WEBVTT

1
00:00:00.120 --> 00:00:04.679
<v Speaker 1>Welcome to the deep dive. Today, we're unpacking the real

2
00:00:04.719 --> 00:00:09.960
<v Speaker 1>world power of open source intelligence. Mmm, you know, Ocent, exactly.

3
00:00:10.279 --> 00:00:14.240
<v Speaker 1>You our listener shared some really fascinating material, and well,

4
00:00:14.240 --> 00:00:16.399
<v Speaker 1>our goal is to pull out the most valuable insights

5
00:00:16.399 --> 00:00:16.640
<v Speaker 1>for you.

6
00:00:16.879 --> 00:00:21.600
<v Speaker 2>That's right, Ocent. It really boils down to finding and

7
00:00:21.679 --> 00:00:25.079
<v Speaker 2>analyzing information that's already out there in the open.

8
00:00:24.879 --> 00:00:25.800
<v Speaker 1>Like public information.

9
00:00:26.000 --> 00:00:28.960
<v Speaker 2>Yeah, exactly. It's like being a detective who you know,

10
00:00:29.199 --> 00:00:31.440
<v Speaker 2>only uses publicly available clues.

11
00:00:31.760 --> 00:00:34.799
<v Speaker 1>Wow. To really bring this home. One of the sources

12
00:00:34.840 --> 00:00:37.920
<v Speaker 1>you sent had this powerful personal story. Oh yeah, yeah.

13
00:00:37.960 --> 00:00:41.039
<v Speaker 1>The author talked about their grandmother's life journey Germany to

14
00:00:41.079 --> 00:00:45.679
<v Speaker 1>the US, all documented through public records stuff that's online now,

15
00:00:45.799 --> 00:00:49.799
<v Speaker 1>Incredible things like you know, marriage licenses, census data, even

16
00:00:49.840 --> 00:00:53.840
<v Speaker 1>records of her passing, all accessible and painted this incredibly

17
00:00:53.840 --> 00:00:54.640
<v Speaker 1>detailed picture.

18
00:00:54.840 --> 00:00:56.960
<v Speaker 2>It really hits herme how much is actually out there?

19
00:00:57.000 --> 00:00:58.159
<v Speaker 1>Doesn't it? It really does.

20
00:00:58.240 --> 00:00:59.920
<v Speaker 2>And so for this deep dive, we'll be focusing on

21
00:01:00.119 --> 00:01:03.280
<v Speaker 2>those book excerpts you provided. Our aim is to well

22
00:01:03.439 --> 00:01:07.879
<v Speaker 2>go beyond just defining OSAN and really extract the key insights,

23
00:01:07.920 --> 00:01:09.519
<v Speaker 2>the practical understanding you can use.

24
00:01:09.640 --> 00:01:12.719
<v Speaker 1>Okay, let's unpack this then, So in a more maybe

25
00:01:12.840 --> 00:01:16.519
<v Speaker 1>formal sense, what exactly is osent.

26
00:01:16.400 --> 00:01:20.040
<v Speaker 2>Well, formally osin is it's the process of analyzing publicly

27
00:01:20.079 --> 00:01:25.879
<v Speaker 2>available facts, evidence, observations, arguments, all that stuff to form

28
00:01:25.920 --> 00:01:28.879
<v Speaker 2>a judgment. Right, critical thinking is really at its heart

29
00:01:28.959 --> 00:01:32.480
<v Speaker 2>that ability to you know, connect the dots and evaluate

30
00:01:32.480 --> 00:01:33.480
<v Speaker 2>the information you find.

31
00:01:33.640 --> 00:01:35.840
<v Speaker 1>And this isn't exactly a new field, is it. The

32
00:01:36.000 --> 00:01:38.079
<v Speaker 1>sources touch on its history a bit correct.

33
00:01:38.640 --> 00:01:42.719
<v Speaker 2>Traditionally, within intelligence circles, osent was just one of several disciplines.

34
00:01:43.000 --> 00:01:46.920
<v Speaker 2>It sat alongside things like human that's human intelligence getting info.

35
00:01:46.640 --> 00:01:48.640
<v Speaker 1>From people, right, spies and stuff.

36
00:01:48.519 --> 00:01:53.439
<v Speaker 2>Sort of, and sigant signals intelligence or seat imagery intelligence,

37
00:01:53.480 --> 00:01:57.400
<v Speaker 2>and Mason measurement and signature intelligence. Those were the established

38
00:01:57.400 --> 00:01:59.359
<v Speaker 2>categories for wow a long time.

39
00:01:59.599 --> 00:02:02.879
<v Speaker 1>Things have changed a lot, especially recently.

40
00:02:02.920 --> 00:02:06.599
<v Speaker 2>Absolutely, what's really shaped ocent today is just the explosion

41
00:02:06.680 --> 00:02:10.319
<v Speaker 2>of data from mobile phones and social media platforms like Instagram,

42
00:02:10.360 --> 00:02:16.319
<v Speaker 2>TikTok x formerly Twitter. They're just massive public archives of information.

43
00:02:16.599 --> 00:02:20.439
<v Speaker 2>Huge plus maps and satellite images are incredibly accurate now

44
00:02:20.680 --> 00:02:21.599
<v Speaker 2>and easy to get hold of.

45
00:02:21.719 --> 00:02:24.759
<v Speaker 1>Okay, but here's where it gets interesting. Right, while all

46
00:02:24.800 --> 00:02:28.479
<v Speaker 1>this open data is exploding, there's also this big push

47
00:02:28.599 --> 00:02:34.199
<v Speaker 1>for security privacy. You see encrypted communication like signal and

48
00:02:34.240 --> 00:02:37.240
<v Speaker 1>telegram everywhere. Yeah, that creates a bit of a puzzle

49
00:02:37.280 --> 00:02:38.360
<v Speaker 1>for OCENT, doesn't it.

50
00:02:38.360 --> 00:02:41.560
<v Speaker 2>It definitely presents challenges. But you know, these obstacles have

51
00:02:41.639 --> 00:02:44.159
<v Speaker 2>actually driven the development of new tools, often.

52
00:02:44.000 --> 00:02:45.719
<v Speaker 1>Open source tools like on GitHub.

53
00:02:45.840 --> 00:02:48.599
<v Speaker 2>Yeah, you can find loads on platforms like GitHub. And

54
00:02:48.639 --> 00:02:52.280
<v Speaker 2>we're also seeing the growth of really active OCENT communities

55
00:02:52.319 --> 00:02:56.879
<v Speaker 2>online sharing knowledge exactly, sharing knowledge through blogs, videos, even

56
00:02:56.960 --> 00:03:00.599
<v Speaker 2>live streams. And it's not just governments anymore. Profits are

57
00:03:00.639 --> 00:03:04.520
<v Speaker 2>using crowdsourcing and OCENT for things like finding missing people. Wow,

58
00:03:04.879 --> 00:03:08.879
<v Speaker 2>the lines between those old intelligence categories they're getting blurrier.

59
00:03:09.319 --> 00:03:11.879
<v Speaker 2>Analysts need a broader skill set now, and.

60
00:03:11.800 --> 00:03:14.599
<v Speaker 1>The sources even hint at what's coming, right with a

61
00:03:14.680 --> 00:03:18.520
<v Speaker 1>chapter called What's Next. Sounds like it's always changing.

62
00:03:18.599 --> 00:03:22.360
<v Speaker 2>Precisely, the digital world is always moving, so OCENT methods,

63
00:03:22.479 --> 00:03:25.360
<v Speaker 2>the information we can access, it'll just keep.

64
00:03:25.240 --> 00:03:30.199
<v Speaker 1>Evolving, which makes those core skills like critical thinking even.

65
00:03:29.960 --> 00:03:31.719
<v Speaker 2>More crucial, absolutely essential.

66
00:03:32.120 --> 00:03:36.800
<v Speaker 1>Speaking of skills, the source material really hammers home critical thinking.

67
00:03:37.360 --> 00:03:40.840
<v Speaker 1>Why is that so vital for someone doing OCENT well?

68
00:03:40.960 --> 00:03:44.080
<v Speaker 2>Without critical thinking, it's just so easy to get overwhelmed

69
00:03:44.120 --> 00:03:45.960
<v Speaker 2>by the sheer amount of data right.

70
00:03:46.120 --> 00:03:48.039
<v Speaker 1>Information overload totally.

71
00:03:47.840 --> 00:03:50.599
<v Speaker 2>And it's hard to tell what's reliable. Critical thinking is

72
00:03:50.599 --> 00:03:53.360
<v Speaker 2>about being able to see the connections between different pieces

73
00:03:53.360 --> 00:03:55.680
<v Speaker 2>of info and figure out, you know, what's credible and

74
00:03:55.680 --> 00:03:56.000
<v Speaker 2>what's not.

75
00:03:56.280 --> 00:03:58.840
<v Speaker 1>Like journalists verifying stuff on social media.

76
00:03:58.719 --> 00:04:01.639
<v Speaker 2>Exactly like that, they're off on the front lines separating

77
00:04:01.719 --> 00:04:03.919
<v Speaker 2>fact from fiction. It's a core part of the job

78
00:04:04.280 --> 00:04:05.439
<v Speaker 2>that makes perfect sense.

79
00:04:06.000 --> 00:04:08.199
<v Speaker 1>You can have mountains of data, but if you can't

80
00:04:08.240 --> 00:04:11.199
<v Speaker 1>analyze it right, it's not really useful intelligence, is it.

81
00:04:11.199 --> 00:04:11.719
<v Speaker 2>Not at all?

82
00:04:11.960 --> 00:04:15.319
<v Speaker 1>Now? Something you might not immediately link with intelligence work

83
00:04:15.439 --> 00:04:19.399
<v Speaker 1>is mental well being, But the sources bring this up.

84
00:04:19.639 --> 00:04:23.319
<v Speaker 2>Yes, And it's such a crucial point ascent analysts can

85
00:04:23.600 --> 00:04:28.160
<v Speaker 2>unfortunately encounter deeply disturbing content I can imagine, especially when

86
00:04:28.199 --> 00:04:32.920
<v Speaker 2>dealing with topics like violence or exploitation. It's vital to

87
00:04:33.000 --> 00:04:36.879
<v Speaker 2>acknowledge the potential for trauma for mental health challenges for

88
00:04:36.959 --> 00:04:38.759
<v Speaker 2>ourselves and our colleagues.

89
00:04:38.319 --> 00:04:40.079
<v Speaker 1>Because ignoring it affects.

90
00:04:39.680 --> 00:04:42.560
<v Speaker 2>The work absolutely. It can seriously impact the quality of

91
00:04:42.560 --> 00:04:45.079
<v Speaker 2>the work and of course personal lives too. It's something

92
00:04:45.079 --> 00:04:45.959
<v Speaker 2>we have to talk about.

93
00:04:46.040 --> 00:04:50.480
<v Speaker 1>Another really important aspect highlighted is personal bias. How can

94
00:04:50.519 --> 00:04:53.839
<v Speaker 1>our own beliefs mess up ocent analysis.

95
00:04:54.040 --> 00:04:57.879
<v Speaker 2>Well, our biases can lead us to misinterpret information, plain

96
00:04:57.920 --> 00:05:00.959
<v Speaker 2>and simple. It undermines the impartial. That's just key to

97
00:05:01.000 --> 00:05:02.839
<v Speaker 2>good investigations.

98
00:05:02.000 --> 00:05:04.040
<v Speaker 1>And you need to be aware of them exactly right.

99
00:05:04.240 --> 00:05:08.199
<v Speaker 2>Being aware lets you actively question your interpretations. The example

100
00:05:08.240 --> 00:05:10.000
<v Speaker 2>and the source about the Nicholas Cage fans.

101
00:05:10.040 --> 00:05:12.319
<v Speaker 1>Oh yeah, the best actor investigation. Right.

102
00:05:12.399 --> 00:05:16.519
<v Speaker 2>It perfectly shows confirmation bias, that tendency to just favor

103
00:05:16.560 --> 00:05:18.639
<v Speaker 2>information that supports what we already believe.

104
00:05:18.879 --> 00:05:20.360
<v Speaker 1>We all do it, we all do.

105
00:05:21.040 --> 00:05:24.600
<v Speaker 2>Recognizing that everyone has biases is the first step in

106
00:05:25.319 --> 00:05:29.680
<v Speaker 2>reducing their influence. You have to constantly question credibility and evidence.

107
00:05:29.720 --> 00:05:32.519
<v Speaker 1>That's a good reminder. Okay, So the sources then get

108
00:05:32.560 --> 00:05:35.959
<v Speaker 1>into the methods. This idea of the intelligence cycle can

109
00:05:36.000 --> 00:05:37.040
<v Speaker 1>he gives a quick overview.

110
00:05:37.160 --> 00:05:40.800
<v Speaker 2>Sure, the intelligence cycle is basically a structured way of

111
00:05:40.959 --> 00:05:45.079
<v Speaker 2>doing intelligence work. A process, Yeah, a process. It generally

112
00:05:45.120 --> 00:05:50.319
<v Speaker 2>involves planning and requirements first, then collection, followed by processing

113
00:05:50.319 --> 00:05:54.720
<v Speaker 2>and evaluation, then analysis and production, and finally dissemination and

114
00:05:54.759 --> 00:05:57.319
<v Speaker 2>consumption with feedback looping.

115
00:05:57.000 --> 00:05:58.519
<v Speaker 1>Back like a continuous loop.

116
00:05:58.560 --> 00:06:00.519
<v Speaker 2>Pretty much. Yeah, it feeds back in to itself.

117
00:06:00.560 --> 00:06:02.720
<v Speaker 1>Okay, let's break some of that down starting with planning

118
00:06:02.720 --> 00:06:06.399
<v Speaker 1>and requirements. What's really important in that first stage.

119
00:06:06.000 --> 00:06:08.720
<v Speaker 2>The planning and requirements phase is well, it's all about

120
00:06:08.759 --> 00:06:12.279
<v Speaker 2>defining the who, what, why, and how of your investigation.

121
00:06:12.399 --> 00:06:14.480
<v Speaker 1>Who needs the info and what do they need exactly?

122
00:06:14.560 --> 00:06:17.480
<v Speaker 2>Those questions should be driven by the stakeholders, the people

123
00:06:17.519 --> 00:06:22.040
<v Speaker 2>who need the intelligence. Without clear goals, clear objectives, you

124
00:06:22.160 --> 00:06:25.720
<v Speaker 2>just risk wasting time chasing rabbits, right, wasting time on

125
00:06:25.800 --> 00:06:29.600
<v Speaker 2>irrelevant information, and ending up with intelligence that doesn't actually

126
00:06:29.600 --> 00:06:30.720
<v Speaker 2>answer the original question.

127
00:06:30.839 --> 00:06:31.360
<v Speaker 1>Makes sense.

128
00:06:31.879 --> 00:06:34.519
<v Speaker 2>As analysts, we might be tempted to just dive in

129
00:06:34.560 --> 00:06:37.879
<v Speaker 2>and start gathering data, but setting these initial requirements is

130
00:06:38.000 --> 00:06:42.240
<v Speaker 2>so essential. The key takeaway. Without clear goals upfront, you

131
00:06:42.360 --> 00:06:45.600
<v Speaker 2>risk drowning in data that doesn't help total sense.

132
00:06:45.720 --> 00:06:47.199
<v Speaker 1>You need to know what you're looking for before you

133
00:06:47.199 --> 00:06:52.800
<v Speaker 1>start digging. Okay, next step collection. The sources highlight this

134
00:06:52.879 --> 00:06:56.040
<v Speaker 1>technique called pivoting. What's the art of pivoting?

135
00:06:56.079 --> 00:07:00.839
<v Speaker 2>In osent pivoting, it's like following a trail of digital breadcrumbs.

136
00:07:00.920 --> 00:07:01.199
<v Speaker 1>Okay.

137
00:07:01.439 --> 00:07:04.399
<v Speaker 2>When you're collecting info, you'll often find clues that lead

138
00:07:04.439 --> 00:07:07.720
<v Speaker 2>you to other related data, things that potentially connect different

139
00:07:07.759 --> 00:07:09.279
<v Speaker 2>findings or user accounts.

140
00:07:09.319 --> 00:07:10.680
<v Speaker 1>Like starting with an email address.

141
00:07:10.800 --> 00:07:12.879
<v Speaker 2>Yeah, that's a great example. You start with an email,

142
00:07:13.160 --> 00:07:15.920
<v Speaker 2>and you might pivot to a username, maybe a phone number,

143
00:07:16.000 --> 00:07:17.959
<v Speaker 2>maybe even an IP address.

144
00:07:17.560 --> 00:07:20.879
<v Speaker 1>And each new piece becomes a new starting point exactly.

145
00:07:21.360 --> 00:07:24.879
<v Speaker 2>Each new bit of information lets you pivot again build

146
00:07:24.879 --> 00:07:30.800
<v Speaker 2>out the picture. Mastering. Pivoting really transforms scattered data into

147
00:07:30.920 --> 00:07:35.319
<v Speaker 2>like interconnected narratives. It reveals hidden relationship is crucial. It is,

148
00:07:35.759 --> 00:07:38.399
<v Speaker 2>and it's a skill that really improves with practice. Learning

149
00:07:38.439 --> 00:07:41.399
<v Speaker 2>to spot those potential connections, those pivot points.

150
00:07:41.439 --> 00:07:43.839
<v Speaker 1>And where do we usually start this collection? The sources

151
00:07:43.879 --> 00:07:45.959
<v Speaker 1>mentioned a few common jumping off points.

152
00:07:46.240 --> 00:07:50.360
<v Speaker 2>Well, analysts might start with large collections of data, you know,

153
00:07:50.639 --> 00:07:54.920
<v Speaker 2>big data, right, or just basic search engine results, or

154
00:07:54.959 --> 00:07:58.879
<v Speaker 2>maybe social media profiles. The specific starting point often depends

155
00:07:58.920 --> 00:08:01.079
<v Speaker 2>on what you already know, what you're trying to find out.

156
00:08:01.279 --> 00:08:03.759
<v Speaker 1>Okay, so we've gathered our data. The next step in

157
00:08:03.800 --> 00:08:07.160
<v Speaker 1>the cycle is processing and evaluation. The sources mentioned a

158
00:08:07.240 --> 00:08:11.000
<v Speaker 1>couple of interesting techniques here, reset and gap analysis. Let's

159
00:08:11.000 --> 00:08:12.000
<v Speaker 1>start with reset. Okay.

160
00:08:12.040 --> 00:08:16.120
<v Speaker 2>The reset technique it stands for refresh, explore, think, seek.

161
00:08:16.800 --> 00:08:18.839
<v Speaker 2>It's basically a way to get a fresh perspective when

162
00:08:18.879 --> 00:08:19.480
<v Speaker 2>you feel stuck.

163
00:08:19.560 --> 00:08:20.319
<v Speaker 1>We all get stuck.

164
00:08:20.399 --> 00:08:23.319
<v Speaker 2>Absolutely, It encourages you to take a break, maybe look

165
00:08:23.319 --> 00:08:25.879
<v Speaker 2>at things from a different angle, think creative right, find

166
00:08:25.920 --> 00:08:28.639
<v Speaker 2>the box, yeah, without being limited by your current focus,

167
00:08:28.959 --> 00:08:32.399
<v Speaker 2>and then actively look for new information or new ways

168
00:08:32.399 --> 00:08:35.720
<v Speaker 2>to approach the problem, like taking the walk exactly. The

169
00:08:35.799 --> 00:08:38.159
<v Speaker 2>example of taking a thirty minute walk to clear your

170
00:08:38.200 --> 00:08:40.919
<v Speaker 2>head and come back with a fresh outlook. That's reset

171
00:08:40.960 --> 00:08:41.399
<v Speaker 2>in action.

172
00:08:41.679 --> 00:08:43.480
<v Speaker 1>Sounds like a good way to avoid getting lost in

173
00:08:43.480 --> 00:08:46.440
<v Speaker 1>the weeds. And what about gap analysis? How does that

174
00:08:46.559 --> 00:08:48.679
<v Speaker 1>help in processing and evaluating?

175
00:08:49.039 --> 00:08:53.399
<v Speaker 2>Gap analysis is a bit more systematic. It's a technique

176
00:08:53.720 --> 00:08:55.159
<v Speaker 2>for breaking down an investigation.

177
00:08:55.320 --> 00:08:56.039
<v Speaker 1>How does it work?

178
00:08:56.360 --> 00:09:00.120
<v Speaker 2>It involves asking four key questions what do I already know? Oh,

179
00:09:00.240 --> 00:09:02.480
<v Speaker 2>what does this mean? What do I still need to know?

180
00:09:03.000 --> 00:09:05.120
<v Speaker 2>And crucially, how do I find that out?

181
00:09:05.200 --> 00:09:05.519
<v Speaker 1>Okay?

182
00:09:05.600 --> 00:09:08.840
<v Speaker 2>By methodically answering these you can break down large amounts

183
00:09:08.879 --> 00:09:12.159
<v Speaker 2>of info into a more manageable form and identify the

184
00:09:12.200 --> 00:09:13.720
<v Speaker 2>critical gaps in your knowledge.

185
00:09:13.759 --> 00:09:15.159
<v Speaker 1>The example with the image was good.

186
00:09:15.240 --> 00:09:18.159
<v Speaker 2>Yeah, analyzing the image, noting the boat, the German flag,

187
00:09:18.279 --> 00:09:21.200
<v Speaker 2>the name temptation, and then asking what those details imply

188
00:09:21.320 --> 00:09:23.519
<v Speaker 2>and what else you need to know? It really shows

189
00:09:23.600 --> 00:09:26.320
<v Speaker 2>how effective this can be. It forces you to be methodical.

190
00:09:26.600 --> 00:09:29.960
<v Speaker 1>Right, It's about being methodical in your approach. Okay, after

191
00:09:30.000 --> 00:09:34.759
<v Speaker 1>processing and evaluation comes analysis in production, making sense of

192
00:09:34.799 --> 00:09:37.080
<v Speaker 1>it all. Documentation seems really key.

193
00:09:36.919 --> 00:09:40.679
<v Speaker 2>Here, absolutely essential. Taking detailed notes, capturing the data you find.

194
00:09:41.279 --> 00:09:43.039
<v Speaker 2>You just have to do it or you'll forget or

195
00:09:43.080 --> 00:09:47.120
<v Speaker 2>lose track exactly and depending on how complex the cases,

196
00:09:47.559 --> 00:09:52.519
<v Speaker 2>visualizations like mind maps, charts, graphs, they can be incredibly.

197
00:09:52.080 --> 00:09:53.480
<v Speaker 1>Useful for seeing connections.

198
00:09:53.559 --> 00:09:58.120
<v Speaker 2>Yeah, for understanding entities, connections, characteristics. Link analysis charts are

199
00:09:58.120 --> 00:10:01.960
<v Speaker 2>great for visualizing relationships between people, for instance, Right, while

200
00:10:02.000 --> 00:10:04.279
<v Speaker 2>mind maps can help you see how different pieces of

201
00:10:04.320 --> 00:10:07.840
<v Speaker 2>information relate and maybe spot potential pivot points you missed.

202
00:10:08.399 --> 00:10:11.200
<v Speaker 2>The key is finding a documentation method that works for

203
00:10:11.240 --> 00:10:13.600
<v Speaker 2>you and allows for collaboration if needed.

204
00:10:13.799 --> 00:10:16.799
<v Speaker 1>The sources even mentioned specific tools for this, like Hunchly

205
00:10:16.919 --> 00:10:18.080
<v Speaker 1>in Obsidian. Yeah.

206
00:10:18.159 --> 00:10:21.559
<v Speaker 2>Hunchley is a browser extension. It's designed to automatically grab

207
00:10:21.639 --> 00:10:24.000
<v Speaker 2>and organize your web based research as you go.

208
00:10:24.159 --> 00:10:25.600
<v Speaker 1>Sounds handy any downsites?

209
00:10:25.840 --> 00:10:28.480
<v Speaker 2>Well, One thing is it only works with chromium based

210
00:10:28.519 --> 00:10:32.519
<v Speaker 2>browsers like Chrome or Edge, and some users find its

211
00:10:32.559 --> 00:10:36.919
<v Speaker 2>little overlay box a bit intrusive. But it's powerful for.

212
00:10:36.919 --> 00:10:39.559
<v Speaker 1>Autocapture okay, and Obsidium.

213
00:10:39.639 --> 00:10:43.039
<v Speaker 2>Obsidian is different. It's note taking software. It stores your

214
00:10:43.039 --> 00:10:45.600
<v Speaker 2>notes locally on your machine, which is great to privacy,

215
00:10:46.000 --> 00:10:48.440
<v Speaker 2>and lets you create links between notes.

216
00:10:48.320 --> 00:10:50.960
<v Speaker 1>More like building a personal wiki kind of. Yeah.

217
00:10:51.080 --> 00:10:55.519
<v Speaker 2>It offers features like graph views, seeing the connections visually, slideshows,

218
00:10:55.639 --> 00:10:57.559
<v Speaker 2>even automatic mind map generation.

219
00:10:57.679 --> 00:10:58.519
<v Speaker 1>Why do people like it?

220
00:10:58.600 --> 00:11:00.720
<v Speaker 2>People tend to like it because it's easy to use.

221
00:11:00.759 --> 00:11:03.480
<v Speaker 2>Your data stays secure on your own computer, and it

222
00:11:03.519 --> 00:11:06.120
<v Speaker 2>offers a lot of flexibility in how you organize things

223
00:11:06.320 --> 00:11:07.600
<v Speaker 2>free for personal use too.

224
00:11:07.720 --> 00:11:10.840
<v Speaker 1>Good options. Yeah, okay. So once we've analyzed everything, the

225
00:11:10.879 --> 00:11:13.799
<v Speaker 1>next step is production, putting it all together in a report.

226
00:11:14.320 --> 00:11:17.559
<v Speaker 1>The sources emphasize this is critical, even if it's maybe

227
00:11:17.559 --> 00:11:18.799
<v Speaker 1>not the most glamorous part.

228
00:11:18.919 --> 00:11:21.159
<v Speaker 2>That's so right. All that hard work you put into

229
00:11:21.200 --> 00:11:25.120
<v Speaker 2>collecting and analyzing, it's wasted if you can't effectively communicate

230
00:11:25.120 --> 00:11:27.120
<v Speaker 2>your findings to the people who need them, right, the

231
00:11:27.159 --> 00:11:31.080
<v Speaker 2>stakeholders again, exactly. The report needs to clearly answer the

232
00:11:31.159 --> 00:11:34.519
<v Speaker 2>questions defined way back in planning and requirements, and it

233
00:11:34.559 --> 00:11:37.200
<v Speaker 2>absolutely has to be tailored to the specific audience.

234
00:11:37.279 --> 00:11:40.039
<v Speaker 1>So a CEO gets something different than say, a technical

235
00:11:40.120 --> 00:11:41.559
<v Speaker 1>expert totally different.

236
00:11:41.600 --> 00:11:45.120
<v Speaker 2>The CEO needs the bottom line quickly. The expert might

237
00:11:45.159 --> 00:11:47.639
<v Speaker 2>need all the technical details. The report itself needs to

238
00:11:47.639 --> 00:11:51.159
<v Speaker 2>be well organized, easy to read, key elements, clear title

239
00:11:51.240 --> 00:11:56.039
<v Speaker 2>and date. Obviously, and crucially, an executive summary gets straight

240
00:11:56.080 --> 00:11:59.679
<v Speaker 2>to the point, uses the BLUF approach, bottom line up front,

241
00:12:00.519 --> 00:12:03.159
<v Speaker 2>got it, and the information in the report needs to

242
00:12:03.200 --> 00:12:07.639
<v Speaker 2>be accurate, relevant, objective. The example the US government struggles

243
00:12:07.639 --> 00:12:11.559
<v Speaker 2>to implement OSENT shows that kind of direct statement you

244
00:12:11.639 --> 00:12:13.360
<v Speaker 2>might find in an executive summary.

245
00:12:13.759 --> 00:12:18.360
<v Speaker 1>Clear concise, clear, concise, tailored key for reporting uh okay,

246
00:12:18.360 --> 00:12:20.919
<v Speaker 1>shifting gears a bit. The sources introduced this idea of

247
00:12:20.960 --> 00:12:24.240
<v Speaker 1>the adversarial mindset. Why is it important for someone doing

248
00:12:24.279 --> 00:12:26.320
<v Speaker 1>ocent to well think like an attacker?

249
00:12:26.720 --> 00:12:30.519
<v Speaker 2>Adopting an adversarial mindset? It really helps you understand potential targets.

250
00:12:30.559 --> 00:12:32.840
<v Speaker 2>What kind of data might be valuable to someone looking

251
00:12:32.840 --> 00:12:35.000
<v Speaker 2>to cause harm? How might they try to get it?

252
00:12:35.200 --> 00:12:37.039
<v Speaker 1>So you can anticipate threats exactly.

253
00:12:37.639 --> 00:12:40.639
<v Speaker 2>This perspective is really important for creating intelligence that can

254
00:12:40.720 --> 00:12:45.519
<v Speaker 2>lead to proactive security measures. By understanding the techniques attackers use,

255
00:12:45.679 --> 00:12:48.320
<v Speaker 2>how they might get into systems, how they collect information,

256
00:12:48.799 --> 00:12:51.120
<v Speaker 2>you can better identify weak spots.

257
00:12:50.879 --> 00:12:55.799
<v Speaker 1>In an organization's online presence or even in individuals both. Yeah.

258
00:12:55.919 --> 00:13:00.480
<v Speaker 2>It's a common approach in threat intelligence, red teaming security testing,

259
00:13:01.360 --> 00:13:02.759
<v Speaker 2>thinking like the bad guy to.

260
00:13:02.720 --> 00:13:05.639
<v Speaker 1>Find the holes, which leads us directly to the crucial

261
00:13:05.679 --> 00:13:10.879
<v Speaker 1>topic of operational security op set. Why is OPSX so

262
00:13:11.000 --> 00:13:12.639
<v Speaker 1>vital for someone involved in ocent?

263
00:13:13.080 --> 00:13:16.480
<v Speaker 2>OHPSC is absolutely essential. You have to protect yourself and

264
00:13:16.519 --> 00:13:18.240
<v Speaker 2>your investigations.

265
00:13:17.519 --> 00:13:19.039
<v Speaker 1>Because the work can be risky.

266
00:13:18.840 --> 00:13:21.000
<v Speaker 2>Exactly because of the nature of the work. You might

267
00:13:21.039 --> 00:13:24.639
<v Speaker 2>be dealing with sensitive information or looking into potentially hostile

268
00:13:24.679 --> 00:13:28.679
<v Speaker 2>individuals or groups. Good OPS practices help prevent your activities

269
00:13:28.679 --> 00:13:31.519
<v Speaker 2>from being detected traced back to you. It ensures your

270
00:13:31.559 --> 00:13:33.480
<v Speaker 2>safety and the integrity of your research.

271
00:13:33.799 --> 00:13:37.480
<v Speaker 1>Okay, the sources outline a specific OPSE process. What are

272
00:13:37.519 --> 00:13:39.120
<v Speaker 1>the main steps involved there? Yeah?

273
00:13:39.200 --> 00:13:44.159
<v Speaker 2>The OPSC process usually includes several steps. First, you analyze

274
00:13:44.159 --> 00:13:45.559
<v Speaker 2>the threat who might be targeting you?

275
00:13:45.840 --> 00:13:46.159
<v Speaker 1>Okay?

276
00:13:46.240 --> 00:13:49.840
<v Speaker 2>Then you determine vulnerabilities where are your weak spots? Followed

277
00:13:49.840 --> 00:13:52.399
<v Speaker 2>by a risk assessment how likely is an attack and

278
00:13:52.440 --> 00:13:56.159
<v Speaker 2>what's the impact? And finally you apply countermeasures to plug

279
00:13:56.159 --> 00:13:56.600
<v Speaker 2>the holes.

280
00:13:56.679 --> 00:13:56.919
<v Speaker 1>Right.

281
00:13:57.480 --> 00:14:00.879
<v Speaker 2>It's a systematic way to identify potential day and put

282
00:14:00.919 --> 00:14:02.799
<v Speaker 2>measures in place. To reduce those risks.

283
00:14:03.080 --> 00:14:06.279
<v Speaker 1>One interesting method mentioned is the persona non grata or

284
00:14:06.360 --> 00:14:07.360
<v Speaker 1>PNG method.

285
00:14:07.559 --> 00:14:11.639
<v Speaker 2>What's that about the PNG method? It involves creating detailed

286
00:14:11.639 --> 00:14:16.000
<v Speaker 2>profiles of potential adversaries. You actually give them names, backgrounds,

287
00:14:16.039 --> 00:14:16.919
<v Speaker 2>skill sets.

288
00:14:16.879 --> 00:14:19.120
<v Speaker 1>Like creating fictional characters sort of, Yeah.

289
00:14:19.360 --> 00:14:22.279
<v Speaker 2>But based on realistic threats. This helps you think from

290
00:14:22.320 --> 00:14:25.720
<v Speaker 2>their perspective, understand their goals, how they might operate, and

291
00:14:25.759 --> 00:14:28.879
<v Speaker 2>it helps you spot weaknesses in your own opsec strategy.

292
00:14:29.000 --> 00:14:32.879
<v Speaker 1>That's clever proactively thinking about how someone might target you exactly,

293
00:14:33.200 --> 00:14:35.440
<v Speaker 1>and when it comes to actually applying those countermeasures. What

294
00:14:35.559 --> 00:14:37.080
<v Speaker 1>kind of privacy tools are available?

295
00:14:37.320 --> 00:14:40.279
<v Speaker 2>There are several tools that can really enhance your OPSS.

296
00:14:40.720 --> 00:14:43.039
<v Speaker 2>VPN's Virtual private networks are common.

297
00:14:43.279 --> 00:14:44.080
<v Speaker 1>What do they do again?

298
00:14:44.159 --> 00:14:47.279
<v Speaker 2>They encrypt your Internet traffic and hide your real IP address,

299
00:14:47.679 --> 00:14:50.360
<v Speaker 2>makes it harder to track your online activities back to you.

300
00:14:50.639 --> 00:14:51.000
<v Speaker 1>Okay.

301
00:14:51.759 --> 00:14:55.639
<v Speaker 2>Then there's tor, the Onion router. It provides anonymous browsing

302
00:14:55.639 --> 00:14:59.799
<v Speaker 2>by routing your traffic through multiple servers multiple relays, obscures

303
00:14:59.799 --> 00:15:01.279
<v Speaker 2>your origin and destination.

304
00:15:01.960 --> 00:15:02.799
<v Speaker 1>Can you use both?

305
00:15:02.960 --> 00:15:06.159
<v Speaker 2>Yeah? Using both a VPN and tour together can offer

306
00:15:06.200 --> 00:15:09.720
<v Speaker 2>an extra layer of security. Free net is another option

307
00:15:09.799 --> 00:15:13.200
<v Speaker 2>it's a peer to peer platform using decentralized storage and

308
00:15:13.320 --> 00:15:15.200
<v Speaker 2>encryption for anonymous communication.

309
00:15:15.519 --> 00:15:18.960
<v Speaker 1>Virtual machines vms are also mentioned for security. How do

310
00:15:18.960 --> 00:15:19.440
<v Speaker 1>they help with.

311
00:15:19.399 --> 00:15:24.039
<v Speaker 2>OPSA VMS let you run separate, isolated operating systems on

312
00:15:24.080 --> 00:15:26.840
<v Speaker 2>your main computer, like a computer within your computer, a

313
00:15:26.879 --> 00:15:29.879
<v Speaker 2>sandbox exactly a digital sandbox. So if you click on

314
00:15:29.919 --> 00:15:33.559
<v Speaker 2>a risky link or open a dodgy attachment, it's contained

315
00:15:33.600 --> 00:15:36.480
<v Speaker 2>within that virtual environment. It can't harm your primary system.

316
00:15:36.519 --> 00:15:39.840
<v Speaker 2>But they're not perfect, right, It's worth noting vms aren't

317
00:15:39.840 --> 00:15:43.519
<v Speaker 2>a silver bullet against everything. Things like webcam hijacking or

318
00:15:43.639 --> 00:15:45.600
<v Speaker 2>browser fingerprinting might still be issues.

319
00:15:45.639 --> 00:15:47.279
<v Speaker 1>Browser finger printing, what's that?

320
00:15:47.759 --> 00:15:53.919
<v Speaker 2>Ah, that's when websites collect data about your browser configuration, fonts, graphics,

321
00:15:53.960 --> 00:15:58.120
<v Speaker 2>card drivers, plugins, all sorts of tiny details.

322
00:15:57.679 --> 00:15:59.399
<v Speaker 1>Could identify you potentially.

323
00:15:59.519 --> 00:16:03.360
<v Speaker 2>Yes, enough of these details combined can create a unique

324
00:16:03.360 --> 00:16:06.279
<v Speaker 2>fingerprint that can identify you even if you're using a

325
00:16:06.360 --> 00:16:08.679
<v Speaker 2>VPN or VM. It's a tricky.

326
00:16:08.360 --> 00:16:11.639
<v Speaker 1>Area, okay. Another key part of US and OPSEC seems

327
00:16:11.639 --> 00:16:15.919
<v Speaker 1>to be using research accounts or sock puppets. Yeah, what's

328
00:16:15.919 --> 00:16:18.320
<v Speaker 1>the idea there? Creating fake profiles?

329
00:16:18.480 --> 00:16:22.000
<v Speaker 2>Pretty much? Yeah, research accounts are separate online profiles you

330
00:16:22.080 --> 00:16:24.840
<v Speaker 2>create and maintain specifically for your OCENT work.

331
00:16:24.720 --> 00:16:26.480
<v Speaker 1>To keep it separate from your real life.

332
00:16:26.559 --> 00:16:30.399
<v Speaker 2>Exactly, keep your personal online life completely separate from your

333
00:16:30.399 --> 00:16:33.360
<v Speaker 2>research activities. But just creating them isn't enough.

334
00:16:33.480 --> 00:16:34.600
<v Speaker 1>You have to make them look real.

335
00:16:34.679 --> 00:16:37.159
<v Speaker 2>You got it. To make these accounts look legitimate, you

336
00:16:37.200 --> 00:16:40.559
<v Speaker 2>need to engage in consistent activity that mimics normal human behavior,

337
00:16:40.679 --> 00:16:44.639
<v Speaker 2>like what adding friends, making comments, liking posts, sharing relevant

338
00:16:44.679 --> 00:16:48.519
<v Speaker 2>content stuff related to the persona you've created, and doing

339
00:16:48.519 --> 00:16:50.240
<v Speaker 2>it at typical regional hours.

340
00:16:49.960 --> 00:16:51.480
<v Speaker 1>So they don't get flagg by algorithms.

341
00:16:51.720 --> 00:16:54.919
<v Speaker 2>Right. This helps prevent social media platforms from flagging the

342
00:16:54.960 --> 00:16:58.559
<v Speaker 2>accounts as suspicious and potentially shutting them down. You want

343
00:16:58.559 --> 00:17:01.960
<v Speaker 2>to blend in mean some of that you can. The

344
00:17:02.000 --> 00:17:06.559
<v Speaker 2>source mentions nico building recipes with IFTTT, if this then

345
00:17:06.640 --> 00:17:10.640
<v Speaker 2>that to automate posting things like soccer scores to keep

346
00:17:10.640 --> 00:17:11.799
<v Speaker 2>a persona active.

347
00:17:12.039 --> 00:17:15.160
<v Speaker 1>That makes a lot of sense. Blend in to observe effectively,

348
00:17:15.200 --> 00:17:19.240
<v Speaker 1>don't raise red flags. Okay, let's move into part two

349
00:17:19.319 --> 00:17:23.720
<v Speaker 1>of the sources. This dives into specific OCENT touch points,

350
00:17:23.759 --> 00:17:26.680
<v Speaker 1>starting with something really fundamental. Search engines.

351
00:17:26.839 --> 00:17:30.880
<v Speaker 2>Yes, search engines absolutely central to OCENT they're versatile, they're free,

352
00:17:31.200 --> 00:17:33.480
<v Speaker 2>and often the first place you'll go on starting well

353
00:17:33.519 --> 00:17:34.759
<v Speaker 2>pretty much any investigation.

354
00:17:34.880 --> 00:17:37.640
<v Speaker 1>The mastering search engines is key, more so than fancy

355
00:17:37.680 --> 00:17:39.000
<v Speaker 1>tools sometimes definitely.

356
00:17:39.079 --> 00:17:41.960
<v Speaker 2>While specialized tools have their place, mastering how to use

357
00:17:41.960 --> 00:17:45.720
<v Speaker 2>search engines effectively is absolutely essential. Don't underestimate the basics.

358
00:17:45.759 --> 00:17:48.400
<v Speaker 1>The sources suggest using different search engines depending on what

359
00:17:48.440 --> 00:17:50.960
<v Speaker 1>you're looking for right, not just Google right.

360
00:17:51.400 --> 00:17:54.400
<v Speaker 2>Different search engines use different algorithms the index different parts

361
00:17:54.440 --> 00:17:56.960
<v Speaker 2>of the web, so for more targeted results, it helps

362
00:17:57.000 --> 00:18:00.160
<v Speaker 2>to use search engines popular in specific regions or languages.

363
00:18:00.240 --> 00:18:04.559
<v Speaker 2>Examples Bad is good for researching Chinese entities, yandex is

364
00:18:04.640 --> 00:18:07.799
<v Speaker 2>useful for Russian content. And a good tip is to

365
00:18:07.799 --> 00:18:10.480
<v Speaker 2>set your VPN to the region you're investigating. That can

366
00:18:10.519 --> 00:18:12.920
<v Speaker 2>sometimes give you more relevant local results.

367
00:18:13.319 --> 00:18:15.839
<v Speaker 1>How do you find out which search engine is popular somewhere?

368
00:18:16.400 --> 00:18:19.480
<v Speaker 2>The website similar web dot com for top dash websites

369
00:18:19.559 --> 00:18:23.559
<v Speaker 2>is a good resource for identifying popular sites, including search engines,

370
00:18:23.640 --> 00:18:24.920
<v Speaker 2>in a particular region.

371
00:18:25.119 --> 00:18:27.480
<v Speaker 1>Good tip. It's a good reminder that Google isn't the

372
00:18:27.519 --> 00:18:30.240
<v Speaker 1>only game in town, and the sources also kind of

373
00:18:30.240 --> 00:18:33.359
<v Speaker 1>push back against the idea that you always need specialized

374
00:18:33.400 --> 00:18:35.920
<v Speaker 1>tools to be great at ocent exactly.

375
00:18:36.480 --> 00:18:39.880
<v Speaker 2>While specialized tools can definitely be helpful, a strong understanding

376
00:18:39.920 --> 00:18:43.400
<v Speaker 2>of basic ocent techniques, especially how to use search engines

377
00:18:43.440 --> 00:18:46.599
<v Speaker 2>really well, is far more important. The Defcon story, Yeah,

378
00:18:46.680 --> 00:18:49.319
<v Speaker 2>the story about winning the Defcon twenty eight Missing Persons

379
00:18:49.359 --> 00:18:52.960
<v Speaker 2>Capture the Flag event using mostly basic ocent skills really

380
00:18:53.000 --> 00:18:53.480
<v Speaker 2>highlights this.

381
00:18:53.599 --> 00:18:56.240
<v Speaker 1>It's about the fundamentals, and that brings us to the

382
00:18:56.279 --> 00:19:01.319
<v Speaker 1>power of Google dorking. What are these advanced search operators?

383
00:19:01.400 --> 00:19:05.039
<v Speaker 2>How do they help Google doorking? It sounds funny, but

384
00:19:05.119 --> 00:19:09.079
<v Speaker 2>it's powerful. It involves using special commands and syntax within

385
00:19:09.119 --> 00:19:12.440
<v Speaker 2>the Google search bar to really narrow down your searches.

386
00:19:12.119 --> 00:19:13.880
<v Speaker 1>To find stuff you wouldn't normally find.

387
00:19:13.680 --> 00:19:16.400
<v Speaker 2>Exactly, find information that might not show up with simple

388
00:19:16.480 --> 00:19:20.880
<v Speaker 2>keyword searches. You can use operators like site to search

389
00:19:21.000 --> 00:19:24.680
<v Speaker 2>only within a specific website okay, or in title to

390
00:19:24.759 --> 00:19:27.720
<v Speaker 2>look for keywords just in the page title, or combine

391
00:19:27.799 --> 00:19:31.559
<v Speaker 2>keywords with terms like misconduct for business intelligence or specific

392
00:19:31.640 --> 00:19:33.799
<v Speaker 2>technology names for industrial intel.

393
00:19:33.920 --> 00:19:35.920
<v Speaker 1>So it's about being really precise, very.

394
00:19:35.799 --> 00:19:39.359
<v Speaker 2>Precise, filtering out the noise, pinpointing the information you actually need.

395
00:19:39.519 --> 00:19:41.559
<v Speaker 2>It's a core OCENT skill.

396
00:19:41.480 --> 00:19:45.519
<v Speaker 1>Got it, Okay. The next touchpoint explored is subject intelligence,

397
00:19:45.839 --> 00:19:48.000
<v Speaker 1>focusing on a person's digital footprint.

398
00:19:48.200 --> 00:19:52.240
<v Speaker 2>Yes, subject intelligence. It's fundamental because well, people are involved

399
00:19:52.240 --> 00:19:56.440
<v Speaker 2>in virtually everything. Right. It's about gathering and analyzing publicly

400
00:19:56.480 --> 00:20:00.680
<v Speaker 2>available information about an individual to get a comprehensive understanding

401
00:20:00.720 --> 00:20:03.720
<v Speaker 2>of them, who they are, what they do, who they know.

402
00:20:04.359 --> 00:20:07.759
<v Speaker 1>The sources give some really compelling examples, tracking the Boston

403
00:20:07.759 --> 00:20:09.920
<v Speaker 1>marathon bombing suspects.

404
00:20:09.640 --> 00:20:12.720
<v Speaker 2>Right, though there were issues with how Reddit handled that and.

405
00:20:12.640 --> 00:20:16.000
<v Speaker 1>How that executive's online activity led to the compromise of

406
00:20:16.240 --> 00:20:16.799
<v Speaker 1>HP Gary.

407
00:20:17.119 --> 00:20:20.319
<v Speaker 2>Yeah, those really highlight how much you can learn just

408
00:20:20.400 --> 00:20:25.200
<v Speaker 2>by analyzing someone's digital footprint, the good and the bad uses.

409
00:20:24.960 --> 00:20:27.799
<v Speaker 1>Which brings up legal and ethical stuff like privacy laws.

410
00:20:27.839 --> 00:20:31.400
<v Speaker 2>Absolutely crucial, especially with regulations like GDPR. You need to

411
00:20:31.400 --> 00:20:33.880
<v Speaker 2>stay on the right side of the law. Getting stakeholder

412
00:20:33.920 --> 00:20:36.799
<v Speaker 2>approval for subject intelligence is often recommended.

413
00:20:37.359 --> 00:20:40.039
<v Speaker 1>Now, the sources introduce this idea of pattern of life

414
00:20:40.079 --> 00:20:43.200
<v Speaker 1>analysis within subject intelligence. What does that involve?

415
00:20:43.240 --> 00:20:47.960
<v Speaker 2>Pattern of life analysis? It's about examining a person's regular activities,

416
00:20:47.960 --> 00:20:52.079
<v Speaker 2>their movements to understand their habits and behaviors online habits

417
00:20:52.440 --> 00:20:56.480
<v Speaker 2>in ocent. Yeah, it means using digital footprint data, social

418
00:20:56.519 --> 00:21:00.839
<v Speaker 2>media posts, location check ins, online activity patterns to figure

419
00:21:00.839 --> 00:21:03.960
<v Speaker 2>out when, where, and with whom a person interacts.

420
00:21:04.319 --> 00:21:06.559
<v Speaker 1>Like online surveillance, it's essentially.

421
00:21:06.160 --> 00:21:10.000
<v Speaker 2>The online version of traditional private investigator work. Yeah, and

422
00:21:10.039 --> 00:21:13.240
<v Speaker 2>it can even help you predict future actions sometimes or

423
00:21:13.400 --> 00:21:15.720
<v Speaker 2>confirm assumptions based on observed patterns.

424
00:21:15.759 --> 00:21:17.759
<v Speaker 1>The dark web marketplace example.

425
00:21:17.480 --> 00:21:21.279
<v Speaker 2>Right analyzing the owner's posting habits when they posted could

426
00:21:21.359 --> 00:21:24.759
<v Speaker 2>reveal clues about their time zone, maybe even their offline

427
00:21:24.759 --> 00:21:26.079
<v Speaker 2>activities or sleep schedule.

428
00:21:26.240 --> 00:21:27.839
<v Speaker 1>And the John Stewart example.

429
00:21:27.599 --> 00:21:30.640
<v Speaker 2>Analyzing his Twitter posting times using a tool like account

430
00:21:30.680 --> 00:21:34.119
<v Speaker 2>analysis dot app provides another concrete example of figuring out

431
00:21:34.119 --> 00:21:35.880
<v Speaker 2>patterns from public data.

432
00:21:35.519 --> 00:21:40.960
<v Speaker 1>When researching people. Names can be tricky different cultures, different conventions.

433
00:21:40.559 --> 00:21:44.079
<v Speaker 2>Absolutely, Like in China, someone might use several different names,

434
00:21:44.400 --> 00:21:48.200
<v Speaker 2>social names, married names, maybe a westernized name. In Russia,

435
00:21:48.319 --> 00:21:51.680
<v Speaker 2>Russian naming conventions include a given name, a patronymic based

436
00:21:51.720 --> 00:21:55.599
<v Speaker 2>on the father's first name, and a surname with gender variations.

437
00:21:56.240 --> 00:21:59.359
<v Speaker 2>Being aware of these cultural nuances is really important for

438
00:21:59.440 --> 00:22:04.160
<v Speaker 2>accurate idea identification. Don't assume Western naming conventions apply everywhere.

439
00:22:04.319 --> 00:22:07.039
<v Speaker 1>Usernames too, they can be really significant.

440
00:22:07.039 --> 00:22:11.359
<v Speaker 2>Pivot points, can't they hugely significant? People often reuse usernames

441
00:22:11.400 --> 00:22:12.920
<v Speaker 2>across different platforms.

442
00:22:12.960 --> 00:22:16.240
<v Speaker 1>Pn on example showed that right linking accounts across four

443
00:22:16.319 --> 00:22:17.359
<v Speaker 1>chan eight can.

444
00:22:17.200 --> 00:22:20.920
<v Speaker 2>Exactly Ron Watkins. Even if someone tries to stay anonymous

445
00:22:20.960 --> 00:22:23.799
<v Speaker 2>on one platform, if they use the same username somewhere else,

446
00:22:23.839 --> 00:22:26.359
<v Speaker 2>maybe on a less secure platform, it can reveal a lot.

447
00:22:26.680 --> 00:22:29.359
<v Speaker 1>So always start with a basic search for the username.

448
00:22:29.519 --> 00:22:32.279
<v Speaker 2>Always a good first step. Just plug the username into

449
00:22:32.279 --> 00:22:34.000
<v Speaker 2>a few search engines and see what pops up.

450
00:22:34.039 --> 00:22:36.920
<v Speaker 1>Email addresses are another key piece of data. What can

451
00:22:36.920 --> 00:22:38.160
<v Speaker 1>we get from an email address?

452
00:22:38.279 --> 00:22:40.680
<v Speaker 2>An email address can be a massive pivot point. It

453
00:22:40.680 --> 00:22:44.960
<v Speaker 2>can leads you to associated accounts, other usernames, potentially phone numbers,

454
00:22:45.039 --> 00:22:49.359
<v Speaker 2>even Google IDs. Google IDs, Yeah, Gmail accounts have a

455
00:22:49.440 --> 00:22:52.960
<v Speaker 2>unique Google ID link to them. This ID can sometimes

456
00:22:53.039 --> 00:22:56.039
<v Speaker 2>give you access to a user's publicly available data across

457
00:22:56.200 --> 00:23:01.920
<v Speaker 2>various Google services, maps, contributions, reviews, use photos uploaded wow,

458
00:23:02.039 --> 00:23:04.119
<v Speaker 2>and always check if an email address has shown up

459
00:23:04.119 --> 00:23:04.880
<v Speaker 2>in data breaches.

460
00:23:04.920 --> 00:23:08.279
<v Speaker 1>That can be very informative, which brings us to breach data.

461
00:23:08.759 --> 00:23:12.480
<v Speaker 1>How useful is information from data breaches seems risky?

462
00:23:12.599 --> 00:23:17.240
<v Speaker 2>Well, it's useful for the investigator, risky for the person breached. Unfortunately,

463
00:23:17.319 --> 00:23:19.119
<v Speaker 2>data breaches are incredibly common.

464
00:23:19.200 --> 00:23:20.759
<v Speaker 1>They seem to happen all the time, they.

465
00:23:20.599 --> 00:23:25.240
<v Speaker 2>Do, and they can expose huge amounts of user info. Emails, passwords,

466
00:23:25.279 --> 00:23:29.720
<v Speaker 2>often hash but sometimes cracked, usernames, IP addresses, real names.

467
00:23:29.839 --> 00:23:30.519
<v Speaker 1>How do you search it?

468
00:23:30.720 --> 00:23:34.079
<v Speaker 2>There are specialized search engines like intel X that index

469
00:23:34.200 --> 00:23:37.440
<v Speaker 2>data from numerous breaches. You can search for an email, username,

470
00:23:37.440 --> 00:23:40.559
<v Speaker 2>et cetera, and potentially link different pieces of information about

471
00:23:40.559 --> 00:23:42.119
<v Speaker 2>your subject from various leaks.

472
00:23:42.200 --> 00:23:43.400
<v Speaker 1>Could you find passwords?

473
00:23:43.720 --> 00:23:46.880
<v Speaker 2>Sometimes you might even find patterns in the types of

474
00:23:46.880 --> 00:23:50.519
<v Speaker 2>passwords someone uses across different breaches, which could help uncover

475
00:23:50.599 --> 00:23:54.839
<v Speaker 2>additional accounts or email addresses they use. People reuse passwords a.

476
00:23:54.759 --> 00:23:59.319
<v Speaker 1>Lot, risky habit Okay. Phone numbers another potential data point,

477
00:23:59.559 --> 00:24:01.519
<v Speaker 1>but the verse is to say they can be inaccurate.

478
00:24:01.680 --> 00:24:05.480
<v Speaker 2>They can indeed be unreliable. Numbers get reassigned, people use

479
00:24:05.519 --> 00:24:08.480
<v Speaker 2>burners or VoIP numbers, so it's always best to try

480
00:24:08.480 --> 00:24:10.880
<v Speaker 2>and verify a phone number using multiple sources.

481
00:24:11.000 --> 00:24:11.880
<v Speaker 1>Cross referencing.

482
00:24:12.079 --> 00:24:15.759
<v Speaker 2>Yeah, the story about verifying a foreign national's identity by

483
00:24:15.799 --> 00:24:19.359
<v Speaker 2>cross referencing their landline number with their wife's info found

484
00:24:19.359 --> 00:24:23.279
<v Speaker 2>in public records databases that's a perfect real world example

485
00:24:23.319 --> 00:24:23.960
<v Speaker 2>of confirmation.

486
00:24:24.440 --> 00:24:28.400
<v Speaker 1>Finally, for subject intelligence, public records, what kind of gold

487
00:24:28.400 --> 00:24:30.119
<v Speaker 1>can we find there? And what are the challenges?

488
00:24:30.279 --> 00:24:34.039
<v Speaker 2>Public records can be an absolute gold mine. Voter registration details,

489
00:24:34.079 --> 00:24:37.839
<v Speaker 2>local city and county records, permits, licenses, property.

490
00:24:37.400 --> 00:24:39.400
<v Speaker 1>Records, but access varies hugely.

491
00:24:39.480 --> 00:24:42.960
<v Speaker 2>Access varies wildly depending on where you are. Voter registration

492
00:24:43.039 --> 00:24:47.319
<v Speaker 2>info different rules in Florida VERSUS, say California local records.

493
00:24:47.640 --> 00:24:51.160
<v Speaker 2>Some cities make it easy, others require specific info. Property

494
00:24:51.200 --> 00:24:54.839
<v Speaker 2>records often found on county websites or secondary sources like

495
00:24:54.920 --> 00:24:57.240
<v Speaker 2>Zilo and Trulia can have cashed or related info.

496
00:24:57.680 --> 00:24:58.319
<v Speaker 1>They can give you.

497
00:24:58.279 --> 00:25:02.799
<v Speaker 2>Addresses, ownership details, sometimes even things like security system permits.

498
00:25:02.880 --> 00:25:04.240
<v Speaker 1>International differences too.

499
00:25:04.240 --> 00:25:08.960
<v Speaker 2>Absolutely, Data protection laws very significantly country by country. Francis

500
00:25:09.039 --> 00:25:12.240
<v Speaker 2>CNIL is very different from US regulations. There are even

501
00:25:12.279 --> 00:25:15.039
<v Speaker 2>maps showing data protection levels globally. You need to be

502
00:25:15.079 --> 00:25:17.599
<v Speaker 2>aware of the laws where the data resides and where

503
00:25:17.599 --> 00:25:18.680
<v Speaker 2>your subject resides.

504
00:25:18.720 --> 00:25:21.920
<v Speaker 1>So you canbine official records with maybe unofficial stuff.

505
00:25:21.960 --> 00:25:26.160
<v Speaker 2>Exactly, you combine and enriched data from official documents, maybe

506
00:25:26.160 --> 00:25:29.720
<v Speaker 2>social media news articles. The pivot shart example, starting with

507
00:25:29.799 --> 00:25:32.039
<v Speaker 2>just a subject's name shows how you build out that

508
00:25:32.119 --> 00:25:33.599
<v Speaker 2>picture layer by layer.

509
00:25:33.680 --> 00:25:37.119
<v Speaker 1>Okay, that covers a lot on subject intelligence. Moving on

510
00:25:37.400 --> 00:25:42.039
<v Speaker 1>the next big area, social media analysis. This seems massive

511
00:25:42.079 --> 00:25:43.200
<v Speaker 1>and constantly changing.

512
00:25:43.440 --> 00:25:46.480
<v Speaker 2>It is. Social media platforms are just incredibly rich sources

513
00:25:46.480 --> 00:25:50.640
<v Speaker 2>of ocent data. They show connections between people, organizations, give

514
00:25:50.680 --> 00:25:55.039
<v Speaker 2>insights into routines, locations, and often reveal other online accounts.

515
00:25:55.079 --> 00:25:56.200
<v Speaker 2>You can pivot from.

516
00:25:56.319 --> 00:26:00.960
<v Speaker 1>The sources highlight correlating user accounts. What are the key

517
00:26:01.039 --> 00:26:04.079
<v Speaker 1>things to look for when linking different profiles to the

518
00:26:04.119 --> 00:26:04.799
<v Speaker 1>same person.

519
00:26:05.119 --> 00:26:07.519
<v Speaker 2>When you're trying to connect social media accounts, you look

520
00:26:07.559 --> 00:26:11.119
<v Speaker 2>for consistency shared usernames across platforms.

521
00:26:11.160 --> 00:26:11.880
<v Speaker 1>That's a big one.

522
00:26:12.279 --> 00:26:17.319
<v Speaker 2>Identical or very similar profile photos, also patterns of interaction

523
00:26:17.799 --> 00:26:20.880
<v Speaker 2>accounts that frequently like or comment on each other's posts

524
00:26:21.119 --> 00:26:23.279
<v Speaker 2>that might suggest they're run by the same person or

525
00:26:23.279 --> 00:26:24.680
<v Speaker 2>people who are closely connected.

526
00:26:24.839 --> 00:26:28.799
<v Speaker 1>The fbik study tracking the George Floyd protest suspect through

527
00:26:28.920 --> 00:26:34.759
<v Speaker 1>Etsy poshmark LinkedIn that was powerful username and profile photo.

528
00:26:34.519 --> 00:26:38.519
<v Speaker 2>Pivots a perfect example. Following those digital breadcrumbs across different,

529
00:26:38.559 --> 00:26:43.119
<v Speaker 2>seemingly unrelated platforms ultimately leading to identification, even confirming a

530
00:26:43.119 --> 00:26:44.880
<v Speaker 2>tattoo from a profile picture and.

531
00:26:44.839 --> 00:26:47.160
<v Speaker 1>Once you have multiple accounts, maybe in a group, how

532
00:26:47.200 --> 00:26:52.000
<v Speaker 1>do you visualize those connections? Association matrices and link analysis charts.

533
00:26:52.119 --> 00:26:55.480
<v Speaker 2>Yeah, those are really useful for visualizing relationships within a group.

534
00:26:55.480 --> 00:26:58.759
<v Speaker 2>And association matrix is basically a table showing how strongly

535
00:26:58.799 --> 00:26:59.599
<v Speaker 2>different people are.

536
00:26:59.480 --> 00:27:02.200
<v Speaker 1>Connected based on followers or interactions.

537
00:27:01.839 --> 00:27:05.480
<v Speaker 2>Exactly shared followers, frequency of interaction, things like that, and

538
00:27:05.519 --> 00:27:08.759
<v Speaker 2>then you can turn that data into a link analysis.

539
00:27:08.279 --> 00:27:09.519
<v Speaker 1>Chart using tools.

540
00:27:09.720 --> 00:27:14.039
<v Speaker 2>Using tools like it Maltago or even simpler mind mapping software,

541
00:27:14.440 --> 00:27:17.039
<v Speaker 2>these visuals make it much easier to see who the

542
00:27:17.119 --> 00:27:20.359
<v Speaker 2>key players are in a network, who the influencers are,

543
00:27:20.559 --> 00:27:21.480
<v Speaker 2>how they're connected.

544
00:27:21.960 --> 00:27:25.440
<v Speaker 1>The ability to continuously monitor communities on social media is

545
00:27:25.480 --> 00:27:29.440
<v Speaker 1>also discussed. The analysis after the January sixth Capitol riot

546
00:27:29.799 --> 00:27:35.200
<v Speaker 1>groups like Bellingcat using osand image analysis. Incredible work shows.

547
00:27:34.960 --> 00:27:37.319
<v Speaker 2>The real power of it, doesn't it, But monitoring groups,

548
00:27:37.440 --> 00:27:39.559
<v Speaker 2>especially private ones, definitely has its challenges.

549
00:27:39.640 --> 00:27:41.119
<v Speaker 1>How do you get into private groups?

550
00:27:41.319 --> 00:27:44.559
<v Speaker 2>Well, you can directly observe open groups easily enough, but

551
00:27:44.799 --> 00:27:47.400
<v Speaker 2>for private ones like on Facebook, you often need those

552
00:27:47.400 --> 00:27:48.240
<v Speaker 2>sock puppet accounts.

553
00:27:48.279 --> 00:27:50.240
<v Speaker 1>We talked about fake profiles, right.

554
00:27:50.279 --> 00:27:52.599
<v Speaker 2>Accounts designed to blend in with the group's interests to

555
00:27:52.640 --> 00:27:57.119
<v Speaker 2>gain access without raising suspicion. Telegram also has its own ecosystem.

556
00:27:57.279 --> 00:27:59.920
<v Speaker 2>There are platforms like tgs dot dot com that can

557
00:28:00.000 --> 00:28:02.680
<v Speaker 2>atalog public channels and provide spats, which can be useful

558
00:28:02.720 --> 00:28:03.440
<v Speaker 2>starting points.

559
00:28:03.680 --> 00:28:07.720
<v Speaker 1>Beyond text, image in video analysis is critical. What can

560
00:28:07.799 --> 00:28:08.640
<v Speaker 1>visuals tell us?

561
00:28:08.960 --> 00:28:12.319
<v Speaker 2>Oh a lot? Analyzing images and videos can give you

562
00:28:12.519 --> 00:28:15.319
<v Speaker 2>the location where they were taken, details about what's happening,

563
00:28:15.400 --> 00:28:18.599
<v Speaker 2>who's there, what objects are present, even clues to help

564
00:28:18.640 --> 00:28:21.480
<v Speaker 2>figure out who owns the media or find related accounts.

565
00:28:21.799 --> 00:28:25.160
<v Speaker 1>Reverse image searching seems key here using an image to

566
00:28:25.200 --> 00:28:26.119
<v Speaker 1>search online.

567
00:28:26.400 --> 00:28:30.079
<v Speaker 2>Yes, reverse image searching is a fundamental technique. You upload

568
00:28:30.119 --> 00:28:32.799
<v Speaker 2>an image or its URL to a search engine and

569
00:28:32.880 --> 00:28:35.000
<v Speaker 2>it tries to find similar images online.

570
00:28:35.079 --> 00:28:35.880
<v Speaker 1>Why is it useful?

571
00:28:35.920 --> 00:28:38.119
<v Speaker 2>It can often reveal the original source of an image,

572
00:28:38.200 --> 00:28:42.079
<v Speaker 2>other places it's been posted, maybe higher resolution versions, or

573
00:28:42.160 --> 00:28:45.880
<v Speaker 2>even identify objects or people within the image. The case

574
00:28:45.920 --> 00:28:48.759
<v Speaker 2>study about identifying a sports logo and a fundraiser photo

575
00:28:48.839 --> 00:28:49.519
<v Speaker 2>is a good.

576
00:28:49.319 --> 00:28:51.319
<v Speaker 1>Example which search engines are best for this.

577
00:28:51.920 --> 00:28:55.119
<v Speaker 2>The main ones are Google Images, Bing, Visual search and

578
00:28:55.200 --> 00:28:58.279
<v Speaker 2>yandex Images is often very good, especially for faces or

579
00:28:58.319 --> 00:29:02.480
<v Speaker 2>locations in Eastern Europe. Well, you might need patients. You

580
00:29:02.480 --> 00:29:04.720
<v Speaker 2>can get a lot of results to sift through, and

581
00:29:04.759 --> 00:29:07.440
<v Speaker 2>it doesn't always work perfectly on all social media platforms

582
00:29:07.519 --> 00:29:10.519
<v Speaker 2>due to how they handle images, but it's always worth trying.

583
00:29:10.720 --> 00:29:15.400
<v Speaker 1>The sources also go into geolocation of images, figuring out

584
00:29:15.440 --> 00:29:17.519
<v Speaker 1>where a photo or video was taken. How do we

585
00:29:17.559 --> 00:29:17.880
<v Speaker 1>do that?

586
00:29:18.279 --> 00:29:21.440
<v Speaker 2>Gelocation is like being a visual detective. You look for

587
00:29:21.599 --> 00:29:25.440
<v Speaker 2>clues within the image itself, like what language on signs.

588
00:29:25.480 --> 00:29:30.000
<v Speaker 2>Seeing ditch text might suggest the Netherlands or Belgium or

589
00:29:30.000 --> 00:29:34.559
<v Speaker 2>maybe South Africa, or surname, unique buildings, landmarks, mountains, types

590
00:29:34.599 --> 00:29:36.359
<v Speaker 2>of vegetation, road signs.

591
00:29:36.160 --> 00:29:39.279
<v Speaker 1>The road sign example, planes or plans right.

592
00:29:39.279 --> 00:29:42.119
<v Speaker 2>That specific clue could help narrow it down significantly. Once

593
00:29:42.119 --> 00:29:45.440
<v Speaker 2>you have a general region, then you use online mapping.

594
00:29:45.119 --> 00:29:46.920
<v Speaker 1>Tools Google street View.

595
00:29:46.799 --> 00:29:51.160
<v Speaker 2>Google street View is huge, Wikimapia, panoramio though partly archived,

596
00:29:51.480 --> 00:29:54.880
<v Speaker 2>Mappillari earthcam for live webcams live on map dot com

597
00:29:54.920 --> 00:29:57.279
<v Speaker 2>for conflict zones, and you use these tools to try

598
00:29:57.319 --> 00:29:59.240
<v Speaker 2>and match the visual clues from the image to a

599
00:29:59.279 --> 00:30:02.559
<v Speaker 2>real world. There's a whole step by step process involved.

600
00:30:02.240 --> 00:30:04.319
<v Speaker 1>And sometimes the clues are hidden in the file itself.

601
00:30:04.480 --> 00:30:10.400
<v Speaker 2>Metadata exactly metadata specifically exif data for images can embed

602
00:30:10.480 --> 00:30:11.960
<v Speaker 2>information right into.

603
00:30:11.799 --> 00:30:14.160
<v Speaker 1>The file like GPS coordinates.

604
00:30:13.680 --> 00:30:17.599
<v Speaker 2>Sometimes yes, GPS coordinates showing exactly where the photo was taken,

605
00:30:18.039 --> 00:30:21.000
<v Speaker 2>also the date and time, camera model, phone.

606
00:30:20.759 --> 00:30:21.960
<v Speaker 1>Type, how do you see it?

607
00:30:22.000 --> 00:30:26.160
<v Speaker 2>There are online tools like Jeffrey's exifuere or browser extensions

608
00:30:26.240 --> 00:30:29.680
<v Speaker 2>or desktop software that can extract this data.

609
00:30:29.759 --> 00:30:30.680
<v Speaker 1>That it can be faked.

610
00:30:30.759 --> 00:30:34.759
<v Speaker 2>Absolutely, metadata can be easily stripped out or deliberately changed,

611
00:30:35.200 --> 00:30:37.759
<v Speaker 2>So treat it as a clue, but always try to

612
00:30:37.880 --> 00:30:40.599
<v Speaker 2>verify it with other evidence if possible. Don't take it

613
00:30:40.640 --> 00:30:42.440
<v Speaker 2>as absolute gospel makes sense.

614
00:30:42.559 --> 00:30:45.319
<v Speaker 1>Then there's attribution. Figuring out who owns the photo or video.

615
00:30:45.519 --> 00:30:48.839
<v Speaker 2>Yeah, trying to identify the original creator or owner of

616
00:30:48.880 --> 00:30:52.359
<v Speaker 2>the media and potentially other accounts they might have. Reverse

617
00:30:52.440 --> 00:30:54.960
<v Speaker 2>image search can help here, trying to find the earliest

618
00:30:55.000 --> 00:30:56.960
<v Speaker 2>instance or associated profiles.

619
00:30:57.039 --> 00:31:01.960
<v Speaker 1>Social media is also full of bad information, misinformation, disinformation, malinformation.

620
00:31:02.279 --> 00:31:06.720
<v Speaker 2>Yes, understanding that spectrum is important. Misinformation is false but

621
00:31:06.839 --> 00:31:10.920
<v Speaker 2>not necessarily intended to harm. Disinformation is false and intended

622
00:31:10.960 --> 00:31:13.839
<v Speaker 2>to harm. Malinformation is based on truth but used out

623
00:31:13.880 --> 00:31:18.359
<v Speaker 2>of context to harm. Examples oh Pizzagate, celebrity death, hooxes,

624
00:31:18.799 --> 00:31:24.039
<v Speaker 2>false vaccine, claims wild five G conspiracy theories. Debunking these

625
00:31:24.079 --> 00:31:28.279
<v Speaker 2>often involves ocent techniques like what a verification process, asking

626
00:31:28.480 --> 00:31:31.039
<v Speaker 2>who shared it, what's the source, why was it shared?

627
00:31:31.079 --> 00:31:34.359
<v Speaker 2>How is it created? Using tools like archive dot org

628
00:31:34.440 --> 00:31:37.799
<v Speaker 2>to see past versions of websites, doing reverse image searches

629
00:31:37.839 --> 00:31:40.920
<v Speaker 2>to check the photo's origin. It's about critical examination.

630
00:31:41.319 --> 00:31:46.640
<v Speaker 1>Social network analysis another powerful technique mentioned using graph theory sounds.

631
00:31:46.279 --> 00:31:48.880
<v Speaker 2>Complex it can be, but the basic idea is simple.

632
00:31:48.960 --> 00:31:52.279
<v Speaker 2>It uses concepts from graph theory like nodes representing people

633
00:31:52.359 --> 00:31:56.440
<v Speaker 2>or accounts and edges representing their connections, to visualized relationships

634
00:31:56.480 --> 00:31:59.319
<v Speaker 2>like a map of connections exactly. And you can even

635
00:31:59.359 --> 00:32:01.319
<v Speaker 2>show the stres length of a connection, maybe by the

636
00:32:01.319 --> 00:32:03.880
<v Speaker 2>thickness or color of the edge the line maure nodes.

637
00:32:03.920 --> 00:32:04.920
<v Speaker 1>How tools do you use?

638
00:32:05.160 --> 00:32:09.079
<v Speaker 2>Tools like neo forge or Giffi are popular for creating

639
00:32:09.079 --> 00:32:12.160
<v Speaker 2>these network visualizations. They make it much easier to identify

640
00:32:12.279 --> 00:32:16.200
<v Speaker 2>key influencers see how information spreads, spot clusters or communities.

641
00:32:16.440 --> 00:32:19.559
<v Speaker 1>The example of Benjamin Strick analyzing the pro Indonesian bot

642
00:32:19.680 --> 00:32:21.880
<v Speaker 1>network on Twitter using Giffi a.

643
00:32:21.839 --> 00:32:26.680
<v Speaker 2>Perfect example of visualizing complex networks to uncover coordinated activity.

644
00:32:26.839 --> 00:32:29.519
<v Speaker 1>And the puppy scam case study that really tied a

645
00:32:29.559 --> 00:32:34.240
<v Speaker 1>lot of these threads together. Google dorking, pivot charts, whis

646
00:32:34.400 --> 00:32:38.160
<v Speaker 1>data uncovering that whole network of fake websites linked by

647
00:32:38.240 --> 00:32:39.759
<v Speaker 1>one email address.

648
00:32:39.559 --> 00:32:42.000
<v Speaker 2>Right Jane Do at gmail dot com. It's a great

649
00:32:42.039 --> 00:32:44.759
<v Speaker 2>example of how different OCENT techniques work together in a

650
00:32:44.799 --> 00:32:49.440
<v Speaker 2>real investigation, starting broad finding, pivot points, layering information.

651
00:32:49.680 --> 00:32:53.880
<v Speaker 1>Okay, let's move on to business and organizational intelligence. Why

652
00:32:53.960 --> 00:32:56.839
<v Speaker 1>is understanding companies and organizations so important?

653
00:32:57.039 --> 00:33:00.680
<v Speaker 2>Well? Understanding these entities, their structure, ownership, back activities is

654
00:33:00.759 --> 00:33:04.960
<v Speaker 2>crucial for so many things due diligence for investments, competitive intelligence,

655
00:33:05.000 --> 00:33:08.559
<v Speaker 2>tracking supply chains, investigating fraud or other illegal activities.

656
00:33:08.640 --> 00:33:11.799
<v Speaker 1>The wire Kurt fraud example. Dan mccrumb's OSID.

657
00:33:11.519 --> 00:33:14.799
<v Speaker 2>Work a prime example of how impactful OCENT can be

658
00:33:14.920 --> 00:33:19.400
<v Speaker 2>in uncovering massive corporate fraud. It shows this isn't just theoretical.

659
00:33:20.240 --> 00:33:22.359
<v Speaker 1>So what are some key things we look at when

660
00:33:22.400 --> 00:33:27.960
<v Speaker 1>analyzing an organization structure? Seems important? Parent companies, subsidiaries.

661
00:33:28.200 --> 00:33:31.559
<v Speaker 2>Yes, Understanding the corporate structure is fundamental. Who owns whom?

662
00:33:31.759 --> 00:33:34.799
<v Speaker 2>Where are the branches? Seeing this visually like in an

663
00:33:34.920 --> 00:33:37.000
<v Speaker 2>org chart, if you can find or build one is

664
00:33:37.079 --> 00:33:37.720
<v Speaker 2>really helpful.

665
00:33:37.839 --> 00:33:38.240
<v Speaker 1>We els.

666
00:33:38.319 --> 00:33:42.839
<v Speaker 2>You also look at key people, executives, board members, locations,

667
00:33:42.920 --> 00:33:47.200
<v Speaker 2>financial health, if possible, partners, main products or services, building

668
00:33:47.279 --> 00:33:48.440
<v Speaker 2>a complete profile.

669
00:33:49.000 --> 00:33:51.759
<v Speaker 1>Publicly available documents seem like a huge resource here, What

670
00:33:51.799 --> 00:33:52.799
<v Speaker 1>are the most important ones?

671
00:33:52.920 --> 00:33:56.039
<v Speaker 2>They really are. Annual reports give you a great broad

672
00:33:56.079 --> 00:33:58.880
<v Speaker 2>overview of companies' activities over the past year.

673
00:33:58.839 --> 00:34:01.839
<v Speaker 1>For public companies in the USA, SEC filings exactly.

674
00:34:02.160 --> 00:34:05.079
<v Speaker 2>For US public companies, forms like the ten K, the

675
00:34:05.079 --> 00:34:08.320
<v Speaker 2>Big Annual Report, ten Q quarterly, and eight K for

676
00:34:08.400 --> 00:34:11.880
<v Speaker 2>significant events like mergers or leadership changes are essential.

677
00:34:11.920 --> 00:34:13.119
<v Speaker 1>Where do you find them.

678
00:34:13.039 --> 00:34:17.880
<v Speaker 2>On the SEC's EDGR database. They contain incredibly detailed financial

679
00:34:17.880 --> 00:34:23.079
<v Speaker 2>and operational information. Other filings like proxy statements for shareholder

680
00:34:23.159 --> 00:34:25.480
<v Speaker 2>votes and S one forms when a company plans to

681
00:34:25.519 --> 00:34:27.199
<v Speaker 2>go public are also valuable.

682
00:34:27.519 --> 00:34:30.920
<v Speaker 1>Social media isn't just for people, right, Companies use it too.

683
00:34:31.280 --> 00:34:32.280
<v Speaker 1>How can we leverage that?

684
00:34:32.559 --> 00:34:38.880
<v Speaker 2>Definitely? Organizations use social media heavily for marketing, pr, customer communication, recruitment,

685
00:34:38.920 --> 00:34:41.159
<v Speaker 2>announcing partnerships, events, So.

686
00:34:41.079 --> 00:34:44.159
<v Speaker 1>We can use the same tactics as subject intelligence pretty much.

687
00:34:44.239 --> 00:34:47.360
<v Speaker 2>Yeah, you can use similar techniques to find an organization's

688
00:34:47.440 --> 00:34:50.199
<v Speaker 2>various social media accounts. They often link them from their

689
00:34:50.239 --> 00:34:54.079
<v Speaker 2>main website. Analyzing their posts, who they follow, who follows them.

690
00:34:54.440 --> 00:34:58.639
<v Speaker 2>It can reveal activities, partnerships, key employees, sometimes even information

691
00:34:58.840 --> 00:35:02.119
<v Speaker 2>not intended to be public. Tesla's Twitter account is mentioned

692
00:35:02.119 --> 00:35:03.440
<v Speaker 2>as a potential pivoting point.

693
00:35:03.760 --> 00:35:06.760
<v Speaker 1>The sources also mentioned violation trackers. What are those?

694
00:35:06.920 --> 00:35:10.480
<v Speaker 2>Violation trackers are databases often run by government agencies or

695
00:35:10.519 --> 00:35:14.400
<v Speaker 2>watchdog groups that keep records of legal actions, fines penalties

696
00:35:14.440 --> 00:35:16.559
<v Speaker 2>against companies and sometimes individuals.

697
00:35:16.840 --> 00:35:18.639
<v Speaker 1>Useful for due diligence, very.

698
00:35:18.559 --> 00:35:21.280
<v Speaker 2>Useful helps you identify if a company have a history

699
00:35:21.320 --> 00:35:28.119
<v Speaker 2>of misconduct, safety violations, environmental issues, discrimination, lawsuits. Things like

700
00:35:28.159 --> 00:35:32.440
<v Speaker 2>the contractor misconduct database or violation tracker. The Fair Noose

701
00:35:32.519 --> 00:35:35.480
<v Speaker 2>case is mentioned as an example of corporate wrongdoing.

702
00:35:35.880 --> 00:35:39.400
<v Speaker 1>Contracts seem like another area ripe for osand what can

703
00:35:39.440 --> 00:35:41.199
<v Speaker 1>we learn from public contracts?

704
00:35:41.280 --> 00:35:45.400
<v Speaker 2>Publicly available contracts, often found on government procurement websites like

705
00:35:45.440 --> 00:35:48.719
<v Speaker 2>sam dot gov in the US, can be incredibly revealing.

706
00:35:48.840 --> 00:35:50.239
<v Speaker 1>What kind of details, who the.

707
00:35:50.199 --> 00:35:53.920
<v Speaker 2>Main contractor is, who the subcontractors are, the specific services

708
00:35:53.960 --> 00:35:59.079
<v Speaker 2>or products being provided, maybe the technology involved, project timelines, costs,

709
00:35:59.239 --> 00:36:03.400
<v Speaker 2>sometimes contact info, even supporting documents like blueprints or plans, occasionally.

710
00:36:03.719 --> 00:36:06.559
<v Speaker 2>The soil hauling for Yosemite Park example shows the level

711
00:36:06.559 --> 00:36:07.760
<v Speaker 2>of detail you might find.

712
00:36:08.039 --> 00:36:10.519
<v Speaker 1>Understanding contract jargon helps too, Definitely.

713
00:36:10.840 --> 00:36:15.800
<v Speaker 2>Knowing terms like contractor subcontractor purchase order RFP request for

714
00:36:15.840 --> 00:36:18.159
<v Speaker 2>proposal helps you make sense of the documents.

715
00:36:18.159 --> 00:36:21.599
<v Speaker 1>Power mapping sounds intriguing figuring out influence through investments and

716
00:36:21.679 --> 00:36:23.000
<v Speaker 1>donations exactly.

717
00:36:23.320 --> 00:36:27.760
<v Speaker 2>Power mapping involves identifying key individuals and organizations and then

718
00:36:27.920 --> 00:36:33.239
<v Speaker 2>analyzing their connections through things like investments, campaign donations, board memberships,

719
00:36:33.360 --> 00:36:35.159
<v Speaker 2>lobbying activities.

720
00:36:34.639 --> 00:36:35.920
<v Speaker 1>To reveal hidden influence.

721
00:36:36.159 --> 00:36:39.599
<v Speaker 2>Yeah, it can help reveal political affiliations, links to super

722
00:36:39.639 --> 00:36:43.119
<v Speaker 2>PACs or think tanks, and other relationships that might influence

723
00:36:43.199 --> 00:36:47.679
<v Speaker 2>decisions or policies. The tool Little Messis is mentioned for this.

724
00:36:48.000 --> 00:36:51.320
<v Speaker 2>The twenty nineteen college admission scandal is a related example

725
00:36:51.360 --> 00:36:53.199
<v Speaker 2>of mapping influence and money.

726
00:36:53.400 --> 00:36:57.000
<v Speaker 1>The sources also touch on spotting shell companies. What are

727
00:36:57.039 --> 00:36:57.719
<v Speaker 1>the red flags?

728
00:36:57.800 --> 00:37:01.559
<v Speaker 2>Shell companies, often used to obscure ownership or facilitate illicit

729
00:37:01.679 --> 00:37:05.440
<v Speaker 2>activities like money laundering, tend to have certain characteristics. No

730
00:37:05.519 --> 00:37:08.159
<v Speaker 2>real physical address, maybe just a PO box or a

731
00:37:08.239 --> 00:37:11.400
<v Speaker 2>mail drop. Often they use a registered agent address that's

732
00:37:11.400 --> 00:37:14.400
<v Speaker 2>shared by hundreds or thousands of other companies very little

733
00:37:14.400 --> 00:37:16.239
<v Speaker 2>public presence or operational activity.

734
00:37:16.400 --> 00:37:20.039
<v Speaker 1>Sanctions are another p area, especially internationally. How does OSEND

735
00:37:20.159 --> 00:37:20.599
<v Speaker 1>help here?

736
00:37:20.840 --> 00:37:24.000
<v Speaker 2>Monitoring sanctions lists like the OFACSDN list in the US

737
00:37:24.079 --> 00:37:28.519
<v Speaker 2>is crucial for compliance and risk assessment. OSEND helps provide

738
00:37:28.519 --> 00:37:30.400
<v Speaker 2>context around the sanctions.

739
00:37:30.079 --> 00:37:32.400
<v Speaker 1>Why was they imposed, who else is involved.

740
00:37:32.039 --> 00:37:35.559
<v Speaker 2>Exactly, identifying all the parties involved, understanding the patterns of

741
00:37:35.559 --> 00:37:38.559
<v Speaker 2>activity that led to the sanction like ilicit oil transfers

742
00:37:38.599 --> 00:37:41.159
<v Speaker 2>mentioned as an example, and tracking historical contexts.

743
00:37:41.280 --> 00:37:44.719
<v Speaker 1>Nonprofit organizations also have public data right form nine ninety

744
00:37:44.719 --> 00:37:45.639
<v Speaker 1>in the US. That's right.

745
00:37:45.840 --> 00:37:49.480
<v Speaker 2>In the US, nonprofits generally have to file an IRS

746
00:37:49.599 --> 00:37:53.159
<v Speaker 2>form nine ninety annually. It contains a wealth of financial

747
00:37:53.159 --> 00:37:58.559
<v Speaker 2>and operational data, revenue expenses, salaries of top executive program activities.

748
00:37:58.639 --> 00:37:59.440
<v Speaker 1>How do you find those?

749
00:37:59.639 --> 00:38:03.360
<v Speaker 2>There are online tools like Republica's Nonprofit Explore or Candid's

750
00:38:03.400 --> 00:38:06.039
<v Speaker 2>nine to ninety finder that make searching and accessing these

751
00:38:06.079 --> 00:38:07.039
<v Speaker 2>forms pretty easy.

752
00:38:07.199 --> 00:38:11.079
<v Speaker 1>Finally, for business intelligence, the website itself loads of OSUM data.

753
00:38:11.159 --> 00:38:14.639
<v Speaker 2>There absolutely a company's website is a primary source. You

754
00:38:14.679 --> 00:38:19.519
<v Speaker 2>analyze its IP address, its domain name, registration, whois records

755
00:38:19.599 --> 00:38:23.840
<v Speaker 2>via registrars like I can the actual content, the underlying

756
00:38:23.880 --> 00:38:27.760
<v Speaker 2>code and metadata. Tools for website analysis, tools like build

757
00:38:27.800 --> 00:38:31.719
<v Speaker 2>with can tell you what technologies a website uses, CMS, analytics,

758
00:38:31.800 --> 00:38:35.559
<v Speaker 2>advertising networks, et cetera. Browser developer tools let you inspect

759
00:38:35.599 --> 00:38:38.519
<v Speaker 2>the code. Commandling tools like CURL can fetch.

760
00:38:38.320 --> 00:38:40.079
<v Speaker 1>Headers and source code hidden info.

761
00:38:40.440 --> 00:38:44.320
<v Speaker 2>Sometimes you can find hidden information in website metadata or

762
00:38:44.360 --> 00:38:49.360
<v Speaker 2>accidentally exposed files, maybe old spreadsheets, internal documents, printer names.

763
00:38:49.719 --> 00:38:50.679
<v Speaker 2>You have to look carefully.

764
00:38:50.800 --> 00:38:53.679
<v Speaker 1>Robots dot txt and sitemap dot xml.

765
00:38:53.880 --> 00:38:56.440
<v Speaker 2>Yeah, looking at the robots dot txt file tells you

766
00:38:56.519 --> 00:38:58.559
<v Speaker 2>what parts of the site the owners don't want search

767
00:38:58.599 --> 00:39:02.199
<v Speaker 2>engines to crawl, which can sometimes be interesting. The sitemap

768
00:39:02.239 --> 00:39:06.199
<v Speaker 2>doxml gives you a list of intended public pages. Analyzing

769
00:39:06.280 --> 00:39:10.239
<v Speaker 2>DNS records using tools like mx toolbox provides info about

770
00:39:10.239 --> 00:39:14.199
<v Speaker 2>mail servers IP addresses associated with the domain. It all

771
00:39:14.239 --> 00:39:15.039
<v Speaker 2>builds the picture.

772
00:39:15.239 --> 00:39:17.679
<v Speaker 1>Even understanding basic IP addresses is helpful.

773
00:39:17.719 --> 00:39:21.199
<v Speaker 2>Definitely knowing how the Internet routes information via IP addresses

774
00:39:21.239 --> 00:39:21.920
<v Speaker 2>is fundamental.

775
00:39:22.000 --> 00:39:25.119
<v Speaker 1>That's a really thorough look at business and organizational intel.

776
00:39:25.679 --> 00:39:29.960
<v Speaker 1>Let's switch gears now to transportation intelligence. Seems very practical,

777
00:39:30.239 --> 00:39:31.079
<v Speaker 1>very real world.

778
00:39:31.320 --> 00:39:36.920
<v Speaker 2>It really is transportation, c rail, air road. It's the

779
00:39:36.960 --> 00:39:41.480
<v Speaker 2>backbone of global trade and movement. Being able to track, predict,

780
00:39:41.639 --> 00:39:47.400
<v Speaker 2>or gather intel on transport can provide valuable data for logistics, security, spotting,

781
00:39:47.440 --> 00:39:49.679
<v Speaker 2>illicit activity, you name it.

782
00:39:49.760 --> 00:39:52.280
<v Speaker 1>Satellite imagery plays a big role here, doesn't.

783
00:39:52.079 --> 00:39:56.280
<v Speaker 2>It a huge role? Satellites are used for mapping, weather forecasting,

784
00:39:56.440 --> 00:39:59.599
<v Speaker 2>environmental monitoring, and of course, intelligence gathering.

785
00:40:00.039 --> 00:40:01.239
<v Speaker 1>Types of satellites.

786
00:40:00.840 --> 00:40:05.239
<v Speaker 2>Broadly two main types for imaging. Geostationary satellites stay fixed

787
00:40:05.280 --> 00:40:08.039
<v Speaker 2>over one spot on the equator. They give you frequent

788
00:40:08.119 --> 00:40:12.079
<v Speaker 2>updates high temporal resolution, but cover a wide area with

789
00:40:12.159 --> 00:40:15.880
<v Speaker 2>less detail, lower spatial resolution. And the other type, polar

790
00:40:16.000 --> 00:40:19.079
<v Speaker 2>orbiting satellites, circle the Earth, passing over the poles. They

791
00:40:19.119 --> 00:40:22.679
<v Speaker 2>provide very detailed images high spatial resolution, but cover any

792
00:40:22.679 --> 00:40:27.239
<v Speaker 2>given spot less frequently, lower temporal resolution. Think detailed snapshots

793
00:40:27.280 --> 00:40:28.639
<v Speaker 2>versus frequent wide views.

794
00:40:28.679 --> 00:40:29.960
<v Speaker 1>Where does the imagery come from?

795
00:40:30.119 --> 00:40:34.000
<v Speaker 2>Sources like the Landset program or NASA's Earth Observatory make

796
00:40:34.039 --> 00:40:37.239
<v Speaker 2>a lot of imagery publicly available, which is fantastic for osent.

797
00:40:37.440 --> 00:40:40.239
<v Speaker 2>Commercial providers offer even higher resolution data.

798
00:40:40.679 --> 00:40:44.880
<v Speaker 1>Okay, let's dive into specific modes, starting with maritime intelligence.

799
00:40:46.039 --> 00:40:48.199
<v Speaker 1>AIS data is mentioned. What is that?

800
00:40:48.519 --> 00:40:53.480
<v Speaker 2>AIS stands for Automatic Identification System. Ships over a certain

801
00:40:53.559 --> 00:40:57.519
<v Speaker 2>size are required to broadcast information about themselves identity, position,

802
00:40:57.880 --> 00:41:01.800
<v Speaker 2>course speed using AI transponders.

803
00:41:01.239 --> 00:41:04.000
<v Speaker 1>So it's key for tracking ships. Absolutely.

804
00:41:04.679 --> 00:41:08.320
<v Speaker 2>There are many websites and services that aggregate this AI stata,

805
00:41:08.360 --> 00:41:11.920
<v Speaker 2>allowing you to track vessels globally, in near real time

806
00:41:12.079 --> 00:41:12.840
<v Speaker 2>or historically.

807
00:41:12.920 --> 00:41:14.119
<v Speaker 1>But it has limitations.

808
00:41:14.559 --> 00:41:18.400
<v Speaker 2>Spoofing, Yes, that's a major limitation. AI's data can be

809
00:41:18.480 --> 00:41:22.000
<v Speaker 2>deliberately manipulated or faked. That's called spoofing. Why would someone

810
00:41:22.039 --> 00:41:25.079
<v Speaker 2>do that Various reasons. A Navy ship might spoof its

811
00:41:25.119 --> 00:41:28.719
<v Speaker 2>location during a sensitive mission. A vessel involved in illegal

812
00:41:28.719 --> 00:41:32.119
<v Speaker 2>fishing or smuggling might broadcast false coordinates to hide its activity.

813
00:41:32.480 --> 00:41:34.960
<v Speaker 2>Someone might try to obscure a missile launch location by

814
00:41:34.960 --> 00:41:36.559
<v Speaker 2>having ships spoof nearby, So.

815
00:41:36.559 --> 00:41:38.280
<v Speaker 1>You can't always trust it one hundred percent.

816
00:41:38.360 --> 00:41:40.119
<v Speaker 2>You have to be aware of the potential for spoofing

817
00:41:40.159 --> 00:41:43.280
<v Speaker 2>and look for corroborating evidence if the track seems suspicious.

818
00:41:43.800 --> 00:41:48.239
<v Speaker 2>GNSS jamming disrupting GPS signals is another issue affecting maritime

819
00:41:48.280 --> 00:41:49.360
<v Speaker 2>and aviation navigation.

820
00:41:49.679 --> 00:41:55.079
<v Speaker 1>Besides tracking ships, what else can maritime ocein uncover ports seem.

821
00:41:54.840 --> 00:41:58.840
<v Speaker 2>Important courts are critical hubs. Analyzing port activity gives you

822
00:41:59.039 --> 00:42:02.400
<v Speaker 2>huge insights to trade flows and ship movements. Sometimes you

823
00:42:02.440 --> 00:42:05.840
<v Speaker 2>can find publicly available berthing reports online lists of ships

824
00:42:05.840 --> 00:42:07.239
<v Speaker 2>scheduled to arrive and depart.

825
00:42:07.360 --> 00:42:08.239
<v Speaker 1>What can I Tell You.

826
00:42:08.320 --> 00:42:12.800
<v Speaker 2>Gives you clues about cargo types, origins, destinations, vessel schedules.

827
00:42:13.360 --> 00:42:16.480
<v Speaker 2>Ports are also great places for image and satellite analysis,

828
00:42:16.519 --> 00:42:20.639
<v Speaker 2>as ships are stationary for longer periods. Analyzing port infrastructure

829
00:42:20.639 --> 00:42:24.400
<v Speaker 2>for vulnerabilities is another key area. Undersea cables often land

830
00:42:24.440 --> 00:42:25.199
<v Speaker 2>near ports too.

831
00:42:25.599 --> 00:42:30.800
<v Speaker 1>Moving onto land railway intelligence what osand opportunities exist there?

832
00:42:30.960 --> 00:42:34.679
<v Speaker 2>Railways are vital for moving freight and passengers. Osin involves

833
00:42:34.719 --> 00:42:38.840
<v Speaker 2>identifying rail lines visually using satellite imagery, mapping routes, finding

834
00:42:38.840 --> 00:42:41.960
<v Speaker 2>schedules sometimes available online like the anytrip dot com dot

835
00:42:42.000 --> 00:42:45.480
<v Speaker 2>Au example from Melbourne, and figuring out ownership and operation

836
00:42:45.599 --> 00:42:49.519
<v Speaker 2>of rail infrastructure. Tracking freight yeah understanding how freight moves,

837
00:42:49.639 --> 00:42:53.800
<v Speaker 2>especially the transloading process where goods switch between trucks and trains.

838
00:42:54.440 --> 00:42:59.039
<v Speaker 2>Analyzing track side technology like RFID tags, AI tags or

839
00:42:59.199 --> 00:43:02.920
<v Speaker 2>radio controlled SO systems can also offer insights, including potential

840
00:43:02.960 --> 00:43:04.199
<v Speaker 2>cyber vulnerabilities.

841
00:43:04.280 --> 00:43:09.480
<v Speaker 1>Aviation intelligence. Next, identifying aircraft seems basic but crucial. How

842
00:43:09.480 --> 00:43:10.039
<v Speaker 1>do we do that?

843
00:43:10.320 --> 00:43:14.719
<v Speaker 2>Aircraft have several key identifiers. There's the icoid, a unique

844
00:43:14.719 --> 00:43:18.039
<v Speaker 2>twenty four bit hex code transmitted by the planes transponder.

845
00:43:18.079 --> 00:43:21.199
<v Speaker 2>You see this on flight tracking sites. Then the registration number,

846
00:43:21.280 --> 00:43:24.039
<v Speaker 2>often called the tail number. Like N numbers in the US,

847
00:43:24.400 --> 00:43:26.760
<v Speaker 2>you can look these up in registries like the FAAS

848
00:43:26.800 --> 00:43:29.719
<v Speaker 2>to find ownership and aircraft type. The example N three

849
00:43:29.920 --> 00:43:31.199
<v Speaker 2>eight me leads.

850
00:43:30.920 --> 00:43:33.599
<v Speaker 1>To a Eurocopter. Call signs too right, the call.

851
00:43:33.480 --> 00:43:37.320
<v Speaker 2>Sign used for radio communication. Airlines have specific call signs,

852
00:43:37.400 --> 00:43:42.000
<v Speaker 2>like Brickyard for Republic Airways, Dragon for Cafe Pacific, Cactus.

853
00:43:42.039 --> 00:43:45.719
<v Speaker 2>After the US Airways Flight fifteen forty nine incident, military

854
00:43:45.760 --> 00:43:49.280
<v Speaker 2>aircraft used tailcodes and serial numbers instead of civil registrations.

855
00:43:49.280 --> 00:43:51.119
<v Speaker 1>Can you identify them visually? Yes?

856
00:43:51.199 --> 00:43:54.000
<v Speaker 2>You can learn to identify aircraft types by looking at

857
00:43:54.000 --> 00:43:58.800
<v Speaker 2>their key features wings, engines, fuselage shaped tail configuration, The

858
00:43:58.800 --> 00:44:03.719
<v Speaker 2>WEFT methods engines fuselage tail is a systematic way to

859
00:44:03.760 --> 00:44:07.880
<v Speaker 2>do this. Even identifying UAVs drones involves looking at wing

860
00:44:08.039 --> 00:44:08.960
<v Speaker 2>or rotor types.

861
00:44:09.239 --> 00:44:14.280
<v Speaker 1>How do we track aircraft routes using ocent flight tracking platforms? Yes?

862
00:44:14.320 --> 00:44:18.039
<v Speaker 2>Platforms like flight Aware Flight Tradar twenty four. ADSB exchange

863
00:44:18.079 --> 00:44:21.320
<v Speaker 2>aggregate data from ADSB receivers and other sources worldwide.

864
00:44:21.559 --> 00:44:22.639
<v Speaker 1>What data do they show?

865
00:44:22.760 --> 00:44:26.960
<v Speaker 2>Real time and historical flight info? Aircraft identifier, call sign,

866
00:44:27.000 --> 00:44:32.119
<v Speaker 2>hex code, type, altitude, speed, track, origin, destination. It's incredibly detailed.

867
00:44:32.159 --> 00:44:33.199
<v Speaker 1>Many tips for using them.

868
00:44:33.239 --> 00:44:36.559
<v Speaker 2>Definitely check multiple sites, as coverage and data retention can vary.

869
00:44:36.960 --> 00:44:40.360
<v Speaker 2>Pay attention to patterns. Frequent flights between certain locations can

870
00:44:40.400 --> 00:44:43.840
<v Speaker 2>reveal routines or bases of operation. Look for low flying

871
00:44:43.840 --> 00:44:46.559
<v Speaker 2>aircraft that might not show up on all trackers. Be

872
00:44:46.639 --> 00:44:50.039
<v Speaker 2>aware of things like the FAA's PIA list or LADD program,

873
00:44:50.039 --> 00:44:52.800
<v Speaker 2>which allows some owners to limit public display of their data.

874
00:44:52.840 --> 00:44:54.079
<v Speaker 1>What about official notices?

875
00:44:54.360 --> 00:44:58.920
<v Speaker 2>Checking FAA no TAMS notices to airmen and TFRs temporary

876
00:44:58.960 --> 00:45:03.559
<v Speaker 2>flight restrictions is important for understanding airspace closures or special conditions.

877
00:45:03.639 --> 00:45:05.280
<v Speaker 1>Can you track cargo on planes?

878
00:45:05.480 --> 00:45:10.079
<v Speaker 2>Sometimes air cargo uses an Airway Bill AWB number for tracking,

879
00:45:10.199 --> 00:45:13.880
<v Speaker 2>similar to a shipping tracking number. Combining this with ocent

880
00:45:13.960 --> 00:45:16.760
<v Speaker 2>from other transport sectors can help track goods across the

881
00:45:16.920 --> 00:45:17.880
<v Speaker 2>entire supply chain.

882
00:45:18.000 --> 00:45:20.480
<v Speaker 1>What about air fields themselves? Illicit ones?

883
00:45:20.639 --> 00:45:24.119
<v Speaker 2>Yeah, ocent, especially satellite imagery analysis can be used to

884
00:45:24.159 --> 00:45:29.000
<v Speaker 2>identify potential illicit airstrips and remote areas looking for cleared land.

885
00:45:29.159 --> 00:45:33.199
<v Speaker 2>Maybe science of activity Combining imagery with fire detection data

886
00:45:33.320 --> 00:45:36.480
<v Speaker 2>like NASA firms can sometimes reveal activity like burning vegetation

887
00:45:36.639 --> 00:45:39.840
<v Speaker 2>to clear land for strips. Google Earth is great for

888
00:45:39.920 --> 00:45:41.960
<v Speaker 2>analyzing potential airstrips over time.

889
00:45:42.440 --> 00:45:45.960
<v Speaker 1>Lastly, automotive intelligence, what can we find out about cars

890
00:45:46.000 --> 00:45:46.440
<v Speaker 1>and trucks?

891
00:45:46.559 --> 00:45:50.079
<v Speaker 2>Automotive OCENT involves identifying vehicles, make and model. Tools like

892
00:45:50.119 --> 00:45:53.199
<v Speaker 2>carnate dot AI can help license plates resources like World

893
00:45:53.199 --> 00:45:56.440
<v Speaker 2>license Plates dot Com show formats, then numbers cracking routes.

894
00:45:56.519 --> 00:46:00.280
<v Speaker 2>You can monitor routes using webcams like the famous eleven

895
00:46:00.320 --> 00:46:04.440
<v Speaker 2>foot eight bridge webcam catching trucks hitting it. Satellite imagery,

896
00:46:04.800 --> 00:46:08.800
<v Speaker 2>social media posts showing vehicles, also figuring out ownership and

897
00:46:08.840 --> 00:46:13.119
<v Speaker 2>operation and understanding the vehicle's security features or technology.

898
00:46:13.239 --> 00:46:17.239
<v Speaker 1>Okay, that's a really comprehensive overview of transportation OCENT. Let's

899
00:46:17.280 --> 00:46:21.480
<v Speaker 1>move into an area that feels increasingly urgent, critical infrastructure

900
00:46:21.480 --> 00:46:25.599
<v Speaker 1>and industrial intelligence. Technology integration seems to be the key

901
00:46:25.679 --> 00:46:26.280
<v Speaker 1>driver here.

902
00:46:26.320 --> 00:46:32.599
<v Speaker 2>It absolutely is. Our critical infrastructure power grids, water systems, transportation, networks, communication,

903
00:46:32.719 --> 00:46:36.880
<v Speaker 2>systems relies more and more on interconnected technology.

904
00:46:36.239 --> 00:46:38.360
<v Speaker 1>Which creates vulnerabilities.

905
00:46:37.639 --> 00:46:40.639
<v Speaker 2>Exactly, it increases the potential attack surface. Events like nine

906
00:46:40.639 --> 00:46:44.440
<v Speaker 2>to eleven were turning point highlighting physical vulnerabilities, but now

907
00:46:44.519 --> 00:46:48.199
<v Speaker 2>the cyber threat to industrial control systems I sees is huge.

908
00:46:48.599 --> 00:46:50.559
<v Speaker 2>Stucks Net showed what's possible.

909
00:46:50.760 --> 00:46:53.800
<v Speaker 1>Stuck's Net the worm that hit Iranian nuclear facilities.

910
00:46:53.840 --> 00:46:56.559
<v Speaker 2>That's the one, a landmark case showing how cyber weapons

911
00:46:56.559 --> 00:47:00.400
<v Speaker 2>could target and damage physical industrial processes. It really people

912
00:47:00.480 --> 00:47:02.000
<v Speaker 2>up to ICs security risks.

913
00:47:02.280 --> 00:47:05.360
<v Speaker 1>So OCENT here involves looking for weaknesses.

914
00:47:05.039 --> 00:47:09.639
<v Speaker 2>Yes, often adopting that adversarial mindset again, analyzing the physical

915
00:47:09.639 --> 00:47:13.880
<v Speaker 2>and digital footprints of critical infrastructure operators to identify potential

916
00:47:13.920 --> 00:47:17.760
<v Speaker 2>weak points that an attacker might exploit. Understanding the ICs

917
00:47:17.800 --> 00:47:19.639
<v Speaker 2>cyber kill chain helps frame this.

918
00:47:20.039 --> 00:47:22.119
<v Speaker 1>What is the ICs cyberkill chain.

919
00:47:22.199 --> 00:47:25.239
<v Speaker 2>It's a framework adapted from the traditional cyber kill chain

920
00:47:25.599 --> 00:47:28.599
<v Speaker 2>that outlines the typical stages an attacker might go through

921
00:47:28.760 --> 00:47:33.239
<v Speaker 2>when targeting industrial control systems, from reconnaissance to achieving their

922
00:47:33.239 --> 00:47:37.800
<v Speaker 2>objective like disruption or destruction. OCENT is crucial in that

923
00:47:37.880 --> 00:47:39.239
<v Speaker 2>initial reconnaissance phase.

924
00:47:39.400 --> 00:47:42.960
<v Speaker 1>The rise of IoT, Internet of things and IoT industrial

925
00:47:43.000 --> 00:47:45.079
<v Speaker 1>IoT plays a big role too huge.

926
00:47:45.559 --> 00:47:49.719
<v Speaker 2>These connected devices are everywhere now integrated into critical systems.

927
00:47:49.760 --> 00:47:53.159
<v Speaker 2>They monitor conditions, make automatic adjustments, collect data, but.

928
00:47:53.159 --> 00:47:55.880
<v Speaker 1>They can be insecure. The casino example.

929
00:47:55.639 --> 00:47:59.239
<v Speaker 2>Right the infamous story of a casino network reportedly breached

930
00:47:59.239 --> 00:48:02.719
<v Speaker 2>through a vulnerabiles in a connected fish tank thermometer. It

931
00:48:02.800 --> 00:48:05.880
<v Speaker 2>sounds almost comical, but it highlights how any connected device

932
00:48:05.920 --> 00:48:08.159
<v Speaker 2>can be an entry point if not secured properly.

933
00:48:08.280 --> 00:48:10.480
<v Speaker 1>So osin helps identify these devices.

934
00:48:10.880 --> 00:48:15.719
<v Speaker 2>Yes, osent can help identify connected IOTIOT devices associated with

935
00:48:15.760 --> 00:48:19.760
<v Speaker 2>a target, understand their functions, and uncover any publicly known

936
00:48:19.840 --> 00:48:23.960
<v Speaker 2>vulnerabilities or default credentials that attackers might leverage. Mapping the

937
00:48:24.000 --> 00:48:25.079
<v Speaker 2>infrastructure is key.

938
00:48:25.280 --> 00:48:27.480
<v Speaker 1>How do you map infrastructure using osent?

939
00:48:27.880 --> 00:48:30.599
<v Speaker 2>Tools like Google Earth pro are great for plotting known

940
00:48:30.639 --> 00:48:34.760
<v Speaker 2>locations using GPS coordinates, and there are many publicly available

941
00:48:34.880 --> 00:48:39.440
<v Speaker 2>data sets like what. The US DHS HIFLD Open Data

942
00:48:39.440 --> 00:48:43.840
<v Speaker 2>Portal has tons of infrastructure data. The EIA has energy maps.

943
00:48:44.079 --> 00:48:47.840
<v Speaker 2>There are industry specific maps like Norse Petroleum's interactive map

944
00:48:47.880 --> 00:48:51.760
<v Speaker 2>for Norway, Geri's Thermal power plant map in Japan, wyanos

945
00:48:51.800 --> 00:48:54.920
<v Speaker 2>World Map of Nuclear Operators, even an ARMSCM map of

946
00:48:54.920 --> 00:48:57.719
<v Speaker 2>the Russian defense industry. Lots of data out there if

947
00:48:57.719 --> 00:48:58.360
<v Speaker 2>you know where to look.

948
00:48:58.400 --> 00:48:59.440
<v Speaker 1>Public disclosures too.

949
00:48:59.519 --> 00:49:04.000
<v Speaker 2>Contract resumes absolutely, contracts like unususpending dot dove can reveal

950
00:49:04.039 --> 00:49:08.159
<v Speaker 2>technology suppliers or specific systems being used. Sometimes people list

951
00:49:08.239 --> 00:49:11.360
<v Speaker 2>detailed technical skills or specific ICs SCATA systems they've worked

952
00:49:11.400 --> 00:49:13.840
<v Speaker 2>on in their resumes posted on LinkedIn. You can use

953
00:49:13.840 --> 00:49:17.559
<v Speaker 2>Google dorks to search LinkedIn for these details, potentially revealing vulnerabilities.

954
00:49:17.760 --> 00:49:20.079
<v Speaker 1>Wireless networks are another big vector.

955
00:49:20.199 --> 00:49:23.559
<v Speaker 2>Wi Fi Wi Fi is everywhere. Tools like wage you

956
00:49:23.599 --> 00:49:26.760
<v Speaker 2>wa let you map wireless networks globally by collecting data

957
00:49:26.800 --> 00:49:32.239
<v Speaker 2>points like SSID, network name, b SSID, MAC address of

958
00:49:32.280 --> 00:49:36.880
<v Speaker 2>the access point, encryption type, and GPS coordinates submitted by volunteers.

959
00:49:37.079 --> 00:49:39.840
<v Speaker 1>That raises privacy concerns war driving.

960
00:49:39.599 --> 00:49:42.639
<v Speaker 2>It does war driving driving around scanning for Wi Fi

961
00:49:42.639 --> 00:49:46.159
<v Speaker 2>networks was the original method for building these databases. While

962
00:49:46.159 --> 00:49:50.599
<v Speaker 2>the data itself is broadcast publicly, aggregating it raises privacy questions,

963
00:49:50.719 --> 00:49:54.800
<v Speaker 2>but it's invaluable for mapping wireless footprints. Bluetooth can also

964
00:49:54.840 --> 00:49:58.679
<v Speaker 2>be tracked, potentially inferring location or proximity based on device detection.

965
00:49:59.440 --> 00:50:02.639
<v Speaker 2>Think about fitness trackers. The Strava heat map incident showed

966
00:50:02.639 --> 00:50:06.800
<v Speaker 2>how aggregated user data could reveal sensitive locations like military bases.

967
00:50:06.880 --> 00:50:08.880
<v Speaker 1>Other wireless types opun.

968
00:50:08.639 --> 00:50:12.079
<v Speaker 2>LAURA yes, Low power wide area networks like LOREWN are

969
00:50:12.079 --> 00:50:15.519
<v Speaker 2>increasingly used for industrial IoT because they offer long range

970
00:50:15.559 --> 00:50:19.119
<v Speaker 2>and low power consumption. Understanding these protocols is also becoming

971
00:50:19.199 --> 00:50:22.760
<v Speaker 2>important for OCENT in this space. Baselining normal wireless activity

972
00:50:22.760 --> 00:50:23.440
<v Speaker 2>helps spot.

973
00:50:23.239 --> 00:50:25.079
<v Speaker 1>Anomalies and finding cell towers.

974
00:50:25.360 --> 00:50:28.639
<v Speaker 2>Identifying mobile tower locations can also be part of infrastructure

975
00:50:28.800 --> 00:50:33.960
<v Speaker 2>OCENT using contracts, public disclosures, zoning permits, and tools like

976
00:50:34.039 --> 00:50:38.480
<v Speaker 2>cell mapper, which crowdsources tower locations based on user signal readings.

977
00:50:38.599 --> 00:50:41.840
<v Speaker 1>Okay, let's move to the money financial intelligence. Why is

978
00:50:41.880 --> 00:50:43.039
<v Speaker 1>OSENT so important here?

979
00:50:43.199 --> 00:50:47.440
<v Speaker 2>Financial intelligence or FINANT is crucial for tracking and combating

980
00:50:47.440 --> 00:50:51.920
<v Speaker 2>illicit activities money laundering, terrorists, financing fraud, sanctions of asion.

981
00:50:52.320 --> 00:50:55.440
<v Speaker 2>OSIN provides the publicly available pieces of that puzzle.

982
00:50:55.599 --> 00:50:58.119
<v Speaker 1>Key players FINCIN FATF.

983
00:50:57.880 --> 00:51:01.320
<v Speaker 2>Right organizations like FINCIN Financial Crimes Enforcement Network in the

984
00:51:01.400 --> 00:51:05.519
<v Speaker 2>US and the International FATF Financial Action Task Force, set

985
00:51:05.599 --> 00:51:09.920
<v Speaker 2>standards and provide guidance. Regulatory bodies like the FDIC Federal

986
00:51:09.920 --> 00:51:13.320
<v Speaker 2>Deposit Insurance corporation in the US also provide information on

987
00:51:13.400 --> 00:51:16.280
<v Speaker 2>banks and financial data tools like the Bank Fine Suite.

988
00:51:16.320 --> 00:51:19.199
<v Speaker 1>Tracking criminal organizations TCOs.

989
00:51:19.079 --> 00:51:24.280
<v Speaker 2>Yes, transnational criminal organizations operate across borders. OSEND helps map

990
00:51:24.320 --> 00:51:28.519
<v Speaker 2>their structures, activities, and financial networks. The MS thirteen example

991
00:51:28.519 --> 00:51:31.480
<v Speaker 2>illustrates the kind of group involved. O FAC reports like

992
00:51:31.480 --> 00:51:34.320
<v Speaker 2>the one on the Kinahan organized crime group often contain

993
00:51:34.480 --> 00:51:36.039
<v Speaker 2>valuable OSENT leads.

994
00:51:36.440 --> 00:51:39.639
<v Speaker 1>What about PEPs politically exposed persons?

995
00:51:39.880 --> 00:51:45.360
<v Speaker 2>PEPs are individuals holding prominent public functions politicians, judges, military leaders,

996
00:51:45.519 --> 00:51:50.599
<v Speaker 2>state owned enterprise execs. FtF provides guidelines. They are considered

997
00:51:50.679 --> 00:51:54.039
<v Speaker 2>higher risk for potential involvement in bribery and corruption, so

998
00:51:54.119 --> 00:51:58.000
<v Speaker 2>identifying them is key in due diligence and financial crime investigations.

999
00:51:58.199 --> 00:52:00.960
<v Speaker 1>Money laundering itself, how does OSIN help find it?

1000
00:52:01.440 --> 00:52:05.199
<v Speaker 2>OSIN helps identify red flags associated with money laundering, things

1001
00:52:05.239 --> 00:52:08.760
<v Speaker 2>like complex corporate structures involving shell companies, transactions with high

1002
00:52:08.800 --> 00:52:12.679
<v Speaker 2>risk jurisdictions, unexplained wealth, involvement of PEPs. It complements the

1003
00:52:12.719 --> 00:52:16.639
<v Speaker 2>internal KYC Know Your Customer process as banks use understanding

1004
00:52:16.679 --> 00:52:20.719
<v Speaker 2>common schemes. Helps spot indicators tax evation and fraud. OCIN

1005
00:52:20.840 --> 00:52:25.400
<v Speaker 2>can help uncover concealed income or assets, or identify inconsistencies

1006
00:52:25.440 --> 00:52:29.039
<v Speaker 2>that suggest false information is being submitted to tax authorities.

1007
00:52:29.440 --> 00:52:32.079
<v Speaker 2>The Walter Anderson case is mentioned as a major tax

1008
00:52:32.079 --> 00:52:32.880
<v Speaker 2>evasion example.

1009
00:52:33.039 --> 00:52:36.840
<v Speaker 1>Verifying VAT numbers isocodes.

1010
00:52:36.280 --> 00:52:39.480
<v Speaker 2>Yes, small practical things You can often verify value added

1011
00:52:39.519 --> 00:52:44.400
<v Speaker 2>tax VAT identification numbers online. Knowing isocuntry codes helps identify

1012
00:52:44.440 --> 00:52:49.159
<v Speaker 2>countries mentioned in financial documents or transaction data. Resources like nationsonline,

1013
00:52:49.199 --> 00:52:53.039
<v Speaker 2>dot Org list these codes. Understanding prevalent crime types by

1014
00:52:53.119 --> 00:52:55.239
<v Speaker 2>region also provides context.

1015
00:52:55.000 --> 00:52:57.320
<v Speaker 1>Finding info on organized crime and gangs.

1016
00:52:57.559 --> 00:53:02.239
<v Speaker 2>Resources like Wikipedia surprisingly details sometimes the National Gang Center

1017
00:53:02.400 --> 00:53:06.119
<v Speaker 2>DEA Fugitives List, and specialized news sites like insight Crime

1018
00:53:06.199 --> 00:53:09.760
<v Speaker 2>provide background information and potential leads on individuals and groups.

1019
00:53:09.840 --> 00:53:11.119
<v Speaker 1>Negative news searching this.

1020
00:53:11.039 --> 00:53:14.559
<v Speaker 2>Involves crafting specific search engine queries storks again to find

1021
00:53:14.559 --> 00:53:17.960
<v Speaker 2>derogatory information or negative news reports about a person or company,

1022
00:53:18.280 --> 00:53:22.199
<v Speaker 2>combining names with keywords like fraud, arrests, lawsuits, scandal, etc.

1023
00:53:22.760 --> 00:53:27.599
<v Speaker 1>Okay, now for a really hot topic. Cryptocurrency. How has

1024
00:53:27.639 --> 00:53:30.599
<v Speaker 1>ocent adapted to this often anonymous world?

1025
00:53:30.760 --> 00:53:35.079
<v Speaker 2>Cryptocurrency presents unique challenges and opportunities for Ocent. It's built

1026
00:53:35.079 --> 00:53:39.199
<v Speaker 2>on blockchain technology, which is essentially a public distributed ledger.

1027
00:53:39.320 --> 00:53:43.760
<v Speaker 2>It's anonymous, right'sseudonymous. Usually, transactions are linked to wallet addresses,

1028
00:53:43.840 --> 00:53:48.119
<v Speaker 2>not necessarily real world identities directly, but the transactions themselves

1029
00:53:48.159 --> 00:53:51.239
<v Speaker 2>are public on the blockchain. Understanding the basics is key

1030
00:53:51.480 --> 00:53:52.119
<v Speaker 2>key terms.

1031
00:53:52.400 --> 00:53:54.159
<v Speaker 1>Coins versus tokens.

1032
00:53:53.840 --> 00:53:58.159
<v Speaker 2>Right cryptocurrencies or coins like Bitcoin, BTC or Ethereum eth

1033
00:53:58.559 --> 00:54:01.920
<v Speaker 2>run on their own blockchains and are typically mined. Tokens

1034
00:54:01.960 --> 00:54:05.039
<v Speaker 2>are built on top of existing blockchains like Ethereum using

1035
00:54:05.119 --> 00:54:08.639
<v Speaker 2>smart contracts and are minted. Tokens can represent different things

1036
00:54:08.840 --> 00:54:12.719
<v Speaker 2>value like stable coins, NFTs, non fungible tokens, security tokens,

1037
00:54:12.800 --> 00:54:13.679
<v Speaker 2>utility tokens.

1038
00:54:13.719 --> 00:54:15.719
<v Speaker 1>Bitcoin Ethereum Bitcoin is.

1039
00:54:15.719 --> 00:54:19.000
<v Speaker 2>The original, best known, one decentralized ledger proof of work

1040
00:54:19.039 --> 00:54:24.119
<v Speaker 2>consensus created by the pseudonymous Setoshi Nakamoto. Finite supply fungible

1041
00:54:24.639 --> 00:54:28.360
<v Speaker 2>one Bitcoin is like any other. Ethereum introduced smart contracts

1042
00:54:28.480 --> 00:54:33.320
<v Speaker 2>enabling tokens and decentralized applications de apps. It's the second largest.

1043
00:54:33.000 --> 00:54:34.519
<v Speaker 1>Proof of work versus proof of steak.

1044
00:54:34.679 --> 00:54:38.840
<v Speaker 2>These are consensus mechanisms how the network agrees on valid transactions.

1045
00:54:39.360 --> 00:54:44.039
<v Speaker 2>POW used by Bitcoin initially involves solving complex computational puzzles. Mining,

1046
00:54:44.079 --> 00:54:47.800
<v Speaker 2>which uses a lot of energy pos used by Ethereum

1047
00:54:47.840 --> 00:54:51.519
<v Speaker 2>Now and many others, involves validators locking up staking their

1048
00:54:51.519 --> 00:54:56.159
<v Speaker 2>own crypto as collateral to validate transactions, generally more energy efficient.

1049
00:54:56.440 --> 00:54:59.440
<v Speaker 2>There are other mechanisms too, like proof of capacity or

1050
00:54:59.480 --> 00:55:00.400
<v Speaker 2>proof of acti ativity.

1051
00:55:00.800 --> 00:55:02.679
<v Speaker 1>How does the dark web fit in with crypto?

1052
00:55:02.840 --> 00:55:06.840
<v Speaker 2>Cryptocurrencies, especially privacy focused ones, became the preferred payment method

1053
00:55:06.880 --> 00:55:10.760
<v Speaker 2>on darknet marketplaces selling illicit goods like drugs, weapons, stolen

1054
00:55:10.840 --> 00:55:12.119
<v Speaker 2>data CSAM.

1055
00:55:12.239 --> 00:55:13.519
<v Speaker 1>How do investigators track this?

1056
00:55:14.079 --> 00:55:18.400
<v Speaker 2>Using the Tor browser to access the dark web, identifying marketplaces,

1057
00:55:18.480 --> 00:55:22.360
<v Speaker 2>finding sellar profiles. These profiles often contained pivot points like

1058
00:55:22.519 --> 00:55:28.000
<v Speaker 2>usernames reused elsewhere or cryptocurrency wallet addresses used for payment.

1059
00:55:28.320 --> 00:55:30.480
<v Speaker 1>Case studies Shiny Flakes Yeah.

1060
00:55:30.559 --> 00:55:34.000
<v Speaker 2>The young German guy Maximilian Schmidt, who ran a huge

1061
00:55:34.079 --> 00:55:38.280
<v Speaker 2>online drug empire from his bedroom excepting crypto mistakes and

1062
00:55:38.360 --> 00:55:41.599
<v Speaker 2>shipping led to his arrest shows operational security failures.

1063
00:55:41.639 --> 00:55:43.199
<v Speaker 1>Alpha Bat and Hansa.

1064
00:55:42.920 --> 00:55:46.199
<v Speaker 2>Two massive darknet marketplaces shut down by law enforcement and

1065
00:55:46.239 --> 00:55:49.199
<v Speaker 2>Operation Baynet. They secretly took over Hansa for a while,

1066
00:55:49.280 --> 00:55:52.880
<v Speaker 2>gathering intelligence on users before shutting both down. They seized

1067
00:55:52.880 --> 00:55:56.000
<v Speaker 2>crypto and user data shows the reach of law enforcement

1068
00:55:56.079 --> 00:55:57.360
<v Speaker 2>even in these hidden corners.

1069
00:55:57.440 --> 00:56:01.440
<v Speaker 1>So how do you analyze crypto transactions? Use ocent blockchain

1070
00:56:01.480 --> 00:56:02.840
<v Speaker 1>explorers exactly.

1071
00:56:03.239 --> 00:56:06.159
<v Speaker 2>Blockchain explorers are websites that let you view and navigate

1072
00:56:06.199 --> 00:56:08.800
<v Speaker 2>the public blockchain data. You can enter a wallet address

1073
00:56:08.880 --> 00:56:12.719
<v Speaker 2>or transaction ID and see its history balance incoming outgoing transactions.

1074
00:56:12.840 --> 00:56:16.039
<v Speaker 2>With following the money precisely, even though it's pseudonymous, you

1075
00:56:16.039 --> 00:56:19.280
<v Speaker 2>can follow the flow of funds between addresses. The funnel

1076
00:56:19.280 --> 00:56:22.599
<v Speaker 2>method involves starting with a known transaction or address and

1077
00:56:22.679 --> 00:56:26.280
<v Speaker 2>tracing funds back or forward, looking for links to exchanges

1078
00:56:26.360 --> 00:56:29.400
<v Speaker 2>where crypto might be cashed out to Fiat currency requiring

1079
00:56:29.400 --> 00:56:34.679
<v Speaker 2>identity verification, or other known illicit addresses. Layering information is key.

1080
00:56:35.320 --> 00:56:38.840
<v Speaker 2>The pivot chart example starting with a transaction shows this process.

1081
00:56:39.079 --> 00:56:43.079
<v Speaker 1>Finally, let's briefly touch on non fungible tokens or NFTs.

1082
00:56:43.440 --> 00:56:45.360
<v Speaker 1>They've had their share of crime too. They have.

1083
00:56:46.079 --> 00:56:49.599
<v Speaker 2>NFTs are unique digital assets recorded on a blockchain think

1084
00:56:49.679 --> 00:56:51.320
<v Speaker 2>digital art collectibles.

1085
00:56:51.360 --> 00:56:52.239
<v Speaker 1>Well kind of crimes.

1086
00:56:52.360 --> 00:56:55.519
<v Speaker 2>Because their value can be subjective and volatile. They've been

1087
00:56:55.599 --> 00:56:58.880
<v Speaker 2>used in Ponzi schemes and rug pulls, where it creators

1088
00:56:58.960 --> 00:57:02.400
<v Speaker 2>hype a project NFTs and then disappear with the funds.

1089
00:57:03.079 --> 00:57:06.960
<v Speaker 2>Wash trading to artificially inflate prices is another issue. Investigating

1090
00:57:07.000 --> 00:57:11.000
<v Speaker 2>these often involves blockchain analysis combined with social media OCENT

1091
00:57:11.239 --> 00:57:12.239
<v Speaker 2>to track promoters.

1092
00:57:12.559 --> 00:57:15.119
<v Speaker 1>Wow, Okay, that brings us pretty much to the end

1093
00:57:15.159 --> 00:57:18.199
<v Speaker 1>of this really deep dive into open source intelligence, all

1094
00:57:18.239 --> 00:57:21.079
<v Speaker 1>based on the incredibly insightful material you shared. We've covered

1095
00:57:21.119 --> 00:57:21.559
<v Speaker 1>so much.

1096
00:57:21.840 --> 00:57:25.840
<v Speaker 2>We really have, from its history the basic methods ops

1097
00:57:26.440 --> 00:57:30.760
<v Speaker 2>right through to cutting edge applications in crypto transport critical infrastructure.

1098
00:57:30.800 --> 00:57:34.039
<v Speaker 1>It's vast. Yeah, hopefully you, our listener, now have a

1099
00:57:34.119 --> 00:57:37.519
<v Speaker 1>much clearer picture of not just what OCENT is, but

1100
00:57:37.599 --> 00:57:39.599
<v Speaker 1>how it's actually used, how powerful it can be.

1101
00:57:39.880 --> 00:57:43.559
<v Speaker 2>Yeah, seeing how information that's just out there in the

1102
00:57:43.639 --> 00:57:48.719
<v Speaker 2>open can reveal hidden connections and provide such valuable insights

1103
00:57:48.760 --> 00:57:52.280
<v Speaker 2>when you analyze it effectively. It applies across almost any field.

1104
00:57:52.440 --> 00:57:54.599
<v Speaker 1>There are definitely some surprising facts for me, some real

1105
00:57:54.639 --> 00:57:57.679
<v Speaker 1>aha moments, like the grandmother's story at the start or

1106
00:57:57.719 --> 00:58:01.760
<v Speaker 1>the fish tank hack. It really highlights how much data surrounds.

1107
00:58:01.440 --> 00:58:03.840
<v Speaker 2>Us, absolutely and it kind of makes you wonder, doesn't it,

1108
00:58:03.840 --> 00:58:07.000
<v Speaker 2>about the power of this publicly available information in your

1109
00:58:07.000 --> 00:58:10.239
<v Speaker 2>own areas of interest, What could you uncover, what insights

1110
00:58:10.320 --> 00:58:12.119
<v Speaker 2>might you gain using these principles.

1111
00:58:12.320 --> 00:58:15.159
<v Speaker 1>That's a great point. And maybe on that note, here's

1112
00:58:15.159 --> 00:58:18.639
<v Speaker 1>something I'll leave you thinking about. Given this sheer, vastness

1113
00:58:18.679 --> 00:58:22.719
<v Speaker 1>of open source information and how fast it's changing, what

1114
00:58:22.800 --> 00:58:27.119
<v Speaker 1>are the really big ethical responsibilities for individuals, for organizations,

1115
00:58:27.360 --> 00:58:29.840
<v Speaker 1>how do we use this power responsibly? And how do

1116
00:58:29.880 --> 00:58:31.440
<v Speaker 1>we safeguard data in the future.

1117
00:58:31.760 --> 00:58:34.159
<v Speaker 2>That's the big question, isn't it. It's something we'll all

1118
00:58:34.199 --> 00:58:36.840
<v Speaker 2>have to grapple with as our digital world keeps expanding.