"Exposing Leaked Intimate Imagery Forums" with Bellingcat and The Press

WEBVTT
00:00:02.459 --> 00:00:05.700
You're listening to a stage talk titled Exposing
00:00:05.700 --> 00:00:09.019
Leaked Intimate Imagery Forums. This week, we
00:00:09.019 --> 00:00:11.560
were joined by my colleague, Bellingcat's Kolina
00:00:11.560 --> 00:00:14.179
Koltai and the Press New Zealand's Michael Wright.
00:00:14.480 --> 00:00:16.879
The two of them broke down their recent investigation
00:00:16.879 --> 00:00:20.600
into Leaked BB, a site that had over 2 .3 million
00:00:20.600 --> 00:00:23.339
registered users, rewarding them for distributing
00:00:23.339 --> 00:00:27.390
leaked nude photos and videos. After they identified
00:00:27.390 --> 00:00:29.690
links between an admin account on the website
00:00:29.690 --> 00:00:32.049
and a New Zealand -based man and reached out
00:00:32.049 --> 00:00:35.109
to this individual for comment, LeeakedBB appeared
00:00:35.109 --> 00:00:37.909
to have gone offline. Listen in as they walk
00:00:37.909 --> 00:00:40.030
us through how they found these links and what
00:00:40.030 --> 00:00:43.469
possible pathways exist to report on this type
00:00:43.469 --> 00:00:46.130
of website. You can find links to all the resources
00:00:46.130 --> 00:00:48.509
mentioned in the talk in the podcast description.
00:00:48.670 --> 00:00:51.829
This talk was hosted by me, Shalimar. on Thursday
00:00:51.829 --> 00:00:54.710
the 13th of August, 2026, in the Bellincgcat
00:00:54.710 --> 00:01:05.090
Discord server. Thanks for joining us in this
00:01:05.090 --> 00:01:07.769
stage talk. First, a content warning. We will
00:01:07.769 --> 00:01:10.450
be discussing themes of digital sexual exploitation
00:01:10.450 --> 00:01:13.349
and revenge porn today. So if at any point you
00:01:13.349 --> 00:01:15.950
need to leave the live audience or just step
00:01:15.950 --> 00:01:18.650
away from your laptop, please do. and please
00:01:18.650 --> 00:01:21.030
remain respectful in the comments on behalf of
00:01:21.030 --> 00:01:23.250
anyone who may have lived experience of this.
00:01:23.790 --> 00:01:25.810
Today we're talking about an investigation into
00:01:25.810 --> 00:01:28.849
the website Leaked BB, a forum that for years
00:01:28.849 --> 00:01:31.530
facilitated the trading of intimate images that
00:01:31.530 --> 00:01:33.909
appeared in many cases to have been stolen, hacked
00:01:33.909 --> 00:01:37.000
or shared without consent. Bellingcat and the
00:01:37.000 --> 00:01:39.640
press followed a trail that crossed archive webpages,
00:01:39.939 --> 00:01:43.000
domain registrations, DNS records, company filings,
00:01:43.379 --> 00:01:46.000
payment systems, old usernames, social media
00:01:46.000 --> 00:01:48.739
accounts, and even pieces of software to discover
00:01:48.739 --> 00:01:51.700
the likely key admin of the site. Sites like
00:01:51.700 --> 00:01:54.260
this can be remarkably resilient. They move between
00:01:54.260 --> 00:01:57.000
jurisdictions, use third -party hosting and payment
00:01:57.000 --> 00:01:59.500
providers, hide behind pseudonyms, and can simply
00:01:59.500 --> 00:02:02.400
disappear and reappear elsewhere. So what does
00:02:02.400 --> 00:02:05.420
it take to actually investigate them? Well, today
00:02:05.420 --> 00:02:08.300
we'll find out. I'm joined by the key researchers
00:02:08.300 --> 00:02:10.919
on this project, Bellingcat's Kolina Koltai,
00:02:11.060 --> 00:02:13.520
and The Press' Michael Wright. We'll go behind
00:02:13.520 --> 00:02:16.039
the scenes on the methodology of this investigation,
00:02:16.180 --> 00:02:18.860
and we'll look at the bigger question. Why are
00:02:18.860 --> 00:02:21.400
sites like this so difficult to tackle? And where
00:02:21.400 --> 00:02:24.439
can journalism, policy, and legal actually intervene?
00:02:24.840 --> 00:02:27.080
As usual, we will have plenty of time to answer
00:02:27.080 --> 00:02:28.879
your questions, so you can place your questions
00:02:28.879 --> 00:02:31.340
in the chat accessible on the right hand corner
00:02:31.340 --> 00:02:33.659
of your screen. But please remember that this
00:02:33.659 --> 00:02:36.439
is being audio recorded for the podcast, so if
00:02:36.439 --> 00:02:38.879
you don't want me to mention your username, please
00:02:38.879 --> 00:02:42.599
add that as a note in your question. Okay! All
00:02:42.599 --> 00:02:45.719
that being said, Kolina, I will mute for now
00:02:45.719 --> 00:02:50.129
and hand it over to you. Thanks, Charlie. I am
00:02:50.129 --> 00:02:52.449
so excited to be on the stage talk. I think it's
00:02:52.449 --> 00:02:54.770
been a hot minute since I've last done a stage
00:02:54.770 --> 00:02:56.949
talk. And these are always so fun. So thanks
00:02:56.949 --> 00:02:59.469
for everyone for being here today. And thanks
00:02:59.469 --> 00:03:01.389
to my colleague, Michael Wright, for being here.
00:03:01.930 --> 00:03:03.830
I'll talk a little bit first before handing it
00:03:03.830 --> 00:03:06.789
over to him to talk about this because in true
00:03:06.789 --> 00:03:10.330
Bellingcat fashion, this was an international
00:03:10.330 --> 00:03:14.090
investigation that crossed time zones, legal
00:03:14.090 --> 00:03:17.009
headaches, all sorts of stuff. nothing I ever
00:03:17.009 --> 00:03:19.289
do can ever just be easing in straightforward.
00:03:19.629 --> 00:03:22.770
I feel like that is the name of the Bellingcat
00:03:22.770 --> 00:03:27.370
motto, I guess. So today, I am so excited to
00:03:27.370 --> 00:03:29.509
talk to you about this investigation. I really
00:03:29.509 --> 00:03:33.210
do feel like I'm quite proud of this. And as
00:03:33.210 --> 00:03:35.129
Charlie mentioned, we will be talking about some,
00:03:35.129 --> 00:03:37.930
I think, really difficult topics as the nature
00:03:37.930 --> 00:03:40.490
of the site. So please, if you feel like this
00:03:40.490 --> 00:03:42.740
is too much, don't feel like you have to. uh
00:03:42.740 --> 00:03:45.199
go through it because uh one question I get when
00:03:45.199 --> 00:03:47.780
doing these kinds of investigations is how do
00:03:47.780 --> 00:03:50.659
you deal with uh going through this kind of content
00:03:50.659 --> 00:03:52.080
through this kind of sites and I feel like we
00:03:52.080 --> 00:03:55.520
all have our own different tolerances to the
00:03:55.520 --> 00:03:57.639
kind of content we investigate like I have colleagues
00:03:57.639 --> 00:04:00.819
here that investigate war crimes and I just don't
00:04:00.819 --> 00:04:03.580
have the stomach for it so um you know please
00:04:03.580 --> 00:04:06.060
always be gentle for yourself when uh we're talking
00:04:06.060 --> 00:04:09.379
about these kind of topics that being said Leap
00:04:09.379 --> 00:04:13.500
BB is the site we investigated, and if you hadn't
00:04:13.500 --> 00:04:16.319
heard of that site beforehand, don't feel bad.
00:04:16.639 --> 00:04:19.560
I think most people... hadn't because it was
00:04:19.560 --> 00:04:23.879
a very sort of niche topic, a photographic topic
00:04:23.879 --> 00:04:26.300
sort of website that exists in some of these
00:04:26.300 --> 00:04:28.560
like darker kind of components of the internet.
00:04:28.839 --> 00:04:31.800
And when I say darker, not necessarily offline,
00:04:32.019 --> 00:04:34.860
like on hidden websites, it was easily accessible
00:04:34.860 --> 00:04:36.959
via Google or going to the web domain itself.
00:04:37.300 --> 00:04:39.699
But it was a site that predominantly focused
00:04:39.699 --> 00:04:41.879
on sharing what is sometimes called leaked images
00:04:41.879 --> 00:04:44.899
or leaked nudes. And while some people take this
00:04:44.899 --> 00:04:48.480
to be maybe like content stolen from maybe an
00:04:48.480 --> 00:04:51.899
OnlyFans or Fansly or some other adult sex worker
00:04:51.899 --> 00:04:54.360
that posts content online for sale, then people
00:04:54.360 --> 00:04:57.040
take that and post it. A large portion of the
00:04:57.040 --> 00:05:00.439
website featured people who are not online sex
00:05:00.439 --> 00:05:05.500
workers. And so this site did a variety of different
00:05:05.500 --> 00:05:08.399
harms to people online, from people having their
00:05:08.399 --> 00:05:11.040
copyrighted images stolen and then shared online.
00:05:11.300 --> 00:05:14.540
But then even I think more egregiously, content
00:05:14.540 --> 00:05:17.879
from women who might have sent a photo to a partner,
00:05:18.740 --> 00:05:21.319
photos that they did not necessarily post online,
00:05:22.019 --> 00:05:23.600
content that might have been hacked from their
00:05:23.600 --> 00:05:26.879
accounts, and then shared and posted onto this
00:05:26.879 --> 00:05:29.959
forum. In fact, the sharing of the content was
00:05:29.959 --> 00:05:32.680
integral to this platform because people could
00:05:32.680 --> 00:05:35.100
even get paid out. So if you're a heavy contributor,
00:05:35.839 --> 00:05:39.180
finding leaked or stolen images of women, non
00:05:39.180 --> 00:05:41.860
-consensually taken images, and posted it, you
00:05:41.860 --> 00:05:44.829
could even No one becomes such a prolific partner
00:05:44.829 --> 00:05:47.189
in there, but you can earn crypto currency, get
00:05:47.189 --> 00:05:49.490
paid out financially. So there's even a bit of
00:05:49.490 --> 00:05:52.069
a financial incentive to contributing to the
00:05:52.069 --> 00:05:55.149
website. In addition to that, they had forums
00:05:55.149 --> 00:05:58.170
from which they were able to talk about how to
00:05:58.170 --> 00:06:01.069
hack or potentially to acquire this kind of content.
00:06:01.589 --> 00:06:04.069
People would offer their services on how to do
00:06:04.069 --> 00:06:06.949
so and a variety of other things. And the other
00:06:06.949 --> 00:06:09.919
thing I want to touch on this is that Although
00:06:09.919 --> 00:06:12.620
we personally didn't necessarily see it ourselves
00:06:12.620 --> 00:06:14.879
or were able to verify any of this, there were
00:06:14.879 --> 00:06:17.680
also discussions of potentially underaged content
00:06:17.680 --> 00:06:21.579
on the site. So images, nude images of girls
00:06:21.579 --> 00:06:24.620
and women who are under, or people who are under
00:06:24.620 --> 00:06:28.319
18, whose images were on this site, either sometimes
00:06:28.319 --> 00:06:29.839
without their knowledge or with their knowledge
00:06:29.839 --> 00:06:32.649
and having a hard time to get it removed. So
00:06:32.649 --> 00:06:36.069
that gives you a sort of overview of what the
00:06:36.069 --> 00:06:39.069
site is. And I don't think they were hiding it
00:06:39.069 --> 00:06:42.110
very clearly. They even held a annual Christmas
00:06:42.110 --> 00:06:45.050
contest that you would get paid out in cryptocurrency,
00:06:46.069 --> 00:06:48.790
thousands of dollars worth, if you're like the
00:06:48.790 --> 00:06:53.250
biggest contributor in December. So... The site
00:06:53.250 --> 00:06:57.410
had been operating since 2019. They had millions
00:06:57.410 --> 00:07:00.350
of posts, millions of users, hundreds of thousands
00:07:00.350 --> 00:07:03.129
of threads, and each thread would oftentimes
00:07:03.129 --> 00:07:07.149
be a particular victim, would then link to other
00:07:07.149 --> 00:07:11.089
off -site hosting platforms that wish they would
00:07:11.089 --> 00:07:14.810
have videos, images, you name it. And the other
00:07:14.810 --> 00:07:18.079
bit with this is they often also include... the
00:07:18.079 --> 00:07:20.540
personal identification information about these
00:07:20.540 --> 00:07:22.740
people. Oftentimes, what their social media handles,
00:07:23.519 --> 00:07:25.060
maybe like what city did they live, where did
00:07:25.060 --> 00:07:28.680
they work, where did they go to school. Things
00:07:28.680 --> 00:07:31.519
that made it easy for people to track down and
00:07:31.519 --> 00:07:37.019
find these women and girls. That's a long explanation
00:07:37.019 --> 00:07:39.779
to say. I don't want anyone to say that this
00:07:39.779 --> 00:07:42.639
site, oh, this is just. because that might be
00:07:42.639 --> 00:07:44.079
one criticism you might hear. It's like, oh,
00:07:44.100 --> 00:07:46.319
this is a site that's just had leaked OnlyFans
00:07:46.319 --> 00:07:50.579
content, and it's not. It was a site that, which
00:07:50.579 --> 00:07:52.660
has fortunately been offline since we've reached
00:07:52.660 --> 00:07:56.339
out to the suspected owner, was very clearly
00:07:56.339 --> 00:07:58.019
conducting a lot of harms and a lot of things
00:07:58.019 --> 00:08:00.720
that are illegal, I think, across multiple countries'
00:08:00.959 --> 00:08:04.319
jurisdictions. So that being said, that's a lot
00:08:04.319 --> 00:08:06.339
of sort of say, like, how did we go about this
00:08:06.339 --> 00:08:10.139
investigation? We get, I think, a lot of like...
00:08:10.120 --> 00:08:12.860
tips and heads up, people can email us all the
00:08:12.860 --> 00:08:15.579
time or send us DMs, say like, hey, here's a
00:08:15.579 --> 00:08:17.579
site that I think is doing kind of sketchy stuff
00:08:17.579 --> 00:08:21.220
or things that are, you know, to go check it
00:08:21.220 --> 00:08:25.199
out. And so on the sort of tip of a, hey, go
00:08:25.199 --> 00:08:29.000
check out the site, I did. One of the, there's
00:08:29.000 --> 00:08:30.860
a few different sort of techniques that I like
00:08:30.860 --> 00:08:34.259
to use in trying to determine maybe who's ownership
00:08:34.259 --> 00:08:37.279
or who's an administrator or someone like a real
00:08:37.279 --> 00:08:42.019
person attributed to these types of So one of
00:08:42.019 --> 00:08:45.120
the first things I do is I try to look at websites,
00:08:45.679 --> 00:08:48.600
how websites are built or in how they are established.
00:08:48.820 --> 00:08:51.659
I often will look up like a Whois record. Oftentimes
00:08:51.659 --> 00:08:54.779
those are redacted. So that's one kind of component,
00:08:55.059 --> 00:08:58.679
but there are a lot of other sort of. digital
00:08:58.679 --> 00:09:01.559
markers on websites, one of them being like DNS
00:09:01.559 --> 00:09:03.700
records. And so one of the very first things
00:09:03.700 --> 00:09:06.799
I did without getting too technical into it was
00:09:06.799 --> 00:09:08.740
look at, use a variety of different tools that
00:09:08.740 --> 00:09:11.679
we have to look at everything from like what
00:09:11.679 --> 00:09:14.100
IP addresses do they use, what sort of mailbox
00:09:14.100 --> 00:09:17.480
did they use, or like a mailing address. When
00:09:17.480 --> 00:09:19.360
I said a mailing address, could be like say proton
00:09:19.360 --> 00:09:22.920
mail, not like an actual physical mailing. address,
00:09:22.920 --> 00:09:25.759
things like that. And so one thing we sort of
00:09:25.759 --> 00:09:28.480
noticed a little bit, and this was usually my
00:09:28.480 --> 00:09:31.000
first step, which doesn't necessarily mean as
00:09:31.000 --> 00:09:33.500
it gets, it's immediately anywhere, was looking
00:09:33.500 --> 00:09:35.860
at these records. You found records that were
00:09:35.860 --> 00:09:38.539
linked into other domains. And at the moment,
00:09:38.659 --> 00:09:40.580
we're just like, oh, is that really going to
00:09:40.580 --> 00:09:43.460
be enough? And I'll get back to it, because I
00:09:43.460 --> 00:09:45.379
want to circle back to those domains. Because
00:09:45.379 --> 00:09:47.600
as I talk about all the evidence and the way
00:09:47.600 --> 00:09:50.500
that we went about this, we take a sort of, I
00:09:50.500 --> 00:09:54.360
think, methodical process and we want to have
00:09:54.360 --> 00:09:57.740
a high degree of certainty before we decide to
00:09:57.740 --> 00:09:59.419
say, like, hey, we think this person might be
00:09:59.419 --> 00:10:01.720
connected. You know, sometimes can you explain
00:10:01.720 --> 00:10:03.779
it through other ways? So we started seeing records
00:10:03.779 --> 00:10:06.500
to some particular domains through DNS records,
00:10:06.539 --> 00:10:08.320
and we're like, okay, let's hold off on there.
00:10:09.279 --> 00:10:11.159
And then the next step was basically go through
00:10:11.159 --> 00:10:14.090
the website itself. So, you know, I created an
00:10:14.090 --> 00:10:16.210
account on the website. I never made any sort
00:10:16.210 --> 00:10:18.529
of purchases. You could make payments on the
00:10:18.529 --> 00:10:19.870
site if you wanted to be able to get access to
00:10:19.870 --> 00:10:22.250
all the materials without having to contribute.
00:10:22.370 --> 00:10:25.389
You could do that. So, to be clear, I never made
00:10:25.389 --> 00:10:27.629
any payments on the site, but I did have a free
00:10:27.629 --> 00:10:30.149
account, which made it easy for me to be able
00:10:30.149 --> 00:10:33.909
to browse threads and content, which took me
00:10:33.909 --> 00:10:36.389
probably, I think, almost like two days. I read
00:10:36.389 --> 00:10:41.980
through every single thread I could. related
00:10:41.980 --> 00:10:44.899
to payments. So from the beginning of the site,
00:10:45.240 --> 00:10:49.320
which was hundreds if not thousands of threads,
00:10:49.840 --> 00:10:51.899
and was essentially what I'm looking for in reading
00:10:51.899 --> 00:10:54.899
every one of these in a very manual way, as any
00:10:54.899 --> 00:10:58.419
sort of clues or any other mentions of an identifier.
00:10:58.519 --> 00:11:01.620
So I was looking like, did someone mention a
00:11:01.620 --> 00:11:05.159
email address? Did someone mention a... company?
00:11:05.320 --> 00:11:07.620
Did someone mention what kind of payment provider
00:11:07.620 --> 00:11:10.039
that processor they're using? Is there anything
00:11:10.039 --> 00:11:13.200
here that can give me a clue that'll help me
00:11:13.200 --> 00:11:15.820
identify maybe who's responsible for the website?
00:11:16.700 --> 00:11:21.059
So in that process, I did find several posts
00:11:21.059 --> 00:11:24.740
indicating a particular business name, which
00:11:24.740 --> 00:11:28.830
was Logica LTD, was processing payments. And
00:11:28.830 --> 00:11:30.809
so oftentimes when people want to accept payments
00:11:30.809 --> 00:11:33.490
for websites, they don't just say like, oh, I
00:11:33.490 --> 00:11:36.570
am the owner of HBV. I want to like take payments
00:11:36.570 --> 00:11:38.970
because, but yes, we do. And the people would
00:11:38.970 --> 00:11:40.389
go check out the website and be like, oh, no,
00:11:40.509 --> 00:11:43.009
this is illegal content. We're not going to process
00:11:43.009 --> 00:11:46.110
payments. So oftentimes they'll set up a, might
00:11:46.110 --> 00:11:48.470
want to call it a decoy or redirect site or some
00:11:48.470 --> 00:11:51.009
sort of like shell company, if you can imagine.
00:11:51.590 --> 00:11:54.769
So sort of like. benign looking company, benign
00:11:54.769 --> 00:11:56.929
looking website that'll take payments for some
00:11:56.929 --> 00:11:59.110
sort of digital. And when people make payments
00:11:59.110 --> 00:12:01.269
on there, they're in fact actually getting access
00:12:01.269 --> 00:12:04.669
to LeakBB. So in this case, Logic LTD, which
00:12:04.669 --> 00:12:08.409
was shared in screenshots from like their Apple
00:12:08.409 --> 00:12:11.929
Pay that was set up at the time. We had people
00:12:11.929 --> 00:12:13.990
mentioning that they're making payments to Logica.
00:12:14.789 --> 00:12:18.509
We had people have shared screenshots after they
00:12:18.509 --> 00:12:20.769
had made purchases, which had the Logica email.
00:12:21.090 --> 00:12:23.950
Oh, sorry. the Logica website listed there. So
00:12:23.950 --> 00:12:28.629
we had multiple indicators that this was a consistently
00:12:28.629 --> 00:12:32.210
used site. And then in searching for Logica,
00:12:32.450 --> 00:12:35.309
we have found a connection to a business registry
00:12:35.309 --> 00:12:39.970
in New Zealand. And that could be one signal.
00:12:40.889 --> 00:12:42.330
But also, again, we have to look at multiple
00:12:42.330 --> 00:12:44.210
signals because it could have been someone else's
00:12:44.210 --> 00:12:46.129
using some other name. There could be multiple
00:12:46.129 --> 00:12:48.129
Logica's registered around the world. So how
00:12:48.129 --> 00:12:52.320
do we know if this is the correct one? And related
00:12:52.320 --> 00:12:55.720
to this, we also looked at a YouTube video that
00:12:55.720 --> 00:12:59.080
was shared on the homepage of LeakDB, how to
00:12:59.080 --> 00:13:02.179
make payments. In that payment system, that YouTube
00:13:02.179 --> 00:13:05.299
video that was made publicly available, a person
00:13:05.299 --> 00:13:07.159
walked through how to use their credit cards
00:13:07.159 --> 00:13:10.100
and how to make purchases. And in that video,
00:13:10.480 --> 00:13:13.100
they had a clear sort of screenshots of people
00:13:13.100 --> 00:13:16.179
making purchases on a website that looked like
00:13:16.179 --> 00:13:19.789
to be for digital avatar packs. So like packs
00:13:19.789 --> 00:13:23.429
of JPEGs of, you know, whatever sort of product.
00:13:23.450 --> 00:13:27.710
And these would be items that priced out, match
00:13:27.710 --> 00:13:32.110
the prices of the like BP website. So the next
00:13:32.110 --> 00:13:34.409
thing that we do is also that we'll go look using
00:13:34.409 --> 00:13:36.169
something like the internet archive to look at
00:13:36.169 --> 00:13:39.110
archive versions of the site. We go, I went to
00:13:39.110 --> 00:13:41.950
the web domain that was like shared in the threads.
00:13:43.110 --> 00:13:47.480
I, which was like Logica .nz. NZ being New Zealand,
00:13:47.519 --> 00:13:49.299
so we're now also getting another signal that
00:13:49.299 --> 00:13:52.620
this might be the same New Zealand business.
00:13:53.200 --> 00:13:58.480
And from there, we are able to see archived versions
00:13:58.480 --> 00:14:01.940
of these websites that match the sort of exact
00:14:01.940 --> 00:14:04.360
images that were included in the YouTube video,
00:14:04.399 --> 00:14:06.919
and also ones that were shared in the screenshots
00:14:06.919 --> 00:14:11.299
and the threads. This I thought was a nice, very
00:14:11.299 --> 00:14:13.600
clear indicator that this is probably the same
00:14:13.600 --> 00:14:15.960
website, possibly the same business. We also
00:14:15.960 --> 00:14:19.580
looked at a platform called OpenCorporates, and
00:14:19.580 --> 00:14:23.740
they had listed the same website, Logica .NC,
00:14:24.039 --> 00:14:26.399
as being the affiliate website domain for the
00:14:26.399 --> 00:14:30.039
business Logica LTD. So now we have a lot of
00:14:30.039 --> 00:14:34.080
clear evidence about what's a business here,
00:14:34.100 --> 00:14:36.419
but we're like, okay, do we still want to say
00:14:36.419 --> 00:14:39.409
what is our level of connection there? Another
00:14:39.409 --> 00:14:42.269
way that I also like to do is we look at using
00:14:42.269 --> 00:14:45.190
Internet Archive again, is I want to go through
00:14:45.190 --> 00:14:48.090
the oldest versions of the website. I will say
00:14:48.090 --> 00:14:50.230
just personally for me, it's not always the case,
00:14:50.269 --> 00:14:52.250
but usually if a website is older and there's
00:14:52.250 --> 00:14:54.529
a lot of history there. So in this case, it had
00:14:54.529 --> 00:14:58.029
been up for seven years. When people first get
00:14:58.029 --> 00:15:01.830
into, I think, dodgy businesses or dodgy websites,
00:15:02.370 --> 00:15:04.250
they make a lot of mistakes because they're new
00:15:04.250 --> 00:15:06.610
to the game. They were like, maybe got better
00:15:06.610 --> 00:15:08.649
about like, oh, let me tighten down about like
00:15:08.649 --> 00:15:11.149
maybe personal information here or particular
00:15:11.149 --> 00:15:13.549
clues as they get better about their digital
00:15:13.549 --> 00:15:15.929
safety. So brand new websites can sometimes be
00:15:15.929 --> 00:15:19.929
tricky, but older websites that have been around
00:15:19.929 --> 00:15:21.710
for a while, there's usually maybe more bits
00:15:21.710 --> 00:15:24.889
of evidence, particularly if it's been archived.
00:15:25.269 --> 00:15:27.429
And in this particular case, we did get another
00:15:27.429 --> 00:15:32.470
clue in that sense. We went to the archive of
00:15:32.470 --> 00:15:35.730
their payment screen. So like when you were looking
00:15:35.730 --> 00:15:38.110
at different payment options. So we went to the
00:15:38.110 --> 00:15:40.330
oldest saved archive version of that. And then
00:15:40.330 --> 00:15:42.850
what you're able to do is inspect the HTML of
00:15:42.850 --> 00:15:45.730
the website. Inspecting, which is basically the
00:15:45.730 --> 00:15:47.929
fancy bit for the code. So you have what you
00:15:47.929 --> 00:15:50.450
see, which is a screenshot. But there's also
00:15:50.450 --> 00:15:52.289
a lot of bits that will go into building what
00:15:52.289 --> 00:15:55.590
you physically see in there. So looking in that.
00:15:55.820 --> 00:15:59.200
We looked at one of the payments options they
00:15:59.200 --> 00:16:02.080
had was PayPal at the time. By the time, of course,
00:16:02.179 --> 00:16:04.899
in 2026, PayPal was not processing. But at the
00:16:04.899 --> 00:16:06.460
very beginning, they were saying they were accepting
00:16:06.460 --> 00:16:10.519
PayPal payments. There was an email address associated
00:16:10.519 --> 00:16:14.340
with their payment form. So this would be the
00:16:14.340 --> 00:16:16.940
email address associated with the PayPal account
00:16:16.940 --> 00:16:20.019
that was accepting payments at the time. And
00:16:20.019 --> 00:16:21.559
at the surface, it doesn't look like he gives
00:16:21.559 --> 00:16:24.860
very much clues. It was a string of numbers at
00:16:24.860 --> 00:16:27.779
a proton email that really wasn't used anywhere
00:16:27.779 --> 00:16:29.580
else. I tried searching. I say, like, is this
00:16:29.580 --> 00:16:32.799
number been used? Excuse me, this email had just
00:16:32.799 --> 00:16:34.440
been used to register at other sites, and it
00:16:34.440 --> 00:16:37.360
hadn't been. But at the time, I still held it.
00:16:37.419 --> 00:16:40.379
I kept the notes on it. And as I went through
00:16:40.379 --> 00:16:42.559
the investigation and evidence began to point
00:16:42.559 --> 00:16:46.639
to a particular person, we start looking at does
00:16:46.639 --> 00:16:48.320
this particular person, which ended up being
00:16:48.320 --> 00:16:52.840
Jitendra Maharaj, have consistent bits of evidence
00:16:52.840 --> 00:16:56.120
that point to him being affiliated as a main
00:16:56.120 --> 00:16:59.460
point of contact for this domain? And in particular,
00:17:00.320 --> 00:17:04.099
we believe that he is. So his name was on the
00:17:04.099 --> 00:17:08.000
Alaska LTD New Zealand Company's office listings,
00:17:08.579 --> 00:17:10.920
which we have multiple connections to as facilitating
00:17:10.920 --> 00:17:14.630
payments. What we found is that the string of
00:17:14.630 --> 00:17:17.029
numbers, I was associated with the Proton account,
00:17:17.829 --> 00:17:21.950
that was a phone number, that was a Fijian phone
00:17:21.950 --> 00:17:24.430
number, and Jatindra had been originally from
00:17:24.430 --> 00:17:28.450
Fiji. And that phone number was listed on Whois
00:17:28.450 --> 00:17:31.529
websites registries for websites that were publicly
00:17:31.529 --> 00:17:34.730
registered to Jatindra. So Jatindra back 10,
00:17:34.730 --> 00:17:39.250
15 years ago had, like many people, have been
00:17:39.250 --> 00:17:43.460
able to register website for whatever business
00:17:43.460 --> 00:17:45.660
or whatever personal reasons, they don't hold
00:17:45.660 --> 00:17:47.380
it anymore and then they get rid of it. By the
00:17:47.380 --> 00:17:51.359
time he had put in information that was non -redacted,
00:17:51.559 --> 00:17:53.900
which is that whois record, and we saw the phone
00:17:53.900 --> 00:17:55.660
number there. So we see his name and we see this
00:17:55.660 --> 00:17:57.740
phone number and that phone number was the same
00:17:57.740 --> 00:18:01.180
matching digits of that proton email used to
00:18:01.180 --> 00:18:03.819
accept payments. Then in particular, if we go
00:18:03.819 --> 00:18:06.160
about circle back now onto those DNS records,
00:18:06.850 --> 00:18:10.950
We found a mailing record that was sent out for
00:18:10.950 --> 00:18:14.349
an MX record to another like domain, which is
00:18:14.349 --> 00:18:17.950
leakbb .net. Leakbb .net wasn't necessarily a
00:18:17.950 --> 00:18:20.089
site that was functioning for anything, but someone
00:18:20.089 --> 00:18:23.369
had owed this domain and he was using it to emails
00:18:23.369 --> 00:18:27.809
for leakbb .com. This was later changed to proton
00:18:27.809 --> 00:18:30.410
mail, but for a small period of time, it was
00:18:30.410 --> 00:18:33.559
leakbb .net. Looking at LeakBB .net, we were
00:18:33.559 --> 00:18:37.059
able to then see records connecting it to various
00:18:37.059 --> 00:18:41.119
websites, including websites that used Jitendra's
00:18:41.119 --> 00:18:43.700
name in it. So sites that we were able to, I
00:18:43.700 --> 00:18:47.380
think, connect for one reason or another to Jitendra.
00:18:47.519 --> 00:18:49.619
So we have these records, and these records couldn't
00:18:49.619 --> 00:18:51.500
have been put in by anyone else except someone
00:18:51.500 --> 00:18:53.380
who would have some sort of administrator access
00:18:53.380 --> 00:18:55.859
to grant that connection between those records.
00:18:56.380 --> 00:19:00.099
So that is all to say that in this process, we
00:19:00.099 --> 00:19:03.000
don't just look for one bit of evidence and just
00:19:03.000 --> 00:19:04.960
to suggest that there might be connection, we
00:19:04.960 --> 00:19:08.380
saw repeated evidence over time across multiple
00:19:08.380 --> 00:19:10.859
different avenues that connected this person
00:19:10.859 --> 00:19:13.940
as being an important figure, even from the beginning.
00:19:14.019 --> 00:19:16.900
So it's the start of the website back in 2019
00:19:16.900 --> 00:19:21.299
that connected Jitendra Maharaj to LeadBB. And
00:19:21.299 --> 00:19:23.579
I know I'm almost a little bit at my time, but
00:19:23.579 --> 00:19:27.319
I'll mention from this point then we go and we
00:19:27.319 --> 00:19:29.019
looked a little bit more into Jitendra to know
00:19:29.210 --> 00:19:33.369
who he is as a person. Like, is this person that
00:19:33.369 --> 00:19:36.309
we see him like, especially because Jitendra
00:19:36.309 --> 00:19:38.609
Maharaj is not a completely uncommon name. There
00:19:38.609 --> 00:19:40.450
could be multiple Jitendra Maharaj. So when we
00:19:40.450 --> 00:19:43.049
identify the person associated, we want to make
00:19:43.049 --> 00:19:45.630
sure we are the correct point. In particular,
00:19:45.890 --> 00:19:49.029
we saw several things. So, the Dachandra we found,
00:19:49.849 --> 00:19:53.049
one was originally in Fiji and now lived in New
00:19:53.049 --> 00:19:55.269
Zealand, which kind of matches what we were thinking
00:19:55.269 --> 00:19:58.990
for this person. We found that the Dachandra
00:19:58.990 --> 00:20:02.730
also used to be an avid user and, in fact, a
00:20:02.730 --> 00:20:06.259
staff member onto something called MyBB. And
00:20:06.259 --> 00:20:08.460
BB stands for bulletin board. So MyBB was an
00:20:08.460 --> 00:20:12.339
open source software that a lot of people used
00:20:12.339 --> 00:20:15.779
back in like the early 2000s to build websites,
00:20:15.980 --> 00:20:18.599
build forums, things like that. And he was a
00:20:18.599 --> 00:20:20.240
really avid user on there to the point he was
00:20:20.240 --> 00:20:23.319
a staff member. And so it's interesting that
00:20:23.319 --> 00:20:25.839
this Jitendra who was very familiar with using
00:20:25.839 --> 00:20:29.500
MyBB had multiple websites making plugins and
00:20:29.500 --> 00:20:32.970
website designs for MyBB. then also is connected
00:20:32.970 --> 00:20:35.849
to a site called leaked BB that uses my BB as
00:20:35.849 --> 00:20:39.230
its format to build a website and even in its
00:20:39.230 --> 00:20:42.670
title like leaked bulletin board. So when we
00:20:42.670 --> 00:20:46.210
were going through and I again read through thousands
00:20:46.210 --> 00:20:51.069
of his posts on this my BB forum from his account.
00:20:51.810 --> 00:20:55.509
We found a couple different posts that also indicated
00:20:55.509 --> 00:20:57.089
that this was going to be the right jitendra.
00:20:57.569 --> 00:21:00.009
We found one post that mentioned that he was
00:21:00.009 --> 00:21:03.809
interested in using MyBB to create an adult forum.
00:21:04.750 --> 00:21:08.190
And also for wares, wares being a term for elicit,
00:21:08.190 --> 00:21:10.670
I would say elicit content or pirated digital
00:21:10.670 --> 00:21:13.809
content, which is sort of what LeetBB was about
00:21:13.809 --> 00:21:17.470
is pirated digital content. So he was expressing
00:21:17.470 --> 00:21:20.170
an interest in that content from early on, particularly
00:21:20.170 --> 00:21:22.730
using his forum for it. And I particularly also
00:21:22.730 --> 00:21:25.329
mentioned the selling of a platform or a website
00:21:25.329 --> 00:21:28.730
you own called mybbplugins .com. And mybbplugins
00:21:28.730 --> 00:21:31.769
was the site that connected us to leakbb .net
00:21:31.769 --> 00:21:34.410
because this is the site that was issuing all
00:21:34.410 --> 00:21:37.609
those DNS certifications. So here we have him
00:21:37.609 --> 00:21:40.390
saying explicitly, I own this site. We see him
00:21:40.390 --> 00:21:42.509
initially being registered onto the site before
00:21:42.509 --> 00:21:45.500
redacting it. And in particular, we also found
00:21:45.500 --> 00:21:48.440
some of his other online accounts. We have an
00:21:48.440 --> 00:21:52.579
account that we suspect is his old Twitter or
00:21:52.579 --> 00:21:55.640
ex account. And while it might have been cleaned
00:21:55.640 --> 00:21:57.279
up, we were able to look and use the Internet
00:21:57.279 --> 00:21:59.299
Archive to look at archived tweets from that
00:21:59.299 --> 00:22:03.539
account. And that account was posting, posted
00:22:03.539 --> 00:22:08.059
quite a few tweets, sharing links to leakbb .com
00:22:08.059 --> 00:22:11.460
in in November shortly after the launch of the
00:22:11.460 --> 00:22:14.400
site. So there's other bits when we can also
00:22:14.400 --> 00:22:17.160
talk about his GitHub, his other online profiles.
00:22:17.519 --> 00:22:19.779
There are so much more that I wish I could include.
00:22:20.079 --> 00:22:22.279
I'm not going to badmouth our editors, but if
00:22:22.279 --> 00:22:23.759
we didn't have an editor, this would probably
00:22:23.759 --> 00:22:26.839
be like a 60 -page report with every little bit
00:22:26.839 --> 00:22:30.759
of evidence that I found. But we were not able
00:22:30.759 --> 00:22:35.160
to include all that. But essentially, what we
00:22:35.160 --> 00:22:38.359
can gather from this is that Jitendra Maharaj
00:22:38.539 --> 00:22:42.440
seemingly on the surface is a successful maybe
00:22:42.440 --> 00:22:45.259
businessman, a family man, his partner, multiple
00:22:45.259 --> 00:22:49.099
kids, as Michael talked about who actually got
00:22:49.099 --> 00:22:51.400
to visit his home, seemingly lives in a nice
00:22:51.400 --> 00:22:55.960
place, in a nice neighborhood, has a cryptocurrency
00:22:55.960 --> 00:23:00.799
related startup, and seemingly on the surface
00:23:00.799 --> 00:23:05.160
would be a regular person, but I think through
00:23:05.160 --> 00:23:08.049
our digital footprint tracing and our trails
00:23:08.049 --> 00:23:11.450
were able to find sort of these online profiles
00:23:11.450 --> 00:23:14.210
that are connected to him that were either his
00:23:14.210 --> 00:23:17.130
main profiles to his alternative or an alt of
00:23:17.130 --> 00:23:20.190
profile. And then these sort of digital sort
00:23:20.190 --> 00:23:23.210
of footprint he's left on the internet have been
00:23:23.210 --> 00:23:26.289
repeatedly over multiple instances connected
00:23:26.289 --> 00:23:32.529
us to leakedbb .com. That is a very long. explanation.
00:23:32.769 --> 00:23:35.009
And if you're interested in that, please read
00:23:35.009 --> 00:23:37.470
the article. I'm also happy to answer any questions.
00:23:38.009 --> 00:23:39.650
I'm sure questions might have come in. I've not
00:23:39.650 --> 00:23:41.950
been looking at the chat. I stand and I kind
00:23:41.950 --> 00:23:46.009
of walk around my microphone. But I will leave
00:23:46.009 --> 00:23:49.309
it at that. So the next stage, we have figured
00:23:49.309 --> 00:23:54.069
out that we believe that Jatendra is the suspected
00:23:54.069 --> 00:23:57.730
odor and probably the key administrator of this
00:23:57.730 --> 00:24:02.220
site. and he's located in New Zealand. So I am
00:24:02.220 --> 00:24:06.279
not in New Zealand and considering the sort of,
00:24:06.279 --> 00:24:08.279
I would say legal level, because that's not the
00:24:08.279 --> 00:24:10.779
right words, but considering the severity of
00:24:10.779 --> 00:24:13.720
what we'd be accusing him of, we thought it'd
00:24:13.720 --> 00:24:15.740
be really critical to reach out to a local partner
00:24:15.740 --> 00:24:18.599
and that's where the press and Michael Wright
00:24:18.599 --> 00:24:22.900
here really came in because I think While I might've
00:24:22.900 --> 00:24:24.559
done all this, like the digital footprint stuff,
00:24:24.740 --> 00:24:27.099
I think to really push us through sort of finishing
00:24:27.099 --> 00:24:30.160
the investigation, Michael here was really instrumental
00:24:30.160 --> 00:24:33.660
on that. So I would love to hand it over to Michael
00:24:33.660 --> 00:24:36.140
to talk about sort of the next stage. After I
00:24:36.140 --> 00:24:37.500
did all this digital stuff, I'm like, Michael,
00:24:37.539 --> 00:24:40.279
please take it over and I'll leave it over to
00:24:40.279 --> 00:24:42.900
you. Thanks, Kolina. I hope everyone can hear
00:24:42.900 --> 00:24:45.019
me fine and I sound okay. It's very early and
00:24:45.019 --> 00:24:47.019
very cold here in New Zealand and I'm sitting
00:24:47.019 --> 00:24:51.190
in the dark with my hood on. I'll speak hopefully
00:24:51.190 --> 00:24:55.650
clearly and off -camera. We came into this investigation,
00:24:55.849 --> 00:24:59.369
as Colina said, well into it. And I should stress
00:24:59.369 --> 00:25:02.910
that 90, 95 % of what you might read in either
00:25:02.910 --> 00:25:05.369
story, even the one with my byline, is written
00:25:05.369 --> 00:25:09.630
by Colina. All of that research was done before
00:25:09.630 --> 00:25:13.000
we were even contacted. I think the first draft
00:25:13.000 --> 00:25:15.180
of the story was about 2 ,000 words, and that
00:25:15.180 --> 00:25:17.619
doubled while we were there, but all of the information
00:25:17.619 --> 00:25:21.680
she just described was already there. It was
00:25:21.680 --> 00:25:24.599
clear that these links had been established between
00:25:24.599 --> 00:25:27.799
LinkedIn BB and this person who lived in Christchurch.
00:25:28.420 --> 00:25:31.420
So the first stage was to reach out on email,
00:25:31.700 --> 00:25:34.859
given the detail involved. So that was quite
00:25:34.859 --> 00:25:38.579
an abnormally long email contact to somebody
00:25:38.579 --> 00:25:40.779
to say, hi, I'm a reporter. I'm from New Zealand.
00:25:40.799 --> 00:25:44.180
I'm working with this overseas journalism collective
00:25:44.180 --> 00:25:46.940
whose name you might not recognize, but we are
00:25:46.940 --> 00:25:49.880
sort of the local masthead newspaper in the city
00:25:49.880 --> 00:25:51.680
you live in. We have a little bit more brand
00:25:51.680 --> 00:25:54.619
recognition. Here are 10 also very complicated
00:25:54.619 --> 00:25:58.220
questions that implicate you in this not -unserious,
00:25:59.299 --> 00:26:01.000
apparently illegal -looking website. What do
00:26:01.000 --> 00:26:06.069
you have to say? So I did that. This is, I think,
00:26:06.269 --> 00:26:11.269
early June. We gave him several days to come
00:26:11.269 --> 00:26:15.549
back to us, just for politeness, but also there,
00:26:15.650 --> 00:26:17.930
the nature and detail that was required to come
00:26:17.930 --> 00:26:22.150
back to us. And he didn't, but I got a letter
00:26:22.150 --> 00:26:24.509
from his lawyer, an email back from his lawyer,
00:26:25.490 --> 00:26:27.890
let's say four and a half days into a five -day
00:26:27.890 --> 00:26:31.529
grace period. Well into it. And the first thing
00:26:31.529 --> 00:26:33.089
I noticed, I don't think I've told you this,
00:26:33.190 --> 00:26:36.210
Kolina, but the lawyer had deleted the thread
00:26:36.210 --> 00:26:39.250
between him and his client in between coming
00:26:39.250 --> 00:26:42.150
into me and saying, my client is over six. We'll
00:26:42.150 --> 00:26:45.150
get to this in a minute. But I could see the
00:26:45.150 --> 00:26:49.049
timestamp that showed Jatendra had sent the email
00:26:49.049 --> 00:26:51.410
to his lawyer about half an hour after I sent
00:26:51.410 --> 00:26:54.950
it to him four and a half days ago. So he was
00:26:54.950 --> 00:26:56.950
very much across this and aware of what we were
00:26:56.950 --> 00:26:58.930
doing and had been for several days by the time
00:26:58.930 --> 00:27:02.009
we heard back from anyone. Anyways, lawyer comes
00:27:02.009 --> 00:27:05.130
back and says, I'm very sorry, my client is overseas.
00:27:05.289 --> 00:27:07.289
He's had a family bereavement, he's in Fiji and
00:27:07.289 --> 00:27:10.150
he'll be there for at least two weeks. For the
00:27:10.150 --> 00:27:12.210
next two weeks I can't take any instruction in
00:27:12.210 --> 00:27:13.849
the meantime so we're going to need more time.
00:27:14.630 --> 00:27:16.670
So first things we did were check with our lawyer.
00:27:16.880 --> 00:27:19.500
Do we need to do this? Suspecting we knew the
00:27:19.500 --> 00:27:22.240
answer, and that was yes. As Kolina says, when
00:27:22.240 --> 00:27:24.359
you have something this serious, you really do
00:27:24.359 --> 00:27:29.640
need to try as hard as you can on right of reply,
00:27:29.859 --> 00:27:32.359
despite how much evidence you might have amassed
00:27:32.359 --> 00:27:36.000
beforehand. Second thing we did was get in the
00:27:36.000 --> 00:27:37.980
car and drive to his house just to check he wasn't
00:27:37.980 --> 00:27:40.119
lying. And I was a little bit excited then because
00:27:40.119 --> 00:27:42.180
we showed up to his house. That's the same one.
00:27:42.180 --> 00:27:45.059
You can see him in the photos of these stories.
00:27:45.440 --> 00:27:47.619
There was a dog in the backyard, like a nice
00:27:47.619 --> 00:27:49.740
husky. There was, I think, a light on. There
00:27:49.740 --> 00:27:51.779
was a couple of windows cracked. It's winter
00:27:51.779 --> 00:27:53.940
in New Zealand. So we thought, oh, someone's
00:27:53.940 --> 00:27:56.200
home. And they weren't. I think someone was just
00:27:56.200 --> 00:27:58.500
looking after his house. He was genuine me overseas.
00:27:59.279 --> 00:28:01.799
So I went back and forth with his lawyer once,
00:28:01.839 --> 00:28:04.720
maybe twice in the meantime. And we just had
00:28:04.720 --> 00:28:07.799
to wait two weeks or so and then go and knock
00:28:07.799 --> 00:28:11.319
on his door again. So we did that. He was home
00:28:11.319 --> 00:28:14.839
the second time. It was one of those... I'm standing
00:28:14.839 --> 00:28:18.319
at his doorstep for 20 seconds about to leave
00:28:18.319 --> 00:28:22.339
when he opens the door. Situation. It's also
00:28:22.339 --> 00:28:24.420
the middle of winter in New Zealand. It was raining
00:28:24.420 --> 00:28:27.299
and really crap weather as we were doing this.
00:28:27.640 --> 00:28:29.339
And he was standing there as you see him in the
00:28:29.339 --> 00:28:32.140
photo on his doorstep. Hi, I'm Michael Wright.
00:28:32.160 --> 00:28:34.460
I'm from the press. Did you get my email? Yes.
00:28:34.900 --> 00:28:38.660
And he didn't want to say anything. But he also
00:28:38.660 --> 00:28:41.160
didn't stop talking. If anyone here is a reporter,
00:28:41.180 --> 00:28:45.049
you'll know the situation where... Somebody you
00:28:45.049 --> 00:28:47.130
really want to get answers from is giving them
00:28:47.130 --> 00:28:48.890
to you, but they're also not slamming the door
00:28:48.890 --> 00:28:52.250
in your face. So you just keep them talking,
00:28:52.470 --> 00:28:55.390
keep circling the same couple of points to get
00:28:55.390 --> 00:28:58.029
things moving. I was on his doorstep getting
00:28:58.029 --> 00:29:01.470
very wet on the backside of myself. He was in
00:29:01.470 --> 00:29:03.690
his doorway. I could see his kids sort of playing
00:29:03.690 --> 00:29:06.529
in the hallway. It was one of those awkward situations
00:29:06.529 --> 00:29:08.069
where you really just want to make the most of
00:29:08.069 --> 00:29:11.250
it. And we circled the same two or three points.
00:29:11.609 --> 00:29:14.569
The detail that Kolina had amassed was too much
00:29:14.569 --> 00:29:16.630
for me to have in my head and to extemporize
00:29:16.630 --> 00:29:18.470
and think quickly with at the time so I had sort
00:29:18.470 --> 00:29:22.190
of two or three key points to cling to and keep
00:29:22.190 --> 00:29:24.910
putting to him. One was the link to the Logica
00:29:24.910 --> 00:29:28.829
NZ company and the payment information that she
00:29:28.829 --> 00:29:32.910
found and also the proton email and the match
00:29:32.910 --> 00:29:35.190
of the digits to his phone number. Just a couple
00:29:35.190 --> 00:29:37.390
of things to say look dude here are some clear
00:29:37.390 --> 00:29:41.339
links can you please explain and answer these,
00:29:41.339 --> 00:29:44.759
yeah, pretty straightforward questions. We circled
00:29:44.759 --> 00:29:46.799
this for a while. It was on the record and then
00:29:46.799 --> 00:29:49.680
off the record. Off the record, he offered a
00:29:49.680 --> 00:29:51.980
little bit more detail, but nothing that would
00:29:51.980 --> 00:29:55.799
have cleared all of this up. And we left it at
00:29:55.799 --> 00:29:59.859
that. That was, oh, again, Octa Ferticalina.
00:29:59.980 --> 00:30:04.680
I think it was July. And we took what we had,
00:30:04.680 --> 00:30:06.980
which wasn't very much, but we were pretty satisfied
00:30:06.980 --> 00:30:09.880
at that point that we had given him every right.
00:30:10.769 --> 00:30:15.009
to answer our questions, to explain away, if
00:30:15.009 --> 00:30:17.529
this wasn't anything to do with him, what all
00:30:17.529 --> 00:30:19.549
this was about, and really enough to go with
00:30:19.549 --> 00:30:21.750
the story at that point. The other side of it
00:30:21.750 --> 00:30:24.470
from my end was what were the New Zealand legal
00:30:24.470 --> 00:30:27.130
implications for this? I could talk about that
00:30:27.130 --> 00:30:30.329
a little bit when we move into Q &A, if you like.
00:30:30.650 --> 00:30:34.150
But yeah, the story was 95%, Kolina. Thank you,
00:30:34.150 --> 00:30:36.769
Kolina. And we eventually were able to pin him
00:30:36.769 --> 00:30:40.150
down, which was a small but quite crucial element
00:30:40.150 --> 00:30:42.849
to the story. That's about all I have at the
00:30:42.849 --> 00:30:45.089
moment. Do you want me to get into the other
00:30:45.089 --> 00:30:46.970
side of what I did here? Or do you want to sort
00:30:46.970 --> 00:30:50.750
of move subject -wise, Charlie, into the next
00:30:50.750 --> 00:30:55.009
stage? I think it might be useful here to pause
00:30:55.009 --> 00:30:58.630
for questions and then perhaps we can bring up
00:30:58.630 --> 00:31:01.390
those stages as we go through the questions because
00:31:01.390 --> 00:31:03.890
there's a lot of questions, for example, about
00:31:03.890 --> 00:31:07.809
legal repercussions. And I want to make sure
00:31:07.809 --> 00:31:09.710
that we also have time for all of the questions.
00:31:10.230 --> 00:31:13.990
So if that's all right, I'd love to go into the
00:31:13.990 --> 00:31:16.930
question part. I also wanted to thank Michael
00:31:16.930 --> 00:31:18.789
and Colleen of both being here. We're currently
00:31:18.789 --> 00:31:22.390
talking across the globe at various different
00:31:22.390 --> 00:31:25.289
times in the day and the evening. So I really
00:31:25.289 --> 00:31:28.779
appreciate everybody joining. I wanted to quickly
00:31:28.779 --> 00:31:32.160
ask, just to kick the questions off, is LeetBB
00:31:32.160 --> 00:31:35.059
a standalone or are there other websites just
00:31:35.059 --> 00:31:38.359
like this one? How do we estimate the scale of
00:31:38.359 --> 00:31:42.039
the issue here? And what does the popularity
00:31:42.039 --> 00:31:45.839
of a site like this tell us? Perhaps you can
00:31:45.839 --> 00:31:48.900
both have a crack at that and we can then go
00:31:48.900 --> 00:31:52.480
to some of the more specific questions on legal
00:31:52.480 --> 00:31:54.599
and things like that. Yeah, I'll quickly jump
00:31:54.599 --> 00:31:58.460
in on that. I would like to say that this was
00:31:58.460 --> 00:32:01.859
a standalone, but unfortunately it's not. There
00:32:01.859 --> 00:32:06.119
are a number of websites that offer sort of these
00:32:06.119 --> 00:32:10.599
same types of images. but so they love to let
00:32:10.599 --> 00:32:13.039
people host leaked images. However, I will say
00:32:13.039 --> 00:32:16.160
this site was particularly egregious because
00:32:16.160 --> 00:32:18.200
it had a variety of other content. So if you
00:32:18.200 --> 00:32:21.059
go to other websites, you might say they might
00:32:21.059 --> 00:32:24.240
specialize just in OnlyFans or leaked content
00:32:24.240 --> 00:32:26.460
from adult creators or specifically adult creators.
00:32:26.500 --> 00:32:28.079
Some of them will have those disclosures. We
00:32:28.079 --> 00:32:31.599
only host leaked content from adult creators.
00:32:32.500 --> 00:32:35.480
Some might have other images that have been stolen
00:32:35.480 --> 00:32:38.089
from other sites and like shared there. But I
00:32:38.089 --> 00:32:41.549
think what pushed LeakB over the edge was particularly
00:32:41.549 --> 00:32:43.849
the forum component in which people were able
00:32:43.849 --> 00:32:48.190
to sell hacking or blackmailings type services
00:32:48.190 --> 00:32:50.750
or pressuring to get news to coerce women to
00:32:50.750 --> 00:32:53.369
give their nudes, particularly that they had
00:32:53.369 --> 00:32:56.609
absolutely no problem with leaked images from
00:32:56.609 --> 00:32:59.349
people who were not adult content creators. So
00:32:59.349 --> 00:33:02.130
imagine just like a woman going about her life.
00:33:02.650 --> 00:33:06.079
And I think that's what also just made the site
00:33:06.079 --> 00:33:08.380
I think worse than even some of the other leaked
00:33:08.380 --> 00:33:10.940
sites that exist out there. I will note that
00:33:10.940 --> 00:33:14.279
like these types of sites have been coming under
00:33:14.279 --> 00:33:16.160
greater scrutiny over the year so maybe a site
00:33:16.160 --> 00:33:18.640
will come down and then someone else will take
00:33:18.640 --> 00:33:21.960
a name over it. So I will say that even for something
00:33:21.960 --> 00:33:24.079
like Leaked BB if you're to search it there is
00:33:24.079 --> 00:33:26.980
someone who was a big fan of the site that credit
00:33:26.980 --> 00:33:29.420
is now creating their own version of that try
00:33:29.420 --> 00:33:32.210
to recreate it. you know, they said they have
00:33:32.210 --> 00:33:34.410
a lot of the content that's unfortunately been
00:33:34.410 --> 00:33:36.869
saved on their own platform, on their own devices
00:33:36.869 --> 00:33:39.589
over the years. And we see this time and time
00:33:39.589 --> 00:33:43.190
happen again, even with our Mr. Deepfakes investigation.
00:33:43.589 --> 00:33:46.230
After the site came down, after years are being
00:33:46.230 --> 00:33:49.529
up, someone else who's not necessarily affiliated
00:33:49.529 --> 00:33:53.049
with the website, who's just been a fan, decides
00:33:53.049 --> 00:33:56.269
to try to like do their own version of it, carrying
00:33:56.269 --> 00:34:00.920
on the mantle, if you will. So, I like to say
00:34:00.920 --> 00:34:05.119
that it is a bit of a whack -a -mole type situation,
00:34:05.119 --> 00:34:09.019
but I think each time we try to have when these
00:34:09.019 --> 00:34:12.599
sites get taken down, they never come back at
00:34:12.599 --> 00:34:15.619
full force. They lose, I think, a lot in that
00:34:15.619 --> 00:34:19.940
process. And I like to think that there is continued
00:34:19.940 --> 00:34:21.719
pressure to keep these sites down. So while this
00:34:21.719 --> 00:34:24.619
is not a unique and only site, LeapBB was particularly
00:34:24.619 --> 00:34:29.710
egregious. And it, I think, is It's like pulling
00:34:29.710 --> 00:34:31.730
weeds. If you keep at it, you're eventually going
00:34:31.730 --> 00:34:34.710
to get the weeds. I don't have too much to add
00:34:34.710 --> 00:34:36.809
to it, only to say that one thing I forgot to
00:34:36.809 --> 00:34:39.170
mention, maybe Colleen had did, was when it came
00:34:39.170 --> 00:34:41.190
to this site, which I think as far as we know
00:34:41.190 --> 00:34:43.849
is a standalone site and that it was the only
00:34:43.849 --> 00:34:46.690
one that Jatendra Maharaj appeared to be connected
00:34:46.690 --> 00:34:50.670
to. In denying any links to it, the website,
00:34:51.309 --> 00:34:52.909
again, correct me on the dates here, I think
00:34:52.909 --> 00:34:55.769
it was two days after I sent an email to him,
00:34:56.110 --> 00:34:59.570
it was disabled. Um, yeah, I think the 48 hour
00:34:59.570 --> 00:35:02.170
period. Yeah, absolutely. I think that's also
00:35:02.170 --> 00:35:05.050
a pretty, um, damning, uh, connection that if,
00:35:05.429 --> 00:35:07.150
uh, within 48 hours of Michael sending these
00:35:07.150 --> 00:35:09.650
emails, the site coming offline and not coming
00:35:09.650 --> 00:35:15.070
back online on czar, uh, that is, um, he is,
00:35:15.070 --> 00:35:17.230
uh, responsible for the turning off of that site.
00:35:18.070 --> 00:35:20.489
Logica limited, which has its own site, logica
00:35:20.489 --> 00:35:23.369
.nz is still down as of about 10 minutes ago.
00:35:23.369 --> 00:35:24.989
I just had another look and it's, yeah, it's
00:35:24.989 --> 00:35:28.739
been disabled for, for weeks now as well. That
00:35:28.739 --> 00:35:32.159
leads me nicely to the next question, but I just
00:35:32.159 --> 00:35:34.880
wanted to mention that in the chat, I've put
00:35:34.880 --> 00:35:36.880
the link to the Mr. Deepfakes investigation that
00:35:36.880 --> 00:35:39.440
you mentioned and also somebody said wasn't them
00:35:39.440 --> 00:35:43.159
motherless .com also one of these sites and yes
00:35:43.159 --> 00:35:46.260
it was. And we had a chat on that recently too
00:35:46.260 --> 00:35:49.320
with the CNN team. You can listen back to that
00:35:49.320 --> 00:35:53.460
on our podcast. But yeah, we've had a few questions
00:35:53.460 --> 00:35:57.840
on what taking action looks like. Perhaps we
00:35:57.840 --> 00:36:01.320
can potentially talk about how far journalists
00:36:01.320 --> 00:36:05.900
can take this. How far can we take action against
00:36:05.900 --> 00:36:10.239
these kinds of sites? And then maybe we can go
00:36:10.239 --> 00:36:14.840
more into the legal and the law and where the
00:36:14.840 --> 00:36:17.940
jurisdiction is there. How can researchers or
00:36:17.940 --> 00:36:20.420
overseas researchers or journalists like yourselves
00:36:20.420 --> 00:36:25.110
tackle these sites? How far can you go? and when
00:36:25.110 --> 00:36:28.809
reporting on this. Oh, gosh. I mean, I think
00:36:28.809 --> 00:36:32.269
there's a particular, you know, we, particularly
00:36:32.269 --> 00:36:33.349
at Valley Castle, I don't know, I don't want
00:36:33.349 --> 00:36:37.010
to speak for the press. But I know for us, we
00:36:37.010 --> 00:36:40.590
don't want to like transition into activist territory
00:36:40.590 --> 00:36:44.909
necessarily. So I think for me, my big role is
00:36:44.909 --> 00:36:47.610
to shine a light on accountability for these
00:36:47.610 --> 00:36:50.969
kind of sites. Oftentimes, when someone's behind
00:36:50.969 --> 00:36:53.409
a site like this that's hosting a lot of non
00:36:53.409 --> 00:36:57.460
-consensual imagery or what I oftentimes do my
00:36:57.460 --> 00:36:59.380
research on which is on deep fake knock central
00:36:59.380 --> 00:37:03.719
imagery. The person who is profiting off of this
00:37:03.719 --> 00:37:06.179
hosting the site, facilitating the creation of
00:37:06.179 --> 00:37:09.119
those images and hosting of those images is obscured
00:37:09.119 --> 00:37:13.000
in some way. So I find that consistently when
00:37:13.000 --> 00:37:16.139
we identify a person who is behind it and we
00:37:16.139 --> 00:37:18.480
say we are going to make this known to the world.
00:37:18.730 --> 00:37:21.929
the site that comes off light. And that is, I
00:37:21.929 --> 00:37:24.809
think, a major step towards reducing the harm
00:37:24.809 --> 00:37:27.829
that's obviously being caused by that site. And
00:37:27.829 --> 00:37:30.010
so I feel like for me, that's really immense
00:37:30.010 --> 00:37:34.110
power as a journalist and where we also have
00:37:34.110 --> 00:37:37.309
a lot of responsibility in doing this safely,
00:37:37.530 --> 00:37:41.269
in doing this ethically, in doing this also that
00:37:41.269 --> 00:37:43.110
we're not also misidentifying someone because
00:37:43.110 --> 00:37:46.269
that would be obviously a lot of reputational
00:37:46.269 --> 00:37:50.659
harm to everyone involved. And I think that is
00:37:50.659 --> 00:37:54.099
where our role plays. I'm not a lawyer. I'm not
00:37:54.099 --> 00:37:56.920
an investigator. I'm not at any sort of police
00:37:56.920 --> 00:38:01.380
or law enforcement agency. I'm just a woman who
00:38:01.380 --> 00:38:05.440
sits at a computer all day. And that's kind of
00:38:05.440 --> 00:38:08.699
where I feel like our role as investigators is
00:38:08.699 --> 00:38:11.159
to see some sort of harm that's happening and
00:38:11.159 --> 00:38:15.090
where can we apply that skill set. in a legal
00:38:15.090 --> 00:38:17.969
and safe way that can reduce that harm. And in
00:38:17.969 --> 00:38:20.070
these cases, I think just even the identification
00:38:20.070 --> 00:38:23.170
of those owners, particularly when they're doing
00:38:23.170 --> 00:38:26.250
something that is anti -social in this nature
00:38:26.250 --> 00:38:31.170
can have an immense impact. But I don't know
00:38:31.170 --> 00:38:33.769
what, Mike wants to add anything out from his
00:38:33.769 --> 00:38:36.949
standpoint. Not too much, only then to seek into
00:38:36.949 --> 00:38:40.550
that yes, activist or activism type. journalism
00:38:40.550 --> 00:38:43.909
is generally a no unless you sort of embrace
00:38:43.909 --> 00:38:46.110
that as the thing that you are doing in whatever
00:38:46.110 --> 00:38:49.349
subject or story you happen to be turning your
00:38:49.349 --> 00:38:51.969
attention to. The story here is to do your job,
00:38:52.190 --> 00:38:55.429
as you say, in journalism and if the site is
00:38:55.429 --> 00:38:59.510
disabled or comes down, that is a happy byproduct
00:38:59.510 --> 00:39:03.369
of that fact. harm reduction is the main thing.
00:39:03.449 --> 00:39:05.489
And when we get into the legal side of things
00:39:05.489 --> 00:39:07.769
in New Zealand, that is how the law is built.
00:39:07.929 --> 00:39:11.650
That is the focus of law here when it comes to
00:39:11.650 --> 00:39:14.610
harmful online content is to end the harm first
00:39:14.610 --> 00:39:19.250
and perhaps expose or unmask those responsible
00:39:19.250 --> 00:39:22.719
second. We often talk about when we're doing
00:39:22.719 --> 00:39:25.239
these kinds of investigations, and I know, Eklina,
00:39:25.260 --> 00:39:28.000
for example, you've come on to a stage talk before
00:39:28.000 --> 00:39:31.280
and talked about the importance of really investigating
00:39:31.280 --> 00:39:35.099
the payment providers and because that is also
00:39:35.099 --> 00:39:39.199
a section where we can often implement some change.
00:39:40.500 --> 00:39:43.559
On sites like these, are the payment providers
00:39:43.559 --> 00:39:47.920
often aware of the connection between the site
00:39:47.920 --> 00:39:53.500
and their Do you often find that the chain kind
00:39:53.500 --> 00:39:58.079
of stops with the site itself and are these payment
00:39:58.079 --> 00:40:01.699
providers often surprised that their infrastructure
00:40:01.699 --> 00:40:05.260
is being used by these kinds of forums? In this
00:40:05.260 --> 00:40:07.960
case, with the payment systems that you contacted,
00:40:08.139 --> 00:40:11.760
did they respond at all to any of the information
00:40:11.760 --> 00:40:14.239
that you shared with them? Yeah, great question.
00:40:16.159 --> 00:40:18.920
not just in this case, but in previous cases,
00:40:18.980 --> 00:40:21.719
when we talk about sort of, I think, your mainstream
00:40:21.719 --> 00:40:26.340
payment processors. So you imagine PayPal, Stripe,
00:40:26.599 --> 00:40:29.579
Klarna, those sort of are name brand ones that
00:40:29.579 --> 00:40:33.340
a lot of people recognize. They have really strong
00:40:33.340 --> 00:40:37.199
terms of service agreements. And those are also
00:40:37.199 --> 00:40:38.840
name brands that people trust when people are
00:40:38.840 --> 00:40:41.420
making payments to a site that you know is a
00:40:41.420 --> 00:40:43.380
little bit dodgy and you want to know you're
00:40:43.380 --> 00:40:46.659
getting your dodgy sort of purchase. you feel
00:40:46.659 --> 00:40:50.440
better using a name brand platform. And so there
00:40:50.440 --> 00:40:52.659
is desire to use those because people are more
00:40:52.659 --> 00:40:55.079
likely to facilitate transactions using that.
00:40:55.480 --> 00:40:59.159
But since those oftentimes are not allowed, they
00:40:59.159 --> 00:41:01.719
created these like redirect sort of hidden obscured
00:41:01.719 --> 00:41:05.969
systems. So in this case, it was Logica. as this
00:41:05.969 --> 00:41:08.889
website and business that may look normal, but
00:41:08.889 --> 00:41:11.329
in reality was facilitating these transactions.
00:41:11.469 --> 00:41:13.750
So on the side of the payment processor, it just
00:41:13.750 --> 00:41:15.869
looks like they're processing payments for Logica.
00:41:15.989 --> 00:41:17.690
That doesn't look like they're processing payments
00:41:17.690 --> 00:41:21.570
for leaked BB. And similarly for the consumer
00:41:21.570 --> 00:41:24.750
on their billing statement, it'll say they made
00:41:24.750 --> 00:41:26.369
a purchase of Logica. It's not going to say they
00:41:26.369 --> 00:41:31.000
made a payment to an adult site. So I think there's
00:41:31.000 --> 00:41:33.199
really incentive on there. Some sites get consistently
00:41:33.199 --> 00:41:35.079
kicked off of those and they get discovered.
00:41:36.159 --> 00:41:39.159
Each payment processor has their own system for
00:41:39.159 --> 00:41:43.159
identifying when people are misusing their platform.
00:41:43.780 --> 00:41:46.360
And so they'll go oftentimes then to some cryptocurrency
00:41:46.360 --> 00:41:49.739
related companies or other sketchy sites that
00:41:49.739 --> 00:41:52.420
maybe don't care as much about that. We've seen
00:41:52.420 --> 00:41:55.579
that happen as well. I would say that, fortunately
00:41:55.579 --> 00:41:59.500
in this case, I think maybe within 12 hours,
00:41:59.579 --> 00:42:02.400
maybe not a full 24 hours, the payment processor
00:42:02.400 --> 00:42:05.679
that they were using at the time, right before
00:42:05.679 --> 00:42:09.539
the site went offline, it immediately was responded.
00:42:09.679 --> 00:42:11.780
It was like, we're preventing it. We're blacklisting
00:42:11.780 --> 00:42:13.619
this person. Don't worry. They were like very
00:42:13.619 --> 00:42:16.440
clearly in their response was not happy with
00:42:16.440 --> 00:42:20.210
the use of their... a platform to process payments
00:42:20.210 --> 00:42:22.730
and quickly shut it down. And then when I went
00:42:22.730 --> 00:42:25.070
onto the site and went through the steps of trying
00:42:25.070 --> 00:42:27.489
to process a payment, it immediately was giving
00:42:27.489 --> 00:42:30.869
me an error message. So I would say for the most
00:42:30.869 --> 00:42:33.409
part, these sites do respond pretty quickly,
00:42:34.989 --> 00:42:36.489
especially as they try to be more mainstream,
00:42:36.530 --> 00:42:39.909
more legitimate. But I still find processors
00:42:39.909 --> 00:42:44.010
out there that will take a riskier business.
00:42:44.050 --> 00:42:47.639
They still process payments. And I think that
00:42:47.639 --> 00:42:50.960
is oftentimes one of the best sort of like leverage
00:42:50.960 --> 00:42:54.239
points in identification because at the end of
00:42:54.239 --> 00:42:57.420
the day, I think it comes down to money. People
00:42:57.420 --> 00:42:59.599
want to make money off this kind of a list of
00:42:59.599 --> 00:43:01.639
content. They want to be able to make money off
00:43:01.639 --> 00:43:05.699
of the non essential imagery. And I think not
00:43:05.699 --> 00:43:07.539
only is it a great way to be able to identify
00:43:07.539 --> 00:43:09.599
who is behind it because the money has to go
00:43:09.599 --> 00:43:14.000
somewhere. It's also a great way to sort of get
00:43:14.000 --> 00:43:16.280
people to, they maybe stop investing resources
00:43:16.280 --> 00:43:17.780
and trying to get the payment systems up and
00:43:17.780 --> 00:43:19.380
going because if they're not able to process
00:43:19.380 --> 00:43:21.219
payments, they're probably not going to keep
00:43:21.219 --> 00:43:24.159
the site up and going for much longer. Thanks
00:43:24.159 --> 00:43:27.119
so much for that context. We've got about 15
00:43:27.119 --> 00:43:29.280
minutes left. So if you want to pop a question
00:43:29.280 --> 00:43:32.440
in the chat, do so now because we only have a
00:43:32.440 --> 00:43:36.079
few more minutes left to explore them. I want
00:43:36.079 --> 00:43:40.989
to now approach the question of legal. Is it
00:43:40.989 --> 00:43:43.949
legal to operate a site like LeapBB and what
00:43:43.949 --> 00:43:46.070
legal protections are there for those who may
00:43:46.070 --> 00:43:49.050
have been victimised by websites like this? And
00:43:49.050 --> 00:43:51.150
Michael, maybe you can give us an insight into
00:43:51.150 --> 00:43:54.409
whether there's better legal pathways to explore
00:43:54.409 --> 00:43:56.929
in New Zealand and if the jurisdiction of the
00:43:56.929 --> 00:44:00.650
alleged admin of the site matter here at all.
00:44:01.349 --> 00:44:03.969
Yes. So as you'll see in both versions of the
00:44:03.969 --> 00:44:07.190
story, one of the elements was what are the implications
00:44:07.190 --> 00:44:10.719
for if Jitendra Maharaj and Alik Bipi are based
00:44:10.719 --> 00:44:16.460
here legally. New Zealand has a law called the
00:44:16.460 --> 00:44:20.239
Harmful Digital Communications Act, which is
00:44:20.239 --> 00:44:22.019
pretty old. It's more than 10 years old. It's
00:44:22.019 --> 00:44:24.199
been around for a long time and it's looked at
00:44:24.199 --> 00:44:28.940
globally as a reasonable version of this type
00:44:28.940 --> 00:44:31.960
of law. It responded well to deep fake AI, which
00:44:31.960 --> 00:44:34.860
has come into existence since the laws passed,
00:44:34.860 --> 00:44:38.829
for example. But Speaking to the person in this
00:44:38.829 --> 00:44:42.869
case, a guy from NetSafe, which is a private
00:44:42.869 --> 00:44:45.510
agency, but the approved agency under this law,
00:44:45.690 --> 00:44:47.809
they can act and work with the courts under the
00:44:47.809 --> 00:44:51.650
law. The limitations of it in a context like
00:44:51.650 --> 00:44:55.590
this are that it was really set up for one individual
00:44:55.590 --> 00:44:59.949
seeking to do harm to another individual. And
00:44:59.949 --> 00:45:02.320
if there was a platform, third -party platform
00:45:02.320 --> 00:45:04.840
involved, it was still only on that one -on -one
00:45:04.840 --> 00:45:06.659
basis and that someone was hosting something.
00:45:06.860 --> 00:45:09.599
So when it comes to something like League2BB,
00:45:09.659 --> 00:45:13.980
wherever it might be hosted, the law in New Zealand
00:45:13.980 --> 00:45:17.000
kind of gets left behind. In that sense, there
00:45:17.000 --> 00:45:20.199
is not much you can do, especially if a third
00:45:20.199 --> 00:45:24.860
party is a bad actor or just refuses to engage.
00:45:25.599 --> 00:45:28.719
And it's not a major meta or social media platform
00:45:28.719 --> 00:45:31.690
that wants to or be seen to be doing the right
00:45:31.690 --> 00:45:34.289
thing and being a good corporate and online citizen
00:45:34.289 --> 00:45:37.650
and working with law enforcement, all those sorts
00:45:37.650 --> 00:45:39.889
of agencies when issues are brought to their
00:45:39.889 --> 00:45:47.090
attention. In that sense, there wasn't much law
00:45:47.090 --> 00:45:51.489
in New Zealand that you could have used if you
00:45:51.489 --> 00:45:55.550
discovered to your horror that your content was
00:45:55.550 --> 00:45:58.130
on this site and being used and exposed and shared.
00:45:59.240 --> 00:46:04.360
well past how much you might even know. When
00:46:04.360 --> 00:46:08.679
we used the phrase, revenge porn, the point is,
00:46:08.699 --> 00:46:11.539
by definition, that the person who is the subject
00:46:11.539 --> 00:46:14.599
of the content knows. It's unfortunately what
00:46:14.599 --> 00:46:17.519
that is about. And in this case, while Kolina
00:46:17.519 --> 00:46:20.380
found some examples of people who had discovered
00:46:20.380 --> 00:46:23.500
that their content was on, leaked to be being
00:46:23.500 --> 00:46:26.659
shared, The vast majority probably didn't and
00:46:26.659 --> 00:46:29.860
that was the point was this was a leak and we
00:46:29.860 --> 00:46:33.400
can do this privately amongst ourselves without
00:46:33.400 --> 00:46:35.539
these people for the most part being aware of
00:46:35.539 --> 00:46:39.579
that. We had a question earlier about do laws
00:46:39.579 --> 00:46:43.719
regarding coercion or coercive violence, are
00:46:43.719 --> 00:46:46.579
they any help in these kinds of cases or is it
00:46:46.579 --> 00:46:50.300
just because it's digital and on a specific forum
00:46:50.300 --> 00:46:54.300
that makes that kind of... legal pursuit difficult.
00:46:57.900 --> 00:47:01.380
I can defer to Colleen there for the most part,
00:47:01.420 --> 00:47:03.280
but in the New Zealand sense, the same issue
00:47:03.280 --> 00:47:07.760
would apply in that the people involved, the
00:47:07.760 --> 00:47:10.539
individuals would need to be in New Zealand or
00:47:10.539 --> 00:47:13.980
New Zealanders for the law here to be able to
00:47:13.980 --> 00:47:18.389
do anything about it. I think it's a hard question
00:47:18.389 --> 00:47:20.190
to answer because there are a lot of factors
00:47:20.190 --> 00:47:25.570
here. Because on a site like leakedVB, you have
00:47:25.570 --> 00:47:28.489
a person's images being shared by an anonymous
00:47:28.489 --> 00:47:30.230
account. And then, of course, you have someone
00:47:30.230 --> 00:47:33.090
who might be the admin or the hoster of that
00:47:33.090 --> 00:47:36.570
page. One law that's come into the conversation,
00:47:36.610 --> 00:47:39.210
particularly in the US, is the Take It Down Act,
00:47:39.750 --> 00:47:43.860
which requires platforms to respond within 48
00:47:43.860 --> 00:47:49.760
hours of a request to remove non -concentral
00:47:49.760 --> 00:47:53.260
imagery and content. And the thing is though,
00:47:53.400 --> 00:47:56.920
the site this is where it becomes a global problem
00:47:56.920 --> 00:48:00.059
because this is a law in the U .S., but this
00:48:00.059 --> 00:48:03.320
was a site where the admin that we discovered
00:48:03.320 --> 00:48:06.500
was based in New Zealand is not necessarily maybe
00:48:06.500 --> 00:48:08.820
known to be a U .S. site or it's unclear about
00:48:08.820 --> 00:48:12.460
where the origins of the site is. So they may
00:48:12.460 --> 00:48:15.860
choose to not follow or respond to any of those
00:48:15.860 --> 00:48:19.079
requests. you know, this might vary versus say
00:48:19.079 --> 00:48:21.980
like a social media platform like say Facebook
00:48:21.980 --> 00:48:24.539
that might be clearly based and originated in
00:48:24.539 --> 00:48:26.800
the US, even though it's used across the world
00:48:26.800 --> 00:48:30.059
globally. And so I think, you know, the sort
00:48:30.059 --> 00:48:32.679
of blurring a sort of legal jurisdiction when
00:48:32.679 --> 00:48:35.920
it comes to platforms and content is really difficult.
00:48:35.940 --> 00:48:37.860
And in particular, so I think pursuing this if
00:48:37.860 --> 00:48:40.159
you are a victim, and again, I'm not a lawyer,
00:48:40.500 --> 00:48:43.699
but you know, a lot of laws are designed to say
00:48:43.699 --> 00:48:46.179
like go after the person who posted the images.
00:48:46.429 --> 00:48:49.570
and I think that becomes really difficult. It's
00:48:49.570 --> 00:48:52.610
hard to identify someone beyond an anonymous
00:48:52.610 --> 00:48:56.369
username. So if my images were stolen or taken
00:48:56.369 --> 00:48:58.730
from me and people, multiple people are posting
00:48:58.730 --> 00:49:00.349
them on variety of different websites and I don't
00:49:00.349 --> 00:49:03.829
know who those people are, I have very little
00:49:03.829 --> 00:49:07.630
recourse action until I can maybe invest my own
00:49:07.630 --> 00:49:09.889
resources or time or something into identifying
00:49:09.889 --> 00:49:12.510
who is the person responsible. And sometimes
00:49:12.510 --> 00:49:16.000
it's, you know, obvious, but it's a, I think,
00:49:16.199 --> 00:49:18.739
arduous journey for victims of this kind of content.
00:49:18.900 --> 00:49:21.320
So oftentimes, their only recourse or the easiest
00:49:21.320 --> 00:49:23.039
bit of recourse is just trying to get those images
00:49:23.039 --> 00:49:27.420
removed off offline and no real harm or consequences
00:49:27.420 --> 00:49:29.739
happen to the people who post it. So, you know,
00:49:29.739 --> 00:49:33.369
they have, you know, the... digital, there's
00:49:33.369 --> 00:49:37.650
a copyright law, DMCA, here in the US, which
00:49:37.650 --> 00:49:40.250
is, if you have a copyright violation, people
00:49:40.250 --> 00:49:43.210
post stuff, that's your copyrighted images, that
00:49:43.210 --> 00:49:45.469
you can take it down, but that's usually something
00:49:45.469 --> 00:49:49.329
that doesn't fall under the, for people who are
00:49:49.329 --> 00:49:52.769
non -content creators. And that's where the Take
00:49:52.769 --> 00:49:54.949
It Down Act kind of like came in, as that was
00:49:54.949 --> 00:49:57.070
allowed anyone to be able to do this, regardless
00:49:57.070 --> 00:50:00.090
of a copyright, because it's your imagery. I
00:50:00.090 --> 00:50:04.150
think that is only part of the solution. I think
00:50:04.150 --> 00:50:08.130
that it's an incredibly tricky and arduous bit
00:50:08.130 --> 00:50:10.469
of where, what are you actually reducing the
00:50:10.469 --> 00:50:12.309
harm? What kind of recourse do you have as a
00:50:12.309 --> 00:50:15.110
victim? How can you go out of way? You don't
00:50:15.110 --> 00:50:16.750
know who the owner of the site is. There's other
00:50:16.750 --> 00:50:19.150
sites I've been investigating for years that
00:50:19.150 --> 00:50:23.099
we still don't know who the... owner or the person
00:50:23.099 --> 00:50:25.679
who is responsible for the platform that crosses
00:50:25.679 --> 00:50:28.239
that and that platform causes harm globally to
00:50:28.239 --> 00:50:32.500
women across the world. And, you know, between
00:50:32.500 --> 00:50:35.699
like site hosters, payment processors, where
00:50:35.699 --> 00:50:38.900
people are physically located to where victims
00:50:38.900 --> 00:50:42.110
are physically located are all varying factors
00:50:42.110 --> 00:50:45.489
in how, from a legal sense, what action you can
00:50:45.489 --> 00:50:47.550
possibly take. In addition to that, and then
00:50:47.550 --> 00:50:49.230
the evidence you would need and what court they
00:50:49.230 --> 00:50:51.570
would go to. And so it's really difficult. And
00:50:51.570 --> 00:50:55.010
so I do think legal regulations are necessary
00:50:55.010 --> 00:50:58.309
and helpful. It could be maybe help in discouraging
00:50:58.309 --> 00:51:01.710
the behavior, but ultimately it is a hard avenue
00:51:01.710 --> 00:51:05.139
to pursue. in this case. And so that's why I
00:51:05.139 --> 00:51:07.019
think even from our roles as journalists, to
00:51:07.019 --> 00:51:09.239
go back to your previous question, in being able
00:51:09.239 --> 00:51:12.659
to highlight or identify the person who was behind
00:51:12.659 --> 00:51:16.260
the site, that is a great way. So even to bring
00:51:16.260 --> 00:51:19.219
up the Mr. B fake investigation again, I don't
00:51:19.219 --> 00:51:21.519
think any legal consequences happened to this
00:51:21.519 --> 00:51:25.260
person. David Doe, who was a Canadian pharmacist
00:51:25.260 --> 00:51:27.599
who was behind this website that went up. I think
00:51:27.599 --> 00:51:32.079
also since 2019, maybe 2017. for a number of
00:51:32.079 --> 00:51:35.159
years, the largest non -consensual deep fake
00:51:35.159 --> 00:51:38.639
celebrity pornography site in the world. And
00:51:38.639 --> 00:51:42.739
he did lose his job as a pharmacist, but no legal
00:51:42.739 --> 00:51:47.019
harm came to this person. And I think that is,
00:51:47.019 --> 00:51:50.320
as you've seen, I think so few cases in which
00:51:50.320 --> 00:51:54.139
the website owner or website administrator of
00:51:54.139 --> 00:51:57.360
these types of platforms and sites receive any
00:51:57.360 --> 00:52:00.679
sort of consequence besides a sickening, besides
00:52:00.679 --> 00:52:02.539
them themselves turning off their own sight.
00:52:03.739 --> 00:52:06.639
Terrifying. I am conscious of time, but I just
00:52:06.639 --> 00:52:09.599
wanted to mention that we did have a talk recently
00:52:09.599 --> 00:52:13.559
with Image Angel, which is a company that's building
00:52:13.559 --> 00:52:16.679
protective tech to try and deal with this. Somebody
00:52:16.679 --> 00:52:19.539
in the chat said, as a follow -up, it does get
00:52:19.539 --> 00:52:21.780
tricky helping survivors, victims in the sense,
00:52:21.960 --> 00:52:24.000
but there is civil litigation. However, that
00:52:24.000 --> 00:52:26.780
presents a barrier due to financial costs. And
00:52:26.780 --> 00:52:28.559
I will say there are a few law firms in the US
00:52:28.559 --> 00:52:30.380
who are adding digital behavioural forensics
00:52:30.380 --> 00:52:32.559
to their teams to help. It's kind of what Image
00:52:32.559 --> 00:52:36.139
Angel are also doing. They're doing digital watermarking
00:52:36.139 --> 00:52:39.579
as well. We've had a question whether, as journalists,
00:52:39.659 --> 00:52:42.260
you would ever notify the victims of such sites.
00:52:42.699 --> 00:52:45.920
And I think you've mentioned already when you
00:52:45.920 --> 00:52:48.920
were describing this investigation, how, you
00:52:48.920 --> 00:52:51.699
know, there was a lot of people who may be unaware
00:52:51.699 --> 00:52:55.059
that their material is on there. And often the
00:52:55.059 --> 00:52:58.739
posters, I've read some of the posts having worked
00:52:58.739 --> 00:53:02.239
on this investigation as well, about how a lot
00:53:02.239 --> 00:53:05.239
of the posters were quite boastful, let's put
00:53:05.239 --> 00:53:07.960
it, about some of the ways that they'd obtained
00:53:07.960 --> 00:53:10.820
or said that they'd obtained this kind of material.
00:53:11.400 --> 00:53:14.099
Would you as journalists, both of you, would
00:53:14.099 --> 00:53:18.500
you ever feel the desire to notify victims in
00:53:18.500 --> 00:53:20.980
these cases? And are there any ethical or moral
00:53:20.980 --> 00:53:24.619
concerns with doing that? I don't know if you
00:53:24.619 --> 00:53:27.360
want to take that first, Michael, and then I'll
00:53:27.360 --> 00:53:32.940
comment afterwards. Sure. I have never had that
00:53:32.940 --> 00:53:35.980
situation where I knew about something like that,
00:53:36.039 --> 00:53:38.760
that the person who was at the center of it did
00:53:38.760 --> 00:53:42.679
not. Outside of anything with League BB, say,
00:53:43.570 --> 00:53:46.409
There would be a scenario where you would do
00:53:46.409 --> 00:53:51.170
that, yes. If the situation demanded it, I would
00:53:51.170 --> 00:53:53.610
feel comfortable doing that, but it would be
00:53:53.610 --> 00:53:57.510
very much case by case. It's a funny line when
00:53:57.510 --> 00:53:59.969
we say we're not activists here, we are just
00:53:59.969 --> 00:54:04.309
looking to report what we report. But if somebody
00:54:04.309 --> 00:54:06.610
is in that position and you know and they don't,
00:54:06.710 --> 00:54:09.929
there is absolutely an avenue by which it would
00:54:09.929 --> 00:54:12.130
be the right and responsible thing to do, I think.
00:54:12.269 --> 00:54:15.050
to let them know so that they can do whatever
00:54:15.050 --> 00:54:18.190
they would like to do about it. But it's complicated.
00:54:20.289 --> 00:54:22.429
I remember that movie she said when one of the
00:54:22.429 --> 00:54:25.230
New York Times reporters shows up trying to interview
00:54:25.230 --> 00:54:28.070
a potential victim and encounters the husband
00:54:28.070 --> 00:54:30.610
first, who has no idea what might have happened
00:54:30.610 --> 00:54:34.170
10 years ago with Harvey Weinstein. And you can
00:54:34.170 --> 00:54:37.329
get into difficulties pretty quickly when you
00:54:37.329 --> 00:54:40.510
get into that territory. I agree with Michael.
00:54:41.650 --> 00:54:45.730
really complicated. I think there's been a couple
00:54:45.730 --> 00:54:48.289
of times in stories in which I did reach out
00:54:48.289 --> 00:54:50.309
to the victim, especially when I was doing one
00:54:50.309 --> 00:54:52.789
of my first stories in this, and they chose not
00:54:52.789 --> 00:54:56.010
to respond to me. And it did make me think that,
00:54:56.010 --> 00:54:58.670
you know, not everyone wants to know. It's like
00:54:58.670 --> 00:55:01.469
you are then telling this person, like, the question's
00:55:01.469 --> 00:55:04.989
like, I think about it for myself. If there was
00:55:04.989 --> 00:55:07.309
non -consensual imagery or deep fake imagery
00:55:07.309 --> 00:55:09.449
of myself on the internet, which is always a
00:55:09.449 --> 00:55:14.070
risk, being a woman as a journalist in this area
00:55:14.070 --> 00:55:18.730
is, like, what I myself want to know. And I don't
00:55:18.730 --> 00:55:20.889
think so necessarily. Like, if, you know, if
00:55:20.889 --> 00:55:22.769
I come across or a fighter comes out, then, okay,
00:55:22.909 --> 00:55:24.489
I've kind of, like, mentally prepared for it.
00:55:24.670 --> 00:55:26.869
But that could be a really, I think, damaging
00:55:26.869 --> 00:55:30.710
thing if you don't already know. So I think unless,
00:55:30.710 --> 00:55:33.269
like, it's a, it is also, I think, pretty much
00:55:33.269 --> 00:55:35.789
a case -by -case basis because otherwise, I'd
00:55:35.789 --> 00:55:38.530
be spending all my time... I think identifying
00:55:38.530 --> 00:55:41.309
victims and contacting them. And that's not my
00:55:41.309 --> 00:55:44.429
job. It's not my role to do so. I think if there
00:55:44.429 --> 00:55:47.449
is... I would ideally would want to reach out
00:55:47.449 --> 00:55:49.650
to someone who already knows, especially if I
00:55:49.650 --> 00:55:50.909
want to interview them from their story. If they
00:55:50.909 --> 00:55:53.090
already know their images on that site, that
00:55:53.090 --> 00:55:56.869
would be the ideal. Because you do risk being
00:55:56.869 --> 00:56:00.510
the person that introduces that trauma to them.
00:56:00.570 --> 00:56:04.730
Because there has been research now about the
00:56:04.730 --> 00:56:08.610
sort of the... emotional and mental harms that
00:56:08.610 --> 00:56:12.849
can happen once someone realizes non -consensual
00:56:12.849 --> 00:56:17.110
imagery of them is either authentic or deep fake
00:56:17.110 --> 00:56:20.250
is spreading of them on the internet and they
00:56:20.250 --> 00:56:22.429
have little little recourse. They could really
00:56:22.429 --> 00:56:26.289
damage their lives in a way. So it's tough. It's
00:56:26.289 --> 00:56:28.110
a really tough question and I don't think there
00:56:28.110 --> 00:56:33.230
is a perfect answer for that. I think for this
00:56:33.230 --> 00:56:36.849
story in particular, we discussed it with our
00:56:36.849 --> 00:56:39.829
editorial team. And ultimately, the only person
00:56:39.829 --> 00:56:42.429
we thought about that we would reach out to would
00:56:42.429 --> 00:56:44.210
be victims who already know that their image
00:56:44.210 --> 00:56:49.190
is on there because we are not re -exposing them
00:56:49.190 --> 00:56:52.090
or exposing them as their first initial surprise,
00:56:52.250 --> 00:56:54.789
like, hey, this content is as obvious as on these
00:56:54.789 --> 00:56:57.369
sites. And I think that would probably just be
00:56:57.369 --> 00:57:01.690
the best situation, but I think there are a lot
00:57:01.690 --> 00:57:05.690
of ethical moral concerns in being the person
00:57:05.690 --> 00:57:08.909
to tell people that their images are spreading
00:57:08.909 --> 00:57:11.250
online to be the first person to do so. Yeah,
00:57:11.610 --> 00:57:13.670
I just want to very, very, very quickly, because
00:57:13.670 --> 00:57:16.550
I know we're about to go to time, ask you, Kolina,
00:57:16.730 --> 00:57:19.929
because archive pages were really quite important
00:57:19.929 --> 00:57:22.980
in this investigation, as you mentioned. If somebody
00:57:22.980 --> 00:57:25.119
is doing a similar investigation or if you were
00:57:25.119 --> 00:57:27.880
going to go back and do this investigation again,
00:57:28.460 --> 00:57:31.019
what data would you be particularly interested
00:57:31.019 --> 00:57:34.340
in archiving or making sure that you had saved
00:57:34.340 --> 00:57:37.099
versions of? I'm not talking about, for example,
00:57:37.199 --> 00:57:38.820
the material that you might find on the site,
00:57:38.840 --> 00:57:41.139
but what kind of information was really vital
00:57:41.139 --> 00:57:44.280
to the investigation that was important was saved
00:57:44.280 --> 00:57:48.679
on archive pages? Yeah, I think one of the most
00:57:48.679 --> 00:57:52.170
important or a couple of important things was
00:57:52.170 --> 00:57:56.269
those early captures of the website that it's
00:57:56.269 --> 00:57:59.309
like beginning days, particularly the HTML that
00:57:59.309 --> 00:58:01.210
was saved because that's how we were able to
00:58:01.210 --> 00:58:04.230
find that proton email address that used the
00:58:04.230 --> 00:58:07.570
phone number as the username. If that wasn't
00:58:07.570 --> 00:58:11.250
archived, then we just wouldn't have that link
00:58:11.250 --> 00:58:15.139
because later versions of the website... Certainly,
00:58:15.239 --> 00:58:18.239
I think probably after PayPal discovered that
00:58:18.239 --> 00:58:20.139
they are being used to facilitate these kind
00:58:20.139 --> 00:58:25.599
of payments, that clue, that bit was no longer
00:58:25.599 --> 00:58:30.039
saved. So I think that was really important bit
00:58:30.039 --> 00:58:33.960
of evidence that was for us. I also think that
00:58:33.960 --> 00:58:39.059
sites that archived the history of DNS certificates
00:58:39.059 --> 00:58:43.619
and website information about the websites, like
00:58:43.619 --> 00:58:47.900
including the MX address that was used, that
00:58:47.900 --> 00:58:51.280
was also important because the history of that,
00:58:51.420 --> 00:58:53.760
because we didn't obviously investigate this
00:58:53.760 --> 00:58:57.300
website in 2020, we're investigating it in 2016.
00:58:58.159 --> 00:59:01.099
Those are, I think, important clues that led
00:59:01.099 --> 00:59:04.960
us to identify this person. And it's those repeated
00:59:04.960 --> 00:59:07.219
bits of evidence that gives us the confidence
00:59:07.219 --> 00:59:14.079
in an identification. And I think the other component
00:59:14.079 --> 00:59:17.579
about this that's always the worry is owners
00:59:17.579 --> 00:59:20.599
of websites can request their content being removed
00:59:20.599 --> 00:59:22.519
from the Internet Archive. We've seen that in
00:59:22.519 --> 00:59:26.260
investigations before. In one of my previous
00:59:26.260 --> 00:59:29.659
ones, we had a bunch of stuff archived on the
00:59:29.659 --> 00:59:31.699
Internet Archive. There had already been a history
00:59:31.699 --> 00:59:34.480
of it because the site's been up. And after we
00:59:34.480 --> 00:59:36.980
reached out to the person about the website to
00:59:36.980 --> 00:59:40.599
do our write or apply, we checked sort of our
00:59:40.599 --> 00:59:42.719
links or evidence in the Internet Archive, and
00:59:42.719 --> 00:59:44.750
it had all been removed. because the owner of
00:59:44.750 --> 00:59:47.530
the site can remove it. And also, people can
00:59:47.530 --> 00:59:49.949
put up blockers to make it hard for a site to
00:59:49.949 --> 00:59:52.829
get archived. And so, I'll also note that another
00:59:52.829 --> 00:59:55.429
thing that I do on our end is use a tool called
00:59:55.429 --> 00:59:59.630
Hunchly to help sort of give redundancy in our
00:59:59.630 --> 01:00:03.429
archiving process. And I will also use something
01:00:03.429 --> 01:00:06.710
called our Bellingcat Auto Archiver because even
01:00:06.710 --> 01:00:09.530
these archive services which we're really great
01:00:09.530 --> 01:00:11.289
for looking at historical stuff. We also want
01:00:11.289 --> 01:00:14.789
to archive to maintain sort of evidence chain
01:00:14.789 --> 01:00:21.090
for our own purposes or for later on. Thank you
01:00:21.090 --> 01:00:23.869
so much for those key tips there. I will make
01:00:23.869 --> 01:00:26.230
sure to include links to those tools as well
01:00:26.230 --> 01:00:27.869
that you mentioned in the description of the
01:00:27.869 --> 01:00:31.409
podcast, but we are absolutely out of time. Thank
01:00:31.409 --> 01:00:35.010
you so much, both Kolina and Michael, for joining.
01:00:35.780 --> 01:00:38.820
this talk and for taking us through your amazing
01:00:38.820 --> 01:00:42.460
investigation. Please do go and read it, both
01:00:42.460 --> 01:00:44.679
versions on the Presser's site and on Bellingcat's
01:00:44.679 --> 01:00:48.019
if you haven't already. And yeah, thank
01:00:48.019 --> 01:00:50.059
you so much for joining us. We'll be back in
01:00:50.059 --> 01:00:52.039
two weeks time with another stage talk, but for
01:00:52.039 --> 01:00:56.019
now, thank you all. Thank you for listening to
01:00:56.019 --> 01:00:58.880
the stage talk. If you'd like to catch a stage
01:00:58.880 --> 01:01:01.900
talk live where you can ask the guest questions,
01:01:02.170 --> 01:01:05.369
Join the Bellingcat Discord server by visiting
01:01:05.369 --> 01:01:11.389
www .discord .gg slash Bellingcat. The music
01:01:11.389 --> 01:01:14.849
you've heard is titled Dawn by Newer Self and
01:01:14.849 --> 01:01:16.530
is courtesy of Artlist.