:23.139 --> 00:39:26.760 life, his character traits, everything else. 00:39:26.920 --> 00:39:29.659 He's just a very secretive individual. And then 00:39:29.659 --> 00:39:34.360 yet, He goes on Google review and posts all of 00:39:34.360 --> 00:39:37.380 these reviews, which give away his locations 00:39:37.380 --> 00:39:42.239 at various times and all of that. And if I can 00:39:42.239 --> 00:39:45.079 maybe name -check Beau Donnelly and Peter Bart, 00:39:45.219 --> 00:39:47.699 who are also part of the four -man team that 00:39:47.699 --> 00:39:50.980 we kind of assembled. Like myself and Beau, who 00:39:50.980 --> 00:39:54.199 used to work with the Sunday Times, were defected 00:39:54.199 --> 00:39:58.230 to Bellingcat after all of this. We used to wonder 00:39:58.230 --> 00:40:01.449 was this actually Kinnunen at one stage or was 00:40:01.449 --> 00:40:06.250 this some sort of code that they were uploading 00:40:06.250 --> 00:40:09.469 on Google reviews that people were reading and 00:40:09.469 --> 00:40:11.909 there was some hidden meaning behind it or something 00:40:11.909 --> 00:40:15.449 like that because it was so utterly bizarre that 00:40:15.449 --> 00:40:20.469 someone involved in this type of activity would 00:40:20.469 --> 00:40:24.889 be doing this. It was a really strange experience, 00:40:25.309 --> 00:40:30.409 all of this, and to kind of look at it and to 00:40:30.409 --> 00:40:33.130 get a sense of what this guy was like. And indeed, 00:40:33.170 --> 00:40:35.670 I know a lot of police officers who had spent 00:40:35.670 --> 00:40:38.710 their careers, or spent most of their careers, 00:40:39.250 --> 00:40:41.949 hunting the Kennetons, were completely astonished 00:40:41.949 --> 00:40:46.730 by all of this. They just found it almost impossible 00:40:46.730 --> 00:40:49.599 to believe that their target number one, was 00:40:49.599 --> 00:40:53.559 so casual about info security. Yeah, casual is 00:40:53.559 --> 00:40:56.119 really the word. And I think it's really important 00:40:56.119 --> 00:40:58.599 that you outlined that, you know, this person 00:40:58.599 --> 00:41:02.099 is a violent individual and somebody who has 00:41:02.099 --> 00:41:06.159 wreaked havoc across the globe, really. But some 00:41:06.159 --> 00:41:08.260 of the reviews, I mean, I think he reviewed some 00:41:08.260 --> 00:41:10.820 petrol stations, right? It wasn't just high -end 00:41:10.820 --> 00:41:13.820 restaurants either. He was reviewing everything 00:41:13.820 --> 00:41:16.880 and anything that came across in his path, which 00:41:16.880 --> 00:41:21.079 is bizarre and very, very interesting. We've 00:41:21.079 --> 00:41:23.900 had a question on doing these kinds of investigations 00:41:23.900 --> 00:41:26.179 and some of the people in the chat have responded. 00:41:27.260 --> 00:41:30.239 But Daniela Castro said, do you recommend creating 00:41:30.239 --> 00:41:33.079 false Facebook or Instagram profiles when looking 00:41:33.079 --> 00:41:35.780 into people of interest on social media? What 00:41:35.780 --> 00:41:37.320 kind of protections do you put in place when 00:41:37.320 --> 00:41:39.900 you're actually looking into these individuals? 00:41:41.139 --> 00:41:44.840 Yeah, I definitely recommend that. Yeah. And 00:41:44.840 --> 00:41:46.860 on LinkedIn as well, it's important to adjust 00:41:46.860 --> 00:41:49.639 your privacy settings to make your account private. 00:41:49.739 --> 00:41:52.360 So you're not giving away your identity when 00:41:52.360 --> 00:41:55.139 you visit someone's profile and definitely have 00:41:55.139 --> 00:41:57.219 it under the pseudonym. Although that's harder 00:41:57.219 --> 00:42:00.340 to do nowadays with their verification. Same 00:42:00.340 --> 00:42:02.900 with Facebook. But yeah, I would definitely, 00:42:03.159 --> 00:42:05.380 you try to be invisible, as invisible as possible 00:42:05.380 --> 00:42:08.340 when you're doing research because you don't 00:42:08.340 --> 00:42:10.880 want to tip people off. Like so generally, like 00:42:10.880 --> 00:42:13.409 if I'm Looking at a specific website, I tried 00:42:13.409 --> 00:42:15.650 my best not to actually go onto the live website. 00:42:15.829 --> 00:42:18.170 I will try and find an archive on the Wayback 00:42:18.170 --> 00:42:21.250 Machine first. So they're not seeing all these 00:42:21.250 --> 00:42:25.389 IP addresses. Yeah. So just like try to be as 00:42:25.389 --> 00:42:28.510 invisible as possible. Create sock puppet accounts. 00:42:28.610 --> 00:42:30.949 And these are just for research, not for like 00:42:30.949 --> 00:42:33.630 contacting people around like that. But you just 00:42:33.630 --> 00:42:35.030 want to be kind of invisible when you're doing 00:42:35.030 --> 00:42:38.150 your research. That's the main thing. Yeah. Speaking 00:42:38.150 --> 00:42:41.449 about privacy, has these two investigations, 00:42:41.690 --> 00:42:43.309 particularly the one on straw, that made you 00:42:43.309 --> 00:42:45.949 think a little bit more about what kind of data 00:42:45.949 --> 00:42:49.389 your apps are sharing? Has it made you a little 00:42:49.389 --> 00:42:53.050 bit safer when it comes to infosec? Well, if 00:42:53.050 --> 00:42:55.670 I could answer that question, I met Connor the 00:42:55.670 --> 00:42:58.409 other day for a cup of coffee. And after that 00:42:58.409 --> 00:43:01.369 meeting, I spent about four hours changing passwords 00:43:01.369 --> 00:43:03.940 and everything else. And every time I interact 00:43:03.940 --> 00:43:07.940 with Bellingcat, I leave feeling a little bit 00:43:07.940 --> 00:43:11.039 more vulnerable because of some of the techniques 00:43:11.039 --> 00:43:13.639 and you know, it's been a kind of a baptism of 00:43:13.639 --> 00:43:16.119 fire in terms of open source intelligence and 00:43:16.119 --> 00:43:20.960 how effective it can be. So I won't speak for 00:43:20.960 --> 00:43:23.320 Connor, but certainly for myself. It's taught 00:43:23.320 --> 00:43:26.840 me so much. And indeed I've learned so much from 00:43:26.840 --> 00:43:31.150 the team at Bellingcat about info security and 00:43:31.150 --> 00:43:36.130 trade craft in terms of conducting online investigations. 00:43:36.590 --> 00:43:40.210 I was always very good at dealing with people 00:43:40.210 --> 00:43:44.829 secretly who may be involved in all sorts of 00:43:44.829 --> 00:43:47.590 activities that they shouldn't be. And I've never, 00:43:47.949 --> 00:43:50.969 you know, had, you know, governments and stuff 00:43:50.969 --> 00:43:52.869 have spent a lot of money trying to identify 00:43:52.869 --> 00:43:59.090 sources of information. But I have been astonished 00:43:59.090 --> 00:44:04.230 by how much people leak about themselves through 00:44:04.230 --> 00:44:07.550 the use of social media accounts and phones and 00:44:07.550 --> 00:44:11.210 emails. And I've learned all of that from Bellingcat 00:44:11.210 --> 00:44:14.030 and the spirit of Bellingcat, which is to share 00:44:14.030 --> 00:44:16.210 this type of information and make people aware 00:44:16.210 --> 00:44:20.610 of it. Um, and, uh, but, but it certainly has, 00:44:20.610 --> 00:44:24.670 um, focused me to an extent that, uh, you know, 00:44:24.789 --> 00:44:29.309 I regularly now would do, um, digital, uh, cleansing 00:44:29.309 --> 00:44:33.269 operations to make sure that I, I, I'm just checking 00:44:33.269 --> 00:44:35.690 myself and, you know, I've done a couple of the 00:44:35.690 --> 00:44:37.449 courses with Bellingcat, which I'd recommend 00:44:37.449 --> 00:44:40.030 to anyone. And, but one of the most scariest 00:44:40.030 --> 00:44:42.030 things they ever did was actually investigate 00:44:42.030 --> 00:44:47.639 myself. You know, that was a sobering experience 00:44:47.639 --> 00:44:50.840 because I would have considered myself secretive 00:44:50.840 --> 00:44:54.780 and very careful. And I discovered that I'd left 00:44:54.780 --> 00:44:58.840 gaping, you know, bits of information on the 00:44:58.840 --> 00:45:02.099 internet about myself, which I had to deal with 00:45:02.099 --> 00:45:06.000 and that kind of stuff, you know? So, yeah, so 00:45:06.000 --> 00:45:08.380 certainly I'll let maybe that Conor explain a 00:45:08.380 --> 00:45:10.980 bit more because he's far more qualified than 00:45:10.980 --> 00:45:15.909 me. Thanks, Ron. Yeah. Um, yeah. So like, I would 00:45:15.909 --> 00:45:18.070 just say, like, um, I've always been kind of 00:45:18.070 --> 00:45:20.269 cautious with what I put online for a number 00:45:20.269 --> 00:45:23.150 of years. Um, I just think a good attitude to 00:45:23.150 --> 00:45:27.150 have is with technology nowadays, um, they try 00:45:27.150 --> 00:45:29.449 and make it as convenient as possible, but with 00:45:29.449 --> 00:45:31.130 that convenience, you're paying, often paying 00:45:31.130 --> 00:45:34.030 a price with privacy. So when you're connecting 00:45:34.030 --> 00:45:37.849 all your accounts or whatever it is, um, So what 00:45:37.849 --> 00:45:40.289 I try, what I try and do is I use different email 00:45:40.289 --> 00:45:43.570 addresses, never reuse the same password. Um, 00:45:43.750 --> 00:45:46.150 and I only use like email addresses for, for 00:45:46.150 --> 00:45:48.230 communication. And then I would use a different 00:45:48.230 --> 00:45:50.429 email address to register for things just so 00:45:50.429 --> 00:45:52.929 you're not leaving that, uh, digital breadcrumb 00:45:52.929 --> 00:45:55.510 trail. And also obviously like with things like 00:45:55.510 --> 00:45:58.630 Strava, I mean, you know, people know that they're 00:45:58.630 --> 00:46:01.710 posting things, but sometimes I wonder just do 00:46:01.710 --> 00:46:04.750 they realize how public those things are? And 00:46:04.750 --> 00:46:07.429 so it's always good to just, just sit back and 00:46:07.429 --> 00:46:09.949 think about your social media and how publicly, 00:46:10.590 --> 00:46:12.309 because sometimes you just kind of fall into 00:46:12.309 --> 00:46:14.750 the idea that it's just your friends and family 00:46:14.750 --> 00:46:16.530 or something that has seen this stuff, but often 00:46:16.530 --> 00:46:18.449 it's not the case. So it's good to have, you 00:46:18.449 --> 00:46:21.110 know, spend a day or two maybe like having an 00:46:21.110 --> 00:46:24.190 audit of your social media and seeing what, not 00:46:24.190 --> 00:46:26.130 just social media, but any kind of online account, 00:46:26.309 --> 00:46:28.309 seeing what information you're, you're leaving 00:46:28.309 --> 00:46:30.630 out there. What kind of breadcrumbs you might 00:46:30.630 --> 00:46:33.210 be leaving, but someday it might come back to 00:46:33.210 --> 00:46:36.360 haunt you. Absolutely great advice. And if you 00:46:36.360 --> 00:46:40.019 want some more tuition or you have been convinced 00:46:40.019 --> 00:46:43.320 by John that Bellingcat is the place to learn 00:46:43.320 --> 00:46:46.380 more about Infosec, you can actually look at 00:46:46.380 --> 00:46:47.699 our website right now because we actually have 00:46:47.699 --> 00:46:50.260 some workshops coming up. I linked it in the 00:46:50.260 --> 00:46:54.449 chat. And Merle has very helpfully linked an 00:46:54.449 --> 00:46:56.170 overview video as well that's on our YouTube 00:46:56.170 --> 00:46:58.610 about things to consider to improve your digital 00:46:58.610 --> 00:47:03.550 safety. That's filmed by our very talented investigator, 00:47:03.989 --> 00:47:06.429 Eganush. And you can watch that now as well. 00:47:06.489 --> 00:47:08.989 And I'll link then the description of the podcast. 00:47:09.630 --> 00:47:12.469 And we've had so many questions coming in about 00:47:12.469 --> 00:47:16.449 what the Kinnerhans response has been to the 00:47:16.449 --> 00:47:20.489 two articles. Have they gone to ground? Is he 00:47:20.489 --> 00:47:24.449 still posting Google reviews? Have we seen any 00:47:24.449 --> 00:47:27.269 movement since these two articles have come out? 00:47:27.909 --> 00:47:30.110 Maybe if I can answer that. They were delighted 00:47:30.110 --> 00:47:35.070 with the coverage they got. That's a joke. They 00:47:35.070 --> 00:47:39.269 haven't gone to ground. I think what those investigations 00:47:39.269 --> 00:47:43.150 have done is that they've become a little bit 00:47:43.150 --> 00:47:46.230 more conscious about what they've been doing. 00:47:46.539 --> 00:47:52.159 They probably are, with my understanding, possibly 00:47:52.159 --> 00:47:55.579 looking at what they've done in the past and 00:47:55.579 --> 00:47:59.139 trying to figure out can they cover and conceal 00:47:59.139 --> 00:48:02.360 some of their online activities, but they are 00:48:02.360 --> 00:48:05.260 a massive criminal organization. And you must 00:48:05.260 --> 00:48:08.719 remember while they look, they kind of look at 00:48:08.719 --> 00:48:11.860 Bellingcat and the Sunday Times and the sort 00:48:11.860 --> 00:48:14.840 of reports we publish about them. as very much 00:48:14.840 --> 00:48:17.820 a nuisance, their biggest problems are police 00:48:17.820 --> 00:48:20.679 agencies that are trying to extradite them, trying 00:48:20.679 --> 00:48:22.820 to arrest them, trying to seize their drugs, 00:48:23.159 --> 00:48:25.199 freeze their money, identify their assets, et 00:48:25.199 --> 00:48:28.019 cetera. And that's their real problem at the 00:48:28.019 --> 00:48:31.480 moment. But they don't like, and I know this 00:48:31.480 --> 00:48:34.940 for a fact, they don't like this sort of attention. 00:48:35.320 --> 00:48:39.159 But in the overall scale of things, it's just 00:48:39.159 --> 00:48:42.079 another headache to a very complex series of 00:48:42.079 --> 00:48:43.989 headaches they're dealing with at one time. The 00:48:43.989 --> 00:48:47.570 only thing though that I'll say this is that, 00:48:47.590 --> 00:48:49.949 and I think it's important to remember is that 00:48:49.949 --> 00:48:53.230 when investigations like this come out and when 00:48:53.230 --> 00:48:56.289 they log on to Sunday Times or they log on Bellingcat 00:48:56.289 --> 00:48:58.630 and they see all of this storted stuff about 00:48:58.630 --> 00:49:02.769 themselves and they see, you know, pictures taken 00:49:02.769 --> 00:49:08.090 in the cycle beast row that, you know, has been 00:49:08.090 --> 00:49:12.070 uploaded on an Instagram account and Connor just 00:49:12.070 --> 00:49:15.320 happened to find it. And when they see other 00:49:15.320 --> 00:49:18.119 information about the reviews and how we've managed 00:49:18.119 --> 00:49:21.039 to analyze that and look at what's happened, 00:49:21.539 --> 00:49:25.219 that does weaken them a little bit in the eyes 00:49:25.219 --> 00:49:29.019 of their associates. Because in that criminal 00:49:29.019 --> 00:49:33.219 world, in that world of extremists, terrorists, 00:49:33.659 --> 00:49:36.659 organized crime gangs and spies and intelligence 00:49:36.659 --> 00:49:40.889 officers and undercover agents. Anything that 00:49:40.889 --> 00:49:45.570 signifies or suggests weakness is a vulnerability 00:49:45.570 --> 00:49:47.949 and that can manifest itself in lots of different 00:49:47.949 --> 00:49:51.010 ways. So it may have some of their associates 00:49:51.010 --> 00:49:53.769 might be a little bit wary of them, certainly 00:49:53.769 --> 00:49:57.150 wary of him being around a phone with them or 00:49:57.150 --> 00:50:02.730 something like that. They may be looking at this 00:50:02.730 --> 00:50:04.869 and I understand that they were kind of very 00:50:04.869 --> 00:50:07.639 concerned about what else. is known that just 00:50:07.639 --> 00:50:10.460 hasn't entered the public domain yet. So in that 00:50:10.460 --> 00:50:13.460 respect, an investigation like this has, apart 00:50:13.460 --> 00:50:17.000 from the public interest in getting this information 00:50:17.000 --> 00:50:19.860 out, it does have a kind of practical knock -on 00:50:19.860 --> 00:50:23.219 effect on their criminal activities and their 00:50:23.219 --> 00:50:26.719 money laundering activity. Because it should 00:50:26.719 --> 00:50:30.440 also be stated that police forces and intelligence 00:50:30.440 --> 00:50:33.900 services are reading all of these reports. and 00:50:33.900 --> 00:50:36.599 they're taking information and it opens up avenues 00:50:36.599 --> 00:50:39.480 of investigation for them. For example, Oliver 00:50:39.480 --> 00:50:42.519 Herman, his identity wasn't known to many police 00:50:42.519 --> 00:50:46.139 forces in Europe and he wasn't associated with 00:50:46.139 --> 00:50:49.619 the Kinnon cartel or having any sort of links 00:50:49.619 --> 00:50:53.599 to Christie Kinnon until we published it. So 00:50:53.599 --> 00:50:57.260 that opens up all sorts of issues for them as 00:50:57.260 --> 00:51:00.519 well. Thanks for that. Connor has actually commented 00:51:00.519 --> 00:51:02.980 as well, his Google review profile is still live 00:51:02.980 --> 00:51:06.360 but no activity since our reporting. Just on 00:51:06.360 --> 00:51:11.719 Herman, was it more difficult to report on Herman's 00:51:11.719 --> 00:51:14.619 case because there's an ongoing court case, as 00:51:14.619 --> 00:51:18.860 mentioned, he's been charged but not found guilty 00:51:18.860 --> 00:51:21.820 as of yet? How do you balance the need to reveal 00:51:21.820 --> 00:51:24.320 information about an individual and potential 00:51:24.320 --> 00:51:26.239 court proceedings that they might be going through, 00:51:26.280 --> 00:51:31.340 for example? I don't know whether you want me 00:51:31.340 --> 00:51:35.400 to answer that, but we took a lot of advice on 00:51:35.400 --> 00:51:40.780 that and we would have engaged in what I would 00:51:40.780 --> 00:51:45.179 consider balanced and fair reporting that did 00:51:45.179 --> 00:51:50.420 not seek to influence any case, that is before 00:51:50.420 --> 00:51:54.000 any court. And we were quite careful about that. 00:51:54.650 --> 00:51:57.170 just for the listeners out there, contempt of 00:51:57.170 --> 00:52:01.190 court and court proceedings, the reporting on 00:52:01.190 --> 00:52:04.030 that is quite restricted. You can say certain 00:52:04.030 --> 00:52:07.769 things and you can't say others. So what we did 00:52:07.769 --> 00:52:11.190 was we reported as much as we could, we documented 00:52:11.190 --> 00:52:14.150 as much as we could and we've done that within 00:52:14.150 --> 00:52:22.260 the confines of sort of what is permissible when 00:52:22.260 --> 00:52:26.139 an accused person is before a court. So that's 00:52:26.139 --> 00:52:30.219 what we did. It's really important that newspapers 00:52:30.219 --> 00:52:34.860 and websites, they would know this, but it's 00:52:34.860 --> 00:52:39.239 not a free for all. We have to be almost more 00:52:39.239 --> 00:52:43.780 careful to protect someone's rights. that if 00:52:43.780 --> 00:52:48.659 they're an accused person, then otherwise would 00:52:48.659 --> 00:52:51.360 be maybe normal. So we're just very, very careful 00:52:51.360 --> 00:52:55.480 about all of that. And I can say with a degree 00:52:55.480 --> 00:52:58.960 of confidence that every word that we published 00:52:58.960 --> 00:53:02.480 about this was scrutinised by ourselves. And 00:53:02.480 --> 00:53:06.440 we also sought external advice on this. So we 00:53:06.440 --> 00:53:09.260 did it in a way that was legally permissible 00:53:09.260 --> 00:53:11.380 as King's stand. Oh yeah, I was just going to 00:53:11.380 --> 00:53:13.480 say, yeah, I hope you haven't undid that. Fair 00:53:13.480 --> 00:53:15.539 enough. Okay, so we've got about five minutes 00:53:15.539 --> 00:53:18.820 left. I wanted to ask, and maybe this will be 00:53:18.820 --> 00:53:21.360 our last question, depends on how quick you answer. 00:53:22.019 --> 00:53:24.800 What would be your top tips for someone who is 00:53:24.800 --> 00:53:27.219 embarking on their first investigation into a 00:53:27.219 --> 00:53:29.659 criminal group? And bearing in mind that, Connie, 00:53:30.179 --> 00:53:33.039 you shared some amazing tools earlier. What would 00:53:33.039 --> 00:53:36.219 be your top tips for someone who, perhaps like 00:53:36.219 --> 00:53:39.480 yourself, is interested, has found something 00:53:39.480 --> 00:53:43.719 and is interested in pursuing it? Yeah, I would 00:53:43.719 --> 00:53:47.260 just say like first and foremost to do it responsibly. 00:53:48.360 --> 00:53:50.019 You know, when you're when you're researching 00:53:50.019 --> 00:53:53.900 things like this, you quickly start coming across 00:53:53.900 --> 00:53:56.719 individuals, you know, like companies and you 00:53:56.719 --> 00:53:58.420 don't want to be just throwing names out there. 00:53:58.800 --> 00:54:02.219 So you have to be very careful about that. But 00:54:02.219 --> 00:54:05.619 yeah, apart from that, like you just what I did 00:54:05.619 --> 00:54:08.980 was just follow my curiosity. I just. Like I 00:54:08.980 --> 00:54:11.719 don't think you need to know all these tools. 00:54:11.820 --> 00:54:14.380 You don't need to be a huge expert. It definitely 00:54:14.380 --> 00:54:17.960 helps if you're tech savvy, but I think that 00:54:17.960 --> 00:54:22.380 if you're able to sign up for an email account, 00:54:22.440 --> 00:54:24.380 then you have enough technical ability to do 00:54:24.380 --> 00:54:26.619 a few Google searches. And ultimately it's just 00:54:26.619 --> 00:54:30.340 a matter of having the creativity to think of 00:54:30.340 --> 00:54:34.159 things to search. And then like you don't need 00:54:34.159 --> 00:54:37.179 to like use fancy Google docs, although I think 00:54:37.179 --> 00:54:40.480 if you learn one thing to do, just use quotes 00:54:40.480 --> 00:54:42.780 a lot, use quotation marks around your terms. 00:54:43.260 --> 00:54:45.699 I basically all of my searches, I do a quotation 00:54:45.699 --> 00:54:47.860 marks. It's a simple thing, but it just gives 00:54:47.860 --> 00:54:50.360 you that exact term that you're looking for. 00:54:50.400 --> 00:54:53.300 So if you're searching for like a house on this 00:54:53.300 --> 00:54:55.820 street, you have to put that term in quotes to 00:54:55.820 --> 00:54:57.159 get the result you're looking for. Otherwise 00:54:57.159 --> 00:54:59.480 you're just going to get a lot of nonsense. So 00:54:59.480 --> 00:55:01.599 yeah, that's what that's the main thing I would 00:55:01.599 --> 00:55:05.760 say is just like all of your curiosity. like 00:55:05.760 --> 00:55:07.840 try and think of creative ways. Like don't just 00:55:07.840 --> 00:55:10.159 sometimes it's better not to just dive into searching 00:55:10.159 --> 00:55:12.219 straight away. You might just want to sit back 00:55:12.219 --> 00:55:14.880 for a while and think about ways to approach 00:55:14.880 --> 00:55:16.820 it before you start searching because you can 00:55:16.820 --> 00:55:20.380 kind of end up going down rabbit holes. But yeah, 00:55:20.460 --> 00:55:22.820 I think that's the main thing. Just keep it simple 00:55:22.820 --> 00:55:28.119 and follow your curiosity. Well, I wouldn't even 00:55:28.119 --> 00:55:32.900 attempt to advise someone on open source research, 00:55:33.760 --> 00:55:37.480 whilst on the same chat room as Connor, because 00:55:37.480 --> 00:55:41.000 he really is exceptionally skilled in all of 00:55:41.000 --> 00:55:45.099 this. So I would take Connor's advice on that. 00:55:46.059 --> 00:55:48.460 I mean, the one thing that I've really learned 00:55:48.460 --> 00:55:53.219 in all of this, and it has been like a stratospheric 00:55:53.219 --> 00:55:56.539 learning experience for me, who does a kind of 00:55:56.539 --> 00:55:59.980 different type of work is that some of this stuff 00:55:59.980 --> 00:56:04.719 is so simple, it's scary. What Connor is describing 00:56:04.719 --> 00:56:11.219 is it's not usually, and I mean this in the best 00:56:11.219 --> 00:56:13.920 possible way, it's not usually sophisticated, 00:56:14.059 --> 00:56:18.659 but what it is is a process of searching for 00:56:18.659 --> 00:56:21.920 information in a very methodical and thorough 00:56:21.920 --> 00:56:25.710 way. And that really does work. It really, really 00:56:25.710 --> 00:56:28.090 does work. It takes time and it takes patience 00:56:28.090 --> 00:56:34.869 and it takes a certain kind of mind to look for 00:56:34.869 --> 00:56:38.590 this information and know about how to go about 00:56:38.590 --> 00:56:45.949 it. But it really does work. It's kind of like 00:56:45.949 --> 00:56:49.550 being a deep dive into this sort of stuff. open 00:56:49.550 --> 00:56:52.030 source intelligence and how collection and how 00:56:52.030 --> 00:56:56.409 it's going. Like it's it to me as someone who 00:56:56.409 --> 00:56:59.710 has, you know, both studied and spent a lot of 00:56:59.710 --> 00:57:03.110 time with intelligence officers dealing with 00:57:03.110 --> 00:57:05.530 intelligence services for a long time and know 00:57:05.530 --> 00:57:08.769 about the way to collect information. And I often 00:57:08.769 --> 00:57:12.869 hear people to me say to me that open source 00:57:12.869 --> 00:57:16.110 is now becoming this huge, huge thing for them. 00:57:16.349 --> 00:57:18.849 And I think a number of years ago people used 00:57:18.849 --> 00:57:22.469 to dismiss this, but I don't think they dismiss 00:57:22.469 --> 00:57:25.969 it anymore. I think they kind of know that this 00:57:25.969 --> 00:57:29.530 is a really, really significant arm now of law 00:57:29.530 --> 00:57:33.449 enforcement, of defense, of intelligence collection 00:57:33.449 --> 00:57:37.090 by governments around the world who are targeting 00:57:37.090 --> 00:57:42.900 malign actors. But if you can get into it and 00:57:42.900 --> 00:57:47.400 if you can kind of develop a taste for it or 00:57:47.400 --> 00:57:51.800 an interest in it, it is phenomenal and what 00:57:51.800 --> 00:57:56.880 can be achieved. And as Conor very eloquently 00:57:56.880 --> 00:57:59.880 said there, it can be done if you have the ability 00:57:59.880 --> 00:58:02.079 to open up an email address and go searching 00:58:02.079 --> 00:58:04.739 for information, just picking up some of those 00:58:04.739 --> 00:58:09.650 techniques. turn up all sorts of things. Because 00:58:09.650 --> 00:58:11.989 I think what I've really as well learned from 00:58:11.989 --> 00:58:16.630 all of this is that people overlook things. They 00:58:16.630 --> 00:58:19.090 would find it difficult to believe that someone 00:58:19.090 --> 00:58:21.289 like Christie Kenan, for example, would have 00:58:21.289 --> 00:58:24.329 a Google review account be posting information 00:58:24.329 --> 00:58:27.110 about themselves because they've spent so long 00:58:27.110 --> 00:58:30.070 trying to investigate them. And he's never made 00:58:30.070 --> 00:58:34.329 a mistake that would lead to him being sufficiently 00:58:34.329 --> 00:58:39.269 damaged. And yet. Conor comes along with his 00:58:39.269 --> 00:58:44.409 laptop and manages to do what a lot of police 00:58:44.409 --> 00:58:48.110 forces would have liked to have done, or maybe 00:58:48.110 --> 00:58:51.210 just didn't do because they never thought about 00:58:51.210 --> 00:58:53.869 it. So that really is the beauty of Bellingcat 00:58:53.869 --> 00:58:56.610 and it's the beauty of open source intelligence. 00:58:56.989 --> 00:59:01.130 And I think in many years to come that news organizations 00:59:01.130 --> 00:59:04.869 like the Sunday Times or the BBC already have 00:59:04.869 --> 00:59:08.380 it. But I think open source intelligence and 00:59:08.380 --> 00:59:11.900 its collection will be a normal part of any investigation 00:59:11.900 --> 00:59:14.280 going forward. That's just the way it's going. 00:59:15.519 --> 00:59:17.659 John, you've just given us the new Bellingcat 00:59:17.659 --> 00:59:21.039 advert just there. Thank you very much. Thanks 00:59:21.039 --> 00:59:24.000 everybody for coming to the stage talk. It's 00:59:24.000 --> 00:59:27.619 been amazing to hear about your incredible investigative. 00:59:28.039 --> 00:59:31.579 the collaboration and can't wait to see what 00:59:31.579 --> 00:59:34.179 you come up with next. We'll all be keeping our 00:59:34.179 --> 00:59:37.400 eyes out on the Bell and Cat on Sunday Times 00:59:37.400 --> 00:59:41.800 websites. Please check out the links that I've 00:59:41.800 --> 00:59:44.019 put in the chat for the various tools that Connor 00:59:44.019 --> 00:59:47.739 mentioned and this recording will hopefully be 00:59:47.739 --> 00:59:51.960 up on our podcast platforms by tomorrow or at 00:59:51.960 --> 00:59:55.059 least by the end of the weekend. Thank you everybody 00:59:55.059 --> 00:59:58.139 for coming and come back in two weeks time when 00:59:58.139 --> 00:59:59.800 we're back with our next stage talk. Thank you 00:59:59.800 --> 01:00:02.619 John, thank you Connor. Thank you very much. 01:00:02.719 --> 01:00:06.500 Thanks, John. Thank you for listening to the 01:00:06.500 --> 01:00:09.300 Stage Talk. If you'd like to catch a Stage Talk 01:00:09.300 --> 01:00:12.800 live where you can ask the guest questions, join 01:00:12.800 --> 01:00:16.179 the Bellingcat Discord server by visiting www 01:00:16.179 --> 01:00:22.000 .discord .gg slash Bellingcat. The music you've 01:00:22.000 --> 01:00:25.880 heard is titled Dawn by Newer Self and is courtesy 01:00:25.880 --> 01:00:26.760 of Artlist.