Maximising the Impact of OSINT in Investigations

hi and good morning everyone and welcome um to this presentation so thank you Michelle for the introduction uh my name is Ruth McAllister I'm head of research and intelligence for a company called harid Associates um we're based in London I'm obviously not from London you have guessed um but we opened up our Bast office a few months ago so I'm very pleased to be here and speak on behalf of the company so in terms of you know the format today firstly I will introduce myself properly explain more about my background for example I'll also explain what I mean by open source intelligence I have a lot of acronyms in my presentation I'll explain them all don't

worry particularly I'll be exploring the social and the technical um I'm a social scientist by background so I feel a little bit out of my depth all these brilliant technical people um in the room I'm going to talk around a few case studies um human trafficking is one and sexual offending um I'm just going to throw the Cal out right now um the sexual offending aspect is around cesam or child sexual abuse material I am not in any way discussing anything graphic it's very much about technical discussions so don't worry about anything like that I'll then mention a little bit around AI uh I mean in a room full of technical people I haven't got

to explain very much around that of course but it really is impacting on some of the work that I do and I think working with technical people social scientists like me can really help further our work around B actors in the online space so about me uh I'm an academic for better for worse um for 15 years I was a full-time academic in uu teaching in criminology and I developed the cyber crime curriculum there for the last two years I have been part-time because I jumped into the private sector Waring I investigate cyber crimes and and other types of issues in the online environment criminology for me was very much social science based and I tried to

change that to make it more interdisciplinary and Technical I have worked a lot with computer science both within AER University and also in universities across the water in England I work a lot with various rocku we organized crime units and also with PS and here with the cyber crime unit in terms of my research um I really am interested in technology and High facilitates human trafficking and modern slavery I work a lot within child sexual abuse environment and I've also investigated Russian hacking unfortunately I'd be here for three hours it guys to cover everything in depth but wor I'm not going to um unfortunately I have decided not to talk about the the Russian hacking today just

in case um what do I do know I lead investigations across a variety of areas within har Associates everything from harassment fraud asset tracing and I use open source intelligence tools and a little bit of code as well I am not a programmer but I canip little bit to help me if I need to so I am not going to read every single point on these slides don't worry um I just want to give a bit of background if you like about how I came to be where I am and in terms of criminology and especially with cyber crime a lot of crime sites now they happen in what we deem cyers space of course crime still happens on the

streets offline crime I fully appreciate that but we have to really think around new ways to conceptualize this online environment what or where is cyberspace that's like a $64,000 Question for example that people actually do struggle to answer and also how does it differ from this real world or physical crimes I would argue that actually it can be more impactive for victims due to a lack of understanding and a lack of support whenever they have been a victim of crime in the online environment and that can be anything from doxing to fraud to um in abuse images being shared online so what we have now is a really really rich source of data that's available a lot of the time in online

forums lot of research like undertaken for example in Harding forums that's been traditional thought around cyber crime investigation my for me as a social scientist how the heck do I analyze thousands and thousands and thousands of posts I mean to do that manually um I probably lose the will to live um very very quickly I would say this is one of the key thoughts I had in my head a few years ago how do I get around this issue of course you can use automated tools but instead I knocked on the door of the computer science department and said let's try and work together they were very confused by me I'm not going to lie at the start um but they they

soon understood where I was going with my requests for help and information so from working with you know technical experts people like yourselves in this room um I've been able to undertake a lot of really valuable research and that's what I'm going to share with you today why is that important now for my job because from this research I gather intelligence from a lot of common identifiers closed Source information and open source information and I passed that straight to law enforcement to help them go after the bad guys and birs so what is open source intelligence it's essentially public data um I don't hack to get the data um that's just on on ethical if you like from our

perspective so everything that I look at is publicly available open source it's available online some examples of Open Source intelligence you can see it could be public records even information and planning applications for example social media can be a dream at times um sometimes meta make it very difficult but I'll move on from that um news articles again can be a wealth of information um information images and videos as well just as a few examples of what we can um utilize in our work everything is publicly available as I said and everything is acquired through legal means Stockman or social media intelligence is generally a subdiscipline of aent um you have humans as well human intelligence you have Tans

you can see all the various acronyms around the the screen there I personally work with an aent and sment I do a little bit around jent which is geospatial intelligence as well what's it used for primarily in my work for investigation um I do a lot of fraud investigation that will come as no surprise um I liked the thoughts around generative Ai and going after the fraud stories and closing your bank accounts that there a little uh reminder for to follow up on that one from my perspective um def slander um we can profile buildings geog TRC areas it's also useful for families you know anyone involved in a data breach for example there's been quite a few recently um you

know you can come to me and I'll check that you see if um publicly available information is locked down as much as it can be uh we could also check out employees for example if you're a CEO for example or a hirer within a company you want to know who you're going to employ is there any Insider threat for example due diligence can be quite useful as well to check out the background of people so the the first area I want to talk about and I do this I have a a leg straddled in the university and a leg straddled within um hard Associates whenever I do this work around human trafficking whenever I began this um

like I say I was a social science researcher and you know from my perspective this is very very qualitative very manual and also very very slow in terms of how I do this research and get my information it's really problematic for for two key reasons it's difficult to extrapolate qualitative data and apply that across the board it's very very difficult to draw from very small sample huge spes of the like I said they cannot be analyzed manually so what I was interested is high technology has impacted on trafficking itself so so how has that impacted particularly on recruitment exploitation and how do I go about assessing this so the first thing just to highlight is that human trafficking and

concerns around it we hear modern slavery mentioned quite a lot for example even in the media these concerns are not new there is a general consensus I would say throughout the public that there has been an explosion particularly in sex trafficking and that's due to technology so therefore when with some of my colleagues it seems quite logical that the solution to this increased F technology is to combat it with technology okay timely investigations machine learning techniques we can better understand movements and transition patterns through um various societies and countries within Europe so we need to better understand trafficking and technology so there are lots and lots and lots of claims that tools can identify and reduce investigation time

but from a social science perspective human trafficking is extremely difficult to investigate we're talking about serious and organized crime you simply just can go and knock the door of a person and ask them interview questions about their involvement in the movement of people illegally that does not happen so it's very very difficult to investigate so therefore whenever I live statistics around trafficking how can they be so specific we don't know exactly who has and who has not been the victim of trafficking in a particular city or country so therefore have algorithms accurately captured trafficking victims so we have this focus on technology but has anybody ever asked the question number one what actually is sex work

what is sex trafficking and how can technology really work to combat that so there can be a distinction if you like to really think about within this trafficking and Technology Nexus how trafficking victims even Define themselves and trust me a lot of them do not Define as victims but that is probably a whole other uh conference talk so from a really critical perspective it's impossible to remove bias from data and the interpretation is often restricted to the conceptual framework of investigator so for example if I ask an expert to identify a suspicious advert online how would they do that you would probably think of your own personal perspective I would imagine around what suspicion is what risk is

what might or may not look suspicious so that can be a real difficulty so there is a common if you like trap where people can conflict data and it doesn't actually represent what it claims to represent so we have to think about a person's understanding of trafficking so going back to what I said before it's working with people who understand it the social scientists who work in this area the NOS for example working with experts like you within technology to better develop these technical Solutions even when models have been trained and have been successfully trained by the way to distinguish between what is a suspicious advert and non-suspicious and trust me that is really really difficult if you think

about the nuances of that the very conception of what is suspicious is constructed by 1 2 3 maybe four people so you have to really think around the accuracy of that as well so therefore it's really compelling to suggest that because technology has increased trafficking therefore let's use technology to combat it I would say let's make it part of the answer and let's obviously work much better together data from open sources or websites is is really really important but we have to really be quite critical around how we interpret this data interpret this information so what I really wanted to do was investigate properly and thoroughly how we can reduce the demand at source how

can we prevent the recruitment of human beings into the trafficking Arena so there are three key stages in trafficking process as you can see in the screen you have recruitment you have transportation and we have exploitation I wanted to go to the very front end of equipment stop it a lot of work has been done at the end the exploitation so how do we better do that so as a social scientist I began looking at a myself and I wanted to see what was suspicious I have redacted the full email addresses so this is not people's personal information on the screen um I was working within Romania at the time because Romania is a key Source country

for human trafficking into the UK and really has been in the nrm Starts Now for really quite a few years in this example you can see from the website that there is an email address bb91 ao.com looking for girls 18 years who are serious um willing to work and they are guaranteed €6,000 a month no would that be a red flag to anybody yes if I he 6,000 a month I probably would not be standing here so yes that is a definite red flag of course um and of course then we have Matt aaho uh again Manchester escort away from crowds in danger and just with my girlfriend um I want one or two girls

this is all a direct translation from Romanian by the way just for your information of the others um the kind of very long story short within this particular aspect of the research I were able to connect these two individuals that they were working out of the same apartment in Manchester so what I can do then um using open source tools I can enrich the email to get other personal identifiers help me work out who these individuals are unfortunately um I redacted everything so of course you you can't see it suffice to say that you know you can see you IP addresses breach data for example that I can pivot off as well with was was really quite useful for one

of the emails um the second email as well you can see um breach data which is very helpful for investigators um to Pivot off again and and that was particularly useful I eventually was able to track down the two individuals to an apartment Block in Manchester and hand that information over to um the police to let them deal with them the next one um is involving who calls herself beatric um you can see that I've obviously blurred that image but I had concerns around this particular advert that I found online in terms of Recruitment and also exploitation so bearing in mind i' identified V address um and there was a partial phone number um on that

particular adver that I obviously haven't shown and an email address I was able to track um that phone number to a particular posting on Facebook and you can see it's called a Romanian gathering in leads so again we're tied to the country of Romania um I can identify the phone number but I also have a m behind that phone number so again I was able to say number one who had liked that post which was really key in the investigation because beatric had liked the post but of course beatric used her Facebook profile to do that so that was very very helpful you can see there that um George who made the post is looking

to again rent a room to girls in leads but it's just for girls you have to note these people are very careful around how they phrase their advertisements you know they never overtly say what it is that they're recruiting these girls for what was also quite interesting was I was further post from from George and the the translation there as you can see on the screen he is essentially looking for anyone who works for Uber in leads or Bradford now you may deduce that could be because he's looking to work for Uber IED it was a personal arrangement with a Romanian speaker to bring girls to their house in Lads as a nice little social opportunity structure

within that particular um piece of organized crime I said to you before that the be um lady had liked one of George's posts and that took me to her Facebook profile which is there so that's the correct beatress now even without you know blurring the image and with blurring the image you can see that it's c a lady with dark brown hair and and trust me they are the same individuals there were other little um breadcrumbs if you like around the trail of this particular case um one was from an adult service website um where I identified um h Road in leads um to to basically take me to her if I wanted to have a massage if you like again it was

massage it wasn't anything else um through doing a a driveby with Google Maps I kid you not um I was able to identify the house um I also identified that George was selling his car on G Tre he currently put his full vehicle registration number in the up for me which is very helpful I was also able to cross reference two weens yes that is not a joke and also a bunch of trees in their driveway and that's also able to match the window in their house to the backr windows of the photographs that be had taken I was 100% that I had the correct individuals the one issue I had however with this is not

only was it clearly recruitment for sex work um within the genuine profile of beatric on her Facebook there was a young child that for me raised a safeguarding issue so again that was reported to lead's police as well so that took me quite a while I'm not going to lie in terms of you know doing all that manually so I thought right let's do it better let's do it smarter let's engage more with my technology experts so I wanted greater technical input so I went for a full socio technical approach um in terms of what I was going to do next and unfortunately the next thing that happened happened in February last year and you probably know where I'm

going to go with this of course trafficking from Ukraine and of course not long after Putin ined Ukraine there were lots of discussions around the displacement of women and children who were fleeing the country um and I was involved in investigating along with um a group of Americans the movement of women from Ukraine and neighboring countries we focus on mova again it's a Romanian speaking country and I worked with interpool last year doing some training for Nos and health staff around how to identify victims of trafficking so what we quickly realized was that traffickers are getting quite smart there there was no doubt about that whatsoever um in Border countries volunteers were told out to look for men

offering young women rides at Refugee centers they were very nice they were very encouraging they were very supportive very welcoming the traffickers really really switched up tactics they had couples my rather than men so again the female May trust a female or another couple for example there were even stories for example around cooking traditional food but you know the smell would encourage people bearing in mind they have you know had such an ous Journey from Ukraine and other countries so there were lots of lures of food energy snacks fake friendship clamps this was all ongoing photograph on the screen is from a group of traffickers that was taken um at the border within Ukraine so again what are we do from a

technology background and what can we do in Northern Ireland you know hundreds and hundreds of miles away if you like from where all this situation is happening um there are various tools available of course um traffic jam photo DNA SP Spotlight all around the focus of identification um the Americans have access to some controversial facial recognition that we in the UK don't have access to um so they were able Sly to help from that aspect as well so my perspective was we can look at technology to help us as a friends but we can't truly rely on it so within the Ukraine situation um I Tri this work much further than the Romania one so like I said working in malova and in

particular I look at D recruitment there are three websites that are particularly prone to posting suspicious adverts let's just say robot. mdmmd and 999.md um so through that I thought right let's script the websites let's identify and analyze the data and let's see who's actually posting on these webs sites why did I do that I want to find information identifiers phone numbers email addresses usernames photographs I want to see links and connections between users who post them adverts and also websites I'm going to skim over these you guys all know this different websites have similar information but they have a different structure um scribing is not that easy it has to be said particularly in different languages

I'm particular the websites aren't that well built every effort has key information for me so a location um a phone number as you can see information about the person posting it yet it was posted amount of money offered email addresses images and how long the job may be for is a full-time permanent part-time all of that information what were the challenges like I said before the website structure websites changing trying to get the right information extracted and oh my goodness working with Romanian was terrible but also some ads were in cilic that was just really really power awful then we have the other issue a ring translation I'm not sure how many of you work with um foreign languages

but trying to get automatic translation it has got better but my goodness it really is SL quite P um you know sometimes we translate word by word sometimes phrases anded up being that a little bit more straightforward I also learned that Google made a lot of mistakes no offense to anyone from Google who may be in the room so I'm time to Google translate um you can see my moven audience find this very funny that um the very bottom unskilled workers or hummocks I can guarantee right now that there was not a job a job alert looking for a Hummock that field translation actually meant a career so we're a long way off that one so what do we notice from having

scrap these websites it was something really quite interesting the registration yet of advertisers if you look at the dut on the screen and you've got a large Blue chunk the majority of advertisers have registered in 2022 so literally last year whenever the invasion occurred n were these people who were genuinely trying to help those from the war ukan or were the people there with nefarious intent so that in itself was was a red flag for me like I said always rely on technology even looking at some of the the manual adverts I thought you know this is quite interesting you know tickets to Poland cheap you need to get there you don't know how you can come from any direction

H okay so I have a phone number and again through analysis of that phone number you can pivot off and get a Gmail address um I can the network is connected to I also have a telegram account so that allows me to go to various other pivot Points around people's personal identifiers so just a quickly summarize the trafficking aspect um my my key takeaways if you like from doing this work and I'm still involved in this work at the minute is being quisitive we we have to really drill down what we mean by trafficking and how technology can really help those individuals who are being traffic we just can't look to technology but I'd really love you guys

to work with us more um and to really help us in terms of trying to think around tools that can help us identify suspicion um look at false adverts um word matching you know that kind of thing to really make our work that a little bit easier in terms of victim identification and to reduce out source of course um the recruitment of these individuals and really from our perspective working together we can then develop much better anti-trafficking initiatives there's been a lot of work done in this area but there still a long long long way to go current research I'm also doing there is aring child sexual abuse material like I said I'm not talking about

anything to do with the images do not worry um around that today um I'm particularly interested however in going after these people and I look particularly at their operational security they're OAC and how they talk about technology what steps they take to prevent themselves so I'm trying to get into their heads around their security angle um again myself and my colleague we script uh a live Forum um a particular sex offender Forum I'll not name it and there what we have done is we have taken Tak all the usernames all the avatars and the entire discussions that were based on the entire um Forum but particularly focusing on technology social scientists have done this before

but they've analyzed a few hundred posts we analyzed over 123,000 and again that was with the help of Technology like I said social scientists simply could not do that themselves this forum has been active for quite a long time since January 2012 you can see 123,000 posts um 11 sub forums um 2 and 12,000 user profiles and on average there are 1100 posts per month now like I said I'm interested in the Forum on the technology so in terms of the Forum like I said it's been active from 2012 what quite interesting from that graph is there's a huge dip around 2015 so somebody I need to ask what happened in 2015 thank you very much for asking me

questions um the administrator got arrested it took a while to find that out actually from The Forum but that's actually what happened um and then you can see it came back online and there was more activity and it sort of peaked and troughed whenever there's any kind of you know operations you know and policing around this area things go a little bit quiet whenever our website gets seized it goes a bit quieter but then sometimes conversely the the chat increases as people display from other forums then join this one so looking at the activity itself can be quite interesting you can also see in terms of the number of posts you know that they Peak around 3 and a half thousand and

then they they sort of dip again and you can see that there's nothing really around 2014 as well so something really happened around that time so actually looking at the activity itself can be really quite interesting in terms of profiling the users and again from a social science perspective and from an intelligence perspective it may come to surprise you or maybe not to be honest around these individuals they are very Tech very very much so um there's clearly some experts who have experienced or have worked within a technical background or within computer science or programming or the developers or whatever they may be but they're very tech savvy and they will share technical information now they generally doal with

very trusted individuals they will tell you how to stay CF online in fact there's an entire manual around how to stay CF online and how they avoid the cops as they put so they're very good operational security but they're also very nervous very anxious about being discovered and you can see that whenever a forum has been seized they'll worry of new users um they will discuss other sites and of course they do discuss law enforcement operations in terms of their avatars I've blurred them because um I just felt it was right to do that despite the fact that they're not graphic avatars um believe it or not a lot don't actually choose to have them on their profile

those that do um they may be off famous child actors they could be off like famous Brands like Pepsi and KitKat for example uh and they could also be video game characters as well but what I did discover from this particular Forum was that they really like to exploit neurot technology they talk around how you can modify content around images around audio around video for example they talk a lot around high anity content 4K K virtual reality and of course augmented reality as well so they're also adopting and exploiting new technologies in 2023 however AI has really worked on to the thing I don't have to tell any of you guys this but trust me the sex vendor Community have

also adopted it as well and they are discussing a lot around how to alter and also create images using a Ai and that's starting to cause a real problem for investigators for building intelligence and also for trying to identify um real children and also how do we remove the fake children from investigations so that's a huge issue it's not a new issue it's in the headlines it's been well publicized um throughout the UK in terms of how pedophiles are adopting some of this technology I'll skim over the next couple of slides quickly because I'm getting near the end um they talk about generative Ai and they talk about open source tools are available for them talk about do and Di

2 um you know and how they can easily remove any mitigations um to exploit any of this technology again the advancements have been really really phenomenal over the last 6 n months I say in terms of how images have changed um probably one of the most obvious was at the son word photography awards earlier this year and the Word was given to a person who created a f a i image which leads me to a question are you all still awake I think you are I'm going to test you right now okay can you tell the difference so the dogs the one on the left and the one on the right who thinks the one on the left

is our real

image okay you're wrong but thank you I'm also conscious that there maybe cut people in the room so so is the cat on the left is it a real image you're wrong but thank you so much for for playing along with me there so just very quickly you know seeing is not always believing and this is a problem that we really have from a serious perspective and in terms of this area it's very difficult to identify um and research has been undertaken on this looking at L's people objects for example but then you know we have a SE of Doubt whenever we don't fully trust what we see online so it's just trying to think

about how we can really better think around this and how we can remove this Spar of Doubt what we do see online so I'm almost wrapping up so is AI is it going to be a gateway to abuse more children or can be used to prevent there's a big big debate around this at the minute the key thing is that people who have an interest within children they will identify themselves as different we're all the bad people just for what it's worth and we're trying to infringe their their human rights so there's some you know there's some questions if you like around how we can better use technology to disu individuals from adopting this particular aspect of AI but what I would

say is where I've seen users discussing AI their conversations and commentary are much more graphic than what they have been in the past and that causes concern for me as an academic and investigator and researcher in this world one of the the issues is photo realism photos were hyper realistic a few months ago and therefore they weren't interested because they they they were too perfect and neither photo realistic and that that's a big problem so from an Bassa of concern um how how you kid as five Pho realistic images kid is the child abuse internet database um the internet watch Foundation what's a real image what's a fake image what do they pull offline in

terms of virtual reality and forensic evidence how do we seize evidence in a virtual environment there's also greater commercial opportunities particularly within the tech sector where we have seen anecdotal evidence of some people with um a skill set in this area using it for Mal intent but there are some better shap is that there's much much more work now going in to develop tools to identify um this AI generated content and the UK is probably almost leading the way if you like in terms of dealing with this in terms of a legal framework certainly at the very least for the online harms bille that's going through legislation just now and I'm just going to finish

there thank you so much for listening