WEBVTT
00:00:03.439 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.199 --> 00:00:17.359
Not all heroes wear capes.
00:00:17.359 --> 00:00:27.199
Some spend their nights sifting through satellite imagery, social media posts, and shaky phone footage, searching for the fragments of truth that others have tried to bury.
00:00:27.199 --> 00:00:36.719
They identify where missiles have landed, document attacks on civilians, challenge governments when official statements don't match what happened on the ground.
00:00:36.719 --> 00:00:39.840
Sometimes their work helps locate missing people.
00:00:39.840 --> 00:00:44.640
Other times it preserves evidence that could one day bring war criminals to justice.
00:00:44.640 --> 00:00:55.359
In a world where anyone can manipulate an image, twist the truth, or simply deny that something ever happened, the work of OSINT investigators has never been more important.
00:00:55.359 --> 00:01:01.439
When trust in society is disappearing, someone has to prove what is real.
00:01:01.439 --> 00:01:06.719
So it was a great honor for me to get to know one of these heroes.
00:01:06.719 --> 00:01:09.840
Vladimir Zaha, welcome to the podcast.
00:01:10.239 --> 00:01:11.040
Thank you very much.
00:01:11.040 --> 00:01:12.480
It's great to be here.
00:01:12.480 --> 00:01:14.159
Tell us what you do for a living.
00:01:14.159 --> 00:01:16.879
Yeah, so uh I work for iProov.
00:01:16.879 --> 00:01:22.560
It's a British company, and we deal with research and prevention of biometric security attacks.
00:01:22.560 --> 00:01:29.920
Primarily, we are focusing against combating fraud and identity reappropriation by specific threat actors.
00:01:29.920 --> 00:01:30.560
Cool.
00:01:30.719 --> 00:01:33.920
So you're basically making it so people can't hack your face, basically.
00:01:34.239 --> 00:01:35.200
Yes, essentially, yeah.
00:01:35.200 --> 00:01:48.239
And especially with the the prevalence of AI nowadays and uh deep fakes, face swaps, and uh all of these beautiful capabilities that now are in everyone's hands, this this is becoming a much bigger threat to a lot of companies.
00:01:48.640 --> 00:01:56.879
This is not the topic of discussion today, but tell us how does one go about hacking a face recognition software?
00:01:57.280 --> 00:02:17.919
Obviously, there's there's implications of whether or not they have the the passwords and the credentials and a leak to to a particular person, but they might just simply want to create a new account, for example, with the bank and not have that account linked to them because then they can operate that account for their own reasons without fear of repercussions from authorities.
00:02:17.919 --> 00:02:40.719
How they do it is is mostly through an advanced technique, which is the main reason why we have a security operations center detecting these attacks and a threat intelligence team, which I'm a part of, is they perform injections on either mobile or on web applications that these banks or institutions utilize, and they try to inject their own arbitrary imagery.
00:02:40.719 --> 00:02:54.080
So instead of them scanning their face and improving their liveness, they inject uh either an AI-generated model from scratch or a face swap on their like real bodies, but a a separate synthetic face.
00:02:54.080 --> 00:03:04.719
And we have mitigations in place for all of this, but there are so many different types of attacks that of course it's it's a thing to look out for constantly, right?
00:03:04.719 --> 00:03:05.840
Because it's always evolving.
00:03:05.840 --> 00:03:10.879
And you've seen the pace at which these tools have have evolved recently, and AI has evolved recently.
00:03:10.879 --> 00:03:21.439
And most AI models that have reached a particular level of maturity are are fully capable of generating imagery of if it's the case for image models.
00:03:21.439 --> 00:03:27.360
But even to write a script that can do this for you, many models are capable of this already.
00:03:28.319 --> 00:03:31.199
And you work with threat intelligence because you keep up to date with that.
00:03:31.199 --> 00:03:34.960
So you follow the threat landscape and what people are doing on Telegram and all these places.
00:03:35.280 --> 00:03:35.680
Absolutely.
00:03:35.680 --> 00:03:39.360
And and it's thrilling because you see constant movement at any hour of the night.
00:03:39.360 --> 00:03:47.759
It's it's literally coming from every possible continent, the these pings of intelligence where someone might want to try a new technique or they invent one.
00:03:48.159 --> 00:03:48.719
Cool.
00:03:48.719 --> 00:03:51.439
But you have other hobbies.
00:03:51.439 --> 00:03:53.599
You have a you have a life outside of work.
00:03:54.000 --> 00:03:54.479
I do.
00:03:54.479 --> 00:03:56.319
I do, and it's also worker related.
00:03:56.319 --> 00:03:58.800
It's also very much uh aligned with intelligence.
00:03:58.800 --> 00:04:14.080
I I volunteer for the Bellingcat volunteer community, and it's a crowdsourced group of vetted members that assist with analysis of different data points that might help the Bellingcat staff with processing very large cases.
00:04:15.599 --> 00:04:16.800
What's the point of Bellingcat?
00:04:16.800 --> 00:04:18.319
What's their like purpose?
00:04:18.800 --> 00:04:29.360
The the point of Bellingcat is to be essentially, in my opinion, they are the only journalistic source of truth that I've seen in today's online world.
00:04:29.360 --> 00:04:33.439
They are by no means a classical news publication.
00:04:33.439 --> 00:04:42.000
They take news what I like to describe as low and slow, which means that facts are not presented immediately as they arrive.
00:04:42.000 --> 00:04:58.000
They are first verified, they are cross-referenced, and they're they're sourced to to where they come from in order to be able to actually determine the veracity of the facts that are being presented and not just easily get, you know, publication and clicks for for the speed of it.
00:04:58.800 --> 00:05:01.120
So they're there to verify facts.
00:05:01.600 --> 00:05:02.000
Absolutely.
00:05:02.240 --> 00:05:02.480
Yeah.
00:05:02.480 --> 00:05:05.680
Are there any other communities that are similar to Bellingcat that you're aware of?
00:05:06.319 --> 00:05:13.120
There are fringe communities that I wouldn't call them fringe necessarily, but they are adjacent to this cause.
00:05:13.120 --> 00:05:19.360
For example, geo-confirmed is one that relates to geolocating um conflict content.
00:05:19.360 --> 00:05:34.160
So videos, images from from active conflicts around the world, they put them on a map and they require the volunteer members of those community to assist with geolocating and verifying that these events have actually occurred in the places that they're they're alleged to occur.
00:05:34.160 --> 00:05:46.720
But in terms of the complete journalistic workflow and the presentation and the assurance that the data is factual, I have not so far met anything similar to Belling cat.
00:05:47.759 --> 00:05:49.920
But they work with open source intelligence, basically.
00:05:49.920 --> 00:05:50.560
OSINT.
00:05:51.120 --> 00:05:51.439
Absolutely.
00:05:51.439 --> 00:05:56.560
Everything needs to be verifiable through uh sources that are already available on the internet and anyone can find.
00:05:56.959 --> 00:05:57.120
Right.
00:05:57.120 --> 00:05:59.759
When I think of OSINT, I think of that that challenge.
00:05:59.759 --> 00:06:01.519
I think it's called the Where Am I challenge.
00:06:01.519 --> 00:06:09.279
And there's a bunch of different examples, but one of them was somebody put up just a picture of a shadow and they where am I?
00:06:09.279 --> 00:06:14.800
Can you just explain how how hard it is or how easy it is to do something like that?
00:06:15.120 --> 00:06:15.600
Yeah, absolutely.
00:06:15.600 --> 00:06:30.639
This is uh this is prevalent on on Twitter and other social media if if you search for #OSINT, # Where Am I or challenge, you'll find plenty of people that are uh trying to see if how easily they are they are able to be found.
00:06:30.639 --> 00:06:40.399
And uh essentially this this one case, I believe it it referred to simply the shadow of a of a window being projected onto a white wall with no other context whatsoever.
00:06:40.399 --> 00:06:43.839
So at first glance it was a a pretty hard challenge.
00:06:43.839 --> 00:06:55.680
But I I think even when you look at a at a specific point of data and you feel overwhelmed by the lack of detail in it, you can still find many things.
00:06:55.680 --> 00:06:59.040
And this speaks a lot to your own experience as a person.
00:06:59.040 --> 00:07:12.720
For example, if you have architectural knowledge or a background in architecture or in design, you might recognize that a windowsill has a particular shape or that the light is hitting at a particular angle inside of the building.
00:07:12.720 --> 00:07:22.879
And if you know about buildings and how they're built, they're mostly desired to be facing either east or west in order to either benefit from dusk or or dawn.
00:07:22.879 --> 00:07:23.439
Right.
00:07:23.439 --> 00:07:48.800
And in this case, I believe it was someone who found the shape of the windowsill was completely atypical, and uh reconstructing the full shape just from the shadow cast on the wall was able to determine the actual location of the building, and also correlating that with the position of the sun at the point where the image was taken, that actually gave a tremendous amount of information, which looking or scrolling past the picture, you would not believe this would be the case.
00:07:48.800 --> 00:07:50.800
But uh it absolutely is helpful.
00:07:51.600 --> 00:07:54.720
So people that work with OSINT, they're puzzle solvers.
00:07:55.519 --> 00:07:56.720
Very much so, yeah.
00:07:56.720 --> 00:08:03.759
Very much people with attention to detail and people with a desire to determine facts.
00:08:05.360 --> 00:08:11.040
Besides solving puzzles for fun, because they have this is a community that a lot of people just do it for fun.
00:08:11.040 --> 00:08:13.600
You have applied it to other matters.
00:08:13.600 --> 00:08:15.680
Tell us about some of the things you've applied it to.
00:08:16.079 --> 00:08:16.879
Yeah, absolutely.
00:08:16.879 --> 00:08:20.720
So some of the work I've been involved in, these are published articles.
00:08:20.720 --> 00:08:30.560
I've had the tremendous opportunity to to help with monitoring conflict in uh in Ukraine, and this is part of the civilian uh civilian harm in Ukraine Time Map.
00:08:30.560 --> 00:08:47.039
And the civilian harm in Ukraine time map essentially geolocates uh videos from Telegram and Twitter and other social media where it's showcased that missiles were used against civilian populations in certain areas during and throughout the invasion and the war in Ukraine.
00:08:47.039 --> 00:08:52.960
And there have been vast amounts of data to sift through, of course.
00:08:52.960 --> 00:08:59.279
And it's not easy, but it's it's something to remember that there are people who are living through this.
00:08:59.279 --> 00:09:08.159
Um and for me, just to be able to look at this and geolocate it is nothing compared to having to live this as a as a day-to-day.
00:09:08.159 --> 00:09:14.000
Um other projects have been uh the ICE raids in in the US.
00:09:14.000 --> 00:09:34.559
So the the actions and the activity of ICE uh and and affiliated enforcement agencies throughout the US recently, and particularly focusing on the abuse of power from these agencies, uh especially due to the fact that they are masked and and um, so to speak, unaccountable for for what actions they take in the field.
00:09:35.360 --> 00:09:39.600
There are facts in the world and their story contradict the facts.
00:09:40.240 --> 00:09:40.879
Yeah, absolutely.
00:09:40.879 --> 00:10:07.519
Do in my own opinion, I I want to say I do participate in this because I have a very strong interpretation of what fairness is, and I believe that what we're seeing coming out of the US, uh both uh at the initialization of these agencies and the revival of these agencies has not been congruent with fairness and how I define it, and I think how many other people define it as well.
00:10:07.519 --> 00:10:39.360
Um but uh absolutely in terms in terms of analyzing the actions of authoritarianism in today's modern world, you do see the trend of public statements not really matching up with what is seen on the ground, and the invalidation of eyewitness records and uh victim experiences, the invalidation of these through through a simple waving of the hand and saying, no, the legal state has the final opinion on this.
00:10:39.360 --> 00:10:45.279
This is not this did not happen, and actually our actions are fully compliant with how we normally do things.
00:10:45.279 --> 00:10:49.759
When um that's when I feel people need to step in.
00:10:49.759 --> 00:11:03.679
And that's when I feel OSINT is a public tool more than a personal preference, is to to search for those facts and make everyone aware that it's not just what one party says.
00:11:03.679 --> 00:11:06.559
It's it's actually what is seen and verifiable on the ground.
00:11:06.960 --> 00:11:23.600
One of the articles you wrote, there was the government said that, yeah, this individual drove into uh a cop car, an unmarked cop car, and then you saw the video, which is just from some somebody's iPhone, that the the cop car actually ran into her and dragged her out by her feet.
00:11:23.600 --> 00:11:28.799
So the government says one thing what are the steps that you actually take to prove this is actually what happened?
00:11:28.799 --> 00:11:30.480
I like how'd that look like for you?
00:11:30.879 --> 00:11:32.879
There's a bifold approach to this, right?
00:11:32.879 --> 00:11:40.639
I mean, there's there's the odd uh person living in England that wants to to verify this and put it out as a fact.
00:11:40.639 --> 00:11:51.039
Uh, but then there's also the citizen part of the the particular state where this happens, which I believe has a lot more control over what can happen in the future in that state.
00:11:51.039 --> 00:12:01.759
So your elected officials, your your police departments, how they are, um how they face the repercussions of these types of actions is is also a very valid approach, right?
00:12:01.759 --> 00:12:18.399
In the case of the open source intelligence analyst, uh simply having multiple views of the same thing happening, which goes against what a public authority states happened, is already a telltale sign of what actually occurred on that day, right?
00:12:18.399 --> 00:12:26.159
There's obviously arguing with AI earlier, there can always be manipulations of this.
00:12:26.159 --> 00:12:38.639
And I I believe OSINT analysts around the world have seen at least once uh an AI manipulated piece of content that aims to disrupt the normal analytical flow and what we do.
00:12:38.639 --> 00:12:46.960
Um however, there's verifiable means through which this has not happened with the particular video you're referencing, right?
00:12:46.960 --> 00:12:55.600
Even though it's easy to tout uh an overall devil that uh you know invalidates everything one person says.
00:12:55.600 --> 00:13:01.200
Um I think everyone should be the devil's advocate in this case and and actually research it themselves.
00:13:01.200 --> 00:13:04.480
And see, there's no artifacts of modified imagery.
00:13:04.480 --> 00:13:15.519
There is uh there is full one-to-one matching between two perspectives from two different observers, is what we call the people with the phones on the on the sidewalks, right?
00:13:15.519 --> 00:13:25.919
Two different observers filming the exact same thing with no uh inconsistencies between the videos is already a one in a million chance that this this might be a fake, right?
00:13:25.919 --> 00:13:27.840
It's uh you can tell that it's real.
00:13:27.840 --> 00:13:40.320
In the case of the person living in the state, I I believe protesting is one is one form of reaction to the spread of this type of disinformation from from official governing bodies.
00:13:40.320 --> 00:14:02.960
But at the same time, being equipped with the knowledge to perform their own verification of events, being able to hold accountable their states using FOIA requests or any type of public inquiries, or even being prepared to understand the current political situation in their state will help them a lot to protect themselves and their family from this happening to them as well.
00:14:03.440 --> 00:14:07.039
But what do you actually do when you're when you analyze these videos?
00:14:07.039 --> 00:14:08.960
Like how do you how do you know if they're fake?
00:14:08.960 --> 00:14:10.000
How do you verify facts?
00:14:10.000 --> 00:14:15.200
Like what is the verification process that what organizations like Bell ingcat would do or anybody else similar?
00:14:16.000 --> 00:14:20.399
I'll give you my example because I think it's unique to every every person.
00:14:20.399 --> 00:14:23.200
Um let's take the example of the OSIN challenge.
00:14:23.200 --> 00:14:31.759
Um and there there has been another one, for example, where um a person recently posted a photo from a window this time looking outside.
00:14:31.759 --> 00:14:35.200
Um and I believe in the end it was determined that it was in France.
00:14:35.200 --> 00:14:35.600
Right.
00:14:35.600 --> 00:14:39.360
So in one of these challenges, the workflow is very straightforward.
00:14:39.360 --> 00:14:43.440
Essentially, you're looking at an image, if we simplify it.
00:14:43.440 --> 00:14:49.039
A video is more complex, and at that point you you get more of a view of what's going around, so it's easier.
00:14:49.039 --> 00:14:50.720
Let's say it's just a photo.
00:14:50.720 --> 00:14:56.000
In the case of a photo, you try to break down the visual elements that you're looking at.
00:14:56.000 --> 00:15:08.159
If we're talking strictly about geolocation, which is a subset of open source intelligence, you need to take each object within the picture as a specific data point that you can research upon.
00:15:08.159 --> 00:15:12.559
Does the window have a particular frame, which is a thing that we've analyzed before?
00:15:12.559 --> 00:15:17.200
Does the the sun uh shoot through the window in a particular color?
00:15:17.200 --> 00:15:18.080
Is it warm?
00:15:18.080 --> 00:15:21.440
Is it more akin to a to white or blue color?
00:15:21.440 --> 00:15:22.399
So is it dusk?
00:15:22.399 --> 00:15:23.200
Is it dawn?
00:15:23.200 --> 00:15:32.159
The angle is always a thing to keep in mind, regardless, because it can determine roughly a time estimate of when the photo was taken.
00:15:32.159 --> 00:15:38.240
But then you also need to look at other objects which you might not usually is is there parquet flooring?
00:15:38.240 --> 00:15:39.679
Is it hardwood flooring?
00:15:39.679 --> 00:15:40.720
Is it cement?
00:15:40.720 --> 00:15:45.919
This will tell you a lot about the building standards in that area.
00:15:45.919 --> 00:15:53.759
Is the furniture from the you know 18th century, or is it modern, or is it IKEA, or does it look like IKEA, but it's not quite that?
00:15:53.759 --> 00:16:02.639
So is it a country that offers mock-up IKEA furniture, which also tells you a lot about where the subject uh is or or where they're located?
00:16:02.639 --> 00:16:05.519
And more of it than that, you need to look outside.
00:16:05.519 --> 00:16:14.720
You need to think outside the box, which is very much a thing that um maybe listeners that are from the cybersecurity realm uh might very much relate to if they do offensive security.
00:16:14.720 --> 00:16:16.080
You need to think outside the box.
00:16:16.080 --> 00:16:18.240
You need to look at the person who posted the photo.
00:16:18.240 --> 00:16:21.440
Do they normally post within that time frame?
00:16:21.440 --> 00:16:26.639
Are those their normal active hours or are they posting at night?
00:16:26.639 --> 00:16:29.360
Uh this is called pattern of life analysis.
00:16:29.360 --> 00:16:37.519
And and when you look at this, you can deduce, uh, but not with 100% certainty, of course, because nothing is.
00:16:37.519 --> 00:16:40.559
But you can start to deduce the time zone that the person might be in.
00:16:40.559 --> 00:16:43.440
So that helps you narrow down a lot, actually.
00:16:43.440 --> 00:16:56.399
This would be a normal flow for geolocation, but there is, as you can imagine, the the many different aspects of the world can be dissected in and so many other different aspects of data points that you can look at and you can learn about them.
00:16:56.399 --> 00:17:00.559
Munitions are one thing, weather are is another one.
00:17:00.559 --> 00:17:07.039
Um, knowing the different models of cars that exist in certain countries, the different street signs that exist in different countries.
00:17:07.039 --> 00:17:17.119
All of this is a very particular subset of skills that anyone with the background knowledge immediate to the subject might find useful to apply.
00:17:17.839 --> 00:17:19.759
Now you mentioned uh munitions.
00:17:19.759 --> 00:17:24.880
When I think of munitions, I think of there's a lot of work being done in OSINT in wars.
00:17:24.880 --> 00:17:30.960
Obviously, munitions is basically to see which sort of mercenaries, which sort of soldiers were there, or can you want to detail about that?
00:17:31.279 --> 00:17:32.160
This helps a lot, yeah.
00:17:32.160 --> 00:17:37.200
It it helps a lot to determine what kind of parties have worked together to launch attacks.
00:17:37.200 --> 00:17:48.079
Um and especially it it points towards the more revealing fact of how many stockpiles a particular army has, for example.
00:17:48.079 --> 00:18:11.119
If they start using munitions from the Cold War, suddenly after only using cluster munitions or very advanced guided uh missiles or any of the sort, if they start suddenly relying on very old, almost close to being recycled munitions, then you can already draw a conclusion from that.
00:18:11.119 --> 00:18:22.319
It's it's a lack of resources that that pose this need, or it's a pause before a next very strong assault if they're trying to pull together more resource for the next one.
00:18:22.319 --> 00:18:30.400
So it can tell you a lot about the mentality of the generals on the on the battlefield and the decisions that are being made at a very high level.
00:18:30.400 --> 00:18:35.519
Um because no stock is being sent to the front line just by pure choice.
00:18:35.519 --> 00:18:44.000
There's active logistical solutions that are in play that are different from missile to missile, from munition to munition.
00:18:44.000 --> 00:18:50.400
Um, for example, a tornado multiple launch rocket system requires its own loader.
00:18:50.400 --> 00:18:55.920
Uh you have to now back up the loader on the train and freight it to the front line as well.
00:18:55.920 --> 00:19:00.240
It's very different from having some, I don't know, mortar shells, right?
00:19:00.240 --> 00:19:06.079
And and it varies from decade to decade of manufacturing these missiles.
00:19:06.079 --> 00:19:09.680
And you can always tell a lot from from what is being used.
00:19:10.720 --> 00:19:14.400
There's a podcast that I follow, it's Ukraine today.
00:19:14.400 --> 00:19:16.160
Ukraine the Latest, I think it's called.
00:19:16.160 --> 00:19:21.279
And also a part of that, they have YouTube channels that show you every day what's going on on the front line.
00:19:21.279 --> 00:19:26.480
And that's it's I guess some of the military is sharing that for various reasons.
00:19:26.480 --> 00:19:31.839
Uh why is this war, or why are wars so visible these days, or how are they so visible?
00:19:31.839 --> 00:19:36.240
Is if you go on YouTube and you type in Ukraine or Russia, you see what happened yesterday.
00:19:36.240 --> 00:19:40.880
Can I trust that information, or like how would you look at those types of videos?
00:19:41.759 --> 00:19:45.279
That's a very good question because a lot of people, I believe, are doing the same thing nowadays.
00:19:45.279 --> 00:19:50.319
I mean, making these exact Google searches, and it's important to know if if you are looking at the right thing.
00:19:50.319 --> 00:19:50.720
Yeah.
00:19:50.720 --> 00:20:00.160
You've got you've got channels like Preston Stewart and Ryan McBeth who are doing like an amazing job at dissecting the battlefield and the political decisions behind what is going on in Ukraine.
00:20:00.160 --> 00:20:05.599
So if you are looking for points of truth, I can personally vouch to the veracity of those accounts.
00:20:05.599 --> 00:20:07.440
Um, definitely 100%.
00:20:07.440 --> 00:20:22.079
However, the wars are becoming more visible now, at least in the Western hemisphere, where you have this mentality of crowdsourcing and public support, right?
00:20:22.079 --> 00:20:35.200
If you if you're looking at an authoritarian government trying to trying to stop a civil war, they're not gonna have a telegram channel or or a TikTok channel posting like short clips of of what they're doing militarily, whatever is safe to post, right?
00:20:35.200 --> 00:20:35.839
Because they don't care.
00:20:35.839 --> 00:20:39.839
They're having a civil war and they're an authoritarian government.
00:20:39.839 --> 00:20:54.400
But in in for example, in the Russia-Ukraine conflict, um you want to garner support from home viewers because pretty much both sides still rely on public donations uh in order to support their their militaries.
00:20:54.400 --> 00:21:07.920
Like as wild as it seems, Russia, as as big as as it is, lacks, of course, a lot of equipment and has failed to maintain a lot of its equipment since the last wars that it waged, right?
00:21:07.920 --> 00:21:28.079
Ukraine, a very much smaller country, ill-prepared at the beginning of the war, now a lot better, has very quickly adopted Western mentality in in warfare and methodologies that are that are very compatible with current weapon systems that are being donated to them by the by the West, right?
00:21:28.079 --> 00:21:40.160
But they they both need just as much crowdsourced financial help donations, either in terms of like material, like drones or uh vehicles.
00:21:40.160 --> 00:21:51.359
Vehicles is a big one because of course they are almost dispensable in specific parts, but also just monetary help to buy to buy their own gear, to buy vests, to buy plate carriers, ammunition, and everything else.
00:21:51.359 --> 00:21:59.519
So you see this trend of everything appearing on social media from the point where.
00:21:59.519 --> 00:22:02.559
Becomes operationally safe to do so.
00:22:02.559 --> 00:22:08.079
It gets edited, it gets put in a compilation, and it arrives on your phone.
00:22:08.079 --> 00:22:14.240
And um it's it's quite surprising actually to see some platforms where you might not expect this to exist, like Instagram.
00:22:14.240 --> 00:22:26.960
You can scroll through and the algorithm will simply suggest uh frontline combat from from Ukraine, which speaks towards the desensitivization of audiences towards this type of content.
00:22:26.960 --> 00:22:34.880
It's also quite ironic that we we can sit in our own comfort and suddenly we're looking at someone die on the on the battlefield in Ukraine.
00:22:34.880 --> 00:22:35.839
That's fucked up.
00:22:35.839 --> 00:22:37.039
Yeah, absolutely.
00:22:37.039 --> 00:22:45.279
And but it also garnishes support from people in the West who who are seeing this injustice and and they want to help.
00:22:45.599 --> 00:22:48.720
We're talking about satellite data uh that you can buy.
00:22:48.720 --> 00:22:51.839
You said that you can get within a meter accuracy.
00:22:51.839 --> 00:22:57.839
How accurate is that satellite data and how easy it is it for somebody like you that knows where to look to actually get that information?
00:22:58.240 --> 00:22:58.640
Absolutely.
00:22:58.640 --> 00:23:08.000
I think I think the the main blocking point there is money, uh, because of course satellite imagery providers are also in touch with what is going on.
00:23:08.000 --> 00:23:22.480
So obviously, if you are buying extremely accurate satellite imagery uh down to one meter in Ukraine or in Crimea or somewhere in in Russia, they're gonna get the idea of what what is going on.
00:23:22.480 --> 00:23:28.559
Um but essentially there are specific ways in which uh one one can do this.
00:23:28.559 --> 00:23:38.960
And of course, it it helps to be able to represent yourself to an organization rather than an individual randomly going to uh to to buy you know one meter imagery.
00:23:38.960 --> 00:24:00.400
Um however it's they do their own vetting because of course they don't want to provide this this imagery to, for example, the Russians or or to any threat actor that might be interested in joining a conflict or um just anyone realistically because these are targeting capabilities, right?
00:24:00.400 --> 00:24:02.880
At that point, you're speaking about targeting capabilities.
00:24:02.880 --> 00:24:08.240
Ukraine has solved a lot of this cost issue, for example, by crowdsourcing their own satellite.
00:24:08.240 --> 00:24:14.799
And uh and this this helps them operationally to achieve their objectives on the front line, even long distance as well.
00:24:14.799 --> 00:24:43.599
What I've seen recently, and actually I want this question to answer because I'm not I'm not quite sure if this is the case, but in uh Copernicus, which is a online tool, it's it's a satellite, but it's publicly available satellite imagery on a date selection basis, and it offers different filters and different satellites that are all open source, and you can look at their imagery when they passed over a specific area.
00:24:43.599 --> 00:24:51.039
The idea is you can uh you can you can look at infrared signatures depending on what's available and what satellite has passed over that area.
00:24:51.039 --> 00:24:56.240
You may be able to look at infrared signatures or or other sort of filters, which is called remote sensing.
00:24:56.240 --> 00:25:05.119
When you start filtering the image back from the satellite and you filter out different wavelengths, you can see vegetation more clearly than you can see cars or buildings, for example.
00:25:05.119 --> 00:25:12.160
You can see night lights in urban areas better than you can see the sun reflecting off rooftops, for example.
00:25:12.160 --> 00:25:19.519
So it lets you remote sense particular materials and areas of interest.
00:25:19.519 --> 00:25:32.079
I I'm seeing now recently with Copernicus, there's these streaks that come at diagonal angles over important parts of Russia and Crimea, which I'm very curious about.
00:25:32.079 --> 00:25:34.160
I haven't managed to find an answer to this.
00:25:34.160 --> 00:25:42.880
Um, but it almost looks as if someone is trying to obscure the satellite view from these critical areas because there is a conflict.
00:25:42.880 --> 00:25:47.279
And looking around the world, nowhere else have I seen these these streaks right now.
00:25:47.279 --> 00:25:58.000
So those there's obviously acknowledgement from both sides that uh these satellites offer open source uh information about what's what's being seen from space over these territories.
00:25:58.000 --> 00:26:02.880
They just want to limit accessibility to this imagery as much as possible.
00:26:03.680 --> 00:26:06.640
Should have probably covered this earlier, but open source doesn't mean free.
00:26:06.640 --> 00:26:10.480
It just means that it's publicly available, you don't have to be military to get it.
00:26:11.039 --> 00:26:11.279
Yes.
00:26:11.279 --> 00:26:12.880
So there's different approaches to this.
00:26:12.880 --> 00:26:21.839
Um open source originally comes from the fact that yeah, you don't need to be in the intelligence services or in the military to achieve this information.
00:26:21.839 --> 00:26:37.680
Um the uh the opposing side we call closed source intelligence, which is what you know the NSA have and what GCHQ has, which is collection data from who knows what, uh, but from centralized systems that nobody else has access to.
00:26:37.680 --> 00:26:45.680
Open source data is originally the opposite of that, it's just things that people leave behind publicly, intentionally.
00:26:45.680 --> 00:26:46.640
Organically, yeah.
00:26:46.640 --> 00:26:50.240
Organically think of like dumpster diving but online, right?
00:26:50.240 --> 00:26:54.480
That's essentially what I do to summarize your your previous question.
00:26:54.480 --> 00:27:04.319
But there's also the the concept that you don't need to pay for it, because payment in certain areas implies that not everyone can access it, so it's not democratized.
00:27:04.319 --> 00:27:10.880
So therefore, if it's not verifiable by everyone, then it's not accessible by by everyone.
00:27:10.880 --> 00:27:20.000
For example, Trace Labs, which is a really great organization from the US, they do capture the flag tournaments where you find missing persons.
00:27:20.000 --> 00:27:28.160
So they collaborate with police stations and police associations and institutions across the US and Canada, I believe, both of them.
00:27:28.160 --> 00:27:36.720
And any missing person cases that they get from those police institutions, they offer as a package for the CTF.
00:27:36.720 --> 00:27:41.680
And essentially you um you employ, you volunteer 100, 500.
00:27:41.680 --> 00:27:43.839
I'm not sure how many people participate in these.
00:27:43.839 --> 00:27:52.400
I've I've personally both been a participant and a coach, but you get crowdsourced intelligence polls about where the whereabouts of these people might be.
00:27:52.400 --> 00:27:59.279
Um some some of them um are you know people who who live a very active life.
00:27:59.279 --> 00:28:03.279
They are active socially, so there's a lot to search through.
00:28:03.279 --> 00:28:09.359
They are very well connected, all their friends post together with them, so it's easy to cross-correlate where they might be.
00:28:09.359 --> 00:28:19.200
Others are ghosts, they're they're simply people that are not using social media, but they might use one account once to check in someplace because someone asked them to leave a review, right?
00:28:19.200 --> 00:28:34.240
So it takes like different levels of skill sets to try to find as much as possible about these people, and then you submit it in the coach reviews uh this information to see if it's like valid for what we are looking for.
00:28:34.240 --> 00:28:43.440
And at the end, what happens is all this information gets submitted back to the police department that requested its review, and a lot of the times or sometimes, people are found.
00:28:43.440 --> 00:28:49.440
People are found uh well, people are found otherwise, but uh the family gets an answer.
00:28:49.440 --> 00:28:57.359
And one of the particularities of the CTF is that open source intelligence in this case does need to mean free.
00:28:57.359 --> 00:29:10.720
Because when you give this information back to the police station, or might it be a detective, might it be uh someone else in the police station, you don't know who gets this information and if they have the technical capability to review it, right?
00:29:10.720 --> 00:29:15.119
You cannot give them like terminal output from an automated collection tool.
00:29:15.119 --> 00:29:19.920
You need to give them factual evidence that they know how to access and is is easy for them as well.
00:29:19.920 --> 00:29:22.480
So part of it is yeah, it it can be paid.
00:29:22.480 --> 00:29:24.319
They need to be able to access it straight away.
00:29:25.920 --> 00:29:28.079
How do you use OSINT and cyber?
00:29:28.079 --> 00:29:34.319
The majority of people listening to this episode or this episode and the nomadic security podcast or cybersecurity professionals.
00:29:34.319 --> 00:29:37.119
How would OSINT help them in their job?
00:29:37.119 --> 00:29:43.039
Or is there a connection there between their protecting a network and OSINT?
00:29:43.519 --> 00:29:44.160
There is absolutely.
00:29:44.160 --> 00:29:58.480
I mean, at least to say the work that I do right now shows there's a direct correlation between the security of a product or of a company and the activities of threat actors that are interested in in nabbing those secrets from the company, right?
00:29:58.480 --> 00:30:04.319
Um there will always be a vested interest of someone to break into something.
00:30:04.319 --> 00:30:06.720
This is just the nature of criminality.
00:30:06.720 --> 00:30:19.440
And to be one step ahead doesn't just mean to implement your EDR or to implement your SOC team or to to install, you know, uh MDM and antiviruses on your laptops.
00:30:19.440 --> 00:30:24.559
To be one step ahead means to be in tune with what's going on in your operational environment.
00:30:24.559 --> 00:30:32.319
And it's very much what intelligence agencies do, it's very much what the military does, it's awareness of your operational environment, right?
00:30:32.319 --> 00:30:59.119
If you don't know that anyone has a vested interest or has posted on a forum uh to get help to hack your company or or to to find more information about you personally, the head of security of a company, if you don't know how to search these spaces, if you're completely oblivious of them, you can't rely on automated tools for this because the traffic is so organic and the behavior of threat actors is so varied and in different languages, right?
00:30:59.119 --> 00:31:00.799
You you can only do this yourself.
00:31:00.799 --> 00:31:03.440
You can only understand this at a human level.
00:31:03.440 --> 00:31:06.079
So it very much helps security professionals, I believe.
00:31:06.079 --> 00:31:19.039
Even though uh in CTFs, I think OSYNT is a little bit misrepresented, it's a little bit simplified and it's it's synthetically generated to make you find a flag on someone's like a sock puppet's Twitter account, right?
00:31:19.039 --> 00:31:27.839
But OSYNT in real life is so much more different because you've got so much more data to sift through and it's all organic, so it's all random.
00:31:27.839 --> 00:31:32.640
You can't classify it, you can't really put a tag on it, you need to to learn how to look.
00:31:33.039 --> 00:31:51.920
Just put this in perspective, you're when you're protecting your company, the company you work for, which is you basically need to follow a bunch of like I'll call them underground environments to see how threat actors are planning to do something against face facial recognition software.
00:31:51.920 --> 00:31:55.519
Uh that's that's a very much B2C sort of use case.
00:31:55.519 --> 00:32:04.640
It's it's more so B2B, uh because the Yeah, B2B, but they're protecting their clients, so it's B2C or
00:32:04.640 --> 00:32:04.880
Correct.
00:32:04.880 --> 00:32:06.319
Yeah, but through proxy kind of.
00:32:06.319 --> 00:32:06.640
Yeah.
00:32:06.640 --> 00:32:06.799
Yeah.
00:32:06.960 --> 00:32:07.599
I see what you yeah.
00:32:07.759 --> 00:32:07.839
Yeah.
00:32:07.839 --> 00:32:18.000
Because the person the person opening an account with a bank, for example, can never be held liable for someone bypassing the biometric system that the bank uses, right?
00:32:18.000 --> 00:32:18.960
That's the bank's fault.
00:32:18.960 --> 00:32:21.759
Or it's the bank's third-party service provider fault.
00:32:21.759 --> 00:32:31.519
So um mostly what we do is trying to raise awareness into this new field, which is biometrics.
00:32:31.519 --> 00:32:48.960
And especially in this, well, it's not a new field, but it's a new implementation of this because you're seeing now also there being a social media uproar about the overusage of these tools to verify you on social media to make sure you're over 16, over 18, depending on the country, whatever, to make sure you're an adult.
00:32:48.960 --> 00:32:50.799
My opinion, overusage.
00:32:50.799 --> 00:32:55.839
But to prevent threat actors from entering your bank account, sure, no problem.
00:32:55.839 --> 00:32:56.960
That makes sense.
00:32:56.960 --> 00:33:05.920
To prevent people or unknown persons from coming into the to the border of the country, sure, yes, your passport needs to match your face and who you are in real life, right?
00:33:05.920 --> 00:33:07.119
This this all makes sense.
00:33:07.119 --> 00:33:18.160
What we do is we try to create awareness of this issue, which is expanding not only the border controls and financial institutions, but everywhere else as well.
00:33:18.160 --> 00:33:31.839
So identity fraud can happen pretty much at any point, um, because there's steps you can take to escalate your control over this victim's identity as a threat actor.
00:33:31.839 --> 00:33:36.000
And the more you do, the more voracious your identity now becomes.
00:33:36.000 --> 00:33:42.400
And suddenly someone's got a hold of your SIM card number and and they've they performed a simjack attack on you, right?
00:33:42.400 --> 00:33:46.480
The the thing is we create these reports, they're called apex reports.
00:33:46.480 --> 00:34:03.039
And these reports are are given to customers, showcasing not only the typical industries that are being affected, which is what you expect borders financial, uh, but it's it's everything that we see, and it's the trends and the data that we pull from our own uh system being attacked as well.
00:34:03.039 --> 00:34:10.000
So it it we are the tip of the spear right now in in what's as an implementation biometric security.
00:34:10.000 --> 00:34:15.920
And we are obviously the most coveted kind of attack surface, if if you would like.
00:34:15.920 --> 00:34:29.280
Um the insight from that helps companies that do not utilize us also to prepare and and to make steps to to protect themselves without the need for them to you know one click buy a solution and that's the end of the day.
00:34:29.280 --> 00:34:32.079
It's the knowledge that saves them, not not the solution.
00:34:32.400 --> 00:34:33.119
I have to ask it.
00:34:33.119 --> 00:34:34.480
Uh the concept of AI.
00:34:34.480 --> 00:34:46.719
I have colleagues that they're just vibe coding tools that are able to do things that you just they were reserved for nation states before, but now you can just vibe code your way to it because you don't need developers anymore.
00:34:46.719 --> 00:34:48.320
You can just use some tokens on it.
00:34:48.320 --> 00:34:50.639
How is AI changing the world of OSIN?
00:34:50.639 --> 00:34:54.960
Because I would assume that a lot of the things that you'd have to do very manually before are just completely automated now.
00:34:54.960 --> 00:34:58.559
How's that have you noticed that in when you're in your journeys?
00:34:58.960 --> 00:35:02.559
Yeah, actually, um I've I've tried implementing it here and there.
00:35:02.559 --> 00:35:05.199
I've I've used it to the point where I I I understand it.
00:35:05.199 --> 00:35:22.320
And that honestly has accelerated my ability to do things because when did I not have a need, or any OSINT analyst or any security person in general, when did we not have a need that we were like, I wish I had a tool for that, but it like costs like 5,000 pounds a month, so I can't.
00:35:22.320 --> 00:35:23.760
It's like now you can code them.
00:35:23.760 --> 00:35:24.800
Now you now you can make it.
00:35:24.800 --> 00:35:38.880
And there have been people who have done like Palantir at home, and even just as a visualization tool, it's powerful because you get to present things in front of non-technical people and they understand because it has like a nice spinny graph of the world and you can tell where the subject is in the map.
00:35:38.880 --> 00:35:46.159
But also, yeah, information collection solutions, automated reporting, all of these, they're useful.
00:35:46.159 --> 00:35:49.679
Everyone just needs to keep in mind that it's intelligence, guys.
00:35:49.679 --> 00:35:50.960
Like you need to verify it, right?
00:35:50.960 --> 00:35:53.360
Part of it is collection, but part of it is analysis.
00:35:53.360 --> 00:36:05.519
And you need to make sure that once you analyze the intelligence is not hallucinated, it's it's voracious, it's you know, pinpointed in time and space exactly as as you might want it to present to another person.
00:36:06.159 --> 00:36:13.360
Just to end on a philosophical note or forward-thinking note, like the future of OSIN, how do you think that's gonna affect democracy moving forward?
00:36:13.760 --> 00:36:23.920
Oof, yeah, that's uh that's something I've been thinking about recently, especially obviously with the the death of factual analysis of of news.
00:36:24.320 --> 00:36:26.000
As in nobody gives a shit about the facts anymore.
00:36:26.159 --> 00:36:26.559
Yeah, absolutely.
00:36:26.559 --> 00:36:27.360
Yeah, yeah.
00:36:27.360 --> 00:36:32.719
And especially with this, um I'm asking, is it is it going to die?
00:36:32.719 --> 00:36:34.480
Oh or I don't think so.
00:36:34.480 --> 00:36:39.760
Or is it going to become finally paid enough for for more people to do this?
00:36:39.760 --> 00:36:48.559
I mean, this is these are two of the the pain points that I've seen, at least uh in in here and in in other countries, OSINT doesn't pay.
00:36:48.559 --> 00:36:54.000
It's it's so disregarded in terms of his its efficacy as well.
00:36:54.000 --> 00:37:17.360
For example, one of the struggles that people are having right now, unrelated to what I've done before, but with the Kherson and Bakhmut um war crime investigators um currently prosecuting cases against persons in the Russian government or the Russian army, uh it's the attempt to get this uh OSINT collected information valid in court.
00:37:17.360 --> 00:37:19.440
It's still a struggle.
00:37:19.440 --> 00:37:34.159
And just because it came from not uh an analyst in a government office using the analyst's notebook software, and instead they use MultiGo or like a telegram scraper they wrote themselves, just because of that, it's invalid.
00:37:34.159 --> 00:37:38.719
Like it can go through the same validation process as everything else.
00:37:38.719 --> 00:37:50.480
It's just a um lack of education about OSINT and its functionality and how much it has evolved over time that is that is causing this lag behind the uh normal systems.
00:37:50.880 --> 00:37:52.880
So it's the tool you name analyst notebook.
00:37:52.880 --> 00:37:53.920
I used to work for IBM.
00:37:53.920 --> 00:37:55.360
So I know what analyst notebook is.
00:37:55.360 --> 00:37:56.960
I really want a subscription, by the way.
00:37:56.960 --> 00:37:57.599
Yeah, yeah, yeah.
00:37:57.599 --> 00:37:59.519
You can buy it from one of my friends, but it's gonna cost you.
00:37:59.519 --> 00:38:03.280
So it's the tool and also the the person that you are, the authority that you represent.
00:38:03.280 --> 00:38:04.079
Yes.
00:38:04.079 --> 00:38:06.880
That's what sort of works in court.
00:38:07.199 --> 00:38:08.480
I think that's the secret sauce.
00:38:08.480 --> 00:38:23.039
I mean, obviously you have the I'm not I'm not a legal expert or anything, but there's also like a chain of custody, and there's a um requirement for the storage of this information to make sure it wasn't modified and transit and storage or when when opening it just to view it, right?
00:38:23.039 --> 00:38:25.360
It's the same as uh computer forensics, pretty much.
00:38:25.360 --> 00:38:26.880
It's the same standards there.
00:38:26.880 --> 00:38:31.280
Um the information cannot at any point be any different than from the point of collection.
00:38:31.280 --> 00:38:40.559
And the point of collection, preferably, needs to still be available in order to be able to be verified uh that it was indeed that the source that it was collected from.
00:38:40.559 --> 00:38:45.119
Though there's so many instances of this happening, I don't think it's an issue of scarcity.
00:38:45.119 --> 00:38:55.039
I think it's an issue of accepting technology, which is not new anymore, accepting methodology and desire to volunteer, which is again not new anymore.
00:38:55.039 --> 00:39:00.400
But it that it does come from kind of an older institution, which is the the Hague, right?
00:39:00.400 --> 00:39:18.239
Or or the International Criminal Court, which very much relies still on uh processes that are have been established over years to ensure the utmost efficacy when prosecuting war criminals, which is understandable why it's monolithic and why it's it's hard to get it to move, right?
00:39:18.239 --> 00:39:22.559
But this speaks to other courts and other industries, even as well.
00:39:22.960 --> 00:39:28.880
But like when you when I've if I was to film you right now with an iPhone, I would hate the metadata, yeah, yeah, right.
00:39:28.880 --> 00:39:31.280
You need to have a better, you deserve a better camera, I'd agree.
00:39:31.280 --> 00:39:33.920
But like all the metadata is gonna be in that film, right?
00:39:33.920 --> 00:39:38.079
Like somebody that works with the iOS forensics will be able to say that is 100% legit.
00:39:38.079 --> 00:39:39.519
So the fact is still a fact.
00:39:39.519 --> 00:39:43.679
And even though I took it and nobody trusts me because I've had a beer or two, that's still a fact.
00:39:43.920 --> 00:39:44.800
Yeah, it's still a fact.
00:39:44.800 --> 00:39:46.639
I mean, you could always modify it.
00:39:46.639 --> 00:40:02.400
You could use, you know, XF tools to to modify the metadata for that video, but as long as that iPhone doesn't touch anything else, or at least it's provable that anything else it has touched hasn't been able to interfere with the metadata of that video, then it's provable in court, right?
00:40:02.400 --> 00:40:03.679
But can that be proven?
00:40:03.679 --> 00:40:04.880
Is that possible to do as well?
00:40:04.880 --> 00:40:08.719
Uh or is it just word is it still word against word at the end of the day?
00:40:08.719 --> 00:40:09.519
It's word against word.
00:40:09.519 --> 00:40:10.960
It's it's legal matters, I believe.
00:40:10.960 --> 00:40:12.480
I believe it is word against word.
00:40:12.480 --> 00:40:18.159
I mean, anything can be proven only up to a point of credibility, right?
00:40:18.159 --> 00:40:25.679
I mean, if you look at fingerprints, for the longest time there there has been a debate if fingerprints are realistically admissible in court, right?
00:40:25.679 --> 00:40:30.239
Because of different factors, which I'm I'm not fully aware of, so I'm not going to speak about them.
00:40:30.239 --> 00:40:38.239
But the veracity and the correlation between the subject and its and its fingerprint has always been in question, at least at the beginning of fingerprints as well.
00:40:38.239 --> 00:40:41.280
Um and now I think I've seen recently another question about this.
00:40:41.280 --> 00:40:47.360
Like, have we been relying on this tool for prosecuting individuals the wrong way this whole time?
00:40:47.360 --> 00:40:48.320
Not sure.
00:40:48.320 --> 00:40:49.280
Watch the video.
00:40:49.280 --> 00:40:53.760
But um, yeah, there's there's always new things that we learn about the world.
00:40:53.760 --> 00:40:56.960
There's always new things that appear in technology that suddenly change everything.
00:40:56.960 --> 00:41:09.760
Like, how many times have analysts had tools that they relied on almost at a forensic level completely disappear off the face of the planet, or suddenly they're monetizing and they're like popping like mobile game ads in the in the interface, right?
00:41:09.760 --> 00:41:12.719
This is like completely possible for someone who relies on a tool.
00:41:12.719 --> 00:41:15.840
It's it's out of our control because it is open source.
00:41:15.840 --> 00:41:19.920
For example, one uh just one more note there, actually.
00:41:19.920 --> 00:41:35.679
The uh one of the things that OSINT analysts or people aspiring to be OSINT analysts need to do is sure, you can do it one time, you can do it um instantaneously if you just want to uh research something in the moment.
00:41:35.679 --> 00:41:39.840
You just download some tools that might help you, but it's mostly manual work, no problem there.
00:41:39.840 --> 00:41:46.880
If you plan to do it at scale or over a longer period of time, what you need to be aware of is is tool deprecation.
00:41:46.880 --> 00:42:12.400
And for example, with Bellincat, one of the projects uh that that uh is is constantly evolving and constantly present and a need for the community is the Bellincat Toolkit, which is essentially a a um Git book page, a Git book instance, which holds all of the tools that we have vetted uh that are not me, it's mostly Bellincat staff, but um we've we've can volunteer for these things.
00:42:12.400 --> 00:42:28.800
So we look at if they contain sponsorship links or any tracking methods within the tool, if the tool is safe to use in a terminal, if it um takes certain commands to install, like we we look at all of these parameters and uh you need to validate is it still up to date?
00:42:28.800 --> 00:42:29.760
Has anything changed?
00:42:29.760 --> 00:42:30.559
Is anything broken?
00:42:30.559 --> 00:42:31.519
Is anything fixed?
00:42:31.519 --> 00:42:34.639
So keeping it up to date is a big part of it.
00:42:34.639 --> 00:42:42.960
Same goes for sock puppet accounts, your investigative accounts that you need to look after and grow as if they're they're your own because you are posing as a real person.
00:42:43.599 --> 00:42:46.159
On behalf of the world, thank you for all the great work that you do.
00:42:46.159 --> 00:42:48.800
As the Brits would say, Vlad, you're a you're a good lad.
00:42:48.800 --> 00:42:50.159
Thank you so much.
00:42:50.159 --> 00:42:51.119
Take care of yourself.
00:42:51.119 --> 00:42:51.840
It's been a pleasure.
00:42:51.840 --> 00:42:53.119
Keep up the great work.
00:42:53.119 --> 00:42:54.000
Thank you.
00:42:54.000 --> 00:42:56.559
Well, that's all for today, folks.
00:42:56.559 --> 00:42:59.360
Thank you for tuning in to the Mnemonic Security Podcast.
00:42:59.360 --> 00:43:07.760
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcast @ mnemonic.no.
00:43:08.800 --> 00:43:10.559
Thank you for listening.
00:43:10.559 --> 00:43:12.239
We'll see you next time.
00:00:03.439 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.199 --> 00:00:17.359
Not all heroes wear capes.
00:00:17.359 --> 00:00:27.199
Some spend their nights sifting through satellite imagery, social media posts, and shaky phone footage, searching for the fragments of truth that others have tried to bury.
00:00:27.199 --> 00:00:36.719
They identify where missiles have landed, document attacks on civilians, challenge governments when official statements don't match what happened on the ground.
00:00:36.719 --> 00:00:39.840
Sometimes their work helps locate missing people.
00:00:39.840 --> 00:00:44.640
Other times it preserves evidence that could one day bring war criminals to justice.
00:00:44.640 --> 00:00:55.359
In a world where anyone can manipulate an image, twist the truth, or simply deny that something ever happened, the work of OSINT investigators has never been more important.
00:00:55.359 --> 00:01:01.439
When trust in society is disappearing, someone has to prove what is real.
00:01:01.439 --> 00:01:06.719
So it was a great honor for me to get to know one of these heroes.
00:01:06.719 --> 00:01:09.840
Vladimir Zaha, welcome to the podcast.
00:01:10.239 --> 00:01:11.040
Thank you very much.
00:01:11.040 --> 00:01:12.480
It's great to be here.
00:01:12.480 --> 00:01:14.159
Tell us what you do for a living.
00:01:14.159 --> 00:01:16.879
Yeah, so uh I work for iProov.
00:01:16.879 --> 00:01:22.560
It's a British company, and we deal with research and prevention of biometric security attacks.
00:01:22.560 --> 00:01:29.920
Primarily, we are focusing against combating fraud and identity reappropriation by specific threat actors.
00:01:29.920 --> 00:01:30.560
Cool.
00:01:30.719 --> 00:01:33.920
So you're basically making it so people can't hack your face, basically.
00:01:34.239 --> 00:01:35.200
Yes, essentially, yeah.
00:01:35.200 --> 00:01:48.239
And especially with the the prevalence of AI nowadays and uh deep fakes, face swaps, and uh all of these beautiful capabilities that now are in everyone's hands, this this is becoming a much bigger threat to a lot of companies.
00:01:48.640 --> 00:01:56.879
This is not the topic of discussion today, but tell us how does one go about hacking a face recognition software?
00:01:57.280 --> 00:02:17.919
Obviously, there's there's implications of whether or not they have the the passwords and the credentials and a leak to to a particular person, but they might just simply want to create a new account, for example, with the bank and not have that account linked to them because then they can operate that account for their own reasons without fear of repercussions from authorities.
00:02:17.919 --> 00:02:40.719
How they do it is is mostly through an advanced technique, which is the main reason why we have a security operations center detecting these attacks and a threat intelligence team, which I'm a part of, is they perform injections on either mobile or on web applications that these banks or institutions utilize, and they try to inject their own arbitrary imagery.
00:02:40.719 --> 00:02:54.080
So instead of them scanning their face and improving their liveness, they inject uh either an AI-generated model from scratch or a face swap on their like real bodies, but a a separate synthetic face.
00:02:54.080 --> 00:03:04.719
And we have mitigations in place for all of this, but there are so many different types of attacks that of course it's it's a thing to look out for constantly, right?
00:03:04.719 --> 00:03:05.840
Because it's always evolving.
00:03:05.840 --> 00:03:10.879
And you've seen the pace at which these tools have have evolved recently, and AI has evolved recently.
00:03:10.879 --> 00:03:21.439
And most AI models that have reached a particular level of maturity are are fully capable of generating imagery of if it's the case for image models.
00:03:21.439 --> 00:03:27.360
But even to write a script that can do this for you, many models are capable of this already.
00:03:28.319 --> 00:03:31.199
And you work with threat intelligence because you keep up to date with that.
00:03:31.199 --> 00:03:34.960
So you follow the threat landscape and what people are doing on Telegram and all these places.
00:03:35.280 --> 00:03:35.680
Absolutely.
00:03:35.680 --> 00:03:39.360
And and it's thrilling because you see constant movement at any hour of the night.
00:03:39.360 --> 00:03:47.759
It's it's literally coming from every possible continent, the these pings of intelligence where someone might want to try a new technique or they invent one.
00:03:48.159 --> 00:03:48.719
Cool.
00:03:48.719 --> 00:03:51.439
But you have other hobbies.
00:03:51.439 --> 00:03:53.599
You have a you have a life outside of work.
00:03:54.000 --> 00:03:54.479
I do.
00:03:54.479 --> 00:03:56.319
I do, and it's also worker related.
00:03:56.319 --> 00:03:58.800
It's also very much uh aligned with intelligence.
00:03:58.800 --> 00:04:14.080
I I volunteer for the Bellingcat volunteer community, and it's a crowdsourced group of vetted members that assist with analysis of different data points that might help the Bellingcat staff with processing very large cases.
00:04:15.599 --> 00:04:16.800
What's the point of Bellingcat?
00:04:16.800 --> 00:04:18.319
What's their like purpose?
00:04:18.800 --> 00:04:29.360
The the point of Bellingcat is to be essentially, in my opinion, they are the only journalistic source of truth that I've seen in today's online world.
00:04:29.360 --> 00:04:33.439
They are by no means a classical news publication.
00:04:33.439 --> 00:04:42.000
They take news what I like to describe as low and slow, which means that facts are not presented immediately as they arrive.
00:04:42.000 --> 00:04:58.000
They are first verified, they are cross-referenced, and they're they're sourced to to where they come from in order to be able to actually determine the veracity of the facts that are being presented and not just easily get, you know, publication and clicks for for the speed of it.
00:04:58.800 --> 00:05:01.120
So they're there to verify facts.
00:05:01.600 --> 00:05:02.000
Absolutely.
00:05:02.240 --> 00:05:02.480
Yeah.
00:05:02.480 --> 00:05:05.680
Are there any other communities that are similar to Bellingcat that you're aware of?
00:05:06.319 --> 00:05:13.120
There are fringe communities that I wouldn't call them fringe necessarily, but they are adjacent to this cause.
00:05:13.120 --> 00:05:19.360
For example, geo-confirmed is one that relates to geolocating um conflict content.
00:05:19.360 --> 00:05:34.160
So videos, images from from active conflicts around the world, they put them on a map and they require the volunteer members of those community to assist with geolocating and verifying that these events have actually occurred in the places that they're they're alleged to occur.
00:05:34.160 --> 00:05:46.720
But in terms of the complete journalistic workflow and the presentation and the assurance that the data is factual, I have not so far met anything similar to Belling cat.
00:05:47.759 --> 00:05:49.920
But they work with open source intelligence, basically.
00:05:49.920 --> 00:05:50.560
OSINT.
00:05:51.120 --> 00:05:51.439
Absolutely.
00:05:51.439 --> 00:05:56.560
Everything needs to be verifiable through uh sources that are already available on the internet and anyone can find.
00:05:56.959 --> 00:05:57.120
Right.
00:05:57.120 --> 00:05:59.759
When I think of OSINT, I think of that that challenge.
00:05:59.759 --> 00:06:01.519
I think it's called the Where Am I challenge.
00:06:01.519 --> 00:06:09.279
And there's a bunch of different examples, but one of them was somebody put up just a picture of a shadow and they where am I?
00:06:09.279 --> 00:06:14.800
Can you just explain how how hard it is or how easy it is to do something like that?
00:06:15.120 --> 00:06:15.600
Yeah, absolutely.
00:06:15.600 --> 00:06:30.639
This is uh this is prevalent on on Twitter and other social media if if you search for #OSINT, # Where Am I or challenge, you'll find plenty of people that are uh trying to see if how easily they are they are able to be found.
00:06:30.639 --> 00:06:40.399
And uh essentially this this one case, I believe it it referred to simply the shadow of a of a window being projected onto a white wall with no other context whatsoever.
00:06:40.399 --> 00:06:43.839
So at first glance it was a a pretty hard challenge.
00:06:43.839 --> 00:06:55.680
But I I think even when you look at a at a specific point of data and you feel overwhelmed by the lack of detail in it, you can still find many things.
00:06:55.680 --> 00:06:59.040
And this speaks a lot to your own experience as a person.
00:06:59.040 --> 00:07:12.720
For example, if you have architectural knowledge or a background in architecture or in design, you might recognize that a windowsill has a particular shape or that the light is hitting at a particular angle inside of the building.
00:07:12.720 --> 00:07:22.879
And if you know about buildings and how they're built, they're mostly desired to be facing either east or west in order to either benefit from dusk or or dawn.
00:07:22.879 --> 00:07:23.439
Right.
00:07:23.439 --> 00:07:48.800
And in this case, I believe it was someone who found the shape of the windowsill was completely atypical, and uh reconstructing the full shape just from the shadow cast on the wall was able to determine the actual location of the building, and also correlating that with the position of the sun at the point where the image was taken, that actually gave a tremendous amount of information, which looking or scrolling past the picture, you would not believe this would be the case.
00:07:48.800 --> 00:07:50.800
But uh it absolutely is helpful.
00:07:51.600 --> 00:07:54.720
So people that work with OSINT, they're puzzle solvers.
00:07:55.519 --> 00:07:56.720
Very much so, yeah.
00:07:56.720 --> 00:08:03.759
Very much people with attention to detail and people with a desire to determine facts.
00:08:05.360 --> 00:08:11.040
Besides solving puzzles for fun, because they have this is a community that a lot of people just do it for fun.
00:08:11.040 --> 00:08:13.600
You have applied it to other matters.
00:08:13.600 --> 00:08:15.680
Tell us about some of the things you've applied it to.
00:08:16.079 --> 00:08:16.879
Yeah, absolutely.
00:08:16.879 --> 00:08:20.720
So some of the work I've been involved in, these are published articles.
00:08:20.720 --> 00:08:30.560
I've had the tremendous opportunity to to help with monitoring conflict in uh in Ukraine, and this is part of the civilian uh civilian harm in Ukraine Time Map.
00:08:30.560 --> 00:08:47.039
And the civilian harm in Ukraine time map essentially geolocates uh videos from Telegram and Twitter and other social media where it's showcased that missiles were used against civilian populations in certain areas during and throughout the invasion and the war in Ukraine.
00:08:47.039 --> 00:08:52.960
And there have been vast amounts of data to sift through, of course.
00:08:52.960 --> 00:08:59.279
And it's not easy, but it's it's something to remember that there are people who are living through this.
00:08:59.279 --> 00:09:08.159
Um and for me, just to be able to look at this and geolocate it is nothing compared to having to live this as a as a day-to-day.
00:09:08.159 --> 00:09:14.000
Um other projects have been uh the ICE raids in in the US.
00:09:14.000 --> 00:09:34.559
So the the actions and the activity of ICE uh and and affiliated enforcement agencies throughout the US recently, and particularly focusing on the abuse of power from these agencies, uh especially due to the fact that they are masked and and um, so to speak, unaccountable for for what actions they take in the field.
00:09:35.360 --> 00:09:39.600
There are facts in the world and their story contradict the facts.
00:09:40.240 --> 00:09:40.879
Yeah, absolutely.
00:09:40.879 --> 00:10:07.519
Do in my own opinion, I I want to say I do participate in this because I have a very strong interpretation of what fairness is, and I believe that what we're seeing coming out of the US, uh both uh at the initialization of these agencies and the revival of these agencies has not been congruent with fairness and how I define it, and I think how many other people define it as well.
00:10:07.519 --> 00:10:39.360
Um but uh absolutely in terms in terms of analyzing the actions of authoritarianism in today's modern world, you do see the trend of public statements not really matching up with what is seen on the ground, and the invalidation of eyewitness records and uh victim experiences, the invalidation of these through through a simple waving of the hand and saying, no, the legal state has the final opinion on this.
00:10:39.360 --> 00:10:45.279
This is not this did not happen, and actually our actions are fully compliant with how we normally do things.
00:10:45.279 --> 00:10:49.759
When um that's when I feel people need to step in.
00:10:49.759 --> 00:11:03.679
And that's when I feel OSINT is a public tool more than a personal preference, is to to search for those facts and make everyone aware that it's not just what one party says.
00:11:03.679 --> 00:11:06.559
It's it's actually what is seen and verifiable on the ground.
00:11:06.960 --> 00:11:23.600
One of the articles you wrote, there was the government said that, yeah, this individual drove into uh a cop car, an unmarked cop car, and then you saw the video, which is just from some somebody's iPhone, that the the cop car actually ran into her and dragged her out by her feet.
00:11:23.600 --> 00:11:28.799
So the government says one thing what are the steps that you actually take to prove this is actually what happened?
00:11:28.799 --> 00:11:30.480
I like how'd that look like for you?
00:11:30.879 --> 00:11:32.879
There's a bifold approach to this, right?
00:11:32.879 --> 00:11:40.639
I mean, there's there's the odd uh person living in England that wants to to verify this and put it out as a fact.
00:11:40.639 --> 00:11:51.039
Uh, but then there's also the citizen part of the the particular state where this happens, which I believe has a lot more control over what can happen in the future in that state.
00:11:51.039 --> 00:12:01.759
So your elected officials, your your police departments, how they are, um how they face the repercussions of these types of actions is is also a very valid approach, right?
00:12:01.759 --> 00:12:18.399
In the case of the open source intelligence analyst, uh simply having multiple views of the same thing happening, which goes against what a public authority states happened, is already a telltale sign of what actually occurred on that day, right?
00:12:18.399 --> 00:12:26.159
There's obviously arguing with AI earlier, there can always be manipulations of this.
00:12:26.159 --> 00:12:38.639
And I I believe OSINT analysts around the world have seen at least once uh an AI manipulated piece of content that aims to disrupt the normal analytical flow and what we do.
00:12:38.639 --> 00:12:46.960
Um however, there's verifiable means through which this has not happened with the particular video you're referencing, right?
00:12:46.960 --> 00:12:55.600
Even though it's easy to tout uh an overall devil that uh you know invalidates everything one person says.
00:12:55.600 --> 00:13:01.200
Um I think everyone should be the devil's advocate in this case and and actually research it themselves.
00:13:01.200 --> 00:13:04.480
And see, there's no artifacts of modified imagery.
00:13:04.480 --> 00:13:15.519
There is uh there is full one-to-one matching between two perspectives from two different observers, is what we call the people with the phones on the on the sidewalks, right?
00:13:15.519 --> 00:13:25.919
Two different observers filming the exact same thing with no uh inconsistencies between the videos is already a one in a million chance that this this might be a fake, right?
00:13:25.919 --> 00:13:27.840
It's uh you can tell that it's real.
00:13:27.840 --> 00:13:40.320
In the case of the person living in the state, I I believe protesting is one is one form of reaction to the spread of this type of disinformation from from official governing bodies.
00:13:40.320 --> 00:14:02.960
But at the same time, being equipped with the knowledge to perform their own verification of events, being able to hold accountable their states using FOIA requests or any type of public inquiries, or even being prepared to understand the current political situation in their state will help them a lot to protect themselves and their family from this happening to them as well.
00:14:03.440 --> 00:14:07.039
But what do you actually do when you're when you analyze these videos?
00:14:07.039 --> 00:14:08.960
Like how do you how do you know if they're fake?
00:14:08.960 --> 00:14:10.000
How do you verify facts?
00:14:10.000 --> 00:14:15.200
Like what is the verification process that what organizations like Bell ingcat would do or anybody else similar?
00:14:16.000 --> 00:14:20.399
I'll give you my example because I think it's unique to every every person.
00:14:20.399 --> 00:14:23.200
Um let's take the example of the OSIN challenge.
00:14:23.200 --> 00:14:31.759
Um and there there has been another one, for example, where um a person recently posted a photo from a window this time looking outside.
00:14:31.759 --> 00:14:35.200
Um and I believe in the end it was determined that it was in France.
00:14:35.200 --> 00:14:35.600
Right.
00:14:35.600 --> 00:14:39.360
So in one of these challenges, the workflow is very straightforward.
00:14:39.360 --> 00:14:43.440
Essentially, you're looking at an image, if we simplify it.
00:14:43.440 --> 00:14:49.039
A video is more complex, and at that point you you get more of a view of what's going around, so it's easier.
00:14:49.039 --> 00:14:50.720
Let's say it's just a photo.
00:14:50.720 --> 00:14:56.000
In the case of a photo, you try to break down the visual elements that you're looking at.
00:14:56.000 --> 00:15:08.159
If we're talking strictly about geolocation, which is a subset of open source intelligence, you need to take each object within the picture as a specific data point that you can research upon.
00:15:08.159 --> 00:15:12.559
Does the window have a particular frame, which is a thing that we've analyzed before?
00:15:12.559 --> 00:15:17.200
Does the the sun uh shoot through the window in a particular color?
00:15:17.200 --> 00:15:18.080
Is it warm?
00:15:18.080 --> 00:15:21.440
Is it more akin to a to white or blue color?
00:15:21.440 --> 00:15:22.399
So is it dusk?
00:15:22.399 --> 00:15:23.200
Is it dawn?
00:15:23.200 --> 00:15:32.159
The angle is always a thing to keep in mind, regardless, because it can determine roughly a time estimate of when the photo was taken.
00:15:32.159 --> 00:15:38.240
But then you also need to look at other objects which you might not usually is is there parquet flooring?
00:15:38.240 --> 00:15:39.679
Is it hardwood flooring?
00:15:39.679 --> 00:15:40.720
Is it cement?
00:15:40.720 --> 00:15:45.919
This will tell you a lot about the building standards in that area.
00:15:45.919 --> 00:15:53.759
Is the furniture from the you know 18th century, or is it modern, or is it IKEA, or does it look like IKEA, but it's not quite that?
00:15:53.759 --> 00:16:02.639
So is it a country that offers mock-up IKEA furniture, which also tells you a lot about where the subject uh is or or where they're located?
00:16:02.639 --> 00:16:05.519
And more of it than that, you need to look outside.
00:16:05.519 --> 00:16:14.720
You need to think outside the box, which is very much a thing that um maybe listeners that are from the cybersecurity realm uh might very much relate to if they do offensive security.
00:16:14.720 --> 00:16:16.080
You need to think outside the box.
00:16:16.080 --> 00:16:18.240
You need to look at the person who posted the photo.
00:16:18.240 --> 00:16:21.440
Do they normally post within that time frame?
00:16:21.440 --> 00:16:26.639
Are those their normal active hours or are they posting at night?
00:16:26.639 --> 00:16:29.360
Uh this is called pattern of life analysis.
00:16:29.360 --> 00:16:37.519
And and when you look at this, you can deduce, uh, but not with 100% certainty, of course, because nothing is.
00:16:37.519 --> 00:16:40.559
But you can start to deduce the time zone that the person might be in.
00:16:40.559 --> 00:16:43.440
So that helps you narrow down a lot, actually.
00:16:43.440 --> 00:16:56.399
This would be a normal flow for geolocation, but there is, as you can imagine, the the many different aspects of the world can be dissected in and so many other different aspects of data points that you can look at and you can learn about them.
00:16:56.399 --> 00:17:00.559
Munitions are one thing, weather are is another one.
00:17:00.559 --> 00:17:07.039
Um, knowing the different models of cars that exist in certain countries, the different street signs that exist in different countries.
00:17:07.039 --> 00:17:17.119
All of this is a very particular subset of skills that anyone with the background knowledge immediate to the subject might find useful to apply.
00:17:17.839 --> 00:17:19.759
Now you mentioned uh munitions.
00:17:19.759 --> 00:17:24.880
When I think of munitions, I think of there's a lot of work being done in OSINT in wars.
00:17:24.880 --> 00:17:30.960
Obviously, munitions is basically to see which sort of mercenaries, which sort of soldiers were there, or can you want to detail about that?
00:17:31.279 --> 00:17:32.160
This helps a lot, yeah.
00:17:32.160 --> 00:17:37.200
It it helps a lot to determine what kind of parties have worked together to launch attacks.
00:17:37.200 --> 00:17:48.079
Um and especially it it points towards the more revealing fact of how many stockpiles a particular army has, for example.
00:17:48.079 --> 00:18:11.119
If they start using munitions from the Cold War, suddenly after only using cluster munitions or very advanced guided uh missiles or any of the sort, if they start suddenly relying on very old, almost close to being recycled munitions, then you can already draw a conclusion from that.
00:18:11.119 --> 00:18:22.319
It's it's a lack of resources that that pose this need, or it's a pause before a next very strong assault if they're trying to pull together more resource for the next one.
00:18:22.319 --> 00:18:30.400
So it can tell you a lot about the mentality of the generals on the on the battlefield and the decisions that are being made at a very high level.
00:18:30.400 --> 00:18:35.519
Um because no stock is being sent to the front line just by pure choice.
00:18:35.519 --> 00:18:44.000
There's active logistical solutions that are in play that are different from missile to missile, from munition to munition.
00:18:44.000 --> 00:18:50.400
Um, for example, a tornado multiple launch rocket system requires its own loader.
00:18:50.400 --> 00:18:55.920
Uh you have to now back up the loader on the train and freight it to the front line as well.
00:18:55.920 --> 00:19:00.240
It's very different from having some, I don't know, mortar shells, right?
00:19:00.240 --> 00:19:06.079
And and it varies from decade to decade of manufacturing these missiles.
00:19:06.079 --> 00:19:09.680
And you can always tell a lot from from what is being used.
00:19:10.720 --> 00:19:14.400
There's a podcast that I follow, it's Ukraine today.
00:19:14.400 --> 00:19:16.160
Ukraine the Latest, I think it's called.
00:19:16.160 --> 00:19:21.279
And also a part of that, they have YouTube channels that show you every day what's going on on the front line.
00:19:21.279 --> 00:19:26.480
And that's it's I guess some of the military is sharing that for various reasons.
00:19:26.480 --> 00:19:31.839
Uh why is this war, or why are wars so visible these days, or how are they so visible?
00:19:31.839 --> 00:19:36.240
Is if you go on YouTube and you type in Ukraine or Russia, you see what happened yesterday.
00:19:36.240 --> 00:19:40.880
Can I trust that information, or like how would you look at those types of videos?
00:19:41.759 --> 00:19:45.279
That's a very good question because a lot of people, I believe, are doing the same thing nowadays.
00:19:45.279 --> 00:19:50.319
I mean, making these exact Google searches, and it's important to know if if you are looking at the right thing.
00:19:50.319 --> 00:19:50.720
Yeah.
00:19:50.720 --> 00:20:00.160
You've got you've got channels like Preston Stewart and Ryan McBeth who are doing like an amazing job at dissecting the battlefield and the political decisions behind what is going on in Ukraine.
00:20:00.160 --> 00:20:05.599
So if you are looking for points of truth, I can personally vouch to the veracity of those accounts.
00:20:05.599 --> 00:20:07.440
Um, definitely 100%.
00:20:07.440 --> 00:20:22.079
However, the wars are becoming more visible now, at least in the Western hemisphere, where you have this mentality of crowdsourcing and public support, right?
00:20:22.079 --> 00:20:35.200
If you if you're looking at an authoritarian government trying to trying to stop a civil war, they're not gonna have a telegram channel or or a TikTok channel posting like short clips of of what they're doing militarily, whatever is safe to post, right?
00:20:35.200 --> 00:20:35.839
Because they don't care.
00:20:35.839 --> 00:20:39.839
They're having a civil war and they're an authoritarian government.
00:20:39.839 --> 00:20:54.400
But in in for example, in the Russia-Ukraine conflict, um you want to garner support from home viewers because pretty much both sides still rely on public donations uh in order to support their their militaries.
00:20:54.400 --> 00:21:07.920
Like as wild as it seems, Russia, as as big as as it is, lacks, of course, a lot of equipment and has failed to maintain a lot of its equipment since the last wars that it waged, right?
00:21:07.920 --> 00:21:28.079
Ukraine, a very much smaller country, ill-prepared at the beginning of the war, now a lot better, has very quickly adopted Western mentality in in warfare and methodologies that are that are very compatible with current weapon systems that are being donated to them by the by the West, right?
00:21:28.079 --> 00:21:40.160
But they they both need just as much crowdsourced financial help donations, either in terms of like material, like drones or uh vehicles.
00:21:40.160 --> 00:21:51.359
Vehicles is a big one because of course they are almost dispensable in specific parts, but also just monetary help to buy to buy their own gear, to buy vests, to buy plate carriers, ammunition, and everything else.
00:21:51.359 --> 00:21:59.519
So you see this trend of everything appearing on social media from the point where.
00:21:59.519 --> 00:22:02.559
Becomes operationally safe to do so.
00:22:02.559 --> 00:22:08.079
It gets edited, it gets put in a compilation, and it arrives on your phone.
00:22:08.079 --> 00:22:14.240
And um it's it's quite surprising actually to see some platforms where you might not expect this to exist, like Instagram.
00:22:14.240 --> 00:22:26.960
You can scroll through and the algorithm will simply suggest uh frontline combat from from Ukraine, which speaks towards the desensitivization of audiences towards this type of content.
00:22:26.960 --> 00:22:34.880
It's also quite ironic that we we can sit in our own comfort and suddenly we're looking at someone die on the on the battlefield in Ukraine.
00:22:34.880 --> 00:22:35.839
That's fucked up.
00:22:35.839 --> 00:22:37.039
Yeah, absolutely.
00:22:37.039 --> 00:22:45.279
And but it also garnishes support from people in the West who who are seeing this injustice and and they want to help.
00:22:45.599 --> 00:22:48.720
We're talking about satellite data uh that you can buy.
00:22:48.720 --> 00:22:51.839
You said that you can get within a meter accuracy.
00:22:51.839 --> 00:22:57.839
How accurate is that satellite data and how easy it is it for somebody like you that knows where to look to actually get that information?
00:22:58.240 --> 00:22:58.640
Absolutely.
00:22:58.640 --> 00:23:08.000
I think I think the the main blocking point there is money, uh, because of course satellite imagery providers are also in touch with what is going on.
00:23:08.000 --> 00:23:22.480
So obviously, if you are buying extremely accurate satellite imagery uh down to one meter in Ukraine or in Crimea or somewhere in in Russia, they're gonna get the idea of what what is going on.
00:23:22.480 --> 00:23:28.559
Um but essentially there are specific ways in which uh one one can do this.
00:23:28.559 --> 00:23:38.960
And of course, it it helps to be able to represent yourself to an organization rather than an individual randomly going to uh to to buy you know one meter imagery.
00:23:38.960 --> 00:24:00.400
Um however it's they do their own vetting because of course they don't want to provide this this imagery to, for example, the Russians or or to any threat actor that might be interested in joining a conflict or um just anyone realistically because these are targeting capabilities, right?
00:24:00.400 --> 00:24:02.880
At that point, you're speaking about targeting capabilities.
00:24:02.880 --> 00:24:08.240
Ukraine has solved a lot of this cost issue, for example, by crowdsourcing their own satellite.
00:24:08.240 --> 00:24:14.799
And uh and this this helps them operationally to achieve their objectives on the front line, even long distance as well.
00:24:14.799 --> 00:24:43.599
What I've seen recently, and actually I want this question to answer because I'm not I'm not quite sure if this is the case, but in uh Copernicus, which is a online tool, it's it's a satellite, but it's publicly available satellite imagery on a date selection basis, and it offers different filters and different satellites that are all open source, and you can look at their imagery when they passed over a specific area.
00:24:43.599 --> 00:24:51.039
The idea is you can uh you can you can look at infrared signatures depending on what's available and what satellite has passed over that area.
00:24:51.039 --> 00:24:56.240
You may be able to look at infrared signatures or or other sort of filters, which is called remote sensing.
00:24:56.240 --> 00:25:05.119
When you start filtering the image back from the satellite and you filter out different wavelengths, you can see vegetation more clearly than you can see cars or buildings, for example.
00:25:05.119 --> 00:25:12.160
You can see night lights in urban areas better than you can see the sun reflecting off rooftops, for example.
00:25:12.160 --> 00:25:19.519
So it lets you remote sense particular materials and areas of interest.
00:25:19.519 --> 00:25:32.079
I I'm seeing now recently with Copernicus, there's these streaks that come at diagonal angles over important parts of Russia and Crimea, which I'm very curious about.
00:25:32.079 --> 00:25:34.160
I haven't managed to find an answer to this.
00:25:34.160 --> 00:25:42.880
Um, but it almost looks as if someone is trying to obscure the satellite view from these critical areas because there is a conflict.
00:25:42.880 --> 00:25:47.279
And looking around the world, nowhere else have I seen these these streaks right now.
00:25:47.279 --> 00:25:58.000
So those there's obviously acknowledgement from both sides that uh these satellites offer open source uh information about what's what's being seen from space over these territories.
00:25:58.000 --> 00:26:02.880
They just want to limit accessibility to this imagery as much as possible.
00:26:03.680 --> 00:26:06.640
Should have probably covered this earlier, but open source doesn't mean free.
00:26:06.640 --> 00:26:10.480
It just means that it's publicly available, you don't have to be military to get it.
00:26:11.039 --> 00:26:11.279
Yes.
00:26:11.279 --> 00:26:12.880
So there's different approaches to this.
00:26:12.880 --> 00:26:21.839
Um open source originally comes from the fact that yeah, you don't need to be in the intelligence services or in the military to achieve this information.
00:26:21.839 --> 00:26:37.680
Um the uh the opposing side we call closed source intelligence, which is what you know the NSA have and what GCHQ has, which is collection data from who knows what, uh, but from centralized systems that nobody else has access to.
00:26:37.680 --> 00:26:45.680
Open source data is originally the opposite of that, it's just things that people leave behind publicly, intentionally.
00:26:45.680 --> 00:26:46.640
Organically, yeah.
00:26:46.640 --> 00:26:50.240
Organically think of like dumpster diving but online, right?
00:26:50.240 --> 00:26:54.480
That's essentially what I do to summarize your your previous question.
00:26:54.480 --> 00:27:04.319
But there's also the the concept that you don't need to pay for it, because payment in certain areas implies that not everyone can access it, so it's not democratized.
00:27:04.319 --> 00:27:10.880
So therefore, if it's not verifiable by everyone, then it's not accessible by by everyone.
00:27:10.880 --> 00:27:20.000
For example, Trace Labs, which is a really great organization from the US, they do capture the flag tournaments where you find missing persons.
00:27:20.000 --> 00:27:28.160
So they collaborate with police stations and police associations and institutions across the US and Canada, I believe, both of them.
00:27:28.160 --> 00:27:36.720
And any missing person cases that they get from those police institutions, they offer as a package for the CTF.
00:27:36.720 --> 00:27:41.680
And essentially you um you employ, you volunteer 100, 500.
00:27:41.680 --> 00:27:43.839
I'm not sure how many people participate in these.
00:27:43.839 --> 00:27:52.400
I've I've personally both been a participant and a coach, but you get crowdsourced intelligence polls about where the whereabouts of these people might be.
00:27:52.400 --> 00:27:59.279
Um some some of them um are you know people who who live a very active life.
00:27:59.279 --> 00:28:03.279
They are active socially, so there's a lot to search through.
00:28:03.279 --> 00:28:09.359
They are very well connected, all their friends post together with them, so it's easy to cross-correlate where they might be.
00:28:09.359 --> 00:28:19.200
Others are ghosts, they're they're simply people that are not using social media, but they might use one account once to check in someplace because someone asked them to leave a review, right?
00:28:19.200 --> 00:28:34.240
So it takes like different levels of skill sets to try to find as much as possible about these people, and then you submit it in the coach reviews uh this information to see if it's like valid for what we are looking for.
00:28:34.240 --> 00:28:43.440
And at the end, what happens is all this information gets submitted back to the police department that requested its review, and a lot of the times or sometimes, people are found.
00:28:43.440 --> 00:28:49.440
People are found uh well, people are found otherwise, but uh the family gets an answer.
00:28:49.440 --> 00:28:57.359
And one of the particularities of the CTF is that open source intelligence in this case does need to mean free.
00:28:57.359 --> 00:29:10.720
Because when you give this information back to the police station, or might it be a detective, might it be uh someone else in the police station, you don't know who gets this information and if they have the technical capability to review it, right?
00:29:10.720 --> 00:29:15.119
You cannot give them like terminal output from an automated collection tool.
00:29:15.119 --> 00:29:19.920
You need to give them factual evidence that they know how to access and is is easy for them as well.
00:29:19.920 --> 00:29:22.480
So part of it is yeah, it it can be paid.
00:29:22.480 --> 00:29:24.319
They need to be able to access it straight away.
00:29:25.920 --> 00:29:28.079
How do you use OSINT and cyber?
00:29:28.079 --> 00:29:34.319
The majority of people listening to this episode or this episode and the nomadic security podcast or cybersecurity professionals.
00:29:34.319 --> 00:29:37.119
How would OSINT help them in their job?
00:29:37.119 --> 00:29:43.039
Or is there a connection there between their protecting a network and OSINT?
00:29:43.519 --> 00:29:44.160
There is absolutely.
00:29:44.160 --> 00:29:58.480
I mean, at least to say the work that I do right now shows there's a direct correlation between the security of a product or of a company and the activities of threat actors that are interested in in nabbing those secrets from the company, right?
00:29:58.480 --> 00:30:04.319
Um there will always be a vested interest of someone to break into something.
00:30:04.319 --> 00:30:06.720
This is just the nature of criminality.
00:30:06.720 --> 00:30:19.440
And to be one step ahead doesn't just mean to implement your EDR or to implement your SOC team or to to install, you know, uh MDM and antiviruses on your laptops.
00:30:19.440 --> 00:30:24.559
To be one step ahead means to be in tune with what's going on in your operational environment.
00:30:24.559 --> 00:30:32.319
And it's very much what intelligence agencies do, it's very much what the military does, it's awareness of your operational environment, right?
00:30:32.319 --> 00:30:59.119
If you don't know that anyone has a vested interest or has posted on a forum uh to get help to hack your company or or to to find more information about you personally, the head of security of a company, if you don't know how to search these spaces, if you're completely oblivious of them, you can't rely on automated tools for this because the traffic is so organic and the behavior of threat actors is so varied and in different languages, right?
00:30:59.119 --> 00:31:00.799
You you can only do this yourself.
00:31:00.799 --> 00:31:03.440
You can only understand this at a human level.
00:31:03.440 --> 00:31:06.079
So it very much helps security professionals, I believe.
00:31:06.079 --> 00:31:19.039
Even though uh in CTFs, I think OSYNT is a little bit misrepresented, it's a little bit simplified and it's it's synthetically generated to make you find a flag on someone's like a sock puppet's Twitter account, right?
00:31:19.039 --> 00:31:27.839
But OSYNT in real life is so much more different because you've got so much more data to sift through and it's all organic, so it's all random.
00:31:27.839 --> 00:31:32.640
You can't classify it, you can't really put a tag on it, you need to to learn how to look.
00:31:33.039 --> 00:31:51.920
Just put this in perspective, you're when you're protecting your company, the company you work for, which is you basically need to follow a bunch of like I'll call them underground environments to see how threat actors are planning to do something against face facial recognition software.
00:31:51.920 --> 00:31:55.519
Uh that's that's a very much B2C sort of use case.
00:31:55.519 --> 00:32:04.640
It's it's more so B2B, uh because the Yeah, B2B, but they're protecting their clients, so it's B2C or
00:32:04.640 --> 00:32:04.880
Correct.
00:32:04.880 --> 00:32:06.319
Yeah, but through proxy kind of.
00:32:06.319 --> 00:32:06.640
Yeah.
00:32:06.640 --> 00:32:06.799
Yeah.
00:32:06.960 --> 00:32:07.599
I see what you yeah.
00:32:07.759 --> 00:32:07.839
Yeah.
00:32:07.839 --> 00:32:18.000
Because the person the person opening an account with a bank, for example, can never be held liable for someone bypassing the biometric system that the bank uses, right?
00:32:18.000 --> 00:32:18.960
That's the bank's fault.
00:32:18.960 --> 00:32:21.759
Or it's the bank's third-party service provider fault.
00:32:21.759 --> 00:32:31.519
So um mostly what we do is trying to raise awareness into this new field, which is biometrics.
00:32:31.519 --> 00:32:48.960
And especially in this, well, it's not a new field, but it's a new implementation of this because you're seeing now also there being a social media uproar about the overusage of these tools to verify you on social media to make sure you're over 16, over 18, depending on the country, whatever, to make sure you're an adult.
00:32:48.960 --> 00:32:50.799
My opinion, overusage.
00:32:50.799 --> 00:32:55.839
But to prevent threat actors from entering your bank account, sure, no problem.
00:32:55.839 --> 00:32:56.960
That makes sense.
00:32:56.960 --> 00:33:05.920
To prevent people or unknown persons from coming into the to the border of the country, sure, yes, your passport needs to match your face and who you are in real life, right?
00:33:05.920 --> 00:33:07.119
This this all makes sense.
00:33:07.119 --> 00:33:18.160
What we do is we try to create awareness of this issue, which is expanding not only the border controls and financial institutions, but everywhere else as well.
00:33:18.160 --> 00:33:31.839
So identity fraud can happen pretty much at any point, um, because there's steps you can take to escalate your control over this victim's identity as a threat actor.
00:33:31.839 --> 00:33:36.000
And the more you do, the more voracious your identity now becomes.
00:33:36.000 --> 00:33:42.400
And suddenly someone's got a hold of your SIM card number and and they've they performed a simjack attack on you, right?
00:33:42.400 --> 00:33:46.480
The the thing is we create these reports, they're called apex reports.
00:33:46.480 --> 00:34:03.039
And these reports are are given to customers, showcasing not only the typical industries that are being affected, which is what you expect borders financial, uh, but it's it's everything that we see, and it's the trends and the data that we pull from our own uh system being attacked as well.
00:34:03.039 --> 00:34:10.000
So it it we are the tip of the spear right now in in what's as an implementation biometric security.
00:34:10.000 --> 00:34:15.920
And we are obviously the most coveted kind of attack surface, if if you would like.
00:34:15.920 --> 00:34:29.280
Um the insight from that helps companies that do not utilize us also to prepare and and to make steps to to protect themselves without the need for them to you know one click buy a solution and that's the end of the day.
00:34:29.280 --> 00:34:32.079
It's the knowledge that saves them, not not the solution.
00:34:32.400 --> 00:34:33.119
I have to ask it.
00:34:33.119 --> 00:34:34.480
Uh the concept of AI.
00:34:34.480 --> 00:34:46.719
I have colleagues that they're just vibe coding tools that are able to do things that you just they were reserved for nation states before, but now you can just vibe code your way to it because you don't need developers anymore.
00:34:46.719 --> 00:34:48.320
You can just use some tokens on it.
00:34:48.320 --> 00:34:50.639
How is AI changing the world of OSIN?
00:34:50.639 --> 00:34:54.960
Because I would assume that a lot of the things that you'd have to do very manually before are just completely automated now.
00:34:54.960 --> 00:34:58.559
How's that have you noticed that in when you're in your journeys?
00:34:58.960 --> 00:35:02.559
Yeah, actually, um I've I've tried implementing it here and there.
00:35:02.559 --> 00:35:05.199
I've I've used it to the point where I I I understand it.
00:35:05.199 --> 00:35:22.320
And that honestly has accelerated my ability to do things because when did I not have a need, or any OSINT analyst or any security person in general, when did we not have a need that we were like, I wish I had a tool for that, but it like costs like 5,000 pounds a month, so I can't.
00:35:22.320 --> 00:35:23.760
It's like now you can code them.
00:35:23.760 --> 00:35:24.800
Now you now you can make it.
00:35:24.800 --> 00:35:38.880
And there have been people who have done like Palantir at home, and even just as a visualization tool, it's powerful because you get to present things in front of non-technical people and they understand because it has like a nice spinny graph of the world and you can tell where the subject is in the map.
00:35:38.880 --> 00:35:46.159
But also, yeah, information collection solutions, automated reporting, all of these, they're useful.
00:35:46.159 --> 00:35:49.679
Everyone just needs to keep in mind that it's intelligence, guys.
00:35:49.679 --> 00:35:50.960
Like you need to verify it, right?
00:35:50.960 --> 00:35:53.360
Part of it is collection, but part of it is analysis.
00:35:53.360 --> 00:36:05.519
And you need to make sure that once you analyze the intelligence is not hallucinated, it's it's voracious, it's you know, pinpointed in time and space exactly as as you might want it to present to another person.
00:36:06.159 --> 00:36:13.360
Just to end on a philosophical note or forward-thinking note, like the future of OSIN, how do you think that's gonna affect democracy moving forward?
00:36:13.760 --> 00:36:23.920
Oof, yeah, that's uh that's something I've been thinking about recently, especially obviously with the the death of factual analysis of of news.
00:36:24.320 --> 00:36:26.000
As in nobody gives a shit about the facts anymore.
00:36:26.159 --> 00:36:26.559
Yeah, absolutely.
00:36:26.559 --> 00:36:27.360
Yeah, yeah.
00:36:27.360 --> 00:36:32.719
And especially with this, um I'm asking, is it is it going to die?
00:36:32.719 --> 00:36:34.480
Oh or I don't think so.
00:36:34.480 --> 00:36:39.760
Or is it going to become finally paid enough for for more people to do this?
00:36:39.760 --> 00:36:48.559
I mean, this is these are two of the the pain points that I've seen, at least uh in in here and in in other countries, OSINT doesn't pay.
00:36:48.559 --> 00:36:54.000
It's it's so disregarded in terms of his its efficacy as well.
00:36:54.000 --> 00:37:17.360
For example, one of the struggles that people are having right now, unrelated to what I've done before, but with the Kherson and Bakhmut um war crime investigators um currently prosecuting cases against persons in the Russian government or the Russian army, uh it's the attempt to get this uh OSINT collected information valid in court.
00:37:17.360 --> 00:37:19.440
It's still a struggle.
00:37:19.440 --> 00:37:34.159
And just because it came from not uh an analyst in a government office using the analyst's notebook software, and instead they use MultiGo or like a telegram scraper they wrote themselves, just because of that, it's invalid.
00:37:34.159 --> 00:37:38.719
Like it can go through the same validation process as everything else.
00:37:38.719 --> 00:37:50.480
It's just a um lack of education about OSINT and its functionality and how much it has evolved over time that is that is causing this lag behind the uh normal systems.
00:37:50.880 --> 00:37:52.880
So it's the tool you name analyst notebook.
00:37:52.880 --> 00:37:53.920
I used to work for IBM.
00:37:53.920 --> 00:37:55.360
So I know what analyst notebook is.
00:37:55.360 --> 00:37:56.960
I really want a subscription, by the way.
00:37:56.960 --> 00:37:57.599
Yeah, yeah, yeah.
00:37:57.599 --> 00:37:59.519
You can buy it from one of my friends, but it's gonna cost you.
00:37:59.519 --> 00:38:03.280
So it's the tool and also the the person that you are, the authority that you represent.
00:38:03.280 --> 00:38:04.079
Yes.
00:38:04.079 --> 00:38:06.880
That's what sort of works in court.
00:38:07.199 --> 00:38:08.480
I think that's the secret sauce.
00:38:08.480 --> 00:38:23.039
I mean, obviously you have the I'm not I'm not a legal expert or anything, but there's also like a chain of custody, and there's a um requirement for the storage of this information to make sure it wasn't modified and transit and storage or when when opening it just to view it, right?
00:38:23.039 --> 00:38:25.360
It's the same as uh computer forensics, pretty much.
00:38:25.360 --> 00:38:26.880
It's the same standards there.
00:38:26.880 --> 00:38:31.280
Um the information cannot at any point be any different than from the point of collection.
00:38:31.280 --> 00:38:40.559
And the point of collection, preferably, needs to still be available in order to be able to be verified uh that it was indeed that the source that it was collected from.
00:38:40.559 --> 00:38:45.119
Though there's so many instances of this happening, I don't think it's an issue of scarcity.
00:38:45.119 --> 00:38:55.039
I think it's an issue of accepting technology, which is not new anymore, accepting methodology and desire to volunteer, which is again not new anymore.
00:38:55.039 --> 00:39:00.400
But it that it does come from kind of an older institution, which is the the Hague, right?
00:39:00.400 --> 00:39:18.239
Or or the International Criminal Court, which very much relies still on uh processes that are have been established over years to ensure the utmost efficacy when prosecuting war criminals, which is understandable why it's monolithic and why it's it's hard to get it to move, right?
00:39:18.239 --> 00:39:22.559
But this speaks to other courts and other industries, even as well.
00:39:22.960 --> 00:39:28.880
But like when you when I've if I was to film you right now with an iPhone, I would hate the metadata, yeah, yeah, right.
00:39:28.880 --> 00:39:31.280
You need to have a better, you deserve a better camera, I'd agree.
00:39:31.280 --> 00:39:33.920
But like all the metadata is gonna be in that film, right?
00:39:33.920 --> 00:39:38.079
Like somebody that works with the iOS forensics will be able to say that is 100% legit.
00:39:38.079 --> 00:39:39.519
So the fact is still a fact.
00:39:39.519 --> 00:39:43.679
And even though I took it and nobody trusts me because I've had a beer or two, that's still a fact.
00:39:43.920 --> 00:39:44.800
Yeah, it's still a fact.
00:39:44.800 --> 00:39:46.639
I mean, you could always modify it.
00:39:46.639 --> 00:40:02.400
You could use, you know, XF tools to to modify the metadata for that video, but as long as that iPhone doesn't touch anything else, or at least it's provable that anything else it has touched hasn't been able to interfere with the metadata of that video, then it's provable in court, right?
00:40:02.400 --> 00:40:03.679
But can that be proven?
00:40:03.679 --> 00:40:04.880
Is that possible to do as well?
00:40:04.880 --> 00:40:08.719
Uh or is it just word is it still word against word at the end of the day?
00:40:08.719 --> 00:40:09.519
It's word against word.
00:40:09.519 --> 00:40:10.960
It's it's legal matters, I believe.
00:40:10.960 --> 00:40:12.480
I believe it is word against word.
00:40:12.480 --> 00:40:18.159
I mean, anything can be proven only up to a point of credibility, right?
00:40:18.159 --> 00:40:25.679
I mean, if you look at fingerprints, for the longest time there there has been a debate if fingerprints are realistically admissible in court, right?
00:40:25.679 --> 00:40:30.239
Because of different factors, which I'm I'm not fully aware of, so I'm not going to speak about them.
00:40:30.239 --> 00:40:38.239
But the veracity and the correlation between the subject and its and its fingerprint has always been in question, at least at the beginning of fingerprints as well.
00:40:38.239 --> 00:40:41.280
Um and now I think I've seen recently another question about this.
00:40:41.280 --> 00:40:47.360
Like, have we been relying on this tool for prosecuting individuals the wrong way this whole time?
00:40:47.360 --> 00:40:48.320
Not sure.
00:40:48.320 --> 00:40:49.280
Watch the video.
00:40:49.280 --> 00:40:53.760
But um, yeah, there's there's always new things that we learn about the world.
00:40:53.760 --> 00:40:56.960
There's always new things that appear in technology that suddenly change everything.
00:40:56.960 --> 00:41:09.760
Like, how many times have analysts had tools that they relied on almost at a forensic level completely disappear off the face of the planet, or suddenly they're monetizing and they're like popping like mobile game ads in the in the interface, right?
00:41:09.760 --> 00:41:12.719
This is like completely possible for someone who relies on a tool.
00:41:12.719 --> 00:41:15.840
It's it's out of our control because it is open source.
00:41:15.840 --> 00:41:19.920
For example, one uh just one more note there, actually.
00:41:19.920 --> 00:41:35.679
The uh one of the things that OSINT analysts or people aspiring to be OSINT analysts need to do is sure, you can do it one time, you can do it um instantaneously if you just want to uh research something in the moment.
00:41:35.679 --> 00:41:39.840
You just download some tools that might help you, but it's mostly manual work, no problem there.
00:41:39.840 --> 00:41:46.880
If you plan to do it at scale or over a longer period of time, what you need to be aware of is is tool deprecation.
00:41:46.880 --> 00:42:12.400
And for example, with Bellincat, one of the projects uh that that uh is is constantly evolving and constantly present and a need for the community is the Bellincat Toolkit, which is essentially a a um Git book page, a Git book instance, which holds all of the tools that we have vetted uh that are not me, it's mostly Bellincat staff, but um we've we've can volunteer for these things.
00:42:12.400 --> 00:42:28.800
So we look at if they contain sponsorship links or any tracking methods within the tool, if the tool is safe to use in a terminal, if it um takes certain commands to install, like we we look at all of these parameters and uh you need to validate is it still up to date?
00:42:28.800 --> 00:42:29.760
Has anything changed?
00:42:29.760 --> 00:42:30.559
Is anything broken?
00:42:30.559 --> 00:42:31.519
Is anything fixed?
00:42:31.519 --> 00:42:34.639
So keeping it up to date is a big part of it.
00:42:34.639 --> 00:42:42.960
Same goes for sock puppet accounts, your investigative accounts that you need to look after and grow as if they're they're your own because you are posing as a real person.
00:42:43.599 --> 00:42:46.159
On behalf of the world, thank you for all the great work that you do.
00:42:46.159 --> 00:42:48.800
As the Brits would say, Vlad, you're a you're a good lad.
00:42:48.800 --> 00:42:50.159
Thank you so much.
00:42:50.159 --> 00:42:51.119
Take care of yourself.
00:42:51.119 --> 00:42:51.840
It's been a pleasure.
00:42:51.840 --> 00:42:53.119
Keep up the great work.
00:42:53.119 --> 00:42:54.000
Thank you.
00:42:54.000 --> 00:42:56.559
Well, that's all for today, folks.
00:42:56.559 --> 00:42:59.360
Thank you for tuning in to the Mnemonic Security Podcast.
00:42:59.360 --> 00:43:07.760
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcast @ mnemonic.no.
00:43:08.800 --> 00:43:10.559
Thank you for listening.
00:43:10.559 --> 00:43:12.239
We'll see you next time.
