19 Sep 2022

How Technology Changed Investigative Journalism

Maltego Team

Introduction 🔗︎

On August the 17th, the Maltego Academic and Non-Profit Research Program had the great pleasure to host a webinar on “How Technology Changed Investigative Journalism”. Our guest speakers Aida and Brian guided us through the thrilling journey of three recently developed journalistic investigations empowered by Maltego. The webinar discusses:

  • A delve into the research of two journalists who are using technology in critically important exposes.
  • How they collect data, where they collect data and ways in which data can be processed and used.
  • How to safeguard the integrity of the investigator in both the digital and physical worlds.
  • The ethical question that governs journalism.
  • Expose the Maltego community to knowledge from a journalist’s investigative perspective.
  • The importance of what happens after articles are published on sensitive topics.

Let’s take a look at what has been shared!

Human-trafficking in prostitution across Europe: A Person of Interest investigation 🔗︎

Aida Kokanovic has fallen in love with investigative journalism through investigation of corruption and drug crimes. Her career goal is to catch some bad guys and make OSINT tools accessible and applicable for all investigative journalists.

She is in the process of finishing her master’s degree in journalism and social studies at Roskilde University in Denmark and currently works at Danish Broadcast Organization as an investigative journalist.

In a truly vivid way, Aida opens the webinar by narrating the heartbreaking case of “Sofia”, a young woman in her early twenties, who finds herself amid difficult circumstances. Unemployment, a partner with substance abuse problems and financial difficulties. In her quest to improve her situation, Sofia comes across an online advertisement promising thousands of Euros per week, good working conditions, and access to social services. She will work as an escort. As the ad suggests, she will be able to choose her own clients. After her partner’s approval, Sofia decides to take the job. Two men drive her from Poland to Denmark. Instead of a luxurious home, Sofia is constantly moved from one illegal brothel to another. The payment she receives is the minimum necessary to survive while she has no say over the clients she will have sex with, and her passport is withheld.

After this brief but clear introduction on how the operational processes of human trafficking networks usually look like, Aida walked us through her research, the data she gathered, and how she used Maltego for this investigation.

A starting point of the investigation was gathering of information in sex recruiting ads, aiming to test the hypothesis that women are moved across Europe. One of the main goals of the project is to detect organized human trafficking networks in sex work across Europe.

This is where OSINT comes into play. Aida performed a contact exploitation investigation. What does this mean? It means getting as much information as possible from a single phone number or a single email provided by one of the suspects in the recruiting advertisement. After gathering all this information from many phone numbers and email addresses, she performs a link analysis to detect connections between the suspects.

Below is a diagram of the complete workflow of her investigative techniques:

The diagram of the complete workflow of Aida’s investigative techniques

Aida got a lot of data from connecting the contacts on her burner phone to apps and social media. She pointed out that it was quite challenging to have a full overview of hundreds of names, pictures, and nicknames while keeping up with every tab on her spreadsheet. She populated her graph with her existing information and combined it with a trial access to ShadowDragon Transforms in Maltego. In her own words, the fireworks started.

She isolated about 50 Entities and ran the Bulk Search Transform at the same time on all the Entities, and in matter of minutes, almost all the information that she had on her burner phone appeared on her screen. Maltego empowered her investigation by making every link and connection visible and apparent. It also gave her extra data that she didn’t have on her burner phone before.

Social Media investigation on steroids

During her presentation, Aida showed us the techniques that she used in addition to Maltego during her research. For example, how to create a persona to ensure that nothing you used during your research is traced back to you.

The whole process includes some quite interesting tips and tricks:

  • Cool hacks such as how to create and use a sock puppet in combination with a burner phone to connect social media and virtual life and collect information.
  • How to protect your identity to investigate safely.
  • How to play with hacks in different apps to get the most information out of a target.

How to create a sock puppet

OSINT + GEOINT for Human Rights Investigations 🔗︎

Following Aida’s presentation, Brian Perlman gave a very impressive presentation on the use and combination of open-source intelligence (OSINT), geospatial intelligence (GEOINT), and the use of investigative tools for two use cases:

  • An eight-month long investigation pertaining the 44-day war in Artsakh
  • An investigation of a protest in Sudan

Two case examples Brian has used OSINT + GEOINT investigative methods

Brian is an open-source intelligence and geospatial intelligence analyst with a focus on international human rights violations. He holds a master’s degree in journalism from the University of California, Berkeley, and worked as a manager at the Human Rights Center at Berkeley Law, where he led a team of student researchers investigating attacks on Syrian healthcare infrastructure.

First, he encouraged all digital OSINT Investigators to check out the Berkeley Protocol on Digital Open-Source Investigations and to Digital Witness: Using Open Source Information for Human Rights Investigation, Documentation, and Accountability. This is especially useful for people who do not have a legal background, as both readings can give a broad look at Ethics regarding OSINT.

For the first example, the Nagorno-Karabakh Investigation, his remarks on what they did for the investigation were on:

  • Conflict damage assessment + Weapons ID
  • Geolocation/Chronolocation
  • Digital content preservation + archiving
  • Satellite imagery discovery + analysis
  • Facial comparison
  • Uniforms ID

For the Sudan case, the research focused on:

  • Geolocation/Chronolocation
  • EXIF data extraction + analysis
  • Digital content preservation + archiving
  • Audio comparison;
  • Forensic video analysis (FVA)

Brian and his team identified weapons by comparing social media images and imagery reports. He pointed out how different tools available in Maltego, like ShadowDragon or VirusTotal, are very powerful while you are conducting this type of research.

During his presentation, he also shared his top go-tools, besides Maltego, to increase his security and protect his privacy thorough the research process, but also to empower his investigation:

  • Combining Social Media Imagery with different OSINT tools. He used the example of PeakVisor, tool that is usually used by hikers, but by comparing the topography, the team was able to determine the exact location of where the damage happened.
  • Brian recommends the use of Hunchly for internet content preservation in combination with YouTube-DL for video preservation. Later they archived all the information on Mega.
  • To avoid accessing Telegram from his own machine, and in combination with archiving tools, Brian recommended the use of VMWARE to search for the origin from a virtual machine.
  • Comparing the audio of the same incident from different perspectives, to be able to get a fuller picture of what was going on.

Brian’s favorite tools

Conclusion 🔗︎

Both speakers agree on three things:

  • The safety and success of an investigation or operation itself begins with the safety of the investigator. During the webinar, both share with the audience useful tips to achieve this goal.
  • Being able to automate investigation processes takes away a lot of roadblocks. Maltego was instrumental in data management and analysis. Not only did it considerably reduce the research time, but it also made the key elements of the investigation evident.
  • The financial component poses significant constraints to the development of an investigation. These can be overcome through dialogue and the establishment of partnerships that support and encourage investigative journalism.

Check out the entire webinar now to take note of all these practical guidelines and detailed use case demonstrations!

Don’t forget to follow us on Twitter and LinkedIn and sign up for our email newsletter to stay updated on the latest news, tutorials, and events.

Happy investigating!

Download the resource

DE +49
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua & Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia Herzegovina +387
Botswana +267
Brazil +55
Brunei +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde Islands +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus North +90392
Cyprus South +357
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea - Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea North +850
Korea South +82
Kuwait +965
Kyrgyzstan +996
Laos +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mayotte +269
Mexico +52
Micronesia +691
Moldova +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Islands +672
Northern Marianas +670
Norway +47
Oman +968
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russia +7
Rwanda +250
San Marino +378
Sao Tome & Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovak Republic +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
St. Helena +290
St. Kitts +1869
St. Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syria +963
Taiwan +886
Tajikstan +7
Thailand +66
Togo +228
Tonga +676
Trinidad & Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +7
Turkmenistan +993
Turks & Caicos Islands +1649
Tuvalu +688
Uganda +256
UK +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
USA +1
Uzbekistan +7
Vanuatu +678
Vatican City +379
Venezuela +58
Vietnam +84
Virgin Islands - British +84
Virgin Islands - US +84
Wallis & Futuna +681
Yemen +969
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.