Latest / Show & Tell from Indicator / Inside The Tools & Techniques That Exposed Facebook Transit Scams And TikTok's Polarization Industry

Transcript

Inside The Tools & Techniques That Exposed Facebook Transit Scams And TikTok's Polarization Industry · Show & Tell from Indicator

• Craig Silverman: Hey folks, welcome to Show and Tell, the podcast from Indicator that takes you inside digital investigations by leading journalists, OSINT investigators, threat analysts, and researchers. I'm Craig Silverman. Alexios Mantzarlis: And I'm Alexis Macerlis. We set up Indicator to give professionals and citizens who care a place, a resource for investigating and understanding digital deception. If you don't know about us, we publish reporting, investigations, and practical tutorials. Craig Silverman: and you can sign up for our free newsletter using the link in the show notes or by going to our site at indicator.media. You can also hit subscribe below to make sure you do not miss another episode of Show and Tell. Alexios Mantzarlis: This episode, we're talking to my friend Clara Jimenez Cruz, the co-founder and CEO of Maldita.es, a Spanish foundation and nonprofit news organization created to fight disinformation and lies in public discourse through both fact checking and the data journalism. Hi, Clara. We're so excited about this. I first met Clara almost 10 years ago in Madrid when... Clara Jiménez Cruz. Maldita.es: Hi guys, I'm thrilled to be here. Alexios Mantzarlis: She was researching and presenting fact checking segments and more on Spain's La Sexta TV channel and I was at the International Fact Checking Network. In the years since, Clara and her team have built Maldita into one of the world's most innovative and impactful publications focusing on digital deception. It's been so exciting kind of see that from afar. Maldita publishes a lot of ⁓ material, more now. We'll talk about where ⁓ people find your stuff at the end, but... ⁓ Even if you don't read Spanish, a lot of the material can be found in English. so today we'll talk about ⁓ or three articles, LemaLdita LemaLdita did into platforms allowing disinformation, and other unsavory content to proliferate. Klaata will walk us through what tools the team used and hopefully inspire folks do some of their own work. But before we do, I just wanted to set the scene a little because I feel like, you know, since we first met, the fact-shaking ecosystem in general and maybe Maldita in particular has evolved from of a focus on public figures primarily who spread lies and should be held accountable for them to the platforms and technologies that allow those lies to kind of proliferate, monetize, reach a large audience. So. I'm finding that more more fact checkers focus on not just who said what, but how the content reached an audience. Do you agree? I making stuff up? And if not, kind of, why do you think this is happening? Clara Jiménez Cruz. Maldita.es: Yeah. No, I definitely agree. I think we've come to understand that the problem is systemic, that standalone fact checks are needed and are needed specifically by citizens so that they can make informed decisions on specific topics when they're feeling they're being deceived. But in the same way that we talk about how media literacy is needed, only for school kids, but actually for a broader population to understand the ecosystem they're living in with right now. The protection of information integrity also needs us to disable some specific mechanisms that are making that ecosystem much more polluted. For Maldita, that comes from a position of a combination of journalism and advocacy. And we do both and we do them hand in hand. So we do journalistic investigations that will generate evidence that will enable our advocacy team to then put pressure on governments when they're making legislation, on platforms when they have this huge PO system that actually ⁓ not account for how badly some of their systems work. And we try to do that hand in hand. And I think that has been the evolution of some of the more mature fact checkers over time. And I think I see that's where the community is going. So it has more to do with actually providing evidence that bad stuff is happening because of systems. It was political systems in the past, it's technological systems currently, but at the end of the day, it's been watchdog of power anyways, right? Alexios Mantzarlis: Yeah, and I'm curious, you know, obviously the ⁓ also 10 years, there's the fact checking partnership with Meta. are like platforms have sought to engage with fact checkers. It has been my experience that besides that kind revenue on one hand and impact on users on the other hand, both of which I think were important. ⁓ It has not been experience that kind of those partnerships provided great insight into how the platforms work, but I'm curious, know, Maldita, think still affecting a partner of Meta's probably work with TikTok. you, it does not work with TikTok. right. Have you found that like ⁓ partnership helped to understand the dynamics and ⁓ the social network more? Clara Jiménez Cruz. Maldita.es: Yeah. So I don't think partnerships themselves have given us a lot of insights in how ⁓ works. But I do think that the contracts ending right now and the dynamics in our work with the platforms has shown us things that are important. you said it is true that they've given us exposure and ⁓ objectively scale our work. ⁓ me give you two pieces of data that I think are important. With only 150,000 articles, 27 million posts across the EU on meta-platforms were tagged in the first six months of 2025. Or 120 million users came across fact-check information in the EU on the first half of 2024, thanks to claim review. But we also know that none will come across claim review or fact-check content in 2026 because Google killed the fact-check snippet from one day to another. And I think this talks a lot about how fragile... that collaboration is. And I think that's what we've understood over time, that platforms are going to be there when the wind economically and politically blows one way, but that they will very quickly remove themselves from those agreements. And that also means that we need to find other avenues in which that impact can be created and that systemic change can happen as well. Alexios Mantzarlis: Yeah, we've seen certainly disinformation being the first thing to go. We've about it, about it extensively on Indicator. But let's get into some of fun, some of the great stuff that you all have written about. Greg, do you want to kick us off? Craig Silverman: I mean, loved this investigation that I think we want to talk about first. is an investigation you did last summer. We're going to put the link obviously in the show notes as well, where your team found Facebook pages that impersonated transport networks. This happened ⁓ in ⁓ dozens countries at least around 60 or so. And the idea was the Facebook page made people think that it was the local or state or provincial transit authority. there was a great, you know, special offer on a pass. They would go, they would enter their information and that would be stolen from them. And of course there was no transit pass coming their way. And so I would love you to sort of walk through, ⁓ know, some examples, cause you guys found over a thousand pages. So did you come across it? But then that, that sort of connecting the network piece, how did you sort of find one or a few and get to the place where you scaled it up to more than a thousand? We'd love to hear about that. Clara Jiménez Cruz. Maldita.es: Bye. ⁓ Alexios Mantzarlis: to the show to the show part of show and tell. Exciting. Craig Silverman: Yeah. ⁓ Clara Jiménez Cruz. Maldita.es: So ⁓ it's interesting because you're speaking about the global investigation that we did, but it all started with the Spanish investigation, actually, where we spotted 59 Feral and Facebook pages that were impersonating transportation services across 47 Spanish cities. We found this because of our community that reports to us possible disinformation or possible scams or possible things that make them doubt online, right? So they... We started with this one. We did a bit of research on our own, trying to understand which were the specifics that one of these scam pages needed to have so that we could actually call it a scam. in Spanish and for Spain, that's easy for us because the names of the companies are very specific and it's easy to track them down. And then we thought maybe this is not only happening in Spain because I don't see these people in Vietnam actually trying to target only. Spanish audiences. So then we build upon that community again and we reach out to the EFCSN, which are the European Fact Checking Standard Network members that look for those kinds of websites on their own languages and countries and that enabled us to track way more ⁓ accounts that were doing this. And that's where this database came from, right? So some interesting things if you're ⁓ doing this kind of investigation on Meta is that we, think it's important to understand that Meta is an easier place to do this because the idea of those pages is directly on the URL and that enables you to track how that URL changes over time. And not like in other platforms like TikTok where the handle name changes whenever they change the whole page and that. makes it much more difficult to track how pages change over time. One of the things we saw... ⁓ Craig Silverman: And just to be clear, you have the page URL column there. And so we can see there, there's, you know, facebook.com slash all that. And then it goes ID equal. And that's what you're talking about, right? Is the, that is the unique ID for a profile for a page that even if they're, you know, the profile is Craig Silvermore or the page is, know, Toronto Transit Authority. If they change the name tomorrow and you have the ID, you can put that URL in and it will always take you there no matter what. Clara Jiménez Cruz. Maldita.es: Yeah. That's exactly. Exactly. Then the other interesting thing about meta that makes it a lot easier, this one is not available, but that makes it a lot easier to track. ⁓ Craig Silverman: This shows your impact that these have been killed, right? Alexios Mantzarlis: They're finally taking them down! Oh, there we go. Clara Jiménez Cruz. Maldita.es: They finally took them down, But I found several of them today. I didn't think this was going to be so difficult. So the good thing about Meta is that the information is way more accessible. So to know whether a transport ⁓ website like this, Scams has changed name or not, you just go directly here. You go to the transparency and privacy policy here. And you can see the previous names that this website has had and you can see that it's been in different languages in different places perpetrating exactly the same scam and at some point it decided that Ajaccio was a good place to run this scam again because it had worked the first time right. So I think Craig Silverman: And also is amazing. Like we see 2017, it was doing it and then it returns like eight years later. It's like, like you say, Oh, that worked that time. Let's, let's get back to it. And yet there's no defense on the platform to stop. Clara Jiménez Cruz. Maldita.es: Let's try it again. And then the other thing that made ⁓ this specific investigation, I think, sort of easy is that because it's transport websites, they always have the same name. So if you were looking for other places that are or other websites that are the same, you look for Transport Public Depot, the NIM, the FRER, and you just keep on putting cities and you could find new websites that were doing exactly the same, right? So that's how we came up with this huge database. The other thing that was pretty easy to better understand why there had to be some coordination behind this is that some of the people that were doing this were creating a lot of Facebook accounts with random names and then changing them to the specific transport, right? So for example, if you go to HaHa, You will find, maybe you're seeing it there, but this is haha 34, haha 67, haha 39, haha 25. That is exactly the same user. Yeah. Alexios Mantzarlis: Mm-hmm. Craig Silverman: Right. So they're, they're, they're mass creating Facebook pages and because they're creating so many, had to create a naming system. Right. And so they choose, ha ha. And then, you know, 12, 13, 14. I mean, it, it, like speaks to how it is, you know, uh, a sort of an operation, a machinery where it's like, okay, let's create tons of pages. Let's name them so that we can use them later. Go ahead, Alexio. Sorry. Alexios Mantzarlis: I And we found this across our ⁓ investigations in Facebook advertisers too, where they're like, ⁓ Nudifier one, Nudifier two, then, but they've become more sophisticated too, where I am convinced they have an algorithm with like three random names that they keep shifting around a bit like the name generation on community nodes, ⁓ which should be captured both by the platforms, but that's another story. Sorry, I gotta go ahead. Clara Jiménez Cruz. Maldita.es: Yeah. Yeah. Hahaha Craig Silverman: There have been, there have been many operations. I know the folks at reset, they do really good work and they they've identified massive networks of sort of randomly generated pages, but they use the same sort of combination of types of words and they do it. And it's true. Like the platform should be able to see that. ⁓ Clara, you, you had mentioned also the sort of page manager thing and you had mentioned Vietnam. Maybe you want to also show that in the spreadsheet, just of like how with some pages you do see actually where ⁓ Alexios Mantzarlis: Hmm. Yep. Craig Silverman: Facebook is declaring the manager's location. Clara Jiménez Cruz. Maldita.es: Yeah, that's it. Not in all of them, but it did give us some kind of overview. you see there, think Vietnam and Bangladesh were the first, the ones that came first, and then Ukraine and then many in the States. But I'm guessing that is VPNs rather than necessarily a great scam system there because we see this in global South countries happening more often, I guess. But yeah. Craig Silverman: Mm-hmm. Yeah. Clara Jiménez Cruz. Maldita.es: we were able, and this is because it's in the transparency page of ⁓ Meta as well, that we were able to extract that kind of information. Another thing that was interesting to do was to look how these profiles were actually using Facebook ads. So they were making money for Meta through a scam as well. And it also enabled us to discover different websites that we hadn't. that or different groups that we didn't know about yet. So we got the URL that they were redirecting you to and looked that up on the, how is it called in English? It's the ads library, right? Craig Silverman: Yeah, the ad library, right. So the URL that the ad sent people to, steal their information, you can then go back to the library, pop that URL in, and now it's going to show you all the ads that we're directing people to that. And it sounds like that gave you a bunch more pages you didn't necessarily know about before. Clara Jiménez Cruz. Maldita.es: Yeah, that's it. We look for them through the domain and we found new pages that were in a radar. And it's also interesting to see how, from an advocacy or more policy level, how some of those domains had already been restricted for advertising by meta moderation, and yet they were able to put a new ad with a different group with a different name again. So that talks about how the systems are not working either. Alexios Mantzarlis: do think these two examples also, sorry, Greg, to speak to the need for mandated transparency tools like the ones that you just showed right from Meta and both the page transparency and the ad library and how when things aren't, know, crowd-tangled, for example, how if things aren't mandated and you lose them, there isn't really a perfect compliment. So, yeah, anyway. Craig Silverman: Yeah. Clara Jiménez Cruz. Maldita.es: Yeah. And then the third route to discovery was, let me go here, using DS analytics to understand from which IPs the same sites were being run so that you could actually understand if those were scam sites as well, and then look for those on the Facebook page. And you cannot do this with all of them because some of them might be running a hundred thousand domains but if they're running eight, eight is a number that you can actually check. ⁓ Craig Silverman: Yeah, yeah. Like the rule for me is always like it's good news when the number is low. The lower the number, the more interesting it is. It doesn't necessarily mean that those eight are absolutely guaranteed to be connected to the same person, but like it is 100 % worth looking at all eight of those domains to see if there's any consistency across them with, you know, the content that's on them, the ads pointing to them and all that kind of stuff. Yeah. Clara Jiménez Cruz. Maldita.es: Yeah, that's it. That's it. in some of these cases, we found this specifically, we found that that same ⁓ URL and those other URLs that appear there were actually redirecting you to the same kind of scam on transport. So it was useful in this instance. But again, it has to be a bearable number. Eight is okay. Fifteen, my work. Over 25, I think you might be losing your time. Craig Silverman: By the way, this is Rosie who's making her first appearance on Show and Tell here. I'm surprised it took her to the second episode, but ⁓ Clara Jiménez Cruz. Maldita.es: Hahaha Alexios Mantzarlis: Meta. ⁓ I'd love to shift to a different platform, which is and speak specifically about something that ⁓ obviously Craig has ⁓ worked on for very many but like, how the incentive systems of platforms themselves kind of bring about the entire industries almost of deception, clickbait, misinformation. In this case, it's kind of TikTok's creator rewards program, right? Which allows accounts with more than 10,000 followers turn money on the platform, right? You need to have a certain minimum via video views, et cetera, et cetera. But roughly speaking, know, an indicator we've tracked, marketplace in Brazil that's very active buying and selling these accounts to monetize. But Maldita found, I think it was earlier this year, hundreds ⁓ of TikTok accounts spreading AI-generated videos, pushing out, polarizing people on whatever cause there was in the specific country. And years ago in the United States, was kind of a spate. influence up here, right? Like it was the Russian IRA that was trying to polarize people and get people mad with each other in the States. Here it seems that the goal of these accounts is more economical than political. But ⁓ I'd love for you to walk us through the work that you guys did here ⁓ also kind of how you ended up chatting to someone involved the ⁓ operation. there we go. Clara Jiménez Cruz. Maldita.es: To a seller. I mean, he was trying to onboard us as business partners, but he was a Craig Silverman: I've had that conversation so many times where I reach out to somebody who's like, you know, ⁓ running an AI channel and they think that I want to hire them to be my video editor. Not that I'm like, and so it often like, ⁓ takes, you know, few minutes of the conversation to actually be like, no, no, no, I'm a journalist. I'm trying to interview you because they're in sales mode, right? Like they're like, great. Yeah. Let's sign you up. Clara Jiménez Cruz. Maldita.es: Yeah. Yay! Alexios Mantzarlis: That's where our marketing budget has been going. I get it, Craig. Clouta. ⁓ Clara Jiménez Cruz. Maldita.es: Hahaha Craig Silverman: and Clara Jiménez Cruz. Maldita.es: It's okay. The endless screen is going to come up again. I'm sorry. I don't know how to do it otherwise. Okay. There you go. So this is the investigation that we did on TikTok polarization industry. That's how we call it. Yeah. There were thousands of accounts that were creating millions of videos with millions of views that basically they were trying to make those accounts grow so that they could afterwards sell them. Alexios Mantzarlis: We love it, we love it. You're good. Clara Jiménez Cruz. Maldita.es: They acknowledge at some point throughout our investigation that ⁓ political content and polarizing content work way better to grow those accounts that ⁓ actually kittens or dogs or cute puppies, right? ⁓ Yeah, it is true. ⁓ So some things that are specifically important for this kind of investigation. ⁓ We don't have access to the TikTok API. Craig Silverman: Sorry, Rosie. Clara Jiménez Cruz. Maldita.es: which makes our life way more difficult. we have to archive everything and we have to do a lot of it manually. Let me show you how the database looks. ⁓ Some other important stuff on this that we talked about at the beginning. Because ⁓ TikTok works differently from Facebook, you need to extract the TikTok ID to be able to track those accounts because if you only have the URL account and or the handle or the name, you're not gonna be able to see how it changes over time when it changes its name, when it erases all the content or how the account grows over time, right? ⁓ So the first thing we do when we spot one of these accounts is we will archive it and we will use the user ID myosin bookmarklet to extract the... Alexios Mantzarlis: Mm-hmm. Clara Jiménez Cruz. Maldita.es: the idea and paste it here and then we will rebuild the TikTok URL. So TikTok URLs can work like this with a name and a handle or they can work with an ID and what we do is we rebuild them so that we track this one in an easier way so we see how changes over time. ⁓ Craig Silverman: And just, just a note for anyone watching, we will put ⁓ a link to myosin trainings, a free bookmark. Let's page is something we've, we've written about and promoted a lot at indicator. They are fantastic tools. There we go. Showing showing what it looks like. Super easy to install. They're free and it pops up some really useful data, right? Clara Jiménez Cruz. Maldita.es: Yeah, it does. this is maybe you guys have a different way of doing it, but we need to do this manually and we copy and paste the IDs or we download it to a JSON, but then we do need to input it into our spreadsheet manually. Maybe you guys have a different way of doing it and it'd be great to hear from it as well. Alexios Mantzarlis: Mm-hmm. Craig Silverman: Now manual is, is kind of the deal. It's like it pops up and then you've got to, you've got to get in your spreadsheet. But what's, what's really cool is like if somebody had installed their bookmark, even like a few weeks or a couple of months ago, when that pops up, there's like new features all the time. ⁓ those guys are, are just constantly evolving them. So yeah, I always endorse it. Like if you're getting set up to do investigations around social media, you should go and install the Myosin training bookmarklets that relate to the platforms you're looking at for sure. Alexios Mantzarlis: Yeah. Clara Jiménez Cruz. Maldita.es: And they are super nice and if you work in a sort of medium to small newsroom like ours and you have a specific investigation that you're trying to run and you actually reach out, they will build a bookmarklet for you. Alexios Mantzarlis: Aww. They're lovely. Yeah. Craig Silverman: They've done that for you, that's awesome, wow. Clara Jiménez Cruz. Maldita.es: Yeah, yeah, yeah, we've been talking to them in the past few weeks because we're doing a second round of an investigation and we need a bit of help and they're there to help. Yeah. So how did we discover this kind of... Alexios Mantzarlis: It's exciting. Craig Silverman: Nice. Clara Jiménez Cruz. Maldita.es: of accounts. If you see here, they're basically AI generated protests in Colombia, about Palestine, in Venezuela, in the UK, in different countries. It doesn't really matter. They will change over time. These are different countries that they've done videos about, right? And what they do is that they will find a political event that is happening that might be moving in other parts of the world, specifically, I'm guessing, in Europe and in the US, and they will try to push. those kinds of contents ⁓ towards the algorithm to see how works. So ⁓ we realized that they were trying to push this kind of political content through hashtags, basically. So they will use the country hashtags, but also candidate hashtags and some specific wording that resonates in each of the countries. ⁓ And then we trained the algorithm. We saw how different accounts followed between them, we started following them all, and then the algorithm is so good at feeding you what you're looking for, if it's like something very specific, that we would get new accounts in every week for this. Alexios Mantzarlis: Yep. Yeah, we I like lean so much on burner accounts. I'm curious, maybe just a double click on that. Well, first of all, TBD, whether the you know, the tick tock us sale and algorithm change, like whether I'll start seeing that have an impact on my burners. I worry about that. But do you have folks have like like a Maldita phone? Do you do it on your own? Like does everyone have their own burners? Like what kind of... Yeah, I'm like... That face is my same face! Yeah, I am also on my phone and my account, but just... Clara Jiménez Cruz. Maldita.es: It's No, no, no, listen, no, wait. We have, I think there are three accounts in the investigation team, so three different phones that they can use ⁓ for tracking this. The thing is that often investigations come from the top, which is basically Julio, who is the director of Maldita, Julio Montes. Alexios Mantzarlis: Yeah. Clara Jiménez Cruz. Maldita.es: and he will train his algorithm for each specific investigation awfully. And for example, after the, we're going to talk about the CSAM ⁓ investigation later, but after he trained it for looking for small girls, it was awful. Like he was thinking, if the police comes and asks for my TikTok account, I'm going to have a problem. The TikTok account is under my name. And also I can no longer look for content about snooker. I mean, I want to see it. Alexios Mantzarlis: Yeah. Yep. Craig Silverman: Right. Alexios Mantzarlis: Normal videos. Yeah. Yeah, I worry about that with my insta. Yeah. Yeah. Yeah. And passing the border and that kind of stuff. So yeah, probably there's probably better practices, but sorry, keep going. Clara Jiménez Cruz. Maldita.es: some of my own content. Yeah. Craig Silverman: Mm. Clara Jiménez Cruz. Maldita.es: Yeah, no, no, but it is true that it is, I think it's better if you just create your own account that has not been polluted, that it's not attached to your name and it might be attached to a company email so that you can actually explain if someone comes asking and then try to train it from there. And we do that when we can, I would say. That's the best way to put it. So. Alexios Mantzarlis: Yeah. Craig Silverman: Mm-hmm Clara Jiménez Cruz. Maldita.es: Things about ⁓ this specific investigation. We wanted to talk only about the videos that had to do with politics. So all those other testing videos that some of these accounts use in which they will talk about kittens or puppies or anything else, we needed to take them out. We used Instant Data Scraper for that. We downloaded everything and it's also a way of annotating at each point how much an account has grown. And we took out the videos that belong to kitties or things like that. So. For this one, for example, it was important to have the ID name because it did change over time. If you see this one now, it's about cartoons. You can see that it was previously about Columbia and how the handle, the name of the account and the picture was different before. Let me show you here. Craig Silverman: Right. Alexios Mantzarlis: Yep. Clara Jiménez Cruz. Maldita.es: when it used to be a Colombian based account, right? The other thing that is important to us when we archive, and let me go grab this somewhere else, is to see how an account grows and to be able to actually give evidence of how it has grown. So these accounts started when we archived it in January with 3000 followers and it was doing... Alexios Mantzarlis: Mm-hmm. Mm. Clara Jiménez Cruz. Maldita.es: Palestine content basically and started doing a bit of Venezuelan content and when we went back ⁓ I think like a week after Alexios Mantzarlis: Mm. Craig Silverman: Hmm. Alexios Mantzarlis: ⁓ wow, okay. Venezuela was more effective. Craig Silverman: Right. Yeah. Clara Jiménez Cruz. Maldita.es: Yeah, had... Yeah, Venezuela was clearly more effective and he didn't even erase the Palestinian content, but Venezuela was actually bringing way more traffic to it. So, and we were able to do this again because we had the TikTok ID and we were able to track it over time. Alexios Mantzarlis: Yeah. Craig Silverman: Yeah. Alexios Mantzarlis: Yeah, that's a great point about archiving over time, because for me archiving TikTok, I'm always frustrated because obviously you don't get the video and but the follower accounts and... ⁓ go ahead. Clara Jiménez Cruz. Maldita.es: But one interesting thing about archiving the accounts rather than the videos is that Instant Data Scrapper also acts ⁓ on archived content. And that's interesting because it takes out a bit of pressure when you're doing an investigation, actually. You've archived it, and then you can actually go back and take the data out. And you don't need to be running against the guy that's behind the account. That's going to erase it at any moment. Alexios Mantzarlis: Mmm. Mmm. Yep. Craig Silverman: And I find instant data scraper is usually pretty good that it will grab like the view count for each individual video as well. So you get sort of that, you often get like the link to the thumbnail, plus you get the video count on each of them and it's easy to kind of just throw that in a spreadsheet and do a quick total of like, yeah, this account got over, you know, 5 million views or whatever. Clara Jiménez Cruz. Maldita.es: Yeah, yeah, that's it. And be able to track it down over time. Craig Silverman: I'm curious on the spreadsheets, do you folks, do you have a standard formula of like a spreadsheet of like, okay, we're starting a new TikTok investigation. You know, we know we want the account URL, we want the display name. Like, do you guys have a basic spreadsheet template? Clara Jiménez Cruz. Maldita.es: We have a basic spreadsheet template for DSA reporting or for reporting towards ⁓ the platforms themselves, for example, like these are the kind of data that we need so that we can actually report that this policy is not being fulfilled. ⁓ I think it depends. Craig Silverman: Okay. Alexios Mantzarlis: And for listeners, DSA is Digital Services Act. Clara Jiménez Cruz. Maldita.es: ⁓ thanks. I think that for investigations, it varies on what we're investigating. They all look quite alike, but sometimes we will say, listen, we don't, like for example, the target country or cost is not the same as in an investigation on transport scams, right? ⁓ We'll change a bit. There's like some things are consistent, like the URL account, the display name, when it was created, ⁓ the first time we archive it. Those things will be the same, but some of them will change over Craig Silverman: Mm-hmm. Yeah, that makes sense. Clara Jiménez Cruz. Maldita.es: And then some of the things that are interesting, think we started this conversation with how did you talk to the guy that was actually selling and came to understand the process, right? So one of things that we saw pretty quickly is that either in the bios or in the comments of some of the videos, there will be, or a phone number, Alexios Mantzarlis: Mm-hmm. Craig Silverman: Right. Clara Jiménez Cruz. Maldita.es: or directly an advertising of someone selling. In some of the accounts that we were tracking, the same phone number appears several times, which is also a sign of coordination, but it also enables you to better understand where this is coming from. So we reached out, basically. And that person was looking for a business partner and we think it was he because he was bragging constantly about how successful he was. Craig Silverman: Yeah. Clara Jiménez Cruz. Maldita.es: ⁓ He basically gave us ⁓ what we needed to do and how easy it was to get it done, that you could create temporary emails to create accounts, then set the accounts in countries where there was a monetization system, and create temporary emails for Sora to create more videos every day. And he gave us every little tip that we needed. to understand that this was basically about making money and making money quickly with little effort rather than ⁓ being politically invested in the kind of content that he was creating. Alexios Mantzarlis: So now you've set up a parallel Maldita that creates this information, generates revenue and kind of... That's right, yeah, I you may as well. Clara Jiménez Cruz. Maldita.es: Yeah, that's it. Our idea is to finance fact-checking with this information and... Craig Silverman: Exactly. That's the most sustainable business model that you could probably find from the platforms. ⁓ Clara Jiménez Cruz. Maldita.es: They're going to edit this out of this conversation. It's going to be the end of my career. so the the I think the other interesting thing ⁓ about gathering data, for example, that you were asking before, Chris, we, for example, gathered the when it was created and with very precise day and time, because this also shows a bit of coordination. Like you will see accounts that are creating within minutes of each other. Alexios Mantzarlis: That's right. ⁓ Clara Jiménez Cruz. Maldita.es: and or accounts that have the same picture or accounts that have the same snippet and that kind of thing ⁓ tells you that this is one, two, three guys creating a bunch of accounts on the same day. Craig Silverman: it just starts as a simple spreadsheet and you put a bunch of columns in, but as you fill in the columns, you've created your own set. You've built data where there wasn't data before. And now you get to say things like, yes, you know, 50 accounts were created within, you know, two hours of each other and they gained X number of followers over the span of few weeks and that kind of thing. So it's, it's the way to really kind of build those findings. So. I think the last one we wanna talk about is kind of a darker topic, but is interesting to dig into in a few ways. So you found that staying with TikTok, the platform was being used by pedophiles to actually market child sexual abuse material. So do you wanna tell us a bit about ⁓ that And also, we just mentioned this, how you sort of format sometimes the spreadsheets because you're gonna have to file reports. you know, sometimes with legislators for the DSA, but also you file things with the platforms themselves and their own reporting flows. And in this case, we're talking about like the worst of the worst. So what was sort of the, you know, why is that a focus for you folks and how did it sort of work in this investigation? Clara Jiménez Cruz. Maldita.es: So again, and again, and again. I think it's important to understand that, like, why did we start doing fact checking? Because we wanted to protect citizens, right? Because we didn't want citizens to be deceived and to hold power accountable. I think in that same sense, we started doing these kinds of investigations because it's a way of protecting citizens from awful stuff that is happening online that no one is trying to tackle. ⁓ even though they say they are tackling it as much as they can. ⁓ So one of things that we do, and this is how it's linked to the policy system, ⁓ allegedly TikTok and every other platform has these very strong systems to detect CSAM and to understand when children are being put at risk. And I think actually the internal policies that TikTok has for in their terms of use for the platform on sexualized content on minors are good written in paper but they're not actually applied afterwards. So we found more than 5200 AI generated videos and 3600 videos of real minors that were being sexualized in other accounts that had stolen those videos and we filed reports Craig Silverman: Mm-hmm. Clara Jiménez Cruz. Maldita.es: towards TikTok, like if we were a random user telling them, listen, I think this account is sexualizing minors and this is against your terms of use, you might want to look into it. We received an automated answer 30 minutes afterwards telling us that they did not see anything happening there. We think it's automated because it was exactly 30 minutes after we filed it, right? In every instance. And then we reached out again and told them, hey, Craig Silverman: Mmm. Clara Jiménez Cruz. Maldita.es: again, we really think this is sexualizing minors and they told us they reviewed them and only one of them appeared a bit as sexualizing minors. Craig Silverman: good. Clara Jiménez Cruz. Maldita.es: sure, sure. It's interesting how, like, I think the images speak for themselves. If you don't think that that is sexualizing in a minor in some way, you might be having some kind of problem in that sense. But then the other thing that we found out with this investigation, and this is, I think what I would like people that are listening to take away from this is... Craig Silverman: Yeah. Clara Jiménez Cruz. Maldita.es: you need to look at the comments because what we found in the comments first, there were a bunch of male adults making very strong comments about these kids. But secondly, we found a lot of people saying change. And we wondered, what does change mean? And some pictures of pizza and we were like, what's this about? And then we realized that they were actually ⁓ telling you that Alexios Mantzarlis: Mm. Clara Jiménez Cruz. Maldita.es: if you wanted to exchange child pornography on Telegram, could just follow them and either exchange or buy ⁓ child pornography. So I think, yeah, it was the access, the direct access to TICTA, to CSUM, right? And then I think the other part of this, and this I think is proof of the work that we do, many of the investigations Alexios Mantzarlis: It was the top of the funnel basically for an underlying CSAM. Yeah. Clara Jiménez Cruz. Maldita.es: that get done out there that you guys do that we do have an impact in those platforms maybe raising those scams, but they don't always change systems, Those scams are continued to be there. So going around the platforms and going to the legislators and having, for example, what happened with this investigation apart from TikTok's internal reviews is that ⁓ ⁓ A case is going to be open within the Digital Services Act enforcement team to see ⁓ if there's a systemic risk for minors within TikTok with this. And the Spanish government asked the prosecutor to look into it as well on whether they should fine or prosecute TikTok and other platforms because of AI-generated sexualized content of minors. Alexios Mantzarlis: That's awesome. Dark, but I'm glad to hear that's the resolution. I'm also noticing we have gone past all kinds of time ⁓ that we had to impose ourselves, but for good reason, because it was great to actually walk through in detail how well data does this work. So I think we will skip to our final segment of a show and tell, which is a lightning round. Clara Jiménez Cruz. Maldita.es: Yeah. Ha ha ha! Alexios Mantzarlis: So, Klara, warm up your ⁓ round ⁓ ⁓ get basically up or down, yes or no, for few questions. And yeah, are you ready? Okay. So, you get keep, you you spoke about a bunch of tools that you all use ⁓ in your reporting your editorial work. If you could keep only one, which it be? Clara Jiménez Cruz. Maldita.es: I'm Brady. The disinformation management system that Maldita has internally where we gather all the disinformation tips from our community, we get over 200 a day and we organize them, we extract narratives, we track how they evolve over time. To me, that one is the fundamental for the work we do. Alexios Mantzarlis: Very cool. And the messages come in mostly from WhatsApp and or how do people submit tips. Clara Jiménez Cruz. Maldita.es: It's mainly WhatsApp, but we also have incorporated Facebook Messenger, Instagram messages. Alexios Mantzarlis: I think we're going to have to do a other podcast on the digital management system. Do you use any of these? And if which do you prefer Gemini, Chachi PT or Claude? Clara Jiménez Cruz. Maldita.es: I think it depends for what. I use all three of them, but it depends for what. For example, Claude will be very good at making your ideas better organized and like down the framework that you have in your mind, but you're unable to actually translate into words or images. Whereas ChatGPT write very good for me. opening speeches if you need to do something like that or ⁓ to monitor a panel and give you a bit of ⁓ idea of what each of the people that are sitting there can talk Alexios Mantzarlis: Hahaha. Yeah, I'm in a bit of a cloud co-work food state myself. Do you have, you know, this is to be ⁓ unfortunately probably dying art, but do you have a favorite Google search operator like site colon or domain, you know, whatever, you know, date? ⁓ Clara Jiménez Cruz. Maldita.es: So I did political flip-flopping for a very long time and ⁓ to look for specific declarations over a specific period of time from politicians was super important for me. So those operators that enable you to look between this date and this date for this specific ⁓ related terms, that was super useful. Alexios Mantzarlis: Mmm. Mm-mm. Mm-hmm. Yeah, filtering my time is great. ⁓ No, no, I mean, have to choose between fact checking a false claim about the economy that, I don't know, SPM Pedro Sanchez made on a TV show or a viral video on TikTok spreading disinfo about natural disaster. Which do you choose? Clara Jiménez Cruz. Maldita.es: name than what I explained. ⁓ natural disaster for sure. think we always say that we choose what we fact check depending on how dangerous something is and how impactful it can be on people's lives and certainly a natural disaster is going to be way more impactful than a politician that things every day making up a new one. Alexios Mantzarlis: Greg's chuckling, but I'm telling you, the editorial decision-making that goes in source and what topic, cetera, their entire books, right? I feel like Peter Coliff Jones wrote a book about this. Which dead tool or feature would you bring back if you could? Clara Jiménez Cruz. Maldita.es: Crowdtangle. I that was gonna be the exact answer. was an easy one. ⁓ Alexios Mantzarlis: Yeah, that was a slap dunk. And then what is your, we like to end with, you know, not everything is online badness. So what is your favorite thing to do away from your computer and or phone? Craig Silverman: ⁓ yeah. ⁓ Clara Jiménez Cruz. Maldita.es: I mean, it is one of my favorites, also I don't have an option, I have a two year old toddler and that's what I do when I'm not working. Alexios Mantzarlis: Hahaha That's right, do it or wish it or not, but wonderful. ⁓ Okay, that's it done. Before we head off, ⁓ what are the best ways for people to follow you and Maltita? Craig Silverman: Yeah. Clara Jiménez Cruz. Maldita.es: Yeah. So because we're talking about English listeners, I think there is some content published in English on our website, but it might be easier to follow us on LinkedIn, where we post most of the big investigations and talk about them a lot. Either me or people within my team and Maldita. Alexios Mantzarlis: Wonderful. Alright, and we'll put the links in the show notes as well. Craig Silverman: Yes, absolutely. ⁓ Thank you so much for joining us. This was great, really interesting, really instructive. Folks who are out there listening, obviously you can subscribe on the platform that you are listening to right now to make sure you get future episodes. And also we have our free newsletter at indicator.media that you can head over to and sign up for as well. Alexios Mantzarlis: Thanks for watching or listening, and Clara, thanks again for joining us. Clara Jiménez Cruz. Maldita.es: Thank you guys, it's been a pleasure.