Latest / Show & Tell from Indicator / How a Haaretz reporter infiltrates companies offering disinformation-as-a-service

Transcript

How a Haaretz reporter infiltrates companies offering disinformation-as-a-service · Show & Tell from Indicator

• Craig Silverman: Hey folks, welcome to Show and Tell, the podcast from Indicator that takes you inside digital investigations by leading journalists, OSINT investigators, threat analysts, and researchers. I'm Craig Silverman. Alexios Mantzarlis: And I'm Alexis Mancelis. Indicator Media is a resource for professionals and citizens who want to investigate and understand digital deception. If you are here by mistake, if you got confused, we hope you will stick around and look for our investigations and workshops. Craig Silverman: And you can also ⁓ sign up to our free newsletter. ⁓ we'll have the link in the show notes. You can also just go to indicator dot media. And of course you can hit subscribe ⁓ to make sure you don't miss another episode of Show and Tell. Alexios Mantzarlis: Big thank you to our founding sponsor, Lead Stories, which is a global fact-checking organization with journalists working in a dozen languages around the world. Lead Stories combines old-fashioned journalism skills with technology to find and debunk false claims on social media. And they believe, and I happen to agree, that fact-checking is about adding information, not censoring. Today, we are talking to Omar Ben-Jakob, the disinformation and cyber reporter for Haaretz. Hi, Omar. Omer Benjakob: Hi, thanks for having me. Alexios Mantzarlis: We're thrilled to have you. Omer was part of the project Pegasus Investigative Journalism Consortium and is focused on the intersection between technology and politics. He also writes about Wikipedia. if you are an indicator reader, lot of the stuff that Omer writes, if not all of the stuff that Omer writes, you should be interested in. ⁓ no, of course, I wouldn't say it to anyone. ⁓ when I saw Omer give a... Omer Benjakob: That's very kind of you. Alexios Mantzarlis: short talk in Perugia and you were trying to make ⁓ fetch happen in the sense that you were trying to mainstream this term DAS or disinformation as a service. I am a sucker for a good acronym. I understand though that maybe not everyone is. ⁓ But can you tell us a little bit why you think it's worth to think about DAS to put this in some kind of Omer Benjakob: Yeah. Yeah. Alexios Mantzarlis: in this context, why you felt like framing it this way mattered. Omer Benjakob: Yeah, yeah, sure. So I'll I'll kind of take the opportunity to wanna name check and thank ⁓ you said your spont your founding sponsors lead story. Just today I use them in my actual reporting because Haalitz it's a really interesting example to start with. Haalitz was ⁓ spoofed. So someone created a fake Haalitz like domain, Haaritz twenty-four. ⁓ it's it's very reminiscent of Doppelganger and things we've seen in the past, ⁓ where it was like a complete just like technical Alexios Mantzarlis: Look at that. Mm-hmm. Omer Benjakob: Copy of the Haretz website. The domain was Haretz 24 or something like that. And ⁓ shockingly or not shockingly, there was one link being pushed out about how Zelensky is linked to some Jewish oligarch who is actually a real oligarch who does actually live in Israel. ⁓ And of you know, there's some unholy corruption happening in this echo space, and of course, Haretz diligently reported this. I think it and the byline, I think, was for like our transportation reporter or something. Like so they fudged the byline, like it was the wrong reporter, but everything else looked quite real. ⁓ Alexios Mantzarlis: Yeah. Hmph. Of course. Omer Benjakob: ⁓ and I and I kind of had to debunk then and one of the things already up in the air which kind of helped me say that the actual story was debunked was ⁓ the organization and and I think this is a good way to connect to Dust, Alexios Mantzarlis: There Omer Benjakob: this kind of concept of das is to say it's an industry that undermines the conditions of possibility that make kind of personal accountability possible and keep all of us straight. Das as an industry undermines. And I think it does it in two ways. So one, it creates these fake humans. So that's kind of the main asset that is sold. ⁓ But also kind of dilutes ⁓ credibility online in a very kind of interesting way. I think ⁓ we we have this very sad kind of I I I'd almost call it like poverty of intellectual debate around disinformation online. Or so much of our debate is like obfuscated by by social media interest and this like it's a content moderation debate so much of the time or it's like a free speech debate so much of the time. And I think we miss these kind of like more economic or structural things. And I think, ⁓ you you think about how my newspaper makes money. Like we pay people like me to do good work that takes a a lot of time to do, ⁓ with the assumption if I do good journalism someone will be willing to fork out, you know, like roughly more than a hundred bucks for a subscription because subscriptions, you know, I have to provide like real journalistic value for that and the ads are that much better and so on and so forth. But if I'm now competing in a social media feed diluted by fake people putting out fake websites, it becomes that much harder for me to actually be heard and for my stories to resonate. I think in that sense, journalist and media is actually disproportionately affected by disinformation online, as my kind of opening example of this fake Haaretz website shows. Beyond the fact that it's abusing my credibility, it's actually stealing my traffic at some level. It's like stealing my ⁓ credibility to be able ⁓ ride the traffic and influence people therefore also undermines Haaretz's credibility in the long run. Craig Silverman: It it is interesting to ⁓ to kind of think of it like a lot of times as you say, the conversation around disinformation is often around the content, right? and so to almost like recenter it around well, we're talking about, you know, you often need fake humans to spread it. Like s sometimes it is like it's an idea and it's a narrative and it's appealing to real humans and it spreads that way. But Alexios Mantzarlis: Yeah. Craig Silverman: As as you know, we're gonna dive into more in a second, a lot of times there's a system underpinning it that it's not just, okay, let's come up with a good catchy idea or a meme and hope real people spread it. It's actually let's see the whole network of fake humans. And one of the things that actually comes to mind for me is that a lot of times when I interact with platforms, You know, when you're talking about fake engagement or fake accounts, obviously they don't like them, they don't want them, but they don't necessarily that's not their biggest, highest risk activity. But if you allow fake accounts to flourish, then it opens the door to so many other like then they can be used for so many different things, scams, fraud, et cetera, et cetera. And so it is interesting to kind of take it back to the sort of a fake human idea on that. Alexios Mantzarlis: Yeah, and for what it's worth on the right now, you know, it's going to be both much easier to create credible fake humans ⁓ a combination of AI tools. ⁓ it also becomes ⁓ more of a focus of trust and safety teams at platforms as content becomes so much harder to differentiate between real and fake. And so it does become an even more central ⁓ space of intervention. But let's so let's talk about Das in ⁓ Omer Benjakob: Yeah. Alexios Mantzarlis: the context of your series of investigations, this was a few years ago, we'll do then some more recent articles, but ⁓ your seminal investigations into Team Jorge. it's worth focusing a little bit on the how and then maybe tell us a little bit about the what. But basically, you pretended to hire this sketchy agency, as one does, to interfere with an election in an undisclosed country in Sub-Saharan Africa in order... Omer Benjakob: That's right. Yeah. Alexios Mantzarlis: to get from them the full pitch of their capabilities. So how do you come up with this idea and what suite of tools did they offer you? Omer Benjakob: Yeah. So the backstory to this is actually amazing because I had really the unique privilege and sheer luck to be part of this consortium organized by Forbidden Stories that focused on NSO and the NSO project was so successful in terms of like collaboration and actually showing how when we work together and we kind of do away with this very old ⁓ idea of exclusivity, ⁓ we actually resonate much louder. Like when you have a group of journalists from a group of country, and when the data is so rich that you that everyone can have their own kind of focus, it just expands the story. It doesn't cannibalize it quite the opposite. So we had this really strong use case. And it was also quite, I think, like like we became a kind of this group. And then there was this almost idea to like instead of waiting for a leak, to be like, what would we want to do as a group? What would be interesting for us? And disinformation was just like topped everything. And the the two kind of three questions that that was most interesting for us was just like who? Alexios Mantzarlis: Yeah. Mm-hmm. Omer Benjakob: Like at a basic level, you know, it's like like with viruses. You're like you're like, but who actually does this? Like who would create a virus, right? You what I mean? Like you have to like get into a certain kind of criminal headspace 'cause most of us don't think like criminals or don't think like political actors in that way, right? And then ⁓ because we were meeting as this collective ⁓ to kind of discuss what we're interested in, we were discussing different ideas. And one thing that a lot of us who cover tech were were interested in was looking at the avatar industry because like I already back then hated people saying like bots. Like bots is such a like a forgive me BS term. It's so like drenched in this technological thing. And I think Craig you made a very astute point where it's like part of our misplaced vision or idea of disinformation is that it's this like really, you know, fully technical thing, just fake accounts like retweeting saying like Trump is great, Trump is great, Trump is great, Hillary sucks, Hillary sucks, Hillary sucks. But it's not actually that. That's where the fake humans come from. It's actually something much more complex that does actually try to sway you. And and there are many times real humans in the loop, as we would say now post AI, so called super spreaders. We know this from the COVID. So it's actually you really need real people and real assets. That's why it becomes harder over time because it finds harder to find believable people, right? The more someone, the more you use an asset, the less believable they be. And then you have to hijack Arts, the Spiegel, Le Monde. You have to actually steal real websites like the Denver Guardian that we saw in 2016 just doesn't cut it anymore. And we were interested in how that works. So we knew there was an avatar industry that was actually focused on kind of like surveilling social media, because you also need accounts, right, to do ⁓ deep web analysis. So there's also this industry, and me and two other reporters had this hypothesis that like if you run avatars for surveillance, you also get caught, right? Like the same way if you run avatars just for pushing Trump, you get caught. Like a real human does a lot of different things. And I we I we had this hypothesis that there was an overlap between these two industries that like ⁓ if you run avatars to social media, you probably also need avatars to push out some content, and you don't care what content they do, ⁓ as long as it's just churning out your thing. ⁓ And then Gulme Guido, my colleague from the De Marker, who's I genuinely think one of the most talented reporters in the world, just had this idea. Like he literally said this over wine in Paris. He just said, like, why don't we just pretend to be like the representatives of some non democratic country and then try to solicit pitches and like just everyone like That's crazy, that will never work. Some people who have like their countries, you know, don't allow this like ethically were like, That's really a bad idea. And like all the French and like German and like British reporters were like, That's a great idea. How'd like how would you do that? Like like w when can we start doing that? And then like ⁓ we kind of joined up with Frederick Mithizol Radio France, Alexios Mantzarlis: Thanks Omer Benjakob: And and we just started kind of like developing this as a as a big group, but also with us three core people, because Israel is uniquely poised in a in in a good and bad way for this kind of stuff. ⁓ because you do have this in Europe, ⁓ but in Europe you also have very kind of snooty, like highbrow societies. Like you can't just walk into places the same way you can in Israel. So this kind of like what made this stunt possible was just the the sheer car like the the the very unique nature of Israeli society where you can like meet an Israeli guy who'll just tell you, Hey, I'm Bob, and you're like Alexios Mantzarlis: you Omer Benjakob: Okay, and he's like, I'm Bob too, like let's talk. You know what I mean? There's like there's a certain informality that like it just allows this kind of stuff. And and we just literally hatched this plan to start a rumor, like to talk to sources and people we knew in the this kind of avatar and in like private Intel spaces and just kind of say like, Hey, have you heard about this? Alexios Mantzarlis: Ha ha. Omer Benjakob: this French guy, this American guy and this Israeli guy in in Israel, like there they see there's like I heard a rumor, they're like shopping around for like disinformation. Have you heard anything? And after you do this enough time, like, you know, it's like with a bad tip, right? Like it just it circles back at you. So you can also start a bad tip, right? And you can say there's some French guy and he's like brought some Jewish American guy who like he's half Israeli or something like that. And there's some Israeli ringer like taking them around and they're shopping and they need like They need like this service. Like, do you know someone who does this? And at some point Alexios Mantzarlis: How long did this take, the way? Just a curiosity. Like, how long between seeding it? Yeah, that's not too bad. Omer Benjakob: It it it took it took like two or three months because it's also like it's part of this kind of I think investigative journalists kind of know this stuff. Like, you know, you're interested in something, you step into a space, you start like meeting different levels of people, and then you kind of get some sense. But a lot of it was also quite benign, to be honest. Like that's what makes this industry so interesting. Like at this low end, cheap end, these people are selling like you know, likes and followers on Instagram and like ⁓ plays on Spotify, like to like completely like, you know, just to peop influencers who want to buy influence. Alexios Mantzarlis: Yeah. Yep. Mm-hmm. Omer Benjakob: So the the political stuff is a bit higher up. So we kind of managed to get even to this kind of almost like I almost call it like shitty bot dealer level and then move our way up because at some point someone sus that we were actually like, you know, a good fishy client. And at some point someone said, Listen, you have to meet Jorge. Like this is the guy you have to meet. ⁓ I can set this up and da da da. And like and we we managed to like plug into two, three guys who set us up to Jorge. Over time we realized that they were just like sticking around with us for some commission. And we just managed to eventually have ⁓ a Zoom meeting. I always say like the investigative journalism is one of the biggest winners of COVID. Like you just you know, like they're just that they have to like they have to do the meeting on Zoom and and and they they had some OPSE. It wasn't that, like it was without cameras and dah dah dah, but like i within our first like proper meeting with Jolge, we were just like, I think not like I genuinely think like we had like double or tripled everything that was like known at that point about disinformation as an industry because Alexios Mantzarlis: Ha. Hahaha Omer Benjakob: he had a system, he had a program. Like that's kind of the germ of my Daas idea, right? Because you have SAS, you have software as a service, it was just that. It was it was disinformation as a software and also disinformation as a as service, like ⁓ das with a slash s ⁓ because like as Jolkai explained, like either he uses his software as a service and will, know, create, run, ⁓ and actually do an entire disinformation campaign for you ⁓ by creating these fake accounts and having them push out content that he can also help you create but he will also sell you this program. So you as a and he said he I only sell this to governments. So the governments get a program that allows them to then ⁓ create their own avatars and just push out. And it seemed like science fiction to us. Like we were certain we were seeing like a completely fake video ⁓ ⁓ and and we just kept having more meetings with him because they thought we were a very lucrative client and just kept getting like different iterations of the same pitch and and and it reached the point where we kind of had to just say no like we couldn't take it any further without breaking any law and then actually the really funny thing about this is that we just did it again afterwards like to another company ⁓ like that that is much less technological and just much more focused on what they deep avatars, ⁓ which is a very a scary term. ⁓ so for example they presented to me. This is a group called Psy Group. So they were famous because they were caught in the like in the kind of sidelines of the Mueller investigation of disinformation and Trump. But they're also ⁓ they've since rebranded as Percepto. And ⁓ they told us that you don't need like lots of digital accounts, you need one or two good avatars. For example, they have a French-speaking African reporter, a deep avatar called Anita Petit, who hands a website called Paula Veritas, like for the truth. And and this website, as these like guys explained to me, has many interests. So sometimes for corporate clients, they explained it's into like, you know, ⁓ corruption or like, you know, mining rights and like ivory coves. But for political stuff, it could also be interesting in other stuff. I was told to me, and it's it's a reusable smart asset. And she has credibility. She's an independent blogger. So we kind of got saw that as an industry ⁓ and then shared this kind of materials with the wider group that Forbidden Stories had organized and put together what I think is actually a very impressive, also open source investigation with. Craig Silverman: Yeah. Omer Benjakob: With the teams from Le Monde ⁓ The Guardian and Del Spiegel and Side really doing amazing work. Like we managed to find, you know, like the people that they stole the photos of the avatars from. and just maybe one more small thing about this investigation. I think the the the the the funniest or most like interesting thing we got Jorge to do is to actually do a demo campaign for us. because at some point just like, How is this even real? Facebook is actually claiming with a straight face that they invest like tens of millions of dollars in this. Alexios Mantzarlis: Mm-hmm. Omer Benjakob: And this just like Israeli guy who doesn't seem that serious. Yeah, it's not, it is not like Mossad. Like it's he's really not. Like it was really far away. And it was like the office was kind of corny. And you're like, how did he manage to build a system that within three clicks will like create a an a Gmail with a unique IP from the country with a number linked to it that is SMS verified, will then register a WhatsApp and then layer like automatically layer new accounts on like how is this even possible, right? So we wanted to test that it's true. And then we had the funny task of trying to think of a disinformation campaign that we could do, without causing damage. Cause we wanted him to just demo it, like IRL. And like in our meetings with him, we actually it was funny, like in retrospect, it's funny he didn't get that we were journalists. Like we kept saying, like, we want something awesome that we can independently verify was what we kept was the actual term we used. And then we came up with this idea. It was like this the this summer where there was this ⁓ Craig Silverman: Mm-hmm. Omer Benjakob: like very viral animal called ⁓ Emmanuel the emu, you might remember this. And and we just decided like after consulting with our legal departments, our first like our first intuition was to ask for a disinformation campaign personally targeting the journalists in the collective, which seemed like a a really smart idea. And our legal departments thought we were joking and had like there was a funny moment there when they realized like they'd we didn't think this was like then they were like, what you wanna you wanna you wanna pitch yourself as a target? I'm like, yeah, 'cause then the victim won't be mad. And they're like, no, that's just a terrible idea. Alexios Mantzarlis: Hahaha Craig Silverman: Yeah. Omer Benjakob: ⁓ and then we just said like, okay, let d let's just say that this v very popular viral animal passed away in its sleep. We found a unique hashtag that we saw was never used on Twitter and we said to test your capabilities, we want your apatars to use this. And then the Limon team and the Spiegel team just like austented the bejesus out of this hashtag. ⁓ we found close to twenty one other campaigns that some of which like we saw in his videos. So I think that's it's also a very interesting kind of use case for ausent versus like human whatever. So that's kind of our our big Alexios Mantzarlis: I'm taking away the lawyers don't care about emus, which is a question for another day, but... Craig Silverman: is kind of a tricky scenario because it's like you're in you're having a meeting with them, but of course, like they're selling something and they could be overselling what they actually have. everybody you're reporting on is a bullshitter, right? But there's something real going on, but you have to also understand yeah. Omer Benjakob: Especially in tech, especially in this tech space, right? So much of it is hype cycle, so much it's overpromising. You know what I mean? Like and and that's a it is a tough question and you don't actually know. And remember at that point, like the last thing we had heard about this field was Cambridge Analytica. And if you think about what Cambridge Analytica actually is, it's just it was a targeting firm. It was actually part of like an ad stack, you know what I mean? Like it had nothing to do with the actual content, right? At no point was it alleged that Cambridge Analytica was creating its own campaigns, right? They were just helping them focus Craig Silverman: Yeah. Alexios Mantzarlis: Mm-hmm. Omer Benjakob: And micro-target people based on psychological things. And at some point, this was like the Guardian's most interesting contribution that they had like the Cambridge Analytica League. And at some point, ⁓ like Alex Nix just asked Brittany Kaiser, like just asked her, like, hey, what is the name of the guys you work with in Kenya, like the hackers, the Israeli hackers? And she goes, Who, Julgei? ⁓ you're just like, wow, okay. And then and it was actually that, that's the content side, right? So this was the accounts targeting that used for the micro targeting. Craig Silverman: Right. Omer Benjakob: So I think that so of course you don't believe him because at that point we know bots, you know, we know Russian bots from twenty sixteen. That's what we know. Denver Guardian. Craig Silverman: Right. Yeah. And and you know, it's it's interesting 'cause you laid out kind of the tech stack that they were using for a team Corke at the time. And so there was like residential proxies for the IPs. They were getting ⁓ I guess they were getting SIM cards to have phone numbers that were, you know, whether it's physical SIMs or whatever, getting a number. And so I'm curious how that kind of stack is there stuff that like that would still be replicable and usable now? Do you think it's evolved a little bit in terms of these DAS operations? And is it a lot easier or is it more challenging for them? Omer Benjakob: That's a really, really good question. I think a lot of that hinges on how much like good or bad faith you attribute to the kind of big five, six tech companies like the tech giants and their ⁓ kind of the way they treat this stuff because it's always a cat and mouse game, right? Think about NSO and Cyber. Like it's always, you know, they patch this, this so that that in in its of itself is not new. And and I think a lot of the stuff Jorge was doing was actually like in Facebook's or in Meta's defense, I'll say like it was new. We didn't know that, you know, you could stack, for example, like a real virtual proxy, like a good one that actually uses like IoTs to run through local IPs ⁓ with of a mid like, you know, these digital eSIM things, which were still kind of nascent at that time. ⁓ so like You that may okay, you don't know you could do that, fine. ⁓ but today it that that raises a lot of good questions. I think like there's some levels that it's easier and some levels that it's much harder. I'll say this. ⁓ I I think our citizenship, like if you s look at the scale of like a hundred, two thousand, like we're no longer citizens in our countries. We're users of government ⁓ d identification databases de facto. And the way your government ID, at least in Israel, is based, is verified via Gmail and a 2FA like SMS, right? So or or WhatsApp. Like in that sense, Gmail and WhatsApp are de facto our actual state identifiers today. Like at least in Israel. Like if I have to renew my physical ID card, I have to use one of those two identifiers, right? And I think Jolge and these actors get there's a difference. So for example, you no one will now open Facebook account from some like Proton Mail. Like that will just be so sus, right? So the the idea would be to actually create a fake human. And a fake human ⁓ built on these real identifiers. And I always say that like Jorge's avatars are realer than my mom. So my mom is a social worker at like Tel Aviv's main hospital, and she uses like the the hospital kind of given email, so she doesn't have a Gmail. She has some like dot, blah blah blah, health, gov, whatever. And there's tons of stuff she can't do at a citizen level. Like she can't log into certain systems because they have these defenses against these like bespoke, you know, outlook. Like you're supposed everyone's supposed to be on some Gmail or like a meta system and ⁓ so they can have the proper two FA, either via SMS or via whatever. ⁓ like ⁓ in that sense, like if you were to like ausent my mom and ausent Jorge's avatars, my mom would probably trigger more IOCs of like a fake account. than Jorge's thing. So I think in that sense it's the th there's a cat last game, but there's also a question how much we actually update and what it's a very tough question. I think a lot of the content stuff is now much easier. Craig Silverman: know, you're noting about obviously AI is a game-changing element scaling these things up. you can generate, you know thousands of variations of the same narrative. Whereas before you might actually have to sit and write them. But you know, the other one that I'm encountering right now on an investigation is where they're hiring real workers. The workers don't know actually what the whole thing is about. And then they appear to be taking the real photos of the real workers and then they sort of tune them up a little bit with AI. So it looks like them, but not a hundred percent like them would not reverse image search match. ⁓ Maybe would facial recognition but maybe not. so it's like we're getting these real but not real, not a hundred percent AI. ⁓ and you know, the the to which we're gonna have to be dealing with and trying to put these pieces together is ⁓ you know, is just gonna get increasingly more complex, I think. Alexios Mantzarlis: And just a shout out, ⁓ because spoke about SMS verification too, ⁓ it's the heart of some identifications that many other platforms do, like Community Notes on X uses SMS verification as its way to identify other ways, the pseudonymous accounts. And ⁓ we'll in the show notes that ⁓ there's Cambridge project to track the cost of SMS verification across countries. Before we move to the show because had a lot of fascinating tell, but still we want to make sure we have some time for show, ⁓ I want to talk about a more recent investigation, just so that people don't think that ⁓ you wrote one thing four ago, you're actually extremely prolific. Omer Benjakob: Yeah. Shut up and play the hat, as they say. Alexios Mantzarlis: Yeah, you're an extremely prolific reporter. And I appreciate your work too, that you tend to try and collaborate with journalists outside of Israel as well. So a few weeks ago, you wrote a piece with the folks at Liberation about a smear operation targeting mayoral candidates in France. And the setup was similar, right? There was avatars that invented or amplified false claims, in this case of sexual abuse and kind of other debauchery. What ⁓ did you see changed? You know, this was a post-AI operation compared to Jorge's work. In some ways, looked pretty similar, the SOP. In other ways, you know, I noticed in your story, there was like a clearly cloud-generated or codex-generated website that fishy agency was using to promote its stuff personalized to the client. How much has AI changed stuff in the past few years ⁓ our beat? Omer Benjakob: No, that's a really, really good question. Actually, like I think really dovetails perfectly on what Craig had asked me because like for example, like w what we saw here in France and and to a lesser extent also in ⁓ in Slovenia quite recently is this like ⁓ websites that come up and then they kind of smear ⁓ politicians as part of this kind of, quite clearly politically linked campaign. And in this case one of those websites or one of this kind of apparatus thing in France led us ⁓ kind of this just digital infrastructure. ⁓ and and at least in my case, like I I did this in a collaboration with a reporter, a very good reporter Libracion in France, who was really chasing this story. she's ⁓ naturally good webinar and kind of stuff, but I using kind of a lot of the AI stuff managed to kind of help ⁓ and find other websites. found ⁓ some websites that seem to link back the actual company, right? ⁓ And one of the most interesting things learned post Jolge and post Percepto is that like Another interesting gap here is that we all think in terms of brands. And in this industry, it doesn't work that way because people different people have different texts and different kind of stack and different skills and they cluster together. and the companies don't matter. The company name doesn't matter. ⁓ So the company we found as linked to ⁓ one of the that was part of this anti-far left campaign in France. was a company called Blackcore. Blackcore sounds a lot like Black Cube. So anyway, you're like already excited, right? and the website was, as you quite accurately ⁓ analyzed, my friend, quite clawed in that aesthetic, right? Like I love that you can just suss it at some point, right? you know what it's like? it's like when you were younger and we we would download torrents and every illegal download was just like a minefield of of like bad links. And at some point you ⁓ you knew which one of the good links, right? Like you k you like could tell what was the fake like this is a download in a Alexios Mantzarlis: Yep. Yeah. ⁓ Omer Benjakob: Pop up pop pop up. So it's something like you just like something about the smooth movement and the rounded, like I don't know anything about design. Yeah, just like it's it's a vibe and it's a font. and it had that. And you're like, okay, so what is my takeaway here? Is that also now their opse is much easier. Their ability is now set up a company. And no one, I'd never like, I'm I'm I know a lot about this industry in Israel. There's no company called Black Corps. ⁓ it like, we have 15 years of experience and it's former Israeli intel, like blah, blah, blah, blah. And you're like, Alexios Mantzarlis: Mm-hmm. Omer Benjakob: There's no way. and it's not Black Cube. So it's a BS entity that's trying to steal their thing and now repackage it under that. And I think it's a good example because they can now set up an entire website, not just for their campaigns, but also for them, right? And then what gets caught is not even like their actual infrastructure, which has happened because, like, you know, it's like in cyber, like operators do make small technical mistakes, and then people can pivot and they can do like that research. ⁓ But what I'm finding, if I'm finding anything, is this like already synthetic kind of layer of OPSEC which is running under the already synthetic layer of the actual campaign. Craig Silverman: Yeah, it was it was interesting in that one. I mean, and and to be clear, it seems like one of the key things that you guys pivoted on was that, you know, you mentioned there's sort of the front facing brand, but really it was like it was almost like a nesting doll thing. There was this company brand with this company brand. And at the end of the day, I guess it doesn't matter to people who are buying these services, like they, you know, sure, you're using fake or deceptive company names. Like, why is that gonna bother one of these customers? But it it did seem like in that investigation. Finding subdomains connected to the domains you had found was key, is that right? Omer Benjakob: Hundred percent. ⁓ like generally this whole like DNS subdomains ⁓ was a huge, huge thing that like I think allowed us to kind of map bits and pieces of what was left online because there was a massive OPSEC delete. Like the moment this campaign was published by Le Monde, like like you know, d ⁓ like around the time of the actual election, the local election in Marseille and Toulouse. ⁓ like you know, all the pages were taken down, like the avatars were deleted, like as always happens, right? And what was left was kind of like it really is fragments, you know what I mean? Like it's very small fragments that I think the the the the French like Intel also kind of has. And I think what's actually interesting from that perspective is that like we managed to use that stuff, and it seems that our findings don't actually go much farther than what the French intelligence managed to do. So I think that's cool in terms of like I can say, wow, my webin like, you know, at on par. at some level with them, but that's also kind of dang that's weird, you know what I mean? That's like dark. Like how is it that, you know, someone brought in a likely foreign entity to mock in their election and like ⁓ a a eyes level, like a Western state, top tier Western democracy, is unable to do this, not because of lack of willpower, just because of like the so many levels of like obfuscation are so strong digitally that you actually cannot solve this problem. And like ⁓ my answer as good as the the French Intel and there's something really Alexios Mantzarlis: Mm-hmm. Omer Benjakob: Kind of I don't know, just like dark and strange about that. Craig Silverman: Yeah, and it I it it on one level, as you say, it speaks to kind of the power of OSINT and developing these skills and applying these skills because you always assume like, ⁓ they have subpoena power, no, they can do this, and ⁓ they can do that. They should be able to find a lot more, you know, and sometimes they can't, right? Omer Benjakob: No, no, no, no, no. No, no, they really can. And more than that, at some points you they actually hit very serious walls because like I think what we found was part of the stack or part of the infrastructure by who the person who was a subcontractor for the company who's actually doing this campaign. So I think like the Avatar dealer or one of the people on this infrastructure is kind of left holding some of this burning dumpster fire ⁓ or like they're chained to it, you know, kind of via their DNS, which they tried to dump, which of course is also like extremely incriminating when you email someone and then like two hours later the Craig Silverman: Right. Omer Benjakob: you know, the website goes down like the the the last DNS you see is like suddenly now, they like, turn off their account. ⁓ And I think it's it's a very strong case for AusInt and generally expanding kind of what Ausynt means. And I think that term, like I've to be honest, I've never felt really comfortable with it because like as I'd like to said, like my early stuff was about Wikipedia. Like I'm kind of came from like philosophy and the history of science and I was interested in Wikipedia and then just found that like ⁓ Craig Silverman: Yeah. Omer Benjakob: If you think about it in two thousand twelve, like, ⁓ that's actually a very strong influence for me. And I started looking at it, but I called it politics of knowledge online. And then when when Haret set up this Austin desk, my boss and my editor and Avi Sharf, who's an actual like amazing Austin reporter, he does like plane watching and like he knows this webin stuff and he's amazing at corporate docs. ⁓ He's like, I want you to join this Austin desk. I'm But I don't Austin. He's No, you do the the Wikipedia stuff is Austin. ⁓ I'm like, No, I just look at the edit history and try to find the identity of editors based on that. He's like Alexios Mantzarlis: Hehehehehe Omer Benjakob: Yeah, that's it that yeah, that's that. Like, no, no, no, it's not like Belling Cat, like I don't know the shadows, right? Like the shadow thing, like I don't know how to do it. And he's like, No, it's really like it all looks like the the Sahara to me, like I'm so bad at geography. And like he said, No, that's also kind of it. And I think it's also a confidence thing. And after you work with good researchers that help you, kind of stuff. And I think it is interesting because like I did try to get over the years, like, you know, people gave me pro bono programs, for example, like Austin programs. Alexios Mantzarlis: Hahaha Craig Silverman: You Sun Cal. Yeah. Alexios Mantzarlis: Hahaha Craig Silverman: Yeah. Omer Benjakob: And I think I was scared to use them. And I think there's something really good about learning like methodologies, I would say. ⁓ because then you're empowered to do that. And maybe some of these programs are also too tough for me, ⁓ But like I I think there's this kind of, you know, confidence intellectual thing where like, it's it's a lot of different things and and you can bring yourself and learn these methodologies and and deploy them in surprising contexts like today. Craig Silverman: Well let's ⁓ so ⁓ don't we dive in a little bit, you know, I would love for you to show us a little bit of like a a tool or technique that you rely on over and over, ⁓ and give us a sense of of what that is. Omer Benjakob: But I'll do I'll do a backstory and then I'll share. ⁓ So like ⁓ because Israel's a pretty small like there's not a lot of people doing like critical tech reporting. ⁓ and for the past two years I don't I'm not ashamed to say this. Like I've made part of my kind of I do public speaking in Hebrew in Israel alongside my journalism. ⁓ I've made kind of a side living from like, you know, railing against AI and saying it's just like a hype cycle ⁓ that is mostly compensating for the initification of Google. That was my kind of initial take. I'm like, yeah, it's the scaling of something that, you know, it's actually existed for quite a while. Like if you what like your feed is AI, come on, And like what's actually changed is that now it's just to me as well. People are looking for your funny use cases. So you can make like Studio Ghibli porn or whatever you want to do. And like, but mostly the actual value of this of in terms of it's usually it's compensating for the fact that SEO and PDF farming have just decimated Google's real value. So now I can actually ask. like knowledge based questions. And the chat thing seemed cool to me. But that like that's a that was a UX function, right? And then I saw slowly the things kind of mature. And then at some point around I don't mind saying this, but like O three, the the GPD O three, I started like listening to my friends in Israeli Tech and they like, listen, try this with terminal. Like try doing code. And I like, no, I don't know code. I have an MA in like the history of science and philosophy. Like I don't know code. And I think for so many of us like who were born in like late eighties, early nineties, whatever, like Alexios Mantzarlis: Yeah. Omer Benjakob: And remember computers before internet and then internet Like the terminal was this just kind of like frontier. Like that's a difference between people who are good with words and will go study like philosophy or journalism or whatever, and your friend who knows computing. Like that's it. That was it. The terminal was just this like ⁓ this barrier. And and and in that sense, I think the chat of the Chat GPT was ingenious in that, yes, natural language is a huge thing. ⁓ But around the O three, I did kind of get that Python, is something that I'd heard about. Alexios Mantzarlis: Yep. Omer Benjakob: does at some level look kind of like natural language or it's structured as if it's some like if not now kind of logic that as someone who's like if you study philosophy you have a very high tolerance for And I'm like, you know, compared to what? To Wittgenstein like for a second, you know what I mean? Like I'm like, I I I can deal with this for a second. Like you know what I mean? I've studied like formal logic. It's I'm not good at this stuff, but like I I I kind of just went with it. And the fact that I could keep taking it to a chat ⁓ allowed me to create like tools. Alexios Mantzarlis: Heh. Omer Benjakob: And then it changed like four or five months ago with Claude Desktop, ⁓ and cowork and since some point using terminal as on Claude ⁓ like on just via my terminal. ⁓ I think for a journalist, what makes it a game changer is the fact that it runs locally, ⁓ which also means that I actually have since I run local models for certain things because privacy is a huge issue. Like I don't store my, for example, transcriptions of my source meetings on Google Cloud. ⁓ I have a huge transcription issue 'cause I I don't want to use things that are cloud based unless I'm like really, really fine. So I'll try a bit Google pinpoint and these other kind of tools that they give journalists. But like it was an issue and I can say now that I have a fully functioning toolkit ⁓ that I will now show you two instances of. And one of them, which I will not show you, is a local transcriber that is trained on my like weird Hebrew English mix because I read about tech and I talk in Hebrew. And these transcribers have this very kind of basic dichotomy, right? It's you have to pick the language, right? Because it has to pick a model. And mine doesn't do that. Mine just goes re it and it takes forever. It's really inefficient. It would be a really bad product, but it's an amazing product for me. And it has a unique like dictionary of all my and it runs locally and it solved my problem because now I trust my transcripts. And I don't mind that it four times longer. Literally, like it will take it for because it does three times and then it runs and then there's and it backups and it documents. Craig Silverman: Mm. Right. But it's still shorter than you transcribing it yourself, so you're still winning, right? So yeah. Omer Benjakob: And my confidence in it is actually quite high. And then over time, once I've actually structured my work in a way, I now have a database of transcripts, again, completely local, which I can now, you know, now this idea of actually thinking about building some local knowledge base of, you know, fields or sources becomes realistic. I think that is also like like I can now participate in in data science as an abstract thing. And that's been really interesting for me, ⁓ someone who who doesn't have that side and is just completely qualitative. And I've just to be honest, found it so empowering. Craig Silverman: Right. Mm. Alexios Mantzarlis: Yeah. Craig Silverman: So, you know, usually when people do a show and tell, there's like a cool, you know, UI. You're taking us into a terminal. So but it's great because I agree with you. like I work in the terminal now as well Claude Code. ⁓ And I ⁓ I was I was intimidated by it as well. Omer Benjakob: Yeah. Okay, so I'm not I Craig Silverman: ⁓ it looks like you've built your own here that actually has a little bit of a UI. That's nice. But I I, you know, I echo your point to people listening. If you consider yourself to not be like a code person in the terminal of using that is intimidating, you should try it, is what I will just say quickly. But this is cool. All right, talk us through this. Omer Benjakob: Yeah. So Okay, so like I'm we're kind of cutting to the end. this is an actual toolkit I bit. It sits locally on my computer. I actually use it in my day-to-day kind of operations. ⁓ and I'm gonna show you just two kind of tools that I think this is a mock up of it for also for kind of OPSEC so all the to-do lists that I built on the side is fake. But these are the real ⁓ No no no no it's okay. I I thought this through it's okay. I thought this through ⁓ so this a fake this is it's just generated about general things that I'm kind of interested in. ⁓ Craig Silverman: Yeah, I was just looking at that and I'm like, ⁓ crap ⁓ no. Omer Benjakob: But the tools are all real. My tool script looks exactly like this based on a real HTML. ⁓ by the way, I'll just say that like I've actually created this and I think this is ⁓ something that people who are from the 90s will remember also. Like I have a homepage again. Like I actually kind of like that, you know what I mean? Like, no, really, like it's it's this is my homepage now. I don't it's not everything for me. I don't start my day here, right? So I don't have any awesome, like that. I don't read my news here. But I do kind of like it is an integral part of my work, anything from just like plugging in things on my transcriber, for example. Craig Silverman: Right. Alexios Mantzarlis: Yeah. Omer Benjakob: Which like ⁓ doesn't actually work. I'm sorry, demo mode, right? ⁓ but ⁓ but also having this like to do list which I've kind of, you know, built ⁓ which lets me organize. So the the the the Craig Silverman: And to be clear, how many of these are like custom built things versus, ⁓ this is like available on a GitHub and you integrated it here in yours? Omer Benjakob: Okay, so ⁓ just because you asked and I'll blow my own horn, none of these are linked to GitHub at any level. I I all of these are fully bespoke that I developed. The funniest thing that happened to me ⁓ two months ago was my friend who is the chief data science of an a of a of a big data company came to because I told him about this stuff and he like sure that I like just, you know, like vibe coding myself to death. And he came and he and he just and he was blown away because he said, Like, do you use GitHub? And then I said, What is GitHub? And then he said, What do you mean? And I said, What do you mean? He's like Alexios Mantzarlis: You Omer Benjakob: How do you store the files? Because he said, like, I see you have versions here. The version numbers are fake. But at some point I realized I I was getting in trouble because like as I would change one tool, it would screw up the whole other. And so I I developed this system of like versions and like different like trees and documentation. And my friend was like, It's pretty funny. Like he's like he said it's like it's like Darwin. It's like you're like a pigeon that moved to another island and you like develop. He said, He said, like you independently kind of kinda discovered like I'd say like I said it's like sixty percent of coding good practices. ⁓ Alexios Mantzarlis: Haha Yeah. Craig Silverman: Mm. Alexios Mantzarlis: Hahaha Hahaha Craig Silverman: Right. Omer Benjakob: So this is all my stuff. Of course, it uses some online repositories ⁓ and like it's based on some dependencies, but all this stuff is that I built like locally the transcriber is built on local models for Hebrew that like you know four, five, six gigabytes. ⁓ a lot of this stuff is is also just personal stuff. So like I also ⁓ have a tool that l allows me to kind of like organize my expenses, which is something I'm just terrible at for outlets. So it's just it for me. So it's like it's a folder on my desktop and I just download my receipts there and it creates a nice Excel for me. Craig Silverman: Right. Omer Benjakob: Simplifies the way I have to file it without it. So it's even things like that. Craig Silverman: Could you ⁓ it y Yeah, no, that's it. I think I was going the same place too Alexia. It's like pick pick one of them. So we've talked about the transcriber, you talked about expenses. I mean, I was sort of interested in screenshots search, but I'll defer to you which one's like the coolest that you're so proud of, you know? Alexios Mantzarlis: So what's the one you go... Oh, go ahead. Omer Benjakob: Yeah, okay. ⁓ no. So I just qu f for a second, just because you asked. ⁓ so the screenshot one is actually really funny because ⁓ it's the first one I build. I have this issue with screenshots. I I screenshot compulsively and I do so always like ad hoc. So like I sent my boss, you know, some proof of something that he's now asking me about. And then the first thing I built was a script that just like organizes them according to dates. And I was like, ⁓ I'll check when I wrote the file and I'll go back. And then I'll just like hold on a second. And what this is, long story short, it's a local thing that runs at the end of every day. It It takes all my screenshots which save automatically on my desktop. It saves them in a database. It does a visual analysis of them. And then I semantically search all my screenshots going back four years. This is a life-changing tool and it allows me to. Alexios Mantzarlis: I feel like I'm gonna copy you, because honestly, with my Insta burners, I will occasionally go through and screenshot ads, and then I have these ads for god-awful things on my camera roll. My daughter will occasionally use my phone to put a podcast on, and I'll delete them, and I can't remember if I saved them in where and how. So yeah, that's really valuable. Craig Silverman: Damn I want that. Yeah. Mm. Omer Benjakob: the whole thing and as a process it really taught me about organizing data and like where you need everything where you actually need computer vision. W and actually I data's not Alexios Mantzarlis: Yeah. Yeah, I mean, plus if you're a Wikipedia nerd, I'm sure you have some thoughts on taxonomies Omer Benjakob: Yeah. So the one I want to show you is I the one most useful for other reporters, it's called contact ⁓ and and what it is, it's based on like just the fact that I noticed that I had like indifferent leaks and sources that I had, like source materials, like you know, you just have unique names and emails. And I was like, wouldn't it be cool if I could just have like a search tool? of like all of all the emails and stuff that I had, you know, in like different documents that I got leaked over the years. And it just became this kind of initial thing to just go over my Google Drive and go over my like a a finite set of of folders to find unique names with unique phone numbers or emails. And it just developed. it kind of grew and morphed into three different tools. So one is find contact, the other one is find sources, and the other one is save sources. ⁓ So it's now actually extremely enriched. These are like actually reading lumbers. I don't mind like people seeing them, but it's like Netanyahu and like different politicians, just because like all this stuff is available at an Austin level and is leaked at at different levels. And what I've managed to do is just organize the leaks at a kind of, you know, person like for for for for, you know, in a data y kind of way where I can search and then I can find people's numbers and it's it's it's really the data set at this point is quite, quite, big. And I think so, on the one hand, yeah, like there's something kind of, you privacy issue with this stuff, right? But it's all Austin data. Like I'm not buying illegal data. ⁓ it's all op like I think it's a good example of how Austin at a at a almost kind of corporate level scale can actually now search journalists. And ⁓ and I think like for reporters, it saves tons of time. Like you to find people quickly. ⁓ and the other thing I managed to do was this kind of find sources tool which I developed for myself. Which is kind of to to just kind of search ⁓ the people in my contact. So it's a lot of them can be just like, you know, official holders in small ministries or this kind of stuff. ⁓ or people CC'd on emails that I got leaks of, right? ⁓ to kind of see ⁓ to enrich that with all synth LinkedIn data, ⁓ to kind of see who worked where. So have I ever been in touch with someone who worked at a company and I don't know about, for example, right? ⁓ that's kind of that tool. And then I can save search results. across kind of things. So then I can find clusters of people, right? So if have a leaked batch of, for example, NSO would be just an easy random example, then it's quite easy for me to now find, for example, former workers, And this is stuff that I think a lot of people do when they do, you know, AusInt on LinkedIn, right? You'll So I think that's kind of the one example I wanna search with because I think it shows how it's allowed me to kind of accumulate knowledge ⁓ and not kind of you know, you don't start every investigation fresh. And this is exactly the kind of stuff that, you know, bigger organizations has. Like, you know, if you work at Reuters, for example, you have some database like this. You know what I mean? ⁓ And like, but if you're at a small news, but you don't necessarily. So that for me has just been a huge thing. And of course, I'll say I didn't if I didn't mention this, like it's also based on my own contact list. Yeah, I also fed it my own personal contact list and exported like all the emails I've ever been in touch with. And I think we've all forgotten people we know we've been in touch with after, you know, a lot of years. And there's something just interesting to be like, ⁓ that's right. I did talk to this guy So now he works at this consulting firm. But before that, he actually did work at and it's whatever, just as a random example, right? So ⁓ Alexios Mantzarlis: The sense is like the evolution of attempts to structure our sources, kind of really to create structured data around their sources over time that was you know, over late at night at a journalism conference, you'd always be like, ⁓ if I, you know, had the time, would, you know, catalog or we would catalog, but they'd be clunky and it'd take time. And then you wouldn't have the semantics search. So, ⁓ you know, I do think it's worth you flag it too. Like this is a progression of what's. Omer Benjakob: How do you do that? Alexios Mantzarlis: should have been possible, but now it's just easier and much smarter to do and represent. Do you want to show us one more? We are kind of going way deep, but let's do one more and then we'll wrap. Craig Silverman: Mm-hmm. Omer Benjakob: I think like as Yeah. ⁓ I'm sorry, so ⁓ yeah, yeah, of course, of course. ⁓ the other one that I wanted to show you, which I think is really interesting and just very a local kind of thing for me, is the corporate registry. So Israel has ⁓ a pretty good ⁓ corporate registry and you can actually ⁓ find a lot of open source information, but you can also buy documents, right? And I built a tool that actually completely ⁓ automates this pipeline for me. So I actually order ⁓ ⁓ order the documents through my tool. It then ⁓ like, you know, downloads zip, extracts it, and then runs a series of analysis on it to the point where I can kind of get this UX visualization of corporate data, which is something that I never like this is fake data, yeah. But like this is something it's just random names. But this is like it's something that ⁓ I I would never like be able to, you know deal with if I couldn't see, right? 'cause my boss is good at corporate documents. I'm not. ⁓ This kind of allows me ⁓ order and look at companies, know, in a big way and see kind of what happened, who changed directors, you over time. And this is just it makes my life very easy. Alexios Mantzarlis: presumably connect names from this registry to names of your sources or... Omer Benjakob: All right, here we go. Now we reach the same. Now we go to the next level. So this was the original tool. More than that, I can now do kind of this network analysis ⁓ where I can also create investigations, which is a new entity within my structure where I after I've finished working on an entire company, which means I've Craig Silverman: Yeah. Omer Benjakob: Claude has like locally done visual analysis. We've OCR'd all the thing. There's different types of files, right? Some filings are Excels, for example. Some filings are PDFs. Some of them are just like signed documents that are scanned as JPEGs, right? Like it's the entire corporate thing. So you have to like understand the different types of entities. And of course, I would never be able to formalize this and like this tool did. So then I can bring together a number of them and then run a new analysis, which again is at a pretty simple kind of Python-level search, which is just kind of like, ⁓ who's connected to who? ⁓ Who owns what? Can we see cross-references kind of thing? And then ⁓ the main output I put I've g all these things give for me, and I think that's really important when I do more investigative tools is an MD file. Like it will create a file for me. It's never gonna create a publishable text. It's gonna create a file for me which has, you know, references to maybe websites or has some internal justification. And then I will take this MD and use it the same way, you know, you have like when you do investigations, you have like a file where you organize all your notes, right? ⁓ And I'll use that file for context on something else. But having that is like an organizing guide. So I create these background guides for myself, which just simplify things that I would never be able to do myself and just sucked at. ⁓ That's it. That's my tools. Alexios Mantzarlis: Yeah, there's simplification and then there's organization, right? It's like there's so much stuff that we leave behind and... All right, Omar, this was wonderful. We went through a lot. I think only one cigarette, so that's also good for your health, which I'm glad to. All right, well, I thought it was the same one that kept getting turned on. Never mind. ⁓ Well, hopefully last one of the day. ⁓ Craig Silverman: ⁓ no, there was a there was more than one. He he can roll them no. Omer Benjakob: It's like it's like Yep, we let you talk. Alexios Mantzarlis: Thank you. Where can people follow you? You know, these days it's never clear, like ⁓ on your website, on your blue sky, on your ex. ⁓ How do you keep up to speed? Omer Benjakob: Yeah. No, I s I yeah so yeah, so I'm on Instagram and I'm on ⁓ LinkedIn and I'm on X. Alexios Mantzarlis: Yeah. We'll put the ⁓ in the show ⁓ Omer Benjakob: And thank you for having me. You're doing great work and keep it up. Craig Silverman: Thank you, Omer. Awesome to have you. We'll also, of course, put some of our own handles in there for people to follow us as well. Anybody interested in learning more and getting more of these episodes, ⁓ just hit the subscribe ⁓ on this channel on the app that you're listening in. And you can also sign up for our free newsletter at indicator.media. And I will also note that this is kind of a great segue in some ways because you know, we're gonna be doing a lot more around how we're using AI. Alexios Mantzarlis: Yeah. Craig Silverman: some opportunities, you know, of course always the risks. ⁓ so I think this was a great episode to sort of, you know, kick that off. We'll certainly be talking more about AI ⁓ on the show in the future and on Indicator as well. Alexios Mantzarlis: Yeah, especially because when you were talking, Omar, about your transition, your journey from like this is pure snake oil to like, ⁓ there's corner that when it comes to big data analysis ⁓ cannot kind of be wasted. And if we just give it to the bad guys, we are losing ⁓ further, this advantageing us ⁓ is that's been. Yeah, that's right. That's right. ⁓ Omer Benjakob: Make data science human again. Craig Silverman: Yeah. Omer Benjakob: Seriously. Alexios Mantzarlis: Thanks again to everyone for watching and listening. Thanks, Amir, for joining us and good night.