You're listening to a stage talk titled Building
Protective Tech Dealing with Leaked Intimate
Imagery. This week, we spoke with the founder
of Image Angel, a company developing forensic
watermarking technology to help trace the source
of online image abuse. Madelaine explains how
the technology works, the challenges of encouraging
adoption by platforms and how her own experience
led her to found the company. We also discuss
why the technology isn't open source and explore
alternative approaches to addressing this systemic
issue. You can find links to all of the resources
mentioned in the talk in the podcast description.
This talk was hosted by me, Charlotte Maher, on
Thursday the 2nd of July, 2026, in the Bellingcat
Discord server. Welcome back to the Stage
Talks podcast. Today we are diving deep into
the frontier of digital safety, journalism integrity
and the engineering of online accountability.
A short trigger warning that in this discussion
we may touch on themes of sexual exploitation
and image -based sexual abuse. When sensitive
media leaks, when war crime imagery is manipulated
or when intimate images are shared without consent,
the digital damage happens in seconds. For decades,
our cultural and legal response has been entirely
reactive. We try to flag, report and take down
content after it's already spread across the
internet, as many of you will know. But in an
era of generative AI and automated disinformation,
reactive safety is a failing strategy. Our guest
today is tackling this problem by shifting the
entire paradigm from reaction to provenance.
Madelaine Thomas is the founder of Image Angel.
Her company built advanced server -side forensic
watermarking tools that embed invisible mathematical
trackers into the structural frequency of images
and videos the exact millisecond they are viewed.
It means that no matter how much an asset is
screenshotted, cropped or manipulated by deepfake
algorithms, it carries a permanent invisible
digital paper trail back to its source. Within
this next hour, we'll be exploring the exact
methodology of how this technology is built,
the friction between open source transparency
and defensive security, and how this math could
reshape everything from creator safety to global
information warfare. As usual, you can place
your questions in the chat accessible on the
right hand corner of your screen, but please
remember that this is being audio recorded for
the podcast, so if you don't want me to mention
your username, please add that as a note in your
question. It's also worth noting that Bellingcat
does not endorse any individual company. And
today we're talking about the technology rather
than the company itself. Madelaine, your journey
into building this technology is deeply personal.
I want to hand the floor over to you. Take us
back to the beginning, your story and how this
technology works under the hood. Thank you for
having me here. I'm really excited to go through
this with you. I guess I need to just caveat
what you've just said that we're changing the
way the world's working. We're doing it slowly.
And the person in charge of this company has
a long and really successful career as a dominatrix.
So tech is not my first language and business
is not my first line of work. So everything I've
achieved up to now has been hard fought. We've
made mistakes and we've done things wrong. And
I'm proud to say that we've got this far and
I'm really excited to show it to you. So what
I'm going to go through is from the very beginning,
what happened to where we're at now. And then
in the middle of that, we'll go through a bit
of the techie side of things as well. So everyone
can see my screen. I'm going to click through.
So company is called Image Angel because I just
needed a minute. I needed someone, I needed someone
to help me. Because in 2017, my world completely
shattered. I was doing amazing stuff in my line
of work and winning awards and being on magazine
covers and enjoying the successful career that
I fought so hard to achieve. But under cover
of that, I was battling with this secret shame
that my content was just everywhere associated
with my name, my place of where I live and where
I grow up. And there was no way to stop it. There
was no protection. There was no safety net and
I got to the lowest point, the absolute worst
moment of my life, really. I look back at it
and I think it could not have got worse up to
a point that I thought I am worth less. I don't
need to be here anymore, almost. It was a sense
of just exposure and helplessness and I had nowhere
to turn. I did go to the revenge porn helpline
and I asked for some help. But because my work
was commercial, I was considered unable to be
helped. And this is happening all the time to
so many people and more and more. Unattributed,
fraudulent, leak, fake. It causes irreversible
damage. to an individual, but also just to truth
and trust and your sense of self and belonging.
And so I started looking at the world and I'm
like, what can I possibly do as one woman who
does not have a technical background? What can
I do? So I wanted to focus on huge impact with
nothing. So I started with no money, no experience,
but I also wanted people to be protected without
So I built a system that could potentially change
the way harm is happening in these spaces in
a way that could prevent. And I'm looking at
all these things and I need to shape my company
in a way that is going to survive the future.
But like, what the hell is that? What does good
cutting edge tech look like? It looks like all
of these things. And I'm looking at the world
and I'm thinking, Prevention is everywhere in
that we prevent an image being displayed through
hashing. And we tell people, don't express yourself
online and don't go online and don't be part
of this digital world because of the possibility
for things that are bad to happen. So I thought
I must be able to do something. And it took me
a good few years to come up with the correct
solution. Because as policy is evolving, as GDPR
is evolving, as tech is evolving, things became
possible and then impossible. And I actually
found a solution, which was forensic watermarking.
And I genuinely had the thought of, oh, I can
do that. Like it's hard. So I'm really pleased
to be able to say that I have developed Image Angel.
So it is not perfect, but it's a start. It adds
invisible robust data in a private and cheap
way into media. So live broadcast, imagery, and
also video. And it makes the risk of leaking
something outweigh the reward. And throughout
this presentation, I'm going to explain things
to you guys in the sense of, as a consensual
adult content creator, selling consensual content
to a consensual buyer. That's my viewpoint. It's
my origins, although this can be applied to so
many different places. And I would love it if
you could... Think of it from your perspective
and see how it would work in your setting and
what the barriers might be or what the changes
may be. So Image Angel is more than a technical
integration. It is a software as a service, but
it's also a network where creators, regulators,
abusers can see that this platform doesn't tolerate
abuse. This place uses this tech, which means
it doesn't tolerate anything. being used to abuse.
We also have a network where people can seek
help and then give platforms the data so that
they can act upon that verified data. So I see
it as not tech. It's a revolution. It's me using
my harm for the good of the world. And I also
see myself as a little bit like Liam Neeson.
I will look you, I will find you, and there will
be consequences. Because when we do something
and there are no consequences, it feels powerless.
So that's what I wanted to do is give the power
back a little bit. But enough about the background.
I'm going to go into how it works and I want
to show you what it looks like and what our system
does and how it's built. So we're going to use
this beautiful little pup. This is a AI image
of a pup. And this is the data that is embedded
into the image. This is what the computer would
read. You as an individual would see it. as it
is when it turns over. You'll see it as it is
without any data embedded in there. But it is
essentially adding super pixels into the image,
overlaying it on top, depending upon the system
structure or injecting it into the image itself.
Those pixels contain data. They rotate. They
change. And we also have the ability to change
the density and intensity. We also have the ability
to adjust the amount of data that it holds. But
at the moment, 64 bits is our limit. And what
happens then? So you're joining a platform, you're
loading media and somebody comes along and screenshots
it, which is so common. And they may edit it.
They may add something to the top of it. They
may scribble all over it. They may print it out.
They may invert the color or they may change
it, prop it. You will eventually find that out.
That's how this world works. We always find content
out there somewhere in the world. And at that
point, that's where I was. that, oh my God, what
the hell am I going to do moment? And I felt
so powerless. And when I was creating this product,
I needed to be able to say, even if nothing was
possible, something must be possible. Even if
there is no legal recourse or no change that
can be made, it's important at this point to
be able to go somewhere and get the help that
you need, even if that is just a couple of lines
of advice. in one centralized place because you're
panicking. So we created the ImageAngel report
and support system. So as well as creating a
system that injects data into imagery, we also
created a system where you could get the help
that you needed if you needed it. So at that
point, you would find your image out there in
the wild and you would report it to us. And there's
lots of people that ask the question, But how
do I find where that piece of information is?
There are numerous ways of finding data and information
out there in the world. What I didn't want to
do was recreate a system that already exists.
So I've created the two parts of a system that
compliment the tech that already exists in finding
and tracking content out there. We are developing
a system. But I will go into that a bit later,
but we'll search the internet for watermarked
imagery. So then what happens? You submitted
that piece of information to ImageAngel. You
could report it to an NGO. You could report it
to the platform itself. You could report it to
policing or anywhere that works in conjunction
with ImageAngel. That report will come to us.
We then triage it. We take that report and we
see how serious is this. Is this life -threatening?
Have you reported to us that this is danger status,
in which case it would go right to the top of
the pile? Or is this just, I'm a bit annoyed,
my commercial work has gone missing and I'm frustrated?
So we like to find out what's going on, what's
the situation, so we can really triage. Then
we extract the data that's in there. So there's
two watermarks that are in there and they both
contain a small piece of information. One contains
the platform data. So that was where you uploaded
it as the user. And in this instance, let's say
it's a place called Fan Vault. Then Fan Vault,
we contact them and we give that other piece
of information that is held within the watermark.
And we again, don't know what this is. It's just
a random hexadecimal numbers and letters. And
we look at that and go, this belongs to this
platform. you'll be able to decode that. So even
if we wanted to, we wouldn't be able to tell
anyone what that data pertains to. All we know
is where it came from. And then we advise the
platform of Origin what should happen next. And
this information is gathered because the user
has told us what they would prefer. I'm furious.
I'm upset. I need therapy. I need help. I need
takedown help. I need this person to be blocked
from the system. I need the police involved.
Or I need nothing. I don't want to do anything.
I just want to let you know that this has happened.
So the extracted data is only decodable by the
source platform when a verified case is raised.
No exposed personnel identifying information.
It is just a technical identifier. So it's privacy
preserving. GDP are compliant at every step.
That is vital. And one thing that we're still
working out and something that may come up in
questions is, well, how do you verify what a
genuine request is? And that's a really good
question. And we're still working through that.
A genuine request we would imagine comes straight
from a platform or policing and we can verify
those. But sometimes you might get a request
that comes in from an individual and that needs
to be treated with care. But how do we make sure
that it isn't an ex -partner trying to find out
if someone is broadcasting on a platform or working
on, let's say, OnlyFans? So we have to still
work on that and build that part out. And then
what happens? What happens then? So you've found
this piece of leaked information out there in
the wild. You've reported it to us and we've
identified the person. Well, what happens then?
And at this point, there is so many different
options available. It could be small claims.
It could be that it is against the Sexual Offences
Act. It could be a copyright infringement. Is
the user in the US? Are they in India? How do
the two jurisdictions work together? When you
regenerate a piece of material entirely, you
regenerate it with the pixels that we also embedded
in there. So it is somewhat possible to be able
to say the presence of those pixels could denote
that that came from a private channel. And of
course, It's not going to be possible to use
this as an evidence of its in and of itself,
but it could stand as supporting evidence if
you have the rest of the data to back it up.
And of course, we've tested it. We want to know
what people think. We don't want to put something
out there that people don't want. And the response
has been that third party neutrality, lived experience
is really important. And this is the kind of
perpetrator accountability that creators are
desperate for, but no single mechanism is enough.
Because when a harm that is this complex is happening,
you need complex responses. You need layered,
holistic responses. So when used together with
things like hash databases, it can provide a
safety infrastructure that is both preventative
and reactive. But if someone is determined to
do harm, then there is nothing that will stop
them. It's a regulatory ally, not a big full
stop. And then of course, we've asked exactly
the market that we want to sell to the content
creators on their platforms. What do you want?
Does it work for you? And then there's a really
important part that I haven't really gone over,
which is who pays for this? The last thing an
individual needs to do is pay for their own safety.
when someone else is profiting from their work.
It is vital that creating safety infrastructure
is not accessible only to those who know about
it or who can afford it. And that is why in creating
this tech, we embed directly into the platforms.
This also means that the data that is held on
an individual doesn't need to be touched by the
creator. But if we want to have real -world impact,
We need real -world data. So we embed a platform
level. They have the consumer data. They embed
it into their system. And then we give them the
key that unlocks that information. So I hope
there's loads of questions. I'm sure there are.
And that's it from me. Thank you very much. Thank
you, everybody, for your many questions in the
chat, actually. And thank you, Madeline, for
taking us through that. You touched on this very
quickly. We had one question, which I thought
we could just kick off with actually. Somebody
said, is this a stop NCII .org direct alternative?
I was wondering if you could maybe explain about
how you could work, for example, with the revenge
porn helpline or how does that work? How do you
differ from those kinds of services? Yeah. So
there's kind of three things. There's forensic
watermarking, which this is. which adds user
data in there, or it could add origin data, or
it could add the price that someone paid for
something. It could be used in many different
ways. There is hash matching, and that's both
exact hash matching and perceptual. Like, is
it potentially the same image? And then there's
fingerprinting. And fingerprinting is a way that
you can then find that exact copy of that thing
out there in the world. We work in conjunction
with all of these wonderful things. We would
love to work more with Stop NCII, but we're completely
self -funded and it costs money to do that, even
though they're a charity. And to kind of touch
on the kind of commercial side of this, I've
paid for this development and this tech completely
from my own pocket because this is so important
to me. charge the platforms because that's when
the harm is happening. We don't have a penny
to waste and we are super, super, super tight
on what we spend our money on. So to work with
a charity in partnership with them, we need to
be able to fund ourselves to grow big, to be
able to prevent this harm happening. And then
if they need funding, then we can give it to
them because we've earned enough and we've made
sure our ecosystem is running. The last thing
I want to do is make a profit -making machine.
If any profit that we make is going to go straight
back into the system, because this is what needs
it. And when I was thinking of setting up a company,
I was like, how? How do I do this? I don't have
any money. I could set up a company that's a
charity. I could set up a community interest
group. And to do that, I needed to have so many
kind of grants and things like that. And then
there was also the model, do I sort of do this
with fundraising and stuff like that? And I thought,
I don't want to pull from the community. Like
I need this protection now. I don't need to fundraise
and get money in to be able to do this. So I
need this now. So I'm just going to pay for it
to happen. So we do work directly with Stop NCII,
but we are not a partner because we can't afford
to pay that fee. That's a long winded answer,
hey. No, it's a good one. It's a good one. As
you've just mentioned, obviously this is a commercial
entity and we've also spoken about how Bellingcat
is open source and how, to be honest, a lot of
the tech that we do spotlight in this platform
is open source oriented. There is some protective
tech. that is open source source code for public
audit and transparency. For example, Teller is
a really cool tool that helps automatically encrypt
a reporter's data on the front lines if they
are filming within it. Or we have Bellingcat's
auto -archiver tool, which uses one -way cryptographic
hashing to archive an image, video, or post,
even when it's taken offline. But ImageAngel
is closed source, so why have you chosen... to
be closed source and if your algorithm relies
on the source code staying a secret to remain
secure, isn't that a structural vulnerability?
Like how do you address why it's closed source?
It's closed source at the moment because we're
using a specific type of tech that we have to
pay for because we want to be the best. So we
outsource, we buy that and we use it. What we
need to do to remain robust against manipulations
going forward is get rid of that dependency poly
third party and build our own. But we also then
have that dependency on us. And what if someone
works out how to manipulate that? So what we
are now doing is taking a mixture of open source,
closed source, and combining each of those in
various platforms so that it is harder to then
decode in the long run. We're always fighting
against the next thing to kind of break and and
close the stuff, right? So it's always a constant
fight. So what we want to do is just always change
that model so it's harder to decode. But also
what we do is depending on a platform's risk
appetite, vulnerability to this kind of thing,
we work with them directly to figure out the
best model and method for adjusting the algorithm
of the implementation of the watermark. Yeah,
it is interesting, the technicality of everything.
And I really want to dig into that, but we've
had a few, we've still got quite a few questions
to work through, so I want to quickly get them
in. Someone's just asked how much of this is
about risk awareness and accepting that content
placed online may be misused versus preventing
misuse or responding to it. For example, through
techniques like that hex technique. In some cases
is understanding and accepting the risks of sharing
content, such as having an OnlyFans account,
more important than focusing on response. Yeah,
I mean, there is a risk to everything. And honestly,
everyone says to me, oh, well, what do you expect?
You know, having an OnlyFans account, what do
you expect? Well, I expect a little bit of decency
and privacy. I would never share the images that
are sent to me from a user. There is that implicit
expectation of being in a private chat that this
communication doesn't go elsewhere. And our watermark
will only ever apply to content that is private.
There's no point watermarking stuff that's out
there in the world and free to view. That's not
what we do. We're not necessarily here to enforce
copyright. If someone wishes to do that, we can
support them. The main aim of the company is
to prevent harm, and that is with a deterrence
method. Adding in data of consumers into the
content they watch could be seen as a surveillance
sort of, well, that means every piece of content
contains my information and what if this and
what if that? And the simple answer is if you
do no wrong, nothing happens. It is not illegal
to share your own content. You can do what you
want with that image once you've taken a screenshot
of it or a screen recording. You can do what
you want, but you shouldn't be doing that. And
if you do do a negative thing, you could potentially
be caught and understand what the repercussions
of that could be anything from just being banned
or kicked off that platform, for example. So
for example, if you were a content creator who
had a private paid for space, like for example,
people had to pay to gain content and that content
was leaked, would your company help in that sense?
Yeah, definitely. If a consumer was talking with
a content creator and a content creator threatened
to leak or something, their private material
in the same regard, that's a private space. Interesting.
We've had quite a few questions focusing on whether
you've had any success with the big tech platforms
adopting your tech or showing any interest in
it. I wonder if you can speak about that. So
we've had, because of my experience in the adult
space, I used my connections and was like, look,
I've been working on your platform for XYZ time.
Do you think you could use this tech? And mostly
they said no. But there was one platform called
Friends To Follow who were like, we love this,
we want this, make it happen. They've been really,
really great in paying. They paid us, they gave
us money to put this system in their platform
and it's live and it's active and it's protecting
half a million users. And that's the kind of
good tech I see. I've approached, you could pretty
much name every tech platform. We have in some
way approached them. I can't say who has and
who hasn't decided to go ahead with it because
there are some people who are under NDA. The
big, big ones. But I guess I can say, can I say
I can say if someone has decided not to go ahead
with something. Yeah. Yeah. Meta said that they
didn't have a problem with stop NCII. So I was
like, okay. If you think that, cool. I think
there is a certain amount of unwillingness to
accept that this is a good solution, partly because
of my background. In fact, I had somebody who
pitched the deck to, and they said, yeah, you've
not done bad for a whore. And I thought, yeah,
I've not done bad for a whore. Fuck you. But
there are some people who don't like what I do
because of where I've come from, I suppose. I'm
not a native in the tech land, I don't speak
in the same way. So there has been some people
who don't want to be anything to do with this.
And I've actually experienced quite a lot of
negativity from people who are really, really
big voices in violence against women and girls
spaces. Even though I felt that harm, you know?
And I created this to be able to prevent... content
from getting out there and leaking and that kind
of harm that comes through. So the response has
been really mixed. Some places are really keen,
others don't even want to talk about it. And
that's probably because trust and safety is very
different to compliance. Compliance is, oh, I
made my system this safe. Look, we made it. Whereas
trust and safety is anticipating harm, adding
in prevention instead of reaction. I hope that
that will change. There's some quite sarcastic
shock in the chat about Metta saying no. I am
so sorry if somebody said that to you as well.
That's disgusting. You mentioned the tech platforms.
What about governments? For example, why is forensic
watermarking not part of the UK government strategy?
They recently declared intimate image abuse a
national emergency, yet regulations like the
Online Safety Act focus almost entirely on reactive
measures, giving platforms 48 hours take down
content after it's reported, for example. Why
do you think the government and Ofcom in the
UK and more globally as well are hesitant to
mandate preventative server -side forensic tracking?
I wish I knew. I wish I knew. I have been, I'm
not going to lie, bugging Ofcom particularly,
but also the EU commission. about this tech.
I think they don't understand it. If I read,
and if you search through Ofcom's guidance and
you search the word watermarking, in one of them,
probably the most, not the most recent, I haven't
checked that one before that, you search the
word watermarking, it comes up with one thing
referencing, you know, like the old Getty Images
watermark, like Getty Images, proof of origin.
I don't think they get it. But I have been thankfully
invited to teach Ofcom about the tech itself.
Now, of course they have to be really impartial
and I respect that. I'm not interested in kind
of dominating the market and making loads of
kind of moves and money. I want people to be
safe. I don't care if there's another company
out there that can do this. Go ahead and do it.
I need Ofcom to back me, but I don't feel like
I have that. And I don't know why. There you
go. There's your call to action guys. If you
want to make an open source product that takes
the image, go wild. There is someone else who
does this. In fact, there's a couple of companies
that do this and I've raised with them that I
would love to collaborate. I see a world in which
we decode someone else's watermark and we can
say, hey, your content came to us. It actually
belongs to you. You know how to decode that.
And we work as a collaborative approach. It wasn't
welcomed. I tell you what, I'm surprised. I really
am. I grew up in a world where I thought when
I grow up, it's never going to be like that.
And I've grown up and I've realized It's capitalist
hell out here. I hate it. I hope I can weave
a little path out here and do things a bit differently.
Well, we're all about collaboration here, hence
this space. And we do have, by the way, as I'm
on this subject, we do have a space in the server.
If you want to contribute to Bellingcat tools,
you can. It's called Tech Contributors. I'm sure
one of the mods can link it. And then we also
have a space called hashtag tool development,
where you can work together building tools, open
source ones, hopefully. But you can have a little
chat in that space too. Somebody's asked, do
you think that there is some merit in taking
this product to T &S terms and services conferences
that happen around the globe, just as a way to
show the teams firsthand on how this can add
value for users on their platforms? Have you
ever thought about doing that? Yeah, we are actually
presenting at Trustcon in the next few weeks.
It's tough though, because it costs money, doesn't
it, to go to these things. And we're only earning
a little bit of money from the platforms that
we're installed on. Look, it all kind of comes
down to money, doesn't it? It sucks. I hate it.
But yeah, it's something we're doing. It's something
we're doing. The thing is I'm only as powerful
as my team and as the presence of people who
are kind of in the movement with us. We're only
as powerful as those voices. And we're a minority
voice. Like sex workers want this. Sex workers
are a minority voice. No one listens, right?
So to get where we've got to, I'm damn proud.
And to be at TrustCon is pretty cool. But it
all takes time or takes money, you know, effort
and... I swear I have not seen my husband for
a couple of bloody months. Poor guy. He's such
a wonderful guy. He's really supported. This
wouldn't be where it is if it weren't for him.
In regards to money, you were talking at the
beginning as to why you keep the service free
for those that have been subjected to online
image abuse. But platforms like Telegram, for
example, are primary battlegrounds for information
warfare. I mean, a lot of the Bellingcat investigations
start in places like Telegram, but they fiercely
guard their architectural privacy and refuse
server -side moderation. If a platform refuses
to integrate your API, is there a way that journalists
or client -side solutions could work? For example,
allowing journalists or investigators to use
the tech. Is there a way that it could work on
the client side where it doesn't necessarily
have to have the platform's approval? I don't
know. I'm going to say I don't know because I
don't come from a tech background. We have an
amazing tech team working with us. they are so
much better place to answer those questions.
But if a platform does not want a system like
this, that's okay because we do have to have
spaces and places that can be anonymous and you
can go via VPN. You need to be able to do these
things to be critical and to share things that
need to be shared in kind of anonymous places.
This tech is not about changing the whole infrastructure
of the internet. It's about changing the mindset
of people who view content that is privileged
and private. How that happens in a space that
won't do that is a tech question I cannot answer.
And there's probably people in the chat that
can answer that other than I can, for sure. Yeah,
I think there's a cripple of questions about
the technicalities of all of this. I'd love to
dig into that a little bit more. Like for example,
how do you ensure that if somebody's computer
is hacked, for example, and these are leaked,
how do you prevent those kind of false positives
from happening? because as you mentioned, the
kind of watermark gives the user ID. So has there
been cases where that's happened or is there
a way to deal with that kind of situation? So
there's been no cases yet that have happened
in that way. We've worked with a charity called
Refuge to try and understand the way this could
be used in a negative. What could happen to try
and attack this? And we know that it is perfectly
possible that someone will use this method to
try and catch someone out to find data on someone
and create cases that are malicious or get content
taken down. And that's something that we still
need to figure out ourselves. How do we verify
the person who is giving us the information is
the person they say they are? Is that their content?
What information are they trying to find out?
So in the first instance, what we do is if someone
comes directly to us, as a company, we give them
as much information as we feel is right at that
time, which is, thank you very much for submitting
this. We're looking into it. And that's all we
do at that point. We then have a little look.
We see what's in there. If there is no data,
we don't say there is no data. We just say, we
can't do anything with this at this time. We
don't say whether or not there is, or there isn't,
or we found anything. We just sort of say, you
know, sorry, we can't help you today kind of
thing. If we do find data in there, we don't
tell them that either. We then go and find the
information on the platform that it has been
flagged so that we then know, is this a legitimate
request? Because we know that there will be people
who are trying to find content that is not watermarked
so that they can then use that in a space for
abuse or even find content that is watermarked.
There's also that privacy around I'm a user.
I've had my content leaked. I don't want to be
seen as troublesome for the platform that I'm
earning my money on. I'm already feel like I'm
a target or I'm shadow banned. I don't want to
be causing this company more stress and them
think it's a me problem. So we also don't tell
the platform who that end user is. It's a very
complex dance between data and finding the right
information without giving the right information
over and it's complex. But we have a person entirely
dedicated to both GDPR and then we have that
support service who works on making sure that
there is no harm happening in these kind of edge,
weird, odd cases. In regards to, you mentioned
at the beginning that, you know, if it's screen
-shotted or posted across platforms, this forensic
watermarking still tracks. Yeah. However, we
see a lot of manipulation. If somebody mentioned
earlier that one manipulation that's done is
video inversion, for example, horizontal flipping.
We also obviously see... deep fakes now as well
of people taking original video of, for example,
a professional sexual performer and putting a
different face on that. In those cases, is the
watermark strong enough to follow that kind of
paper trail? Is there circumstances, for example,
with AI manipulation where that trail could meet
a dead end? Absolutely. If you're determined
enough, you can break this. There is nothing
that this will survive through if you are determined
enough. We know people who are determined to
do harm will do everything they can. This is
designed for casual, I'm going to call it just
opportunistic and silly leaks. People being stupid,
opportunistic and thinking they might get away
with it. This is not for creating a system that
is unbreakable. It's impossible to create a system
that's unbreakable. I would say that there's
a spectrum of it. The more you do to an image,
the less likely we are to be able to extract
data. But also the more information we put in
there, the less likely it is that we can extract
it. because there's a payoff between how invisible
it looks and how much data we can embed in there.
So it's a dance again of how much information
can we put so we can still identify you but you
still can view the image of disruption versus
how much manipulation can happen to it and every
case. when it comes down to anything outside
of that very generic crop flip minor edit will
then be an individual case that we have a human
review. And that's so important because we also
don't want false negatives. Absolutely. There's
always a hole in every method, in every tech.
If you are looking to the future, In regards
to this space, in regards to protective tech,
what is the biggest technical or cultural hurdle
you predict you might face in making this technology
an uncompromised standard? What are the biggest
obstacles facing protective tech in this space?
You're talking a bit of quantum and we're all
up a creek without a paddle, right? So if we
were to go that far, we're done for, we're cooked.
But in short term, I think the biggest hurdle
is adoption. If, for example, every, let's say,
easily findable space on the internet that our
friends and family use, uses a system like this,
then it will start to become colloquial knowledge
that you don't do that. And then the more people
who get kind of caught for doing negative things
in spaces like this, it will kind of become known,
oh yeah, that was like, did you know what happened
to him? And it becomes kind of that colloquial
understanding that you just don't do that. And
that starts to create a social change of, we
respect people in this kind of space. So adoption
is probably the biggest thing. And I need people
to want it. You know, is this something that
people even want? Do we need people having data
injected into imagery? Our research shows that
it does, but if the wider world doesn't want
to adopt this, then it doesn't go anywhere. Yeah,
absolutely. I mean, you need to make sure that
you're building it for the right people, right?
But you did mention that you were saying that
you, at the beginning, did ask that exact question
to those that have been subjected to this abuse
previously. Sarah, one of our amazing mods in
the chats just asked, regarding humans reviewing
complicated cases, are the people doing so compiling
anything they're learning as they review these
cases? EG, if they are able to see a pattern
in the way Image Angel is outsmarted, is that
being documented for future improvements? Yes,
it is. Yeah. Everything that we do, we need to
keep a record of it because then it improves
our system. But also everything we do to our
imagery also makes the kind of the anti, the
people who were kind of trying to attack it stronger.
So we're always, it's just cat and mouse. We're
always trying to adjust and change. And that
will always be the case. And I think that's great
for innovation. We have ideas. for changing the
way this works, for adding in extra data, for
additional products that could support systems
and take downs and searches and added in signals.
It's all a part of development and they all will
come in time and it all has to be for the right
reasons. But yeah, everything. to be like, how
are we learning? But also importantly, it's really
vital that the people in that human in the loop
don't view this kind of information and content.
So we have to go through a really stringent process
of keeping as much of that content blurred and
blocked out as possible. So even if we do need
to take that piece of information, how do we
make sure that that user is protected and safe?
And also that your nudes aren't being seen by
some tech guy. We've had a couple of questions
about court cases. I don't know if this tech
has ever been used in a legal case, but they've
asked if this is used in court, does having a
watermark have positive effect on the outcome?
Similar to having a lock on a property, how it's
approving that the thief saw it and knew he is
breaking in. I feel like regardless of the technical
part being a hundred percent, this could be a
big benefit in the legal part of the issue. Have
you interacted with that? legal procedure world
yet? Because obviously that's something that
a lot of we do with war crimes, for example,
war crime imagery and manipulated imagery. We
have previously provided information for legal
processes. So is that something that you kind
of work with on your side? Yeah, and it's something
that we want to do more of. The problem is, again,
resources. We're still a startup. We're still
scaling. What we do is test, ask, nudge everyone
all the time. What we know is that data embedded
in imagery is not unusual in court cases. There's
metadata, there's even information like a username,
a handle that could be kind of linked back to
the person who created the deepfake. And there
have been cases that have been successfully prosecuted
in those cases. With the Image Angel, not yet.
But hopefully that'll be the case. And then when
it comes to AI manipulation and how much data
is still left in there, it is possible to still
see information held within an image. Only we
can't read the exact data, but the presence of
the regeneration of those pixels proves that
there was an original image that came from that
non -conceptual space. and just the presence
of it alone. Even though we cannot record or
find enough robust data to pinpoint exactly who
it was, the presence of it there, even visually,
denotes that there was something there and that
can go along to supporting. I know a lot of people
are going to say, oh, well, I had my device stolen.
I was packed. The biggest defense when somebody
is being accused of intimate image abuse or deep
fake creation, for example, is I was hacked,
I had my phone stolen. That may very well be
the case and life is like shit. Things happen,
bad things happen. What we could also do in this
evidence gathering is prove a kind of a pattern
of abuse and we may be able to track somebody's
abusing across a matter of months or weeks. So
it is quite possible that someone had the device
taken and stolen and accessed then, but would
that pattern continue? Who knows? It's all adding
evidence to support people. If you are interested
in this particular subject, I definitely recommend
listening back to our last stage talk with the
CNN team who spoke about some of the work that
they've done, uncovering communities who were
sharing, online communities who were sharing
intimate imagery. that was either filmed or was
leaked. They were into detail about the accountability
there and how they conducted those investigations.
It's definitely worth listening back to and those
links are in the chat and also will be in the
description of the podcast if you're listening
back. And thank you, Sarah, for pinning that
again. We've only got a couple of minutes left,
so I'm going to have to squeeze in the last few
questions now. We had a question earlier. saying,
has there been any resistance in adoption from
the OnlyFans sex worker space? I figured that
would be an audience open to watermarking. You
mentioned that you consulted a few people from
that space, but has there been any resistance
in adoption from those spaces? No, all of my
friends I would say now are sex workers. I had
such a wonderful community around me, sex workers,
creators, you name it. artists of all sorts of
walks of life. There has been no resistance to
it. The only sort of thought was, oh, wait, wait,
wait, are you putting my data in it as a creator?
You know, can that person track who I am? But
no, that's, you don't need to prove who you are.
It's your face or it's, you know, you've got
the original. No, and even in the consumer space
as well. A lot of people I've been speaking to
are consumers of pornography and adult content
and social media and stuff. Nobody has said,
I don't want that. And I think it's because we're
used to data doing things. We know that if we
are responsible for something online, it can
be traced back to us. Our search history is,
you know, it's possible to link these things
back to us. We're never entirely anonymous. I
think it's not beyond our understanding that
this is a thing. And the only people who would
potentially be opposed to it, and I welcome opposition,
are people who would want to do something negative
with that. The one thing that we need to make
sure is that this cannot be used in a negative
way. And that's something that will always be
evolving. Yeah, absolutely. I would potentially
challenge your notion that everybody knows how
much information is behind each thing that they
upload. The stuff that we find in metadata is
sometimes hilarious or source code of websites.
If you want a reference, go check out our work
on the Kinahan Cartel and see kind of what professional
criminal organizations are sharing online. You'll
see the people's understanding of what is being
shared. Right, we are nearly end of time. So
I wanted to ask, as this talk is really about
building protective tech. What would be your
advice to people who perhaps are listening and
want to go out and build something similar themselves?
What would your advice be to those who are looking
to develop protective tech? I think it's important
that we stop and pause and think, who am I building
this for and what are the potential negatives?
Well, how could this be manipulated and used
in a negative way? If we're going to build good
stuff, we have to make sure that it's truly good.
It really, really is good and not just good in
our minds or in our projection of our world.
Is this good for the global South? Is this good
for old people? Is this good for more people
than I can conceive? And that's what we try to
do is stress test in as many different environments
as possible. But also I would say, don't do what
I did and wait. I took this idea to hundreds
of people, I would think, over the time, you
know, hundreds of platforms like, oh, I've got
an idea, would you like to develop this? Everyone
said, no, it's not possible. And I thought, no,
it really is possible and it's really important.
And being ready to do that was a choice. I had
to make that choice. Like I'm never, you're never
going to be financially ready, emotionally ready.
Your home life is never going to be settled enough.
If you want to go out and make a difference,
you got to go and grab it. It's a choice. You
need to make the choice. And if you're not feeling
inspired enough already, as I said, do go look
at hashtag tech development in here because there's
lots of people trying to do the same. We had
a question earlier and I promised them that I
would ask this towards the end. Are you hiring
and or supporting contributors to this project
as you're building it out? Because I think you
have a lot of sans in this space now. I need
fans. Every day I struggle with like, am I doing
the right thing? I've got imposter syndrome to
the max. Are we hiring? We're not directly hiring
because we are growing slow and growing well,
but we want to build a database of people who
want to work for us so that when we have those
money and that time, we give back. I want to
hire the best brains. If you want to work for
us, please come and say hi. If you have a thought,
I'd even love to know, what do you hate about
it? What do you challenge? What do you want to
do? What do you want to hear and say? I'm putting
my heart out to the Bellingcat community. Just
tell me what you think. I'd love to hear your
feedback. And how can they do that would be my
follow up question. Probably Instagram is probably
the best way. We also have TikTok. We have LinkedIn.
We have an X, but I don't like to use it. And
all of it will be linked on our website. But
if you search Image Angel with an underscore
at the end, you'll likely find us. I'm just dropping
that Instagram link into the chat now, and I'll
include it in the description of the podcast.
Finally, finally, finally, as I mentioned at
the start, Bellingcat doesn't endorse individual
companies. So I wanted to ask you if there's
anybody else in this space that you would want
to shout out? For example, is there any other
resources that have been vital to your building
of this project or any other companies that are
doing something cool that you think should be
on people's radars? Oh, my God. Oh, my God. Oh,
my God. That's completely blank. That probably
is. I would say Not Your Porn are a really good
group of people. Not Your Porn is a group that
victims, allies, and they just jump in and try
and lobby and get change to happen. It's a not
for profit. They are volunteer run. They are
awesome. Go and support Not Your Porn. I just
dropped their LinkedIn in the chat there. I didn't
have, I couldn't find the website that quickly,
but it is there. And hopefully you can explore
that and I'll make sure to find the proper link.
Oh, thank you people in the chat for the description
of the podcast. All right. We are about time.
Thank you so much Madelaine, for your time today
and for going through this amazing tech. It's
really fascinating to hear a little bit about.
your solution for this massive problem. And hopefully
it's inspired others in the audience to think
about how they can shape their own solutions
for this issue. A lot of love in the comments.
In two weeks time, we will be back with another
stage talk. It is not going to be on this subject.
We have covered this subject quite a bit over
the last few weeks. We are going to be moving
to environmental. investigations in two weeks
time. We have a fantastic environmental journalist
coming in who recently won environmental journalist
of the year awards, and they're going to be coming
in to talk about how you can do environmental
investigations digitally. So that's what the
next stage talk will be about. But for now, thank
you again, Madelaine. Thank you for having me.
Thank you for listening to the stage talk. If
you'd like to catch a stage tour live where you
can ask the guest questions, join the Bellingcat
Discord server by visiting www .discord .gg slash
Bellingcat. The music you've heard is titled
Dawn by Newer Self and is courtesy of Artlist.