[00:00.160 --> 00:02.620]  I'm Lorax Horne.
[00:02.780 --> 00:06.180]  I'm a writer, a journalist, poet.
[00:06.440 --> 00:10.960]  I joined the DDoS Secrets Board of Advisors in 2019.
[00:11.800 --> 00:25.400]  My role in the collective, which is a publishing collective focusing on hacks and leaks, is to talk to researchers and journalists and introduce them to the leaks that we have been publishing.
[00:25.400 --> 00:32.420]  This is my colleague, Teva, and my colleague, Emma, who can introduce herself.
[00:33.400 --> 00:33.620]  Hi.
[00:35.040 --> 00:36.160]  I'm Emma Best.
[00:36.420 --> 00:41.880]  I'm a former hacker and recovering analyst slash investigative journalist.
[00:42.500 --> 00:53.980]  In late 2018, I co-founded DDoS Secrets, and since then it's grown to proportions that we never imagined at the time.
[00:54.760 --> 01:00.480]  You can find me online at emma.best or mixie at collectiva.social.
[01:03.940 --> 01:07.500]  So, I wanted to tell the story of why I got into DDoS Secrets.
[01:07.500 --> 01:13.660]  This was me in 2016 on a trip to Palestine.
[01:15.640 --> 01:19.140]  And I was there as a reporter.
[01:19.600 --> 01:20.720]  I had a press pass.
[01:21.080 --> 01:32.840]  The first stop was Press House Palestine, which was a nonprofit that was sort of an open space for skillsharing for journalists, but not just for journalists.
[01:32.840 --> 01:40.080]  They did press conferences there, award ceremonies.
[01:40.340 --> 01:50.000]  This is Bilal Jadalla, who introduced me to the space and welcomed me and invited me to do my first digital security training for journalists.
[01:52.140 --> 02:01.940]  This is some of the types of people who would come to Press House and have this open space where they could learn about skills of journalism.
[02:02.720 --> 02:11.540]  But there were also things like book fairs, and I went to a stand-up comedy day, award ceremonies.
[02:11.540 --> 02:18.300]  In February, the building of Press House was destroyed by an Israeli bomb.
[02:18.840 --> 02:25.620]  And before that, in November, Bilal was killed by a targeted strike.
[02:28.220 --> 02:32.380]  But the space that he built sort of lives on.
[02:33.980 --> 02:46.500]  And in 2018, when Emma came to me and started talking to me about DDoS secrets, about this place where sources could go, I immediately saw the appeal.
[02:47.240 --> 02:51.980]  Because as a journalist, leaks had informed my practice.
[02:53.000 --> 03:00.940]  And yet I had seen how our predecessors had made mistakes and caused harm.
[03:01.260 --> 03:04.960]  One of the first things they teach you in journalism school is do no harm.
[03:05.740 --> 03:10.240]  And so I could see the argument for why there needed to be a new leak site.
[03:11.280 --> 03:14.000]  In 2018, Emma and I were just talking about it.
[03:14.100 --> 03:15.200]  I hadn't really joined.
[03:15.800 --> 03:22.100]  I think we might have talked about the name before I joined officially in 2019.
[03:22.600 --> 03:23.240]  Quite possibly.
[03:24.340 --> 03:27.180]  Yeah, so in 2019, I was on the board of advisors.
[03:27.820 --> 03:31.940]  And this is how DDoS secrets works in theory.
[03:32.800 --> 03:33.840]  Data comes in.
[03:35.740 --> 03:39.740]  It's verified to look for a public interest.
[03:41.080 --> 03:43.440]  There's a lot of data out there on the Internet.
[03:44.540 --> 03:47.280]  And a lot of it might not have a public interest.
[03:47.440 --> 03:49.760]  There might not be a researcher who can use it.
[03:50.940 --> 03:58.840]  And so these data sets, as we've gone along, we have had to prioritize the ones that have a research purpose.
[03:59.400 --> 04:01.540]  And the ones that don't, we discard.
[04:02.340 --> 04:14.540]  If there is a public interest in archiving the data set, we look next for the personally identifiable information that might be in there to indicate a release strategy.
[04:14.620 --> 04:22.180]  If there's no PII, then we can publish a torrent and spread the data set via torrent.
[04:23.520 --> 04:32.080]  Obviously, sometimes data sets that do have PII, we also publish via a torrent if there's already a public version of the data out there.
[04:32.080 --> 04:41.350]  And we want there to be a faithful and complete copy instead of edits or versions with unintended redactions.
[04:41.640 --> 04:45.220]  So we'll publish a torrent again for harm reduction.
[04:46.890 --> 04:53.340]  If there is PII, sometimes the PII can be stripped if it's not important to the stories that are in the data set.
[04:54.400 --> 05:05.160]  If it can't be stripped, we put the data in a section of our archive that used to be called limited distribution, and now we've been calling it reserved as a shorter title.
[05:05.560 --> 05:17.560]  But it's a section that is available upon request by people who have published research before, demonstrating that they have a careful understanding of data.
[05:19.560 --> 05:26.020]  So this is a lot of my job right now is verifying people for this access to the reserved section.
[05:26.180 --> 05:28.200]  A lot of journalists are interested in this.
[05:28.400 --> 05:34.380]  It's data that isn't necessarily public, so they can mine it for stories.
[05:36.400 --> 05:41.620]  And if the PII can be stripped, sometimes we do publish redacted data.
[05:42.980 --> 05:47.060]  The clearest example of that was the Blue League's publication.
[05:47.240 --> 05:54.260]  It came in just under 300 gigs, I think, and was redacted down to 269.
[05:57.840 --> 06:01.860]  And we are a pretty small group of people.
[06:02.140 --> 06:08.960]  We have had a small circle from the beginning that has changed.
[06:10.180 --> 06:17.780]  But we haven't been so good at inviting new members to the open mouth of the Pac-Man.
[06:21.320 --> 06:23.460]  So it's time to split up.
[06:24.320 --> 06:25.960]  I mean, I really love you, Emma.
[06:26.220 --> 06:29.780]  But I hope we keep working together.
[06:29.780 --> 06:45.000]  But we are splitting the domains of what we do, and we're hoping to create a space that's more like what Press House Palestine was, to create an open collective that more people can join.
[06:45.820 --> 06:48.580]  Also, fundraising is an issue.
[06:50.000 --> 06:55.160]  These are some of the examples of campaigns that we've launched to try to raise funds for the collective.
[06:55.160 --> 07:05.960]  It's really hard to raise money for leaks publishing, because most people who have money are afraid of their information getting leaked.
[07:07.120 --> 07:10.680]  And so it's not an easy case to make to funders.
[07:10.800 --> 07:16.340]  So we have done a lot of crowdfunding, which has not been always successful.
[07:17.220 --> 07:20.620]  And that just doesn't affect us, but it affects our sources.
[07:20.620 --> 07:26.740]  This is an example of a fundraising page that I did for a source that didn't meet its goal.
[07:27.280 --> 07:30.200]  And, like, these have real impacts on people.
[07:30.380 --> 07:42.340]  If we can't raise money for their lawyers or for protecting them after their data has gone viral, then this can impact our ability to serve sources as well.
[07:43.240 --> 07:46.500]  We don't have... we didn't get in on Bitcoin early.
[07:46.500 --> 07:53.100]  We don't have, like, celebrities selling art to fund our collective.
[07:53.520 --> 08:00.360]  We don't have 50 million NFTs raising funds for us.
[08:00.500 --> 08:05.580]  So to split Dita Secrets up, this is what we've come up with.
[08:06.040 --> 08:20.780]  We want to focus the library of leaks on the archive and invite more collaborators into the library of leaks, including people who've used the datasets before.
[08:22.460 --> 08:42.700]  So many newsrooms have used the data, and at this point, five years in, I have a pretty good handle on which ones are community-minded and which ones are more privately interested in their own bylines or their own prizes or their own exclusives.
[08:42.940 --> 08:55.000]  So the library of leaks part of under the Dita Secrets umbrella is meant to create a space where some of those people who are more community-minded, who want to teach others how to use leaks.
[08:55.300 --> 09:03.480]  And, I mean, Micah might be in here, he's a really good example, but he did this whole book teaching others how to process leaks.
[09:04.760 --> 09:09.720]  So this is the things in the domains that we envision as being under the library of leaks.
[09:09.920 --> 09:21.660]  And then Disclosure Without Borders will stay the small circle of trust where we can talk to sources, talk to them about source protection issues that they might be facing.
[09:22.360 --> 09:39.720]  And we can also talk to journalists about embargoes and the collaborations that they might be building based on exclusive data, which is, again, like from the world of journalism, but it really matters to newsrooms a lot of the times.
[09:39.720 --> 09:47.660]  If they have a dataset exclusively and nobody else is looking at it, they will invest more resources into the research.
[09:49.000 --> 09:51.660]  Do you want to talk about our new release?
[09:52.280 --> 09:52.500]  Sure.
[09:54.140 --> 10:00.640]  Today we're also releasing our latest piece of data from our Israel series.
[10:00.960 --> 10:12.240]  This is a collection of about 2,250 documents relating to Israeli defense forces and military operations.
[10:14.420 --> 10:22.140]  It was originally released about a year ago on, you know, one of these hacking forums.
[10:22.300 --> 10:25.220]  I think the screenshot there is from Telegram.
[10:25.740 --> 10:30.660]  But one of the issues is that this data goes out and then it quickly disappears.
[10:30.660 --> 10:40.660]  If you look at the image, it references a password encrypted or password protected paste bin, which that would then take you to the data itself.
[10:41.500 --> 10:49.960]  That paste was quickly removed, and because it was password protected, archives just don't do any good.
[10:51.560 --> 11:04.800]  So one of the challenges that we've been facing is not only getting this data, but tracking down where did it originally come from, who released it and why, and when possible, speaking to those groups.
[11:04.800 --> 11:15.320]  In this case, it was a self-identified Indonesian hacktivist group called Gamasec Team, which is short for Garuda Anon Security.
[11:18.080 --> 11:34.860]  This data is one of the smaller Israel releases that I think we'll be doing in the near future, but it's what was ready at this time, and hopefully we'll have some larger projects along those lines to announce in the near future.
[11:37.120 --> 11:44.180]  The next slide is the screenshot of what this dataset looks like on our internal search engine.
[11:44.320 --> 11:48.140]  So we have something called Hunter.
[11:48.140 --> 11:59.840]  It's a fork of a search engine built by the Organized Crime and Corruption Reporting Project called Aleph, which a lot of people have probably heard of and use.
[12:00.080 --> 12:03.040]  Aleph is free software, so we just copied it.
[12:03.360 --> 12:07.240]  And when we first launched Hunter, it was public,
[12:10.620 --> 12:15.100]  and we published blue leaks on it, and then it got taken down.
[12:16.220 --> 12:23.780]  But now we have Hunter as a login service for journalists to log in.
[12:24.040 --> 12:36.160]  The dataset that we're publishing today is going to be public, but then you can download the torrent that requires some skill to parse.
[12:36.640 --> 12:49.100]  We also have it in Hunter for journalists to use, people that go through our verification process as people that are researchers that we can dedicate resources to.
[12:49.420 --> 12:52.200]  So this is what the dataset looks like in Hunter.
[12:55.580 --> 13:01.920]  And yeah, another announcement.
[13:02.560 --> 13:08.400]  This year, we've had a lot of incidents.
[13:09.980 --> 13:14.860]  And I'm happy to go into detail, but I'm probably not the best person to talk about them.
[13:15.360 --> 13:16.760]  I think it's...
[13:16.760 --> 13:19.980]  Newsrooms sharing passwords is an easy one to understand.
[13:19.980 --> 13:24.800]  That's also part of the threat model of what we formed to deal with.
[13:25.900 --> 13:37.640]  Famously, the Guardian shared this password in the title of a chapter in a book that one of their reporters published after Cablegate.
[13:37.960 --> 13:45.800]  There's differences of opinions between WikiLeaks and the Guardian about who was to blame for this.
[13:47.800 --> 13:58.620]  But journalists sharing passwords, I think, is one of the things that we have seen that we have to account for in the security of our systems.
[13:58.620 --> 14:06.000]  Because when sources bring us data that they want to stay reserved, we also take that seriously.
[14:06.000 --> 14:08.400]  And we don't want it public on the Internet.
[14:08.420 --> 14:09.920]  They can have repercussions.
[14:09.920 --> 14:11.240]  We can have repercussions.
[14:11.760 --> 14:13.460]  The journalists sharing passwords.
[14:17.080 --> 14:22.620]  The other thing that we've seen is journalists getting hacked.
[14:23.280 --> 14:26.860]  And it might be a phishing campaign.
[14:26.860 --> 14:28.840]  It might be social engineering.
[14:29.600 --> 14:37.020]  But one of the things that happened this year was that one of our datasets that was in our reserved section.
[14:37.280 --> 14:43.680]  And it was seven terabytes, so it wasn't easy to move around for anyone who decided to do this.
[14:45.360 --> 14:51.840]  But it showed up on breach forums, which is a nightmare for me.
[14:52.020 --> 14:55.420]  I mean, five years in, it was bound to happen eventually.
[14:55.960 --> 14:57.940]  But this is the year that it happened.
[14:59.200 --> 15:04.260]  We were able to get that data taken down pretty quickly once we were hoarded to it.
[15:04.260 --> 15:07.980]  But the possibility is still out there.
[15:07.980 --> 15:11.200]  And it's an ongoing issue that we're adapting to.
[15:11.880 --> 15:18.680]  Yeah, this was one of the type of phishing emails that we got.
[15:18.880 --> 15:20.900]  It looks like a legitimate journalist.
[15:20.900 --> 15:24.740]  They have a domain from a newsroom.
[15:25.960 --> 15:31.600]  They referenced an editor who never wrote in to support this request.
[15:31.780 --> 15:35.700]  And I didn't actually send this person the data for that reason.
[15:35.920 --> 15:45.120]  But I think that it's possible that the co-publisher of this dataset might have fallen for this phish.
[15:47.280 --> 15:54.920]  But we then looked into this journalist, and he wasn't a journalist a month after sending this email.
[15:55.100 --> 15:56.940]  He had gone back to working for the government.
[15:57.200 --> 15:59.460]  So that's always phishy.
[16:02.320 --> 16:05.340]  And then overworked volunteers making user errors.
[16:06.180 --> 16:15.780]  I think both of us consider ourselves volunteers as well as staff because we put enough time into it that is volunteer and unpaid.
[16:16.180 --> 16:19.640]  But everybody else in the collective is full-time volunteering.
[16:20.260 --> 16:29.900]  And so as much as we care about the work and about protecting sources and publishing leaks and being a resource to others, you do make mistakes.
[16:30.960 --> 16:42.980]  So what we came up with to deal with this, apart from transparency, and we did speak to the media in El Salvador previous to this presentation to talk about the dataset that got out.
[16:46.280 --> 16:58.720]  Yeah, not to be vague, but this was what we came up with as a solution to prevent phishing in the future and journalists sharing passwords.
[16:59.320 --> 17:07.620]  And we're calling it a library card, because I think that a library card is a concept that a lot of people can relate to and understand.
[17:07.620 --> 17:19.160]  And if I go back to my background training journalists in digital security, that helps to connect it to a concept that they're familiar with.
[17:19.280 --> 17:22.820]  The library card is a symbol of ownership.
[17:22.820 --> 17:24.560]  It's also a symbol of membership.
[17:25.520 --> 17:31.320]  And talking about multi-factor authentication keys is not as easy a concept.
[17:32.340 --> 17:41.160]  A lot of journalists do use them, but for those who don't, we wanted to put it into a format that they could understand.
[17:41.440 --> 17:52.280]  So we are talking about a library card now to access things like Hunter, the search engine that I showed you before, but also our download server.
[17:54.240 --> 17:59.720]  Our reserved download server, the public data server, will still be public to everyone?
[17:59.720 --> 18:08.280]  Yeah, our public data is data.ddossecrets.com, and anybody can go and get the leaks that are public.
[18:08.520 --> 18:19.660]  But for the data sets that are still reserved, that are still going through a verification or a research process, you will now need a physical card in order to access them.
[18:21.720 --> 18:24.940]  But critically, it's not just for journalists.
[18:25.520 --> 18:30.640]  We think that this space should teach people how to do journalism.
[18:30.640 --> 18:49.680]  And if you can demonstrate a research item or background, whether it be a series of TikToks or a blog post that demonstrates some sort of research methodology, we will verify you as a researcher.
[18:50.340 --> 18:57.420]  Especially, like, if you use some of our public leaks and then ask us for reserved leaks, that's really...
[18:58.620 --> 18:59.540]  It's compelling.
[19:00.020 --> 19:06.060]  ...compelling reason to verify you as a researcher and to work with you and to give you access to more data.
[19:08.000 --> 19:09.620]  Also, voting.
[19:10.060 --> 19:28.800]  We don't have the systems in place yet, but we do want to work on more collective processes in the people who request data and have more eyes on the decisions of what gets redacted, what goes into the public stream, what goes into the reserved stream.
[19:29.140 --> 19:37.280]  And we hope that, formalizing this verification process, we will be able to engage more people who will have opinions about these sorts of things.
[19:40.310 --> 19:44.370]  So, I really hope people come volunteer with the Library of Leaks.
[19:45.110 --> 19:51.090]  It is a public resource, and it's larger than the Library of Congress now.
[19:51.290 --> 19:55.690]  So, if that's not a challenge, I don't know what is.
[19:56.470 --> 19:59.210]  I know people in this room like a challenge.
[20:01.750 --> 20:03.810]  I guess I used this slide again.
[20:04.670 --> 20:12.510]  It reminds you that we are working towards the open circle for the Library of Leaks side of things.
[20:14.810 --> 20:19.170]  And also, we are winding down the Board of Advisors.
[20:19.330 --> 20:33.370]  The first structure that I came into the collective on, at the start, I got like a piece of a passphrase, and if I combined my piece of my passphrase with other people on the Board of Advisors, we could revive the Library if something happened to it.
[20:33.610 --> 20:40.530]  The Library is now too big for that, and the Board of Advisors doesn't really fulfill that function.
[20:41.930 --> 20:52.230]  So, we're now winding down the Board of Advisors structure because also we are a non-profit, so we have a board of our non-profit, and it's a little confusing to have two boards.
[20:53.410 --> 20:59.110]  And we want organizers, not advisors, or people just passively giving advice.
[20:59.110 --> 21:05.110]  We want people who are going to come in and run a project and take initiative.
[21:05.710 --> 21:06.310]  Yeah.
[21:06.870 --> 21:25.110]  Advice is wonderful, but unfortunately, the problem with the Board of Advisors in practice has been that there's too much going on that they're a step removed from, and it's hard to get the kind of input that we need from people that aren't part of the process.
[21:25.690 --> 21:44.670]  So that's why we're looking to bring in more people who are familiar with regions and languages that we're not intimately familiar with, as well as specialized topics that, you know, frankly, a layperson would have to spend two years studying to be able to dive into it.
[21:46.050 --> 21:52.350]  Yeah, languages is a really good point, and I didn't write that on the slide, but leaks come in all sorts of languages.
[21:52.650 --> 22:05.730]  We have maybe ten languages proficiency in the collective at the moment, but that's, like, nowhere near the types and variety of languages that are included in the archive.
[22:06.010 --> 22:11.450]  Sixty countries so far, so, you know, we've got a bit of a gap to fill.
[22:13.050 --> 22:18.010]  These are another, like, set of ideas of skills that you can bring.
[22:18.490 --> 22:23.610]  We want to develop a style guide so more people can write articles for the index.
[22:23.870 --> 22:26.010]  They're very basic articles right now.
[22:28.350 --> 22:36.370]  But dataset descriptions, scripts for processing, datasets, like, data comes in all sorts of different formats.
[22:36.370 --> 22:45.990]  Now, a lot of the datasets that come in need new scripts to solve the problems that are in there.
[22:46.870 --> 22:48.830]  Visualizations is something that we haven't really done.
[22:49.010 --> 23:00.130]  We have had offers from people who wanted to make maps or help other people to understand how to orient themselves in the dataset, but we haven't integrated those volunteers successfully.
[23:01.050 --> 23:02.870]  Fundraising, always an issue.
[23:03.130 --> 23:12.270]  Grant writers, I mean, I explained the problems and the challenges of the grant system and the grant givers.
[23:12.670 --> 23:19.750]  So event organizers, designers, researchers, always welcome.
[23:20.570 --> 23:23.010]  Contribute new documents to the library.
[23:23.010 --> 23:25.610]  We don't own leaks.
[23:26.990 --> 23:31.990]  This is our idea of how it can be done, but it's not the only idea of how it could be done.
[23:32.870 --> 23:35.710]  We just saw a gap and we wanted to fill it.
[23:36.410 --> 23:39.830]  And we don't see ourselves as the be-all, end-all.
[23:40.530 --> 23:42.990]  I don't think that computers are going away.
[23:43.230 --> 23:45.490]  I don't think that data leaks are going away.
[23:48.310 --> 23:53.130]  These are some leaks that we don't have, that I get asked for a lot.
[23:55.310 --> 23:57.230]  We don't own leaks.
[23:57.630 --> 23:59.730]  Information does want to be free.
[24:01.650 --> 24:04.670]  So these are books that are missing from our library.
[24:05.270 --> 24:20.010]  If you have these books, if you have source protection to share these books, they're always welcome to come over and live in our stacks and serve other researchers and other journalists.
[24:25.650 --> 24:37.290]  So another change is in the Disclosures Without Borders working group will absorb some of the source protection stuff, the campaigns.
[24:37.870 --> 24:44.530]  And it will also take subscriptions now from the users of the library that are monetizing part of the library.
[24:44.970 --> 24:50.930]  And this can be anything from journalists that pay while they're reporting to think tanks.
[24:51.730 --> 24:55.010]  It has to be a researcher that we would otherwise verify.
[24:55.010 --> 24:58.430]  So they have to be someone who is doing something public-facing.
[24:58.570 --> 25:08.810]  We're still not granting access to the library to people who are purely privately motivated and not sharing any public research.
[25:09.090 --> 25:12.630]  Because the purpose of the library is to serve the public.
[25:13.210 --> 25:23.110]  We get asked for data to feed AI systems or think tanks that just want to serve a private client.
[25:23.270 --> 25:28.350]  And that doesn't really meet our mandate of serving the public and helping journalists and researchers.
[25:29.870 --> 25:40.390]  So we are going to introduce a subscription fee for anybody who wants an embargo and an exclusivity on a data set.
[25:40.470 --> 25:47.030]  Because that is locking the data away in your private entity and you extract profit from it.
[25:47.170 --> 25:47.950]  You get the prizes.
[25:48.610 --> 25:50.410]  So that's something that you can pay for.
[25:50.550 --> 25:54.610]  If you're paying a freelancer to bring you stories, you can pay for access to the library.
[25:54.610 --> 25:58.270]  We do hope that this also helps to fund some of the source protection stuff.
[25:59.050 --> 26:06.730]  If we are expecting a fee from requesters that want these sorts of services.
[26:08.330 --> 26:10.250]  And we are also announcing an award.
[26:11.550 --> 26:13.710]  Emma, do you want to talk about the award?
[26:15.110 --> 26:19.230]  So yeah, this is our first lifetime achievement award for leaking.
[26:19.230 --> 26:38.770]  And we're giving it to Rupinto, who many of you probably haven't heard of, but for the last couple of years has been locked in various legal battles for being a whistleblower and leaker, who provided the football leaks and Luanda leaks, which have had a huge impact in Europe and in Africa.
[26:40.510 --> 26:47.170]  His campaigns have gone largely unnoticed in the United States, unfortunately.
[26:47.810 --> 26:52.330]  But he put himself on the line to get the information out there.
[26:52.550 --> 26:56.570]  He worked with other journalists who processed the data.
[26:57.490 --> 27:05.710]  And while apparently other people may have been involved in the process, he is the person who is named, who has gone through the courts.
[27:06.150 --> 27:14.170]  And this kind of commitment and putting oneself on the line is something that deserves recognition by itself.
[27:14.790 --> 27:24.530]  So as part of our relaunch, we have decided to begin honoring the people who are truly worthy of that.
[27:24.710 --> 27:28.970]  And so our first lifetime achievement award is going to him.
[27:28.970 --> 27:40.490]  And can't think of anyone who deserves it more, and has been more ignored by the wider media attention, unfortunately.
[27:48.820 --> 27:51.080]  Yeah, I mean, that's a huge number.
[27:51.220 --> 27:53.600]  You can't really beat that.
[27:54.320 --> 27:56.420]  So thanks, Rui Pinto.
[27:57.060 --> 27:59.800]  This is the richest woman in Africa.
[28:00.060 --> 28:06.440]  Her father ran the Angola government for a while, and then she suddenly had all these companies that got state contracts.
[28:08.300 --> 28:17.260]  So this was one of the leaks, the Luanda leaks, that Rui worked with the International Consortium of Investigative Journalists on that one.
[28:18.080 --> 28:21.000]  And then the one before that was football leaks.
[28:21.000 --> 28:33.440]  A lot of tax recovery happened in the football world, but also like clubs getting sanctioned for breaking financial fair play rules.
[28:36.240 --> 28:45.900]  The allegations against Ronaldo actually, like they got some money back in Spain, and other footballers had similar stories going on before football leagues.
[28:45.900 --> 28:49.280]  I believe Rui also is responsible for Malta files.
[28:49.560 --> 28:52.640]  So he's been very prolific, allegedly.
[28:53.360 --> 29:07.020]  And I had a chance to attend some of the court hearings in Portugal when the decision was passed down that gave him a suspended sentence.
[29:07.020 --> 29:10.060]  And he has more to come.
[29:10.220 --> 29:15.300]  So that's why we did want to like highlight his case, because there are more charges that he's facing.
[29:18.940 --> 29:20.100]  So, yeah.
[29:20.840 --> 29:22.700]  And also like the Pope.
[29:23.640 --> 29:31.300]  The Pope visited Portugal, and then Portugal brought in some youth amnesty laws that might impact this case.
[29:31.300 --> 29:33.240]  that it's unclear.
[29:33.620 --> 29:37.940]  I mean, Rui was below the age at which the law comes into effect.
[29:37.940 --> 29:39.960]  So that did impact his first case.
[29:40.160 --> 29:42.520]  It's unclear how it will impact the second one.
[29:42.600 --> 29:43.320]  But it's really interesting.
[29:43.500 --> 29:44.540]  I hope people read up on it.
[29:46.700 --> 29:50.700]  He loves football, but he also hates tax evasion.
[29:50.900 --> 29:52.060]  I think it's worth...
[29:52.540 --> 29:54.460]  Can you go back a slide for a second?
[29:54.460 --> 30:04.000]  I think it's worth one forward one pointing out that the next slide after this specifies how many charges he has faced.
[30:04.560 --> 30:07.620]  I think it said 337.
[30:08.060 --> 30:08.860]  Yeah.
[30:09.300 --> 30:18.460]  Or 377 new charges in addition to the legal processes that he's already gone through and faced.
[30:18.460 --> 30:25.060]  So, you know, when we say like, oh my gosh, he has had the state go after him hard.
[30:25.060 --> 30:27.200]  He has had oligarchs go after him hard.
[30:28.240 --> 30:29.540]  We are not kidding.
[30:29.940 --> 30:30.500]  This is...
[30:36.180 --> 30:37.300]  The number...
[30:37.300 --> 30:41.420]  I can't even imagine having to face that many charges.
[30:41.920 --> 30:43.620]  I don't think any of us could.
[30:45.640 --> 30:49.520]  It's like every single email that was...
[30:50.180 --> 30:52.400]  every single email account that was impacted.
[30:52.760 --> 30:57.040]  They made a new charge for simplifying it.
[30:57.220 --> 31:01.800]  But yeah, the court system in Portugal is very interesting.
[31:01.960 --> 31:02.620]  There's no jury.
[31:02.960 --> 31:07.740]  Every case is decided by judge and they also don't go on precedent.
[31:08.080 --> 31:16.820]  So the judge has like omnipotent power to decide in each case, a panel of judges usually.
[31:16.820 --> 31:19.860]  But yeah, it could go either way.
[31:19.960 --> 31:21.020]  It depends what judge you get.
[31:23.520 --> 31:25.080]  I agree with Pink Floyd.
[31:25.620 --> 31:31.180]  How cool would it be that there was suddenly another 800,000 documents explaining everything?
[31:33.360 --> 31:34.280]  If only.
[31:35.180 --> 31:35.740]  Yeah.
[31:36.680 --> 31:43.640]  I just wish that they funded the actual leaks and not just like the showmanship.
[31:44.520 --> 31:48.480]  So come find us on the Internet and on a torrent tracker near you.
[31:49.140 --> 31:50.300]  This is our website.
[31:50.400 --> 31:56.300]  We just published a new version of it, so it's probably got some bugs to work out, but it's beautiful.
[31:57.680 --> 32:01.120]  We're centralizing donations in the Open Collective, as I explained.
[32:01.600 --> 32:03.840]  We're hoping to get newsrooms to subscribe there.
[32:04.100 --> 32:08.320]  We're also going to start putting our newsletter there and in other places.
[32:09.160 --> 32:09.760]  Corey.
[32:12.240 --> 32:12.540]  Telegram.
[32:13.500 --> 32:17.760]  We put torrents up on Telegram usually first to find seeders.
[32:17.760 --> 32:18.560]  It's a good place.
[32:18.560 --> 32:22.840]  If you want to seed torrents, just definitely subscribe to the Telegram feed.
[32:23.420 --> 32:27.480]  Mastodon is for quips and jokes and links.
[32:28.640 --> 32:29.960]  Two different GitHubs.
[32:30.260 --> 32:31.900]  The first one is our new website.
[32:32.840 --> 32:33.460]  The second one is us.
[32:33.800 --> 32:36.180]  And that's my signal, you know, just in case.
[32:36.740 --> 32:40.640]  If you're wondering why Twitter isn't on there, it's because we're still banned.
[32:41.020 --> 32:45.900]  And to this day, you can't even post the URL for our domain on Twitter.
[32:45.900 --> 32:50.280]  So, you know, come hang out with the cool kids on Mastodon.
[32:50.540 --> 32:53.140]  Because apparently leaks are too dangerous for Twitter.
[32:58.860 --> 33:00.460]  We do have some time for questions.
[33:00.640 --> 33:01.120]  I love questions.
[33:02.960 --> 33:07.960]  If anyone has any questions, you can come up to the mic stands and...
[33:16.540 --> 33:16.980]  Hi.
[33:17.500 --> 33:22.140]  So, obviously, no matter which side of the game you're on, source protection is the most important thing.
[33:22.360 --> 33:24.920]  Source protection is how the whole thing works.
[33:24.920 --> 33:25.780]  But...
[33:25.780 --> 33:32.300]  Could you talk maybe a bit about, like, what that looks like in a practical sense from your perspective?
[33:32.640 --> 33:35.100]  And what lessons we can learn from...
[33:35.100 --> 33:36.340]  Like, I'm sure...
[33:36.340 --> 33:40.080]  I don't know of any failures of source protection when it comes to leakers, specifically.
[33:40.720 --> 33:46.540]  But if there are lessons that could be learned for other journalists dealing with source protection from your experience.
[33:48.440 --> 33:53.220]  So, when it comes to source protection, it's very much a case-by-case basis.
[33:53.920 --> 33:57.840]  We would love to have a one-size-fits-all solution.
[33:57.840 --> 34:14.880]  But it depends on the technical proficiency of the leaguer, how well they're able to take care of things on their end, in terms of protection, the size of the data, the nature of the data, and what the different concerns are that they have.
[34:14.880 --> 34:26.620]  For some sources, one reason the data isn't made directly public is because that would make it very easy to figure out, oh, who could have accessed this?
[34:26.620 --> 34:40.280]  Because, you know, when you have the exact scope, when you have the exact files that you can look at and compare, especially if you're dealing with an insider, then the traces become a lot bigger and more clear.
[34:40.880 --> 34:55.820]  In many instances, the solution is simply communicating securely with the source, providing them with a way to get the data to us, and then acting as a firewall for communicating with other journalists.
[34:56.840 --> 35:09.220]  That bit of disconnect has proven pretty essential at times, especially since there are journalists who are unfortunately overly interested in doxing sources.
[35:09.700 --> 35:18.840]  We have had arguments with sources, not with sources, with journalists at times, because they've repeatedly pushed about, oh, who is this source?
[35:19.100 --> 35:23.700]  What exactly are your concerns about, you know, protecting this source?
[35:23.700 --> 35:31.720]  And you can't have those kinds of explicit conversations all the time, especially without saying more than you would like to.
[35:34.920 --> 35:47.100]  Have you explored doing journalist boot camps or two-level webinars like a Fundamentals and a More Advanced for Journalists?
[35:47.180 --> 35:52.220]  I know that the National Institute of Computer Assisted Reporting, NICAR, does these all the time.
[35:52.220 --> 36:05.120]  The investigative reporters and editors do things like this, but maybe they'd even be willing to partner with you on offering some sort of leak-related or large dataset-related tools for journalists.
[36:05.180 --> 36:10.840]  Because I think that's where the bottleneck is, that journalists, a lot of them are interested, but they have no idea where to sort of start.
[36:10.840 --> 36:11.400]  Yeah.
[36:11.440 --> 36:16.080]  And there's a few of them who are very good at it, but there, you know, there's only a few of them like that, so.
[36:16.240 --> 36:16.460]  Yeah.
[36:16.860 --> 36:18.320]  So I think that's a really good question.
[36:18.620 --> 36:20.500]  Um, we have thought about that somewhat.
[36:20.880 --> 36:26.380]  And I think it's something that we would like to do, especially if we're able to bring more people on.
[36:27.200 --> 36:36.560]  Uh, one of the bottlenecks that we faced is, while we know how to do some things, we don't know how to teach people.
[36:37.080 --> 36:38.660]  That's its own set of skills.
[36:39.100 --> 36:46.900]  And personally, I struggle at times to articulate what the process is for doing different parts of this.
[36:47.260 --> 36:49.420]  You know, someone will ask, oh, well, how did you do this?
[36:49.480 --> 36:50.920]  And I just, I'm like, what do you mean?
[36:50.980 --> 36:52.080]  You just, you do it.
[36:52.720 --> 37:06.820]  Because I've been doing it for so long, I've immersed myself in it, that, you know, it's like that ex-KCD comic about, oh, you can't, once you know something too well, you have no idea what it's like for the people that don't.
[37:07.460 --> 37:20.720]  So, you know, we would like to have more involvement from people like Micah, who, you know, wrote a book explaining how to do this stuff, and people who are experienced at communicating these ideas and these processes to people.
[37:21.760 --> 37:23.960]  to then, like, instruct other people.
[37:24.840 --> 37:33.440]  And, yeah, I think if we can find the right people to partner with on that, that would be a great, a great thing for us to do in the future.
[37:33.680 --> 37:38.160]  But, at this time, you know, I'm a terrible teacher.
[37:40.000 --> 37:41.460]  I can jump in on that as well.
[37:41.580 --> 37:49.340]  I did try to join the IRE, and they wouldn't have me, because I don't have any bylines in the five years that I've been publishing leaks.
[37:49.940 --> 37:51.400]  So, yeah.
[37:52.000 --> 37:56.440]  I attended NICAR, but they wouldn't let me join as a member.
[37:56.720 --> 37:58.300]  I know they do a lot of good trainings.
[37:59.740 --> 38:03.320]  You have bylines from before, though, but that's not good enough, apparently.
[38:03.720 --> 38:03.720]  I do, but those don't count.
[38:03.720 --> 38:07.280]  Like, the Twitter rule has got to be within the last six months, or you're not a journalist.
[38:09.880 --> 38:19.980]  But, yeah, it's... I think I see Dida Secrets as a lot of skill-sharing, and, like, people who join, who have something to teach, will do it one-on-one.
[38:20.220 --> 38:30.280]  And there are a lot of people like that in the collective who love, like, sharing their skills, but maybe not in, like, a classroom setting, maybe more one-on-one.
[38:31.180 --> 38:34.880]  And I see myself in that category as well.
[38:35.220 --> 38:41.600]  I like talking to journalists to help them level up on certain things and learn alongside them as well.
[38:42.520 --> 38:48.180]  And, yeah, get Micah Lee's book, Hex, Leaks, and Revelations, because it's like a textbook.
[38:48.620 --> 38:53.140]  And it starts from zero, so anybody can pick it up and learn.
[38:53.140 --> 39:01.360]  Yeah, the physical copies are for sale, but if you're not able to afford that, his website does have a free version that you can download.
[39:02.320 --> 39:04.180]  I'm not sure who's...
[39:04.180 --> 39:14.620]  Could you clarify your strategy for stable, permanent storage, besides relying on torrents for distribution?
[39:14.620 --> 39:19.160]  And also, do you de-identify PII or just strip it?
[39:19.660 --> 39:25.840]  Do you have any de-identification or anonymization technology for PII?
[39:26.140 --> 39:41.540]  So we have a stable data server that hosts all the public information, and that acts as a central repository that, if the torrent ever goes out of circulation, people can access it there.
[39:42.840 --> 39:48.920]  Do you have a single such server in a specific jurisdiction?
[39:49.580 --> 39:51.820]  I mean, that would be of concern to me.
[39:52.520 --> 40:00.060]  Well, that's one reason why the data is spread through torrents, which has also allowed us to save millions of dollars in network fees.
[40:00.460 --> 40:06.520]  Every time someone downloads it, it becomes a new copy, and it's a reinforcing process.
[40:06.520 --> 40:10.340]  But yeah, we are looking at further expanding that.
[40:10.520 --> 40:20.680]  However, one of the problems with these servers is you can't rely on most data centers and most jurisdictions.
[40:20.680 --> 40:24.540]  We've partnered with FlokiNet, which has been wonderful about this.
[40:24.700 --> 40:26.760]  They are very strong about supporting whistleblowers.
[40:26.760 --> 40:33.800]  They've told takedown requests to go fuck off and posted the notices on their website.
[40:35.020 --> 40:44.640]  And one of the things we're looking at and building for the near future is encrypted backups of our reserve data, which people will be able to copy themselves.
[40:45.420 --> 40:54.700]  And if you go onto the website, in the top menu, there is a guide on how to mirror our data en masse and how people can automate that process.
[40:54.700 --> 41:15.700]  But unfortunately, when it comes to dealing with just the public data server alone holds currently over 60 terabytes of data, getting that redundant on multiple systems that have stable drives and are constantly online is incredibly expensive.
[41:15.700 --> 41:23.060]  And there's no way to rely on most cloud processes and servers because Amazon owns half of them.
[41:24.440 --> 41:29.340]  I work at the Internet Archive, so I'm concerned with this problem.
[41:29.920 --> 41:42.280]  Yeah, and I mean, it's... I was gonna say, I mean, these definitely are challenges, and we're not gonna pretend that, oh, we have everything perfectly figured out.
[41:42.540 --> 41:49.980]  And that's one reason why we want more involvement from other people, because they bring outside knowledge and outside perspectives.
[41:50.660 --> 41:59.400]  And, you know, frankly, at this point, we have, you know, about a dozen people that are collectively wearing a hundred hats.
[41:59.860 --> 42:08.740]  And, you know, none of us can be sufficiently experienced and proficient in all of those different things.
[42:10.680 --> 42:12.080]  Okay, we're getting low on time.
[42:12.320 --> 42:13.960]  Question for Emma Best.
[42:14.220 --> 42:14.660]  Okay.
[42:14.660 --> 42:18.660]  Uh, Intelligencer article described your past employment with Wikistrat.
[42:19.640 --> 42:28.420]  And, uh, Der Spiegel kind of just characterized it as a, you know, road to Damascus, saw the light and change your views kind of thing.
[42:28.820 --> 42:39.140]  Um, and then you're, you have a blog post, one, two, three things you learned at the CIA, which seemed to be like a very humorous kind of rebuttal to Internet gossip or something like that.
[42:39.140 --> 42:54.840]  So I was wondering if you could give a very boring, bland, resume-like answer to, without the humor and irony and parody, but of your past, uh, U.S.
[42:54.940 --> 43:06.740]  government employment, including but not limited to military, as well as, uh, past or current employment, uh, for contractors for the U.S.
[43:07.020 --> 43:09.120]  government, including but not limited to spy agencies.
[43:09.120 --> 43:12.820]  So, start date, end date, job title, reason for termination.
[43:14.140 --> 43:21.380]  So, uh, before I got involved in transparency work, I did work as a subcontractor.
[43:21.380 --> 43:24.400]  One of the places that I worked with was Wikistrat.
[43:24.640 --> 43:39.860]  They did crowdsourced analysis, and after I started to, you know, move away from that sort of thing, they got involved in some stuff relating to 2016 election crap.
[43:39.860 --> 43:42.840]  It's a whole mess that is definitely worth Googling.
[43:43.560 --> 43:49.220]  Um, I never worked directly for the U.S.
[43:49.380 --> 43:51.180]  government or any other government.
[43:51.500 --> 43:56.360]  I did not work in any capacity for CIA.
[43:56.920 --> 43:58.740]  That list is satirical.
[43:59.020 --> 44:05.620]  There's, uh, a small handful of entries that are very loosely inspired by real things.
[44:05.620 --> 44:13.460]  Half of them are historical in jokes, like CIA hiding things in the wall of headquarters, which they actually did that twice.
[44:14.480 --> 44:21.620]  Um, I have not had any association with the government for...
[44:23.380 --> 44:26.800]  It's 2024, so...
[44:27.840 --> 44:31.770]  Eight, nine years it's been since I've been a subcontractor.
[44:34.920 --> 44:36.880]  Uh, what about military?
[44:37.640 --> 44:39.600]  I've never been in the military.
[44:40.080 --> 44:42.360]  Any other contractors besides Wikistrat?
[44:43.520 --> 44:44.380]  Yeah.
[44:45.220 --> 44:46.280]  Can you name them?
[44:47.640 --> 44:48.680]  Not at this time.
[44:49.420 --> 44:54.220]  But I can say that I would be very shocked if anyone here had heard of their names.
[44:55.660 --> 44:56.220]  Um...
[44:56.220 --> 45:00.800]  The main one that I did work with was a startup called Red Earth Intel.
[45:01.660 --> 45:09.180]  It did not last very long, and it was focused on environmental crime, countering trafficking, and that sort of thing.
[45:09.820 --> 45:18.460]  That was actually the experience that ultimately led to me deciding that, you know, working within the system was not the way to go.
[45:18.640 --> 45:25.520]  I had believed that, oh, if the right people show up and do the right things, you can make the difference from the inside.
[45:25.700 --> 45:27.180]  You know, be the change and all that.
[45:27.180 --> 45:35.200]  Uh, but during one investigation, we were looking at a World Bank project, and when dealing with one of the...
[45:35.200 --> 45:39.120]  I think the title was Vice President of Integrity or something to that effect.
[45:41.200 --> 45:41.720]  Um...
[45:41.720 --> 45:51.220]  Our phone call ended in a shouting match, because they wanted us to hand over our source and all of our information to some of the people that were being investigated.
[45:51.220 --> 45:56.140]  And people had already been found dead as part of this.
[45:56.480 --> 46:03.960]  And that was when I basically realized that, oh, the system doesn't want to change for a lot of various reasons.
[46:04.960 --> 46:08.960]  And that's when I began to distance myself from things.
[46:09.280 --> 46:10.040]  Thank you.
[46:11.080 --> 46:11.940]  Thanks for your question.
[46:12.140 --> 46:12.720]  Three minutes.
[46:12.880 --> 46:14.060]  All right, so I think last question.
[46:14.620 --> 46:20.580]  Uh, yeah, what is your procedure for dealing with internal disputes between newsrooms and journalists?
[46:20.580 --> 46:23.500]  You might have a newsroom who was footing the bill for subscriptions and so on.
[46:23.600 --> 46:32.480]  And they say, hey, we fired so-and-so because incompetence or malice, and we need you to revoke their card and send us a new one, by the way.
[46:32.820 --> 46:35.680]  Versus that journalists might say, yeah, I was just fired because their...
[46:35.680 --> 46:40.060]  The new owner put a lot of pressure on the newsroom and killed me out of the story.
[46:40.140 --> 46:41.780]  This isn't an unusual story.
[46:41.920 --> 46:42.780]  We're individually... So how do you...
[46:42.780 --> 46:48.440]  What is the procedure for dealing with conflicts between newsrooms, as far as I say, maybe paying bills, and journalists?
[46:48.440 --> 46:52.580]  But they may legitimately say, this person no longer works here because we don't trust them.
[46:52.660 --> 46:54.440]  How do you handle that situation?
[46:55.820 --> 46:56.780]  I think you're better.
[46:57.040 --> 46:59.440]  Yeah, it's case by case.
[46:59.720 --> 47:00.580]  It does happen.
[47:00.740 --> 47:02.980]  I mean, journalists change jobs a lot.
[47:02.980 --> 47:04.060]  They move around.
[47:04.460 --> 47:07.440]  We tend to work with the individual and not the brand.
[47:08.380 --> 47:16.100]  We don't have any exclusivity deals with any of the newsrooms or the networks that are often competing with each other.
[47:16.400 --> 47:30.360]  Some networks only want to deal with one news brand per jurisdiction, but we don't engage in that way with the problem of the silos that journalists make for themselves.
[47:30.360 --> 47:44.380]  We work with people, and if your background is clear from the different places that you've worked, we'll keep working with you, even if you're not at the big newsroom that you used to be at.
[47:46.540 --> 47:52.220]  But yeah, I mean, there's so many stories that I could go into, and I won't.
[47:52.380 --> 47:55.980]  Because I protect my sources, even if they are journalists.
[47:55.980 --> 47:56.120]  Yes.
[48:00.910 --> 48:01.650]  Thanks, everyone.
[48:01.830 --> 48:02.610]  Yes, thank you.