Our weekly Briefing is free, but you should upgrade to access all of our reporting, resources, and a monthly workshop.
This week on Indicator
Craig published the video, slides, and transcript from our workshop on how to use AI to build custom tools and automated skills for investigative workflows. Our guest speakers Eitan Livne and Tom Vaillant explained how they built tools and shared advice. Our next members’ workshop will be at the end of September.
Deception in the News
📍 Apple announced Reference Image for the iPhone 18 Pro, a feature that cryptographically signs photos at capture to establish provenance (see Aug. 14 Briefing). It described the feature as akin to a "digital negative.” Apple also said it will integrate Google’s SynthID watermarking standard to “help users identify images generated or edited with AI.” Verification and digital forensics experts like Hany Farid and Sam Gregory are cautiously optimistic.
📍 Ars Technica reported that a bipolar man who experienced serious self-harm is suing OpenAI because “ChatGPT exchanges allegedly pushed him so deep into a delusional spiral that he first believed he was Jesus, then that ChatGPT was God, and finally that he should attempt suicide to ‘come home’ to Jesus/ChatGPT.”
📍 The US Embassy in London raised “serious concerns” about a controversial British government green paper on promoting “trustworthy content” online. Its submission to the public consultation actually includes some reasonable questions, including: “what specific criteria will be used to determine whether an outlet is sufficiently trustworthy? Who will make such determinations? How does an outlet establish sufficient trustworthiness? Will these criteria be made available to the public?”
📍 The Thames Valley Police arrested a man who they believe is behind deepfake porn videos of several British politicians and celebrities.
📍 Anthropic said it disrupted several influence operations originating from Bangladesh, Iran, Kenya and other parts of the world. The report also found evidence that Russian state media used Claude to repackage content from other outlets.
Tools & Tips
📍 Saad Sarraj shared a technique for extracting owner data from Stripe checkout pages. Open your browser’s Developer Tools and search for fields like “business_url,” “support_email,” and “support_phone.”
Sarraj said that “business_url may point to another site run by the same operator. I've found secondary storefronts this way.” If you find a support email or phone number, you can check them in breach databases or reverse lookups. — Craig
📍 Telegram-bot-dumper is a new free tool from OSINT builder Soxoj (creator of Maigret and other tools). It takes a Telegram bot token and reconstructs the bot’s content and interactions, including its direct-message history and data about users who messaged it. While tokens aren't public, they frequently leak in code repositories, applications, and CI logs. Soxoj said it’s useful for “pentest, recon, malware analysis.” Just remember you'd be reading people's private messages, not a public profile. Check if your organization’s ethical guidelines allow you to use the tool.
📍 Benjamin Strick published the latest edition of his Field Notes newsletter. He looked at “how tech supports disaster situations, especially after the horrible Nepal floods.”
📍 A short thread on the OSINT Subreddit explained how to retrieve an X account’s user ID via the Wayback Machine, allowing you to trace handle changes.
📍 Iain Overton wrote a “Guide to Investigating Tech and AI in Modern Warfare” for the Global Investigative Journalism Network.
📍 The Data and Research Centre published, “Exploring OpenAleph: A Practical Guide to Investigations.”
📍 Columbia Journalism Review published, “The Future of Visual Investigations, If We Can’t Trust Our Eyes.” It asked journalists and experts “how, in the age of AI, technology is transforming the work of visual forensics.” (Craig is quoted.)
Events & Learning
📍 The Global Investigative Journalism Network is hosting a free webinar on Oct. 6, “Investigating Technology and AI in Conflict.” Info and registration here.
📍 Open Ownership is hosting a free webinar on Sept. 23, “Beneficial Ownership Transparency Evidence Centre launch.” Info and registration here.
📍 The next OSMOSISCon OSINT conference will be May 23 to 25, 2027 in Las Vegas. The speaker submissions portal is open.
Reports & Research
📍 Aleksandra Atanasova of Reset Tech published “Monetized Slopaganda,” an in-depth report analyzing how “social media monetization programs are incentivizing a new industry of AI political clickbait and news impersonations.” The full report is worth a read, but here’s one key finding:
Social media companies fail to enforce their own guidelines about inauthentic behavior. Companies based in Pakistan, Vietnam, and Sri Lanka, along with amateur creators and freelancers from multiple countries, are behind the investigated campaigns. Many of these accounts operate in coordinated networks while systematically violating platform policies on inauthentic behavior, impersonation, spam, misinformation, and prohibited practices such as engagement baiting.
📍 The Atlantic’s Ali Breland joined a Discord for a pro-Republican clipping service that “pays huge sums of money to people—many of whom appeared to be outside the U.S.—to push video clips from accounts designed to look like those of ordinary Americans spontaneously touting reasons to favor the GOP.”
📍 The Tech Transparency Project found more than 300 ads on Meta showing AI-generated CSAM, including some representing real children. Matt Burgess has the write-up in Wired.
📍 A Futurism investigation uncovered widespread AI-generated videos on Facebook depicting child abuse. These include videos of “a toddler being struck in the face with a frying pan,” “adults pouring snakes and cockroaches on weeping kids,” and “young Black children being whipped or beaten by white adults as they perform manual labor in what looks like a colonial African setting.”
📍 CBC’s Visual Investigations team and Radio-Canada’s Décrypteurs revealed that a network of fake news sites and Facebook pages were tied to a Vietnamese firm called HTV Network.
📍 Marc Owen Jones tied four news sites to a coordinated campaign leveraging Meta and LinkedIn ads to attack the Sudanese Armed Forces and its allies.
Indicator is a reader-funded publication.
Please upgrade to access all of our content, including our how-to guides and our live monthly workshops.
