Good morning, everyone.
My name is Hervé and I'm French.
Sorry, my English is not very perfect.
It's not my mother tongue.
I work for an NGO called Open Factor, which is a French NGO.
I'm going to talk about it right now.
It's a self-funded NGO based in France.
We created it in 2019.
Our initial goal was to try to federate the Francophone Ozynt open source intelligence scene.
As we noticed that the Anglophone one was pretty active and brilliant with Bellingcat, for example, people like that.
So we decided to create this NGO and we wanted to assist the newsrooms and activists on Ozynt even investigation.
We also wanted to train journalists about what we knew about and also wanted to promote young journalists based in France
in order to help them to get some skills on Ozynt, which is a kind of a pragmatic way to find a job in France right now.
As we are an NGO, a self-funded NGO, we also wanted to set up some philanthropic projects.
We trained investigative journalists from Syria, which are relocated in Europe.
We also did some programs in West Africa, the Francophone area.
The NGO today is about 260 members and it's still counting.
About me, some of the work first, we participated in some of pretty cool investigations,
such as Greenblood for a media called Forbidden Stories.
We also published some things and worked on things for BBC, for the French television on the Wagner group, for example.
We also won a prize with Swiss TV for a documentary on war crimes in Syria, in Ukraine.
Recently, we published two recommendable reports on Infos.
I don't know if you've ever heard about that.
It's a Russian company backed by the Russian intelligence.
We also worked on that and tried to dismantle their network of disinformation inside their border.
About me, I'm not a coder, obviously, as you probably see.
I'm the co-founder of the NGO. I'm a former judicial investigator.
I'm an open source software enthusiast.
I used to compile Linux kernel since 1999 or something like that.
I'm an open source software enthusiast and evangelist.
I'm a techie, but not a coder.
I consider myself rather like a Swiss army knife.
I'm very lazy and believe me, if you want to solve a problem, hire a lazy guy or a lazy woman.
I'm very curious.
What about disinformation?
This topic is about disinformation.
Disinformation is, as you probably know, false information that is deliberately spread by an actor in order to deceive people.
There is a fantastic researcher called Ben Nemo.
He tried to resume this concept using the 4D's acronym.
The first one is dismiss.
The other one is distract.
Distract the people, of course.
Distort the truth and also dismay.
So that's a very good way to define disinformation.
It's an art for several actors. You can compare CTI and disinformation.
There are some overlaps between these actors.
There is a very great investigation.
All the links are in the presentation.
There is a really cool investigation called Doppelganger by the EU Disinformation Lab.
I strongly recommend this report about media clones serving the Russian propaganda.
I'm going to switch from time to time in the presentation.
Disinformation is about war but also health, politics, economy.
It covers mostly every topic, actually.
Of course, internet and the web are probably the greatest echo chamber that they use.
In France, we have such a problem.
We have a problem with QAnon.
There is a website called Cactus in France.
It's called Cactus.
It's for news and Cactus, the tree.
QAnon is an American political conspiracy theory and political movement.
I'm pretty sure you heard about it.
It's mostly far-right based.
It appeared on the net in 2017.
This French website is, of course, Conspiracist.
It's all about anti-vax and it's also very anti-semitic.
It's a problem.
It's present on several platforms such as, of course, the web, but also Telegram, Twitter, Gabber, etc.
All the network.
It has some kind of translated content.
As soon as you arrive on a web page, it depends on the language,
but you can get the news automatically in French or in English.
This is via Tor, the Tor browser.
It's basically in English, but you can also save it in French, for example.
Most of the readers are French or Francophone.
It publishes five or seven articles a day, mostly crap.
It's always crap.
It has more than two million visitors per month, so it's not nothing.
It's a lot of people.
I have a personal blog and I have an open-factor blog and we don't have two million visitors a month.
I can assure you.
Since it was open, it re-vendicates more than 80 million visitors.
It's kind of big things.
It's one of the most productive Q&A websites.
In order to make the investigation, we needed a methodology on this information.
There is a very good framework called the ABCDE, very easy to remember.
It's a good start. A stands for actor, so who is doing the disinformation campaign?
The behavior, how?
The content, what about the content, of course?
The degree, it means the scale of the disinformation campaign.
And the last one, he.
He was added later, but he means the effect that is looking by the actor.
So if we based our research at open-factor for cactus, we would say something like,
what is cactus? What's its audience?
Its environment, ecosystem, its influence, its motivation, above all.
And last but not least, if we can identify who is behind the cactus,
it's really cool for us as journalists.
So we decided to approach this by trying to qualify the environment.
And in order to do that, we used three different tools that I mentioned as a sweet combo.
The first one is HIFE, and it's a tool that was made.
Most of these tools were made by the Media Lab Sciences Po,
and HIFE is one of the greatest ones.
It's a tool that you can download on your computer, and it mostly scrapes the web,
starting from a URL, and you can build a web corpus of all the websites
that are connected to this website by the links inside the article.
So it was very cool to use with cactus,
because the most important activity of cactus is writing articles, as I mentioned,
but inside they put links to other articles, sometimes legit,
sometimes links that lead you to other conspiracies websites.
So kind of a long process, because right now, at the moment of the investigation,
cactus had about 8,000 something articles on the website.
So it took me a long time to scrape everything,
and I had to go to the level two in order to scrape the link from the website
that were cited by Kyaktu, if I'm clear about it.
So I had to go at a level of two.
It works pretty well with a caveat.
There are some limitations with HIFE, especially one that really bothers us.
It's Cloudflare, sorry for the typo,
because as soon as you arrive on a Cloudflare website,
and a lot of websites are protected by Cloudflare, you cannot scrape it.
You cannot scrape them with HIFE, but it works pretty well.
Actually, not on my computer.
I tried at the hotel yesterday night, and it doesn't work, but believe me, it works.
So I scrapped the links.
I'm going to show you the result after that.
The first tool that I combined with HIFE was, of course, Jeffy.
I've been an enthusiast of Jeffy since probably 2011 or something like that,
and it's a very interesting tool to explore and analyze graphs,
and especially if you try to use the modularity algorithm to determine subcommunities,
and it's a brilliant tool that I'm sure you already know about.
And the last one was important for us as journalists.
We tried to illustrate our articles with images and graphs, et cetera,
and it's very difficult to render graphs on websites,
so this tool is brand new, and one of its authors is in this room, actually,
and I'm super happy to know that.
And it's Retina, and Retina offers you the opportunity to import a graph inside your website
and to dive into it and to analyze it,
or at least to help the people try to understand it, and that's really cool.
So that's what we got, and I'm going to show you the rendering of the article.
So this is HIFE, and based on these three tools,
what I tried to do is to illustrate the environment of the website.
So the first one at the top level is Cactus,
and all these websites were at least once mentioned in the articles,
and then all the websites also cite the other one.
And here, for example, you can reach the American disinformation network.
You've got the Francophone one here and the Canadian one here.
So it's very interesting to see where Cactus is in the middle of everything,
so I tried to illustrate the graph like this,
so it gives you with this three tool a very good idea of the environment of the website.
What you can see inside also are some legitimate websites,
such as Mediapart, for example, or YouTube, et cetera, et cetera,
and that's one of their techniques in order to lead some activity on the website.
They link regular websites and also conspiracies websites.
It's in order to increase their SEO, their ranking on Google, for example,
so it's very important to put legitimate and disinformation websites.
So that was the first part of the investigation purely made with the open source software.
The second one was the influence, and it's rather usual to do that,
so we needed a good scraper for Twitter.
Our idea was to have an idea on how the disinformation could escape
from their traditional networks, such as Gabe or Parler, for example,
and to escape from this platform to go to mainstream platforms.
So Twitter used to be a very good platform to analyze.
I don't know what's going on, and I don't know what it's going to be within a few days,
but Essence Scrape is a cool tool to do that.
I don't know if you heard about it.
It's a scraper for Twitter.
So what we did basically was to extract all the tweets from its creation
that had a link referring to cactus.fr, which was the website.
We wanted to know about its activity, so you just basically open a terminal
and you copy-paste this.
I'm not going to export to it first, but what you receive, I hope my connection is okay.
Yes, so you get all the tweets, you can grab a cafe, you don't have to scroll,
and when you come back, you get all the tweets.
So there are approximately 124,000 tweets that talk about it.
Once again, it's not nothing.
And you can export that as a JSON file.
Here.
So it's going to work, blah, blah, blah, blah, blah, blah, blah, blah, blah, blah.
I'm going to break it right now.
Once you have these tweets, you have to scrape them and you have to wrangle your data.
And I used another tool called OpenRefine.
You probably know about OpenRefine.
It's a powerful tool to cleanse.
And there is a wow effect for journalists especially with this tool that I like.
It's how it deals with JSON file.
So this is going to be maybe possible.
So you open the text like this and it knows how to render JSON file in CSV,
which is a format that we all like when we do data journalism.
So you can now analyze all the data that you have.
So that's why I love OpenRefine.
And also when you want to do some clustering.
And the last one was, of course, R anti-diverse.
I'm not going to dive into R anti-diverse.
You have had several presentations and that.
But these tools are really easy because R is an easy language for statistics,
easy syntax, very readable when you don't know how to code.
And this is really important for newsroom.
For example, most of the time, future journalists know how to code.
So having a code that is readable is important.
You get a quick overview.
So we've got 10 minutes, yes, thank you.
It's very convenient for prototyping and important also, reproducibility.
But if you want, you can use Python.
I don't want to enter the war between R and Python.
The motivation.
The motivation, we use Firefox and we dive into the source code.
And this one was pretty easy because QA2 has a Google ad program inside.
So every click that you made on this web page gives you some money.
So this is the main motivation apart from the ideology.
And about the identity, all the tools that we got from GitHub,
Holyhead, Jint and Sherlock.
These are command line tools that are packaged right now
by a French company called APOs.
But you can use them on your terminal
and it will help you to dive into the nicknames
and the mail combination on websites.
We also used some leaks, but we found out who was Patrick behind this website.
So let's wrap this up.
First of all, I want to talk about the myth of a single tool in Hozind.
Most of the time when I say to people,
well, I'm a journalist or I work on Hozind,
they say, oh, which tool do you use?
There are several tools.
There is no single tool in Hozind.
And you've got to mix everything.
About this investigation, this guy, Patrick, is a retired IT technician
in a lost town in the middle of France.
He's a completist, but as we saw,
he's in the middle of a bubble of a completist influence.
He earns approximately $4,000 a month just by writing crap.
So it's very important for us and for the audience to know him
and to how to him on the website.
Patrick, we know who you are.
That's my thing.
Why do we use open source software?
Because they are powerful, adaptable.
They respect your privacy and repress your reproductability.
I don't ever know how to pronounce this word.
Most of the time, these tools are free, which is really important.
And I insist on that.
Junos, we don't have money.
And when you go to Africa and train NGOs, for example, or journalists,
it's very complicated to buy software for them.
They don't even have regular machines.
So having open source software is really important.
So thank you, you all.
If you code for open source software, it's really important for civil society.
Thank you.
The last one, collaboration.
I didn't talk about collaboration.
When you're in the room today, it's important for us to mention
that collaboration on how our investigation is the key.
First of all, by software, but also in order to share information
and to share indicators of confirmation, for example.
So data capitalization is important.
And there is this project called OpenCTI that I hope we will try to impose
in Europe as a tool.
It's an open source tool.
And we'll try to impose it as a standard with the disarm matrix.
It's called disarm.
All the links are in the presentation in order to get some cooperation.
Thank you very much.
Thank you.
Let's spare a thought for Patrick and on with the questions.
Yes.
You mentioned you used some leaks.
Is that a leaks that you have friends that gave you information?
Or is it that you found things that had been put inadvertently in the public space?
Second one.
What we tried to do when we do something.
Sorry.
I mentioned the fact that we use leaks.
And the question was, is this information that some friends give me
or information that is publicly available on the internet?
That was a question.
The answer is, as OpenFactor is an NGO, we don't have friends.
So we use public leaks.
We dive on telegram, the darknet, et cetera.
And we use basically keywords, passwords, and emails in order to make connection
between nicknames and try to identify people like this.
That's what we do.
Thank you.
We also have a sort of, I'm a former investigative journalist,
investigator, so what I try to do is sort of judicial methodology.
So we try to open everything in our investigation,
and we mention all the information that we get.
If we get a link from somewhere on the internet,
we will explain where we got the leak every time.
Transparency is important.
Another question here?
Yeah.
Are you Jewish?
No, I'm not.
OK.
The question was, am I Jewish?
No, I'm not.
No, no, no, no, no.
I'm not Jewish.
Other question?
Yes.
I mean, you mentioned like one particular person that you identified,
but I mean, I guess there are more people.
What is the scope of like the success of those information?
We try to, so the question is that we identified one person
behind this website, and there are probably more people
and more website like this.
So we are just a bunch of cool people working behind their computer.
So we try to do our best, but at least we have one website
which is really influential.
So we start by the most productive website that we want to investigate,
but of course there are millions, not millions,
but thousands and thousands of people doing these kind of things.
We do what we can, and we try to inspire other journalists
in order to make their own investigation
and to out these kind of people.
Sorry.
How big is the environment of NGO working on this kind of subject?
Are you the only one?
Are you a lot of NGOs and friends working on this information?
The question is, are we a lot of people, for example,
in France working on this information?
There are some newspaper and newsroom that start to investigate
on these kind of topics.
It's not very popular, not very famous,
but I think that the last three or four years,
this information has become a major issue, especially in Europe,
and we see plenty of NGOs such as Hew disinfo lab, for example.
They are friends of ours, and we really like them,
and we try to collaborate with them.
So, yeah, I hope that we'll get more and more people
in order to work on that.
Other question?
How can you stop automatic disinformation?
So I'm thinking about chat GPT and Vox and stuff like that.
So can you distinguish whether it's being auto-generated
or human-generated?
So the question is that,
is how can we stop automatic disinformation
made, for example, by chat GPT?
Chat GPT is going to be a very big issue for influence,
which is something pretty obvious.
When I'm saying that, I'm saying obvious thing.
But, yeah, it's going to be a problem because
websites, especially search engines,
they use, as I mentioned, SEO technique
in order to do the ranking of the website.
And one of the biggest issues, for example,
for Google, will be to figure out if a content
not only is duplicated, which was pretty easy to do,
but now automatically connected.
So I don't have any solution for the moment.
We haven't faced this problem so far.
Chat GPT is quite recent, and its use is not
widespread right now, but it's going to change
within the next six months.
And I'm sure about that.
As an answer to this gentleman's question,
the OpenAIG recently launched a site where you can
give a text, it will give you a confidence level
if it's human-generated or computer-generated.
Yeah.
Sorry, sorry.
Yep, sorry.
This one.
Yeah, I was curious about the length that you did
at the notes.
Could you explain more of the color of the page?
The level?
Yes.
So the level is basically the title of the website?
Yeah, sorry, the coloring.
Ah, the coloring.
We use the, we use the, between the centrality
on this graph.
So it's usually what I do on this kind of website
in order to figure out the importance of a node
as a distributor of the connections
between other sub-communities.
So, yeah.
Because the American cluster is, I'm just curious
about your cluster.
Ah, okay.
Oh, the distribution, you mean, for example,
of the links?
It's, it's basically a, it's, it's the standard Gefi.
No, no, no, no, the, the spatialization.
What?
For Satlas.
So it's this one.
Yeah, this one.
So it's for Satlas, so every link that is close
to the other one will be like packed as itself
and a group, a cluster that is not very linked
to another one will be far away from the other one.
There is, there is a bias in the representation
because I wanted QoT to be at the top.
So it's part of my fault.
But for the rest, it's basically the extract
and the export from Gefi.
Yeah, I was just wondering, in the beginning,
you said that this information is deliberate.
Yes.
Incorrect information.
Yes.
How can you judge if it's deliberate?
I mean, this guy behind the website,
is he like, I'm going to push the slide
or is he actually believing it himself?
Is there a method to...
First of all, when you work on this information,
you, so the question is how can we make the distinction
between misinformation and disinformation.
So, basically, when you start an investigation,
this is the first question that you ask yourself.
Is it going to be disinformation or misinformation?
Misinformation is like something that could be true,
but no, that is false, but the person thinks it's true.
Okay?
But when you see the content of the website,
you know that he is talking always on the same topics,
always distributing the same kind of information,
so you know that he does this deliberately.
But the motivation is important,
and that's why, in this case,
it was important to identify the Google Ads tag,
because you know for sure that its motivation,
it's probably ideologic, probably,
if you see his Facebook wall, for example,
but there is the money, and the ads,
and the Google and the platform
are fueling the disinformation with the ad system.
So, this is really important to identify.
Okay, last question over there.
Yes.
Is there a strategy or a approach to tackling disinformation
in authoritarian states?
I didn't get the question, sorry.
I mean, is there a strategy or an approach
to tackling disinformation in authoritarian states
and with partnerships?
I mean, my information is far too beautiful.
So, is there a strategy from,
the question is that, is there a strategy
to tackle disinformation from authoritarian states?
I think so.
The problem is that everyone has its own strategy.
So, there are millions of strategies,
and this is the big issue, according to me.
So, Europe, for example, is trying to organize this
by different programs.
EU Disinfo Lab, like is the leader
in trying to federate the disinfo structure
and activists in order to make wider
and bigger investigations like this.
So, I think, yes, there is a strategy.
The problem is that for the moment,
there are multiple strategies.
But it's going to change.
Thank you.
Thanks.
Thank you.