1. Introduction and context

Satellite imagery has become one of the most powerful tools in any investigative journalist’s arsenal. Whether documenting the expansion of illegal mining in the Amazon, tracking the growth of detention camps, or verifying the destruction of civilian infrastructure in conflict zones, geospatial intelligence (GEOINT) provides an empirical eye in the sky that is difficult for governments or corporations to refute.

🔍 1.1. The investigative need

Traditional reporting often relies on witness testimony or leaked documents, both of which can be challenged. Satellite imagery provides objective, time-stamped physical evidence. It allows journalists to monitor remote or hostile locations where ground access is impossible, providing a longitudinal view of change that reveals patterns of intent and impact over months or years.

1.2. Learning outcomes

• Master multi-platform integration: Combine Google Earth Pro’s historical archives with Sentinel Hub’s multispectral data.

• Conduct temporal analysis: Identify and document physical changes over specific timeframes.

• Verify ground truth: Cross-reference satellite visual data with OpenStreetMap (OSM) vector data for naming and functional identification.

• Maintain evidentiary standards: Create a verifiable audit trail of geospatial findings for publication.

1.3. Case study hook

Imagine investigating an industrial “buffer zone” where residents claim a factory is encroaching on protected wetlands. By layering 2015 imagery over 2025 data, a journalist can calculate the exact square footage of lost vegetation and pinpoint the date construction began, even if official records are missing or altered.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Optical vs. multispectral imagery: Optical imagery is what the human eye sees (RGB); multispectral imagery captures wavelengths such as infrared, useful for detecting healthy vegetation or heat signatures.

• Spatial resolution: The detail level (e.g., 30cm/pixel in high-res vs. 10m/pixel in Sentinel).

• Temporal resolution: How often a satellite captures an image of the same spot.

• Orthorectification: The process of removing geometric distortions caused by terrain and camera tilt to ensure the map is “flat” and measurable.

⚖️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

While satellite imagery captures public spaces, journalists should exercise caution when zooming into private residences. The “stop at the login” rule in GEOINT applies to attempts to access private, non-commercial surveillance feeds or other hacked footage. Stick to commercially available or public-domain orbital data.

2.2.2. Legal considerations

Publicly disseminating high-resolution imagery of sensitive military installations may violate national security laws in certain jurisdictions.

🛑 Disclaimer: This tutorial is for educational purposes. Always consult with your newsroom’s legal department before publishing imagery that could be deemed “classified” by a nation or when navigating copyright licenses of commercial imagery providers like Vantor (formerly Maxar) or Planet.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Google Earth Pro (Desktop): Essential for its “Historical Imagery” slider.

• Sentinel Hub/EO Browser: For free, weekly updates at lower resolution but high spectral variety.

• OpenStreetMap (OSM): To identify buildings, roads, and land use designations.

• QGIS (Optional): For advanced layering and professional cartography.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario 1: Auditing illegal land clearing

1. Locate the target: Enter coordinates into Google Earth Pro.

2. Activate history: Click the “Clock” icon in the top toolbar to reveal the timeline slider.

3. Compare eras: Move the slider to the earliest available high-res date (e.g., 2010) and the most recent (2024).

4. Spectral verification: Open Sentinel Hub EO Browser for the same coordinates to check the NDVI (Normalized Difference Vegetation Index). A drop in NDVI confirms the “green” seen in old photos is gone, ruling out seasonal changes.

Investigative query table

💾 3.3. Data preservation and chain of custody

To ensure your evidence holds up in court or a formal rebuttal:

1. Capture metadata: Always take a screenshot of the entire interface, including the coordinates, capture date, and satellite provider (e.g., “Image © 2024 Airbus”).

2. Log the source: Record the exact URL and sensor ID (e.g., Sentinel-2 L2A).

3. Hash the files: Once you save your final comparison image, generate a SHA-256 hash immediately.

   • Command (Mac/Linux): shasum -a 256 image.png

   • Windows: CertUtil -hashfile image.png SHA256

4. Archive: Save the original files in a “Write-Once” environment or a secured cloud drive with version history.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a single image. Cross-reference your satellite findings with:

• Ground-level imagery: Use Mapillary or Google Street View to see if the “white box” on the satellite is indeed a warehouse.

• Social media geolocated posts: Search for Instagram or TikTok posts from that coordinate to find video evidence from eyewitnesses.

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

Journalists can use AI/LLMs to parse large amounts of metadata or caption text associated with imagery:

• Entity extraction: Use AI to cluster and identify key dates and infrastructure types across dozens of imagery logs.

• Multimodal analysis: For more advanced workflows, refer to the framework in The OSINT prompt for AI-powered image geolocation by Spotlight, which details how to structure prompts to assist in place identification while maintaining investigative diligence.

• Translation: Use LLMs to translate local land-use permits or planning documents obtained from foreign government portals.

⚠️ Warning: AI can “hallucinate” geographical facts. Never ask an LLM to “tell you what is in this satellite image” and use the result as your primary fact. AI may misidentify a shadow as a building or a cloud as a smoke plume. Human verification of every pixel is vital.

🚀 5. Practice and resources

5.1. Practice exercise

The challenge: Locate the “Tesla Gigafactory Berlin-Brandenburg” in Google Earth Pro. Use the historical slider to find the exact month that major forest clearing began. Use OpenStreetMap to identify which water bodies may have been affected by the nearby construction.

5.2. Advanced resources

• Global Forest Watch: An essential tool for monitoring real-time deforestation alerts and historical tree cover loss using Landsat and Sentinel data.

• SkyTruth: Specializes in using satellite imagery to track environmental incidents, such as oil spills and illegal mining, often providing expert-verified datasets.

• Google Earth Engine: For large-scale planetary data analysis and processing of multi-petabyte geospatial datasets.

• Sentinel Hub EO Browser: Free access to multispectral satellite data with pre-built visualization scripts (NDVI, False Color, etc.).

• Vantor: A professional geospatial platform for advanced asset monitoring and risk assessment, useful for enterprise-level investigative tracking.

• Spotlight tutorials: Repository for the latest AI-assisted OSINT techniques and prompt engineering for journalists.

✅ 6. Key takeaways and investigative principles

• Context is king: A change in the landscape is only an investigation if you can link it to a person, company, or policy.

• Trust but verify: Use multispectral data (such as infrared) to confirm what your eyes see in RGB.

• Historical depth: Always look back at least 5-10 years to understand the land's natural state.

• Chain of custody: An image without a timestamp, coordinate, and hash is just a picture, not evidence.

• Resolution awareness: Understand the limits of your data; don’t over-interpret a blurry pixel.

👁️ Coming next week…

Tracking aviation and maritime assets

Using open-source trackers (e.g., FlightRadar24, MarineTraffic) to track aircraft and ships. Cross-referencing live transponder data with ownership registries to expose the movement and identity of global aviation and maritime assets.

1. Introduction and context

The speed of disinformation campaigns often outpaces traditional reporting cycles. For investigative journalists, the ability to rapidly identify whether a viral claim has already been debunked or to ensure their own investigations are discoverable by global fact-checking databases is becoming increasingly important. Automated fact-checking tools act as a “force multiplier,” allowing newsrooms to scan thousands of claims against verified databases in seconds.

🔍 1.1. The investigative need

In the early stages of breaking news, recycled misinformation is a primary trap. Journalists need automated systems to:

• Prevent redundant work: Avoid spending time debunking a video or image that has already been proven to be from a different year, location, or generated by AI by other news or fact-checking organisations, including members of the Eurovision News Spotlight Fact-Checking and OSINT Network.

• Monitor narrative trends: Track how a specific false claim evolves across different regions and languages.

• Enhance digital authority: By using structured data like ClaimReview, newsrooms can ensure their verified findings are prioritized by search engines, and now by AI assistants.

1.2. Learning outcomes

• Query the Google Fact Check Explorer API to automate claim verification.

• Implement ClaimReview and MediaReview schema to make investigations machine-readable.

• Integrate third-party fact-checking APIs and collaborative networks into OSINT workflows.

• Establish a secure chain of custody for digital debunks.

1.3. Case study hook

Imagine a viral photo circulating on social media appearing to show a high-ranking official in an incriminating or highly unusual situation. Before launching a deep-dive forensic analysis, an automated query across global fact-checking databases and reverse-image search reveals that the exact image was identified as “AI-Generated/Deepfake” by a news agency in a different region weeks ago.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• ClaimReview: A standardized schema (tags) used to identify a fact-check article for search engines.

• MediaReview: An emerging schema specifically for tagging manipulated or misrepresented images and videos.

• API (Application Programming Interface): A bridge that allows your software to “talk” to a database of fact-checks directly.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

• The “stop at the login” rule: Automated tools must only access public-facing APIs. Never use automated scripts to bypass paywalls or private group settings (e.g., closed Telegram channels) without explicit legal and ethical clearance.

• Sensitivity: Fact-checking private individuals requires a higher threshold of public interest than checking public figures.

2.2.2. Legal considerations

🛑 Disclaimer: This tutorial does not constitute legal advice. Investigative techniques involving automated data retrieval may intersect with Computer Fraud and Abuse Acts (CFAA) or GDPR. Always consult your organization’s legal department before deploying large-scale automated scrapers or API integrations.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Google Cloud Console Account: To generate an API key for Fact Check tools.

• Python (Optional) or Postman: For making API requests.

• Fact Check Markup Tool: To generate ClaimReview code without manual programming.

• Collaborative Access: Membership in networks like Eurovision News Spotlight for verified information.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario A: Automated auditing of viral claims

To check a list of suspicious keywords or entities against global debunks, use the Google FactCheck Claim Search API.

Table 1: API Query Parameters for Investigative Value

Scenario B: Implementing ClaimReview for your investigation

When publishing a debunk, you must “tag” it so automated systems can find it.

1. Access the Markup Tool: Go to the Google Fact Check Markup Tool.

2. Enter Claim Details: Input the specific claim, the author of the claim (e.g., a specific politician), and your rating (False, Misleading, etc.).

3. Embed JSON-LD: Copy the generated code into the <head> of your article.

💾 3.3. Data preservation and chain of custody

Automated results disappear or change. You must:

1. Archive the API Response: Save the raw JSON output of your API query.

2. Snapshot the Source: Use Hunchly or Archive.today to capture the original claim and the debunking article.

3. Hash the Evidence: Generate a SHA-256 hash for any images or documents you are debunking.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a single automated debunk. Cross-reference an API finding with:

1. Primary-source audit: If the API says a video is from 2018, find the original from 2018.

2. Metadata verification: Use InVID/WeVerify to check if the video’s upload date aligns with the fact-check.

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

Journalists can use LLMs to process large volumes of fact-check data:

• Clustering: Upload a CSV of 500 API results and ask the AI to “Identify the top 3 recurring narratives and the most frequent sources of these claims.”

• Summarization: Use AI to summarize foreign-language debunks found via the API.

⚠️ Warning: AI can hallucinate fact-check ratings. Always click the source link provided in the API response to verify the actual rating. Do not upload confidential source documents or whistleblower data to public AI models as this data is used for training and voids source protection.

🚀 5. Practice and resources

5.1. Practice exercise

1. Go to the Fact Check Explorer.

2. Search for a current viral topic (e.g., “Climate change 15 minute cities”).

3. Identify a debunk from a country other than your own.

4. Find the original “Claim Appearance” URL mentioned in that debunk and use a reverse image search to see if it is still active on other platforms.

5.2. Advanced resources

• Eurovision News Spotlight: A collaborative EBU network providing forensic OSINT analysis, Field Notes, and technical tutorials for public service media, investigative journalists and the public.

• Google Fact Check API Docs: Full technical documentation for developers.

• Schema.org ClaimReview: The official technical definition of the markup.

• Duke Reporters’ Lab: A global database of active fact-checking organizations.

✅ 6. Key takeaways and investigative principles

• Automate early: Run API queries at the start of an investigation to avoid redundant effort.

• Trust verified networks: Leverage the expertise of the Eurovision News Spotlight network for complex cross-border claims.

• Machine-readability is key: Use ClaimReview so your hard work is indexed by algorithms.

• Context is king: An automated rating doesn’t explain the “why”.

• Human-in-the-loop: Always fact-check the automated fact-checkers.

👁️ Coming next week…

Advanced GEOINT: Satellite imagery & temporal analysis
Master the forensic fusion of Google Earth, Sentinel Hub, and OSM to detect, map, and verify environmental and infrastructural change over time.

1. Introduction and context

🔍 1.1. The investigative need

In an era of coordinated disinformation and “pink slime” news sites, journalists cannot take digital content at face value. Traditional vertical reading (staying within a website to judge its credibility) is easily gamed by professional UI/UX design. Investigative OSINT requires lateral reading: moving away from a source to see what the rest of the web says about it. This skill is the “first responder” phase of any investigation, preventing the spread of falsehoods before they enter the reporting stream.

1.2. Learning outcomes

• Implement the four-step SIFT methodology to classify incoming digital leads.

• Execute lateral reading techniques using advanced search operators to bypass a source’s self-presentation.

• Evaluate the institutional “reputation trail” of unfamiliar organizations or individuals.

• Trace original reporting or media assets back to their primary context to identify manipulation.

📋 1.3. Case study hook

Imagine receiving a leaked “scientific study” from a think tank you’ve never heard of, claiming a specific chemical in a local river is harmless. Before analyzing the data, you must determine if the think tank is a neutral academic body or a front for the chemical corporation—a task that requires looking around the site, not just at it.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Lateral reading: The practice of opening multiple tabs to research the source, author, and claims of a piece of content while ignoring the content itself initially.

• Vertical reading: Analyzing a single webpage from top to bottom (looking at “About” pages, logos, and aesthetics), which is often misleading in OSINT.

• SIFT (The four moves): A mnemonic (memory aid) for:

  • Stop

  • Investigate the source

  • Find better coverage

  • Trace claims back to the original context

• Circular reporting: When source A publishes misinformation, source B parrots it, and source A then cites source B as “corroboration”.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

Verification often involves investigating individuals. Journalists must distinguish between public interest (verifying a public official’s claim) and harassment. Never use verification tools to dox private citizens who have no bearing on the public interest.

2.2.2. Legal considerations

While lateral reading involves public searches, stay within the “stop at the login” rule. Using unauthorized access to private databases to verify a source can lead to legal liability and the “fruit of the poisonous tree” doctrine, making the evidence unusable.

🛑 Disclaimer: Always consult your newsroom’s legal department regarding the use of leaked materials.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Multi-tab browser environment: A dedicated browser profile (e.g., on Firefox or Brave) to prevent cookie contamination.

• Search operators: Mastery of Google/DuckDuckGo dorks.

• Archiving tools: Archive.today or the Wayback Machine extension.

• Whois Lookup: DomainTools or ICANN Lookup.

👷‍♀️ 3.2. Practical execution (The “How”)

Move 1: Stop (The classification)

When you feel a strong emotional reaction (outrage, validation) to a source, stop. Do not share or cite it. Ask: “Do I know this source? Is it reputable?”

Move 2: Investigate the source (Lateral reading)

Do not click the “About Us” page. Instead, use these queries to see what others say:

Move 3: Find better coverage

Search for the core claim, not the source’s headline. Look for “consensus” or reporting from established news wires (AP, Reuters, AFP).

Move 4: Trace claims to the original context

If a post quotes a document, find the full PDF. If a video shows a “clash,” use Reverse Image Search (Google Lens/Yandex) to find the full-length video and verify the date/location.

💾 3.3. Data preservation and chain of custody

Every step of the verification process should be documented.

1. Archiving: Use Archive.today to create a permanent snapshot of the source and the lateral evidence you found.

2. Hashing: For downloaded documents, generate a SHA-256 hash immediately.

   Terminal Command: shasum -a 256 document.pdf

3. Logging: Keep a simple spreadsheet log: [Timestamp] | [Action] | [URL] | [Outcome/Result].

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

A finding is only “verified” if it passes the Rule of Three:

1. Technical evidence: (e.g., Whois data shows the site was created yesterday).

2. Lateral evidence: (e.g., A media watchdog identifies the owner as a known operative).

3. Primary context: (e.g., The original video source proves the clip was filmed in 2019, not today).

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

AI can speed up the “Find Better Coverage” phase:

• Summarization: Feed long, complex reports into a local LLM to extract the primary claims.

• Entity extraction: Use AI to list all organizations mentioned in a series of leaked emails.

• Clustering: Group 100+ articles by “narrative similarity” to identify the origin of a rumour.

⚠️ Warning: AI models frequently hallucinate “reputable sources” or mix up dates. Don’t include a fact in a story simply because an AI confirmed it. Don’t upload confidential source documents to public AI models (like ChatGPT) as this may compromise your source and leak the data into the model’s training set.

🚀 5. Practice and resources

5.1. Practice exercise

The “Pop-Up” Challenge: Go to NewsGuard or a local fact-checking site and find a site labelled “Unreliable.” Spend 10 minutes performing Move 2 (Investigate the source) using lateral reading. Try to find the true owner or funding source without ever relying on the site’s own “About” page.

5.2. Advanced resources

• Google Hacking Database (GHDB): Advanced queries for finding exposed data.

• GIJN Resource Center: Global Investigative Journalism Network’s guides on specialized reporting.

• OSINT Framework: A visual directory of tools for different types of data collection.

• Maltego: A graphical link analysis tool for mapping relationships between pieces of information.

✅ 6. Key takeaways and investigative principles

• Ignore the UI: Professional design does not equal credibility.

• Leave the site: The truth about a source is rarely found on the source itself.

• Search for consensus: Established facts should have a trail across multiple reputable outlets.

• Trace to the root: Always seek the raw data, the original video, or the primary document.

• Archive everything: Digital evidence is volatile; capture it before it’s deleted.

👁️ Coming next week…

Automated Fact-Checking Tools and APIs
Streamline your verification workflow by learning how to harness open APIs and ClaimReview data to access thousands of existing debunks.

In this step-by-step tutorial, we look at how journalists can leverage Natural Language Processing (NLP) to move beyond qualitative observation into quantitative evidence.

By using Python to calculate sentiment scoring, journalists and investigators can identify hidden patterns in large datasets. We will also look at algorithmic bias and how to ensure that automated tools do not misinterpret cultural nuance or regional slang, which could lead to false reporting.

What is Sentiment analysis?

Sentiment analysis is a branch of Natural Language Processing (NLP) that lets reporters turn thousands of social media comments, forum posts, or leaked documents into measurable data points.

By keeping an eye on emotional trends, journalists can find the exact moment when bot-driven hate speech took over a grassroots movement or spot new hostility towards whistleblowers before it gets too bad.

1. Introduction and context

1.1. The investigative need

When you have 50,000 Telegram messages or 10 years’ worth of corporate emails, traditional “close reading” doesn’t work. Sentiment analysis gives you the “distant reading” you need to find patterns that you can’t see with the naked eye. It lets reporters:

• Identify “coordinated inauthenticity” by spotting unnatural spikes in specific emotional tones.

• Monitor the escalation of extremist rhetoric within closed digital communities.

• Quantify public reaction to policy changes or scandals over time to test government claims of “broad support.”

1.2. Learning outcomes

By the end of this tutorial, you will be able to:

• Extract and clean large-scale text data for NLP processing.

• Execute sentiment scoring using Python-based libraries and AI-assisted tools.

• Visualize emotional shifts to identify key investigative pivot points.

• Apply ethical safeguards to ensure data privacy and prevent algorithmic bias in reporting.

1.3. Case study hook

Imagine that you are looking into a sudden rise in “spontaneous” protests against a new environmental regulation. When you use sentiment analysis on localized Facebook groups, you find that the early conversations were nuanced and neutral. However, over the course of 48 hours, “High Anger” scores rose by 400%, thanks to a small group of accounts that used the same syntactical patterns — this is a sign of a coordinated influence operation.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Polarity: A metric ranging from -1 (extremely negative) to +1 (extremely positive) that measures the “direction” of an emotion.

• Subjectivity: A score (0 to 1) indicating how much of the text is based on opinion, emotion, or judgment versus factual, objective information.

• Tokenization: The process of breaking down a body of text into individual units (words or phrases) so a machine can analyze them.

• Lexicon: A “sentiment dictionary” used by algorithms to assign weights to specific words (e.g., “disaster” = -0.8; “breakthrough” = +0.8).

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy
Journalists should adhere to the “public interest vs. private harm” balance. While analyzing public tweets is generally acceptable, analyzing “leaked” private chats (e.g., from a hacked Discord) requires a high bar of investigative necessity.

🛑 The stop at the login rule: Do not use automated tools to bypass privacy settings or “friend” targets under false pretences to scrape private sentiment data.

2.2.2. Legal considerations
Terms of Service (ToS) for platforms like X (Twitter) or Meta often prohibit automated scraping. Use official APIs where possible. Unauthorized access to private servers to “harvest” text data may violate the Computer Fraud and Abuse Act (CFAA) or GDPR.

Disclaimer: Always consult with your newsroom’s legal department before deploying scrapers or publishing data derived from private or semi-closed forums.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Python Environment: Install Anaconda or use Google Colab for a browser-based setup.

• Libraries: Pandas (data handling), TextBlob or VADER (sentiment engines), and Matplotlib (visualization).

• Browser Extension: Instant Data Scraper for quick, code-free data extraction from public lists.

👷‍♀️ 3.2. Practical execution (The “How”)

Step 1: Data Acquisition & Cleaning
Export your target text (e.g., a CSV of YouTube comments) into your Python environment. Use Pandas to remove “noise” — URLs, emojis, and “stop words” (common words like “the,” “is,” “at”) that don’t carry emotional weight.

Step 2: Polarity and subjectivity scoring
Apply a sentiment engine to your dataset. VADER (Valence Aware Dictionary and Sentiment Reasoner) is the best tool for journalists because it is specifically designed to handle social media slang and capitalisation (for example, “GREAT!!!” is scored higher than “great”).

Table 1: Investigative Query Logic

Step 3: Temporal analysis (The timeline) Plot your sentiment scores against a timeline. Look for “The Divergence”: a moment where a specific keyword (e.g., a candidate’s name) suddenly shifts from neutral to highly negative.

💾 3.3. Data preservation and chain of custody

To ensure your findings hold up in court or under editorial scrutiny:

1. Archive the source: Use archive.org or archive.ph for the original URLs.

2. Generate hashes: Use a tool like HashMyFiles to create a SHA-256 hash of your original CSV/JSON data. This proves the data wasn’t altered during your analysis.

3. Log the algorithm: Document the specific version of the library (e.g., TextBlob v0.15.3) and any custom lexicons used.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a “sentiment score” alone. Cross-reference your findings:

• Technical: Check if the highly negative sentiment spikes correlate with known bot-deployment timestamps (see: Botometer).

• Human: Select a random sample of 50 “High Anger” posts and manually code them. If the AI labeled sarcasm as “Positive,” your data is skewed.

4.2. Linking data to narrative

Table 2: Translating Technical Data

🤖 4.3. AI assistance in analysis

Use LLMs (like GPT-4 or Claude) to process your final high-intensity clusters:

• Clustering: “Group these 50 negative comments into three primary themes of grievance.”

• Summarization: “Summarize the core arguments in this 200-page forum transcript.”

• Translation: Translate foreign-language vitriol to check for localized cultural idioms.

⚠️ Warning: AI models frequently hallucinate “intent.” An LLM might claim a user is “threatening” when they are using regional slang. Human intervention is required here to fact-check results. Never upload sensitive whistleblower documents or PII (Personally Identifiable Information) to public AI models.

🚀 5. Practice and resources

5.1. Practice exercise

Download a public dataset of news headlines (e.g., from Kaggle) regarding a controversial figure. Use a sentiment tool to find the 10 “most subjective” headlines. Manually check if these headlines come from state-sponsored media or independent outlets.

5.2. Advanced resources

• Advanced scraping & data extraction:

  • GitHub - Social-Analyzer: A powerful tool for analyzing a target’s profile across 1000+ social media platforms.

• NLP & sentiment analysis frameworks:

  • NLTK (Natural Language Toolkit) Documentation: The foundational library for Python-based language processing.

  • VADER Sentiment Analysis (Official Repository): Essential reading for understanding how the algorithm weights social media slang and punctuation.

  • Hugging Face Models: Access state-of-the-art pre-trained models for multi-language sentiment detection.

• Verification & bot detection:

  • Botometer (Indiana University): Checks the activity of X (Twitter) accounts and assigns them a score based on how likely they are to be bots.

  • Hoaxy: Visualizes the spread of claims on social media to help identify coordinated influence operations.

• Investigative standards:

  • The GIJN Digital Forensics Guide: Global Investigative Journalism Network’s best practices for handling digital evidence.

  • EBU News Report 2024 (Trusted Journalism): Insights into maintaining editorial integrity in the age of AI-driven newsgathering.

✅ 6. Key takeaways and investigative principles

• Sentiment is a compass, not a map: Use scores to find where to look, not as a final “proof” of intent.

• Context is king: Algorithms cannot detect deep sarcasm or cultural nuance without human oversight.

• Clean data in, clean data out: Spend 70% of your time cleaning and verifying your text source.

• Transparency is paramount: If you publish a sentiment chart, you must disclose your methodology and the limitations of the tool used.

• Verify the extremes: Always manually read the “most positive” and “most negative” data points; this is where the most significant errors (and stories) live.

👁️ Coming next week…

The SIFT method: Practical tools for faster fact-checking
Master the essentials of the SIFT method and lateral reading to help you quickly assess source credibility and verify claims in your daily newsgathering.

1. Introduction and context

1.1. The investigative need

Data extraction is becoming increasingly important in investigative journalism. To bridge the gap between unstructured web data and a queryable database, reporters must move beyond a ‘copy and paste’ workflow. This tutorial outlines an OSINT framework for web scraping: from navigating the DOM with BeautifulSoup to managing a chain of custody with SHA-256 hashing. Whether you are a no-code advocate or a Python enthusiast, these are the tools required to audit data at scale.

1.2. Learning outcomes

• Differentiate between static and dynamic web content to select the optimal extraction method.

• Construct advanced scraping queries using Python’s BeautifulSoup and no-code selectors.

• Execute a rigorous data preservation workflow to ensure evidentiary integrity.

• Synthesize large-scale datasets using AI-driven entity extraction and clustering.

1.3. Case study hook

A journalist who suspects a housing authority of deleting records of construction violations deploys a web scraper to capture a daily snapshot of the site. The daily captures prove that 15% of violations linked to a specific developer were removed from the public portal without explanation.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• DOM (Document Object Model): The hierarchical structure of a webpage that scrapers navigate to find data.

• CSS selectors: Patterns used to select the specific elements (like .price or #document-id) you want to extract.

• Headless browser: A web browser without a graphical user interface, used to scrape sites that require JavaScript to load.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy
Journalists must adhere to the “stop at the login” rule: If data is behind a paywall, password, or requires bypassing a CAPTCHA, it is no longer considered open source. Scraping private or restricted areas may violate the Computer Fraud and Abuse Act (CFAA) or similar international laws.

2.2.2. Legal considerations
While the 2022 hiQ Labs v. LinkedIn ruling provided some protection for scraping public data, journalists face risks regarding “Terms of Service” violations. Excessive scraping can be interpreted as a Distributed Denial of Service (DDoS) attack.

Disclaimer: This tutorial is for educational purposes. Consult your newsroom’s legal department before initiating large-scale scraping projects involving personal data or proprietary systems.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Environment: A dedicated Virtual Machine (VM) or a cloud-based Python environment like Google Colab.

• Libraries: Requests (fetching), BeautifulSoup4 (parsing), and Pandas (structuring).

• No-code: Web Scraper (browser extension) for quick hierarchical extraction.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario 1: Auditing exposed internal documents
Many organizations inadvertently leave directories open. We can use Python to index these files.

Scenario 2: Automated monitoring of government tenders
Using a “no-code” browser extension like Web Scraper, follow these steps:

1. Define sitemap: Enter the URL of the public tender portal.

2. Add selector: Set Type to Table. Click the first and second rows of the target data to train the tool.

3. Handle pagination: Use the link selector to click the “next” button automatically.

4. Execution: Run the scraper with a 2000ms delay to avoid being blocked.

💾 3.3. Data preservation and chain of custody

To ensure your findings survive a legal challenge, follow these mandatory steps:

1. Archive the source: Use Archive.today or the Wayback Machine to save the live page.

2. Log the metadata: Record the Date, Time, Source IP, and User-Agent string.

3. Generate a hash: Use the SHA-256 algorithm to create a unique digital fingerprint of your raw CSV.

   • Terminal command: openssl dgst -sha256 scraped_data.csv

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Technical data must be cross-referenced. If a scraper identifies a suspicious contract, verify it by:

• Checking the vendor's WHOIS records.

• Looking for the contract ID in separate offline archives or gazettes.

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

LLMs are powerful for processing scraped text, provided the following steps are taken:

• Clustering: Feed the LLM a list of 1,000 project titles to identify the top 5 most frequent themes.

• Entity extraction: Use an LLM to find every mention of a specific politician across thousands of scraped news snippets.

• ⚠️ Warning: Hallucination risk. Always “spot-check” 10% of AI-generated labels against the raw data.

• ⚠️ Privacy warning: Never upload sensitive source data to public LLMs; use local instances for PII.

🚀 5. Practice and resources

5.1. Practice exercise

The challenge: Use a browser extension to scrape the FBI’s Most Wanted list. Extract the Name, Category, and Link for each individual. Ensure your final CSV has no duplicate entries.

5.2. Advanced resources

• ScrapingHub/Zyte: Documentation on handling complex JavaScript sites.

• GHDB (Google Hacking Database): Find “Dorks” to locate scrapable directories.

• GIJN’s Scraping with AI Guide: Expert workflows for using LLMs to build custom scrapers and identify website architectures.

• OCCRP’s Aleph: A global data platform for cross-referencing scraped datasets against millions of leaked corporate and public records.

• The OSINT Framework: An interactive directory for locating specialized scrapers for business registries and social media platforms.

• Apify Actors: A library of pre-configured scrapers designed to bypass anti-bot protections on sites like Google Maps and Amazon.

• Octoparse: A no-code web scraping tool that allows users to extract data from websites into structured formats like Excel or databases

✅ 6. Key takeaways and investigative principles

• Accuracy over speed: Always prioritize rate-limiting to ensure data isn’t corrupted by server timeouts.

• Clean the data: Scraping is 20% extraction and 80% cleaning (removing HTML tags, fixing dates).

• Hash everything: A dataset without a SHA-256 hash is a dataset that can be questioned in court.

• Transparency: Be prepared to publish your scraping code alongside your story for peer review.

• The human element: Use scraping to find the lead, but use traditional journalism to confirm it.

👁️ Coming next week…

Using Natural Language Processing (NLP) for sentiment analysis

Applying simple NLP and text analysis to large bodies of text (e.g., social comments, forum threads) to track emotional tone, emerging narratives, and keywords over time.

To digital investigators, a website is a map of hidden connections. If you’re following a network of shell companies or a coordinated disinformation campaign, SSL certificates, historical registration logs, and shared server headers can lead you to the architect. This guide offers journalists a set of tools and a methodology for identifying who owns and runs hidden websites. In an era of digital obscurity, server fingerprinting is an important skill for verifying the reliability of sources and uncovering hidden networks of influence.

Deconstructing websites: Whois and server fingerprinting

1. Introduction and context

1.1. The investigative need

For a journalist, a website is rarely just a digital shopfront; it can often be a trail of evidence. Identifying the individual or entity behind a site is often the first step in investigating disinformation campaigns, shell companies, or illicit marketplaces. Server fingerprinting lets you go beyond the “About Us” page to uncover the real-world infrastructure and connections the owners may want to keep hidden.

1.2. Learning outcomes

• Trace historical ownership changes using WHOIS archives.

• Identify shared infrastructure between seemingly unrelated websites using SSL/TLS certificate data.

• Uncover a target’s digital footprint by fingerprinting third-party tracking IDs and server configurations.

• Document technical evidence in a format that meets the legal standards for chain of custody.

1.3. Case study hook

Say you are investigating a network of “local news” sites that appear to be spreading coordinated propaganda. By analyzing their server fingerprints, you discover that 50 different sites all share the same Google Analytics ID and were registered using the same obscure hosting provider in a single 24-hour window.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• WHOIS: A query and response protocol used for querying databases that store the registered users or assignees of an Internet resource (domain name or IP address).

• Server fingerprinting: The process of gathering technical signatures (headers, SSL certificates, software versions) to identify a specific server or to link it to others.

• Passive OSINT: Data collection that does not involve direct interaction with the target’s server, making the investigation undetectable to the site owner.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy
Journalists must distinguish between publicly accessible metadata (such as a domain’s registration date) and private data (such as an unlisted phone number).

⚠️ The “Stop at the Login” rule: If your investigation requires bypassing a password, exploiting a vulnerability, or accessing a non-public database, you have moved from OSINT to hacking. Stop immediately.

2.2.2. Legal considerations
While viewing public WHOIS data is legal, some jurisdictions have strict laws regarding automated scraping. Furthermore, “active” fingerprinting (direct probing) can be interpreted as a precursor to a cyberattack.

• Disclaimer: Always consult your newsroom’s legal department before publishing data derived from technical “fingerprints” to ensure compliance with local privacy laws (e.g., GDPR).

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

To maintain operational security (OPSEC), use a dedicated environment:

• Browser: Firefox* with uBlock Origin, Privacy Badger, and User-Agent Switcher.

• Web Analysis: BuiltWith (technology profiles), ViewDNS.info (reverse IP/WHOIS), Crt.sh (certificate logs).

• Archive: Wayback Machine or Archive.today for preserving evidence.

*While Google Chrome and other Chromium browsers have moved to Manifest V3—a framework that restricts how ad blockers work—Firefox continues to support the full power of the original extensions.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario A: Identifying hidden ownership via WHOIS history
Modern WHOIS records are often redacted (privacy protection). To bypass this, you must look at historical records from before privacy was enabled.

Scenario B: Linking sites via SSL/TLS and tracking IDs
Servers often use the same SSL certificate for multiple domains. Tracking IDs (Google Analytics/AdSense) are frequently hardcoded into the site’s HTML.

1. Extracting Tracking IDs: View the page source (Ctrl+U) and search for UA- (Analytics) or pub- (AdSense).

2. Reverse Lookup: Use BuiltWith or DNSlytics to find every other site using that specific ID.

💾 3.3. Data preservation and chain of custody

A screenshot is not enough for a legal challenge.

1. Archive: Save the page to Archive.org to create a third-party timestamp.

2. Hash: Generate a SHA-256 hash of any downloaded files or raw HTML.

3. Log: Keep a precise “Search Log” detailing the date, time, URL, and tool used for every discovery.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a single technical data point. A “matching IP address” could mean both sites use the same cheap shared hosting (like GoDaddy).

• Minimum Requirement: Corroborate a technical link (e.g., shared SSL) with a non-technical link (e.g., identical “Terms of Service” text or shared physical address).

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

• Clustering: Feed a list of 100+ WHOIS records into an LLM to “Identify common patterns in registrars, registration dates, and nameservers.”

• Translation: Use AI to translate obscure technical error messages or foreign language HTML comments.

• ⚠️ AI warning: Never upload sensitive whistleblower documents or non-public data to public AI models. AI can hallucinate technical “facts”—always manually verify an IP address or owner name against the original source.

🚀 5. Practice and resources

5.1. Practice exercise

The Challenge: Select a known “alternative” news site. Use Crt.sh to locate its SSL certificate history. Can you identify any subdomains (e.g., dev.target.com or mail.target.com) that are not linked on the main homepage? What do these subdomains suggest about the organization’s internal tools?

5.2. Advanced resources

• Google Hacking Database (GHDB): For finding exposed .env or configuration files.

• Shodan.io: For analyzing open ports and server headers.

• The Berkeley Protocol: The international standard for digital investigations.

✅ 6. Key takeaways and investigative principles

• History is key: Redacted WHOIS data can often be circumvented by looking at older, unredacted archives.

• Shared IDs = shared control: Tracking IDs and SSL certificates are the most reliable “digital fingerprints” for linking disparate sites.

• Don’t over-interpret: Shared hosting is common; look for unique identifier combinations before claiming ownership.

• Preserve immediately: Digital evidence is ephemeral. Use archives and hashing to make your findings “bulletproof”.

• Ethics first: Always operate within the “Stop at the Login” framework to maintain journalistic integrity.

👁️ Coming next week…

Introduction to data scraping for OSINT with Python/no-code tools

Master the art of ethical data collection by transforming chaotic web pages into actionable intelligence. Whether you’re writing your first line of Python or prefer powerful no-code automation, this tutorial bridges the gap between raw open-source information and structured OSINT insights.

Investigative journalism often hinges on the “paper trail”. Digital footprints can give us hints, but court and legal records are the official, sworn, and verified proof we need to hold influential people accountable. This tutorial shows you a standard way to search these complicated databases for court cases, property records, and administrative filings.

1. Introduction and context

1.1. The investigative need

Court records represent the gold standard of evidence. Compared with social media or leaked documents, court filings provide sworn testimony and judicially verified facts. For members of the Eurovision News Spotlight network, these kinds of records are important for proving that false information is false, tracking money across borders, and holding international organisations accountable with legally binding documents in more than one country.

1.2. Learning outcomes

• Navigate the ECLI system in Europe and the PACER system in the U.S.

• Execute advanced searches in international human rights and trade databases.

• Implement a SHA-256 hashing workflow for preserving digital evidence.

• Ethically use AI to translate and cluster complex legal dockets in multiple languages.

1.3. Case study hook

A European energy firm is accused of human rights abuses in Southeast Asia. While their local filings are “clean”, a search of the US federal courts (PACER) reveals a deposition from a former executive, while the European Court of Human Rights (HUDOC) contains a related petition from local villagers, together forming a global map of corporate liability.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• ECLI (European Case Law Identifier): A standard code used to find judgements across EU member states (e.g., ECLI:EU:C:2024:123).

• Docket/Registry: The central log of all filings in a case; your primary “table of contents” for an investigation.

• Service of Process: Official notice that a legal action has begun, often containing the initial “complaint” with the most detailed allegations.

• Passive vs. Active OSINT: Browsing public registries (passive) vs. filing Freedom of Information (FOI) requests to trigger the release of records (active).

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

In Europe, GDPR Article 85 provides a “journalistic exemption” for processing personal data, but this is a privilege, not a right.

The Rule: If you find a home address or a minor’s name in a public filing, redact it before publication unless its disclosure is essential to the public interest.

2.2.2. Legal considerations
Access rules vary wildly. In the U.S., most records are public for a fee; in many EU states, you may need to prove “legitimate interest.” Never use stolen credentials to bypass a paywall.

• Disclaimer: Legal frameworks change rapidly. Consult with your newsroom’s legal department before publishing sensitive materials.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• European e-Justice Portal: The primary gateway for all 27 EU national registries.

• RECAP Extension: A must-have for US PACER searches; it shares paid dockets for free.

• OCCRP Aleph: A massive global database of leaked and official legal records.

• Multilingual LLM (Local): For translating legal documents without uploading them to public servers.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario: Auditing a target’s global litigation exposure To build a global profile, move from international “hubs” down to national registries.

Step-by-step workflow:

1. Map the Entities: Identify every subsidiary and director of your target using OpenCorporates.

2. Check the “Hubs”: Search Curia (EU), HUDOC (Europe-wide), and PACER (US). These high-level courts often reference smaller local cases.

3. Local Deep-Dive: Use the e-Justice Portal to find the specific national court. In the UK, use The National Archives (Caselaw); in France, use Légifrance.

4. Extract Exhibits: Don’t just read the judgement. Look for “Exhibits” or “Annexes” — this is where the internal emails and bank records are hidden.

💾 3.3. Data preservation and chain of custody

In OSINT journalism, you must prove the document existed at the time you found it.

• Step 1: Download the PDF.

• Step 2: Generate a SHA-256 Hash.

  Command (Terminal): shasum -a 256 filename.pdf

• Step 3: Save the hash and timestamp in a “Master Evidence Log”.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

A court filing is a “claim”, not necessarily a “fact”. Cross-reference allegations with:

• Land Registries: To verify if the property mentioned in a suit actually exists.

• Social Media Footprinting: Verify if a witness’s location on a specific date (via Instagram/LinkedIn) matches their sworn testimony.

🤖 4.3. AI assistance in analysis

For Eurovision News Spotlight readers dealing with 24+ languages:

• Translation & summarization: Use a private LLM to summarize a 100-page Italian filing into an English bullet-point list of “Key Entities and Dates.”

• Relationship Mapping: Use AI to extract every “person” and “organization” from a folder of 50 PDFs to see who appears most frequently (clustering).

• ⚠️ AI warning: Hallucination risk: AI may misinterpret legal jargon (e.g., confusing “Plaintiff” and “Defendant”). Always manually verify quotes and dates before publication. Never upload confidential source material to public AI models.

🚀 5. Practice and resources

5.1. Practice exercise

The Challenge: Use CourtListener to uncover a case involving a major tech company and “Privacy”. Locate the most recent “Order” signed by a judge. What is the judge’s name, and what was the outcome of the order?

5.2. Advanced resources

• e-Justice Portal: The essential map for European court records.

• RECAP / CourtListener: The best free resource for US federal records.

• Global Investigative Journalism Network (GIJN): Detailed guides for accessing records in specific countries like Russia, China, or Brazil.

• Vizlegal: Provides lawyers and legal librarians with access to millions of decisions, court filings, court dates, and other data that they can track or search.

✅ 6. Key takeaways and investigative principles

• The “Follow the Exhibit” Rule: The most valuable data is rarely in the judgement; it’s in the attachments.

• Standardize Evidence: Always hash your files (SHA-256) to ensure they are court-ready for your own defence.

• Think Cross-Border: A lawsuit in one country often triggers a “discovery” process in another.

• Verify the Status: Check if a case was appealed or overturned; a “win” in a lower court may have been reversed.

• Ethical Redaction: Protect PII (Personally Identifiable Information) that isn’t in the public interest.

👁️ Coming next week…

Deconstructing Websites: Whois and server fingerprinting

Uncover the digital DNA of any website by tracing its ownership history and server metadata. Learn to leverage WHOIS records and SSL fingerprinting to deconstruct a site’s infrastructure.

1. Introduction and context

1.1. The investigative need (The “why”)

Amid rising geopolitical tensions and the increasing sophistication of financial crime, monitoring financial flows, assets, and company networks in the public domain is key to accountability.

Open-source documentation and infrastructure can provide journalists with a legal and ethical way to uncover sanction evasion, determine who really owns companies hidden behind shell structures, and report on global procurement fraud.

1.2. Learning outcomes

• Identify and navigate the most valuable global open corporate and property registries.

• Master the use of sanctions list screening and Politically Exposed Person (PEP) databases to generate investigative leads.

• Apply network visualization to map complex ownership structures and cross-correlate addresses, directors, and financial filings.

• Understand the process of data preservation and chain of custody for financial and corporate records.

• Ethically leverage AI for summarizing large financial documents and log files.

1.3. Case study hook

You receive a tip that a company supplying sensitive technology to a sanctioned regime has quietly changed its corporate registration and ownership in three different countries. By analyzing the company’s public business records, shipping manifests, and sanctions databases, you then aim to reconstruct the real beneficial ownership of the company and the supply chain route to expose the network of people and entities that evade global restrictions.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Beneficial ownership: The natural person(s) who ultimately own or control a legal entity, even if the entity is held in another name (e.g., a proxy or shell company).

• PEP (Politically Exposed Person): An individual who is or has been entrusted with a prominent public function, as well as their family members and close associates. PEPs pose a higher risk for involvement in bribery or corruption.

• Shell company: A company that exists only on paper and has no office or employees, often used to mask the true ownership of assets or transactions.

• Corporate registry: A government database that stores official records of registered companies, including directors, registered addresses, and annual filings (e.g., the UK’s Companies House).

• Active vs. Passive OSINT:

  • Passive OSINT involves collecting publicly available information without interacting with the target (e.g., searching a corporate registry).

  • Active OSINT involves direct interactions that can be logged by the target system (e.g., pinging a domain or sending a request to a server).

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

Financial OSINT must strictly adhere to data collected only from public, legally accessible sources (e.g., government filings, official databases, public court records).

⚠️ The “stop at the login” rule: Don’t attempt to guess, bypass, or use leaked credentials in order to gain access to sensitive information, such as password-protected financial databases, email accounts, or private sections of corporate portals. That’s unauthorized access and illegal. Remember, even the public exposure of individuals’ data (e.g., addresses, dates of birth) must be handled with extreme care and only to be used in the public interest, not for harassment or exposure for reasons that are not the public’s intent.

2.2.2. Legal considerations

Consultation with your legal department is paramount when publishing findings related to sanctions evasion, fraud, or the financial activities of individuals or entities. Legal risks include defamation, libel, and unauthorized access. Some jurisdictions restrict the commercial use of public corporate data.

• Disclaimer: This tutorial is for informational and educational purposes only. Always consult with your legal department in the relevant jurisdiction before conducting any investigation or publishing financial findings. We do not endorse or provide instructions for any illegal or unethical activity.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Dedicated Virtual Machine (VM)/OSINT Profile: Use a dedicated browser profile or VM (e.g., a Linux distribution like Kali or a customised browser environment) to separate investigative activity from personal or newsroom accounts. This protects your identity and maintains a clean audit trail.

• VPN/Proxy Service: Use a reputable VPN/proxy to mask your geographic location and IP address when accessing foreign registries or high-risk sites.

• Core OSINT Tools:

  • Browser Extensions: Wayback Machine or Archive.today (for preservation).

  • Network Visualizer: Maltego (commercial) or OCCRP Aleph (free/investigative focus – for mapping entities).

  • Open Databases: OpenSanctions (Sanctions, PEP, Adverse Media lists) and OpenCorporates (Global corporate entities).

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario: Tracing a sanctioned entity’s phantom asset network

The investigative goal is to trace the public-facing and hidden corporate assets of a known sanctioned individual.

Step 1: Baseline search and entity identification

• Search for the individual’s name across major sanctions databases (e.g., OpenSanctions) and global adverse media.

• Collect all variations of their name, dates of birth, known addresses, and listed companies (both current and former).

Step 2: Global corporate registry pivot

Use identified company names, director names, or registered addresses to pivot into national and international corporate registries.

Step 3: Address and network correlation

Use unique identifiers (like an unusual address or a unique director name) as a “pivot point” across registries. If 10 companies have the same registration address, they probably have a common relationship and constitute a corporate cluster.

Step 4: Ship and aircraft tracing (Supply Chain OSINT)

If the entity is involved in logistics or trade, use their corporate name or known vessel/tail numbers on public tracking sites.

💾 3.3. Data preservation and chain of custody

Mandatory step for all financial OSINT: Every key piece of evidence must be captured and logged to maintain a legally defensible Chain of Custody.

1. Archiving: Use a browser extension (like Wayback Machine or Archive.today) or a dedicated tool (Hunchly) to create a full-page, archived copy of the source URL (e.g., the corporate filing). Include a screenshot with a timestamp overlay.

2. Logging: Record every search query, the date/time (in UTC), the URL, and a brief description of the finding in a secure, encrypted log file (e.g., an encrypted spreadsheet).

3. Hash Generation: For any downloaded document (e.g., a PDF of an annual report), immediately generate a cryptographic hash (SHA-256) of the file. This mathematically proves that the file has not been altered since the moment of download.

   Command Line Example (Linux/macOS): sha256sum my_evidence.pdf

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Financial OSINT is high-risk and requires rigorous verification. Corroborate technical data with at least two independent sources or methods.

• Method 1 (Internal Consistency): Cross-reference the same name/address in the corporate registry with the information on the sanctions list and an associated WHOIS record.

• Method 2 (Physical Corroboration): Use a public satellite or map service (like Google Maps or Yandex Maps) to verify the physical existence and nature of a registered address (e.g., is the multi-billion dollar holding company registered to a residential home or a mailbox?).

4.2. Linking data to narrative

Translate complex financial findings into clear, verifiable journalistic facts.

🤖 4.3. AI assistance in analysis

AI/LLMs can be a powerful, ethical tool for processing high-volume, public OSINT data.

• Summarizing large documents or log files: Upload non-sensitive, public documents (e.g., a large, published annual report or a log of vessel movements) to an LLM to quickly extract the core business purpose, key dates, or main financial figures.

• Identifying key entities, dates, and relationships (clustering data): Use an LLM or dedicated AI entity recognition tool to process unstructured data (e.g., a batch of public news articles) to identify and cluster recurring names, dates, or financial amounts.

• Translation of foreign language material: Use AI to translate corporate filings or news articles from foreign registries to quickly assess their relevance before investing in professional human translation.

⚠️ AI warning: Do not submit source-provided data, confidential documents, or sensitive data on private individuals to public LLMs (like ChatGPT or Google Gemini) due to privacy and data leakage concerns. All information found by an AI needs to be checked by a person against the original document, as there is a high chance the AI could make mistakes or create false information.

🚀 5. Practice and resources

5.1. Practice exercise

Challenge: A news report mentions that “Alpha Shipping LLC” owns a vessel named M.V. Freedom. Use open sources to find:

1. The vessel’s IMO number.

2. The full name and jurisdiction of the company that currently owns the vessel.

3. The vessel’s last reported port call (before the current date).

5.2. Advanced resources

• OCCRP Aleph: Search a massive repository of leaks, court records, and public documents curated by investigative journalists.

• OpenSanctions: Consolidated database of sanctions lists, PEPs, and high-interest individuals/entities.

• OpenCorporates: The largest open database of companies and corporate entities worldwide.

• MarineTraffic / VesselFinder: Global real-time and historical tracking of ships using AIS data.

• GHDB (Google Hacking Database): A community-maintained list of advanced search queries for finding publicly exposed documents on the web.

✅ 6. Key takeaways and investigative principles

• Pivoting is key: Successful financial OSINT means constantly pivoting from one data point (e.g., an address) to locate a new entity (e.g., a new company) and repeating the search.

• Correlate the identifiers: Focus on the cross-referencing of unique identifiers—names, addresses, vessel/tail numbers, and shareholder names—to build an undeniable network.

• Prioritize preservation: Adopt a “log everything, hash every document” policy to ensure a defensible Chain of Custody for your evidence.

• Respect the boundary: Adhere strictly to the “Stop at the Login” rule and ensure all data is from public, legally accessible sources.

• AI is an assistant, not a fact-checker: Use LLMs for summarization and translation of public data, but rely on human verification for all final facts and figures.

👁️ Coming next week…

Unearthing public court and legal records

Navigating local, national, and international court databases. Using key search terms and specialized databases to find records, property deeds, and administrative filings.

1. Introduction and context

1.1. The investigative need (The “why”)

Investigating financial crime, corruption, or tax evasion often requires following assets, which are frequently hidden behind opaque, multi-layered corporate structures, trusts, and shell companies. These entities are deliberately designed to separate legal ownership (the entity on paper) from beneficial ownership (the natural person who ultimately owns or controls the entity).

For journalists, tracing this chain of ownership using Open-Source Intelligence (OSINT) techniques is essential to attribute actions and wealth to the responsible, real-life individuals and expose networks of illicit finance, holding those at the top accountable.

1.2. Learning outcomes

Upon completing this tutorial, you will be able to:

• Differentiate between legal ownership, beneficial ownership, and ultimate parent company concepts.

• Systematically use global corporate registries like OpenCorporates and official government sources to map an ownership structure.

• Apply a six-step framework to trace ownership layers until the ultimate beneficial owner (UBO) is identified.

• Visualize complex corporate networks to identify red flags like nominee directors or secrecy jurisdictions.

1.3. Case study hook

A local government council awards a lucrative, no-bid contract to a small, newly registered company with no staff. A search reveals this company is legally owned by a holding company registered in a tax haven.

In using OSINT to track down the holding company’s beneficial owner, you reveal that the UBO is the spouse of a high-ranking council official, providing concrete evidence of a conflict of interest.

💡 2. Foundational theory and ethical-legal framework

2.1.Key terminology

• Ultimate Beneficial Owner (UBO): The real person or people who actually own or control a company, or for whom a transaction is carried out. This means a person, not another business.

• Shell company: A company that holds money and handles transactions but does not have real assets, many employees, or active business activities. People often use shell companies to hide who really owns something.

• Legal owner: The person or company whose name is officially listed in public records as owning shares or holding the legal title to an asset or business.

• Secrecy jurisdiction (or Tax Haven): A country or area with very few financial rules and little transparency, making it easy to hide who owns money or assets. Examples include the British Virgin Islands and Cayman Islands.

• Nominee director/shareholder: A person or company officially listed as a company officer or owner, but who follows the instructions of the real owner. This makes it harder to see who is truly in control.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent and privacy: The most fundamental ethical barrier is the distinction between publicly available data and private life. Directors and officers company registry data are public, and its use must be explicitly justified by a public-interest rationale, such as investigating corruption, fraud, or political conflicts of interest.

Stop at the login rule: It is very important. Do not try to bypass paywalls for restricted, proprietary, or commercial registry data without an official subscription or a documented exemption (for example, access to public-benefit journalist accounts provided by a registry or database). Investigations must use only data that has been openly licensed, that resides in the public record, and that has been legally obtained.

2.2.2. Legal considerations: Identifying such owners involves the collection and correlation of personal characteristics from different sources of registries: name, birth date, and address.

• Data accuracy: Information on companies (registration) available from public-sector entities in less-regulated jurisdictions can be outdated and inaccurate. Journalists need to cross-check the information and include a caveat that registry findings are provisional unless otherwise confirmed.

• Disclaimer: Consult your organization’s legal office on any findings regarding illegal or unethical activity through ownership structures, especially when you attribute property (or control) to an individual. Allegations of concealment or fraud pose serious risks.

🛠️ 3. Applied methodology: Step-by-step practical implementation

3.1. Required tools & setup

1. OpenCorporates Account: Register for a free “Permitted User” account (for journalists, NGOs, and academics) to access the fullest public data set and advanced filtering features.

2. Investigative Dashboard (OCCRP’s Aleph): A free platform for journalists that aggregates and visualizes data from millions of public records, including many company registries and leaked documents (e.g., Panama/Paradise Papers).

3. Visualization Tool: Tools like Maltego (or simple mind-mapping software like XMind or draw.io) are essential for mapping the complex network of entities, officers, and addresses.

4. Jurisdiction-specific registries: Maintain a list of high-value, country-specific public registries (e.g., UK Companies House).

👷‍♀️ 3.2. Practical execution (The “how”)

The process is iterative: start with the known entity, identify its legal owner, search that owner in turn, and repeat until a natural person (UBO) is reached.

Scenario 1: tracing an unknown owner of a target company

Goal: Identify the UBO of TargetCo, a business registered in New Jersey, USA.

Scenario 2: leveraging OpenCorporates’ internal links

OpenCorporates often provides direct links that facilitate traversal.

💾 3.3. Data preservation and Chain of Custody

Handling a large amount of company records can be complicated, so it is essential to maintain a clear, thorough record of all actions.

🧠 4. Verification, analysis, and editorial integration

4.1. Corroboration strategy

Verification is mandatory at every ownership layer to prevent name-matching errors (false positives).

• Cross-reference officer details: If you identify a UBO named “John Smith,” search for their full legal name, date of birth, and any associated address. Verify this against an independent source, such as a different country’s corporate registry or public voting records.

• Asset/activity consistency check: Look for evidence that the UBO is active in the same jurisdiction or sector as the TargetCo. Does the UBO’s LinkedIn profile mention the sector? Does their address link to the country? Inconsistent data (e.g., a UBO with no ties to the target’s industry or location) can be a red flag for a nominee relationship.

• Corroborate UBO status: The most reliable corroboration comes from a Beneficial Ownership Register (like the UK’s PSC register or the EU registers) if one is available and accessible for the target jurisdiction.

4.2. Translating data to narrative

The visualization tool helps translate the complex, often dry, legal structure into a compelling narrative.

🤖 4.3. AI Assistance in analysis and ethical use

LLMs can be deployed to manage and analyze the large volume of structured data pulled from registries.

• Summarizing official filings: Copy the text from lengthy official corporate documents (e.g., articles of incorporation, annual reports) into a local or enterprise-secured LLM to request a summary of the Share Structure, Board Appointments, and any unusual financial clauses.

• Identifying key entities, dates, and relationships (clustering data): Use an AI to process the names, addresses, and dates of all officers collected from the traversal process. Ask the AI to cluster individuals who share the same address or date of registration across different companies.

• Translation of foreign language material: Use AI services to translate key filing documents from non-English jurisdictions (e.g., legal documents from a company register in Latin America or Eastern Europe).

⚠️ AI warning: Hallucination and privacy

1. Hallucination risk: The AI must not be treated as an authoritative source for a UBO declaration. Every fact and name-match must be verified against the original OpenCorporates or registry document.

2. Privacy & data security: Do not submit non-public data (e.g., sensitive source material, draft reports, or any PII gathered that is not officially public record) to public LLMs. Focus AI use on the transcription and clustering of the publicly sourced, structured registry data. Use enterprise or paid LLM versions where possible.

🚀 5. Practice and resources

5.1. Practice exercise:

Challenge: Use OpenCorporates to find the directors of Volkswagen AG (German public company). Then, choose one director’s name and use the OpenCorporates Officer search to find any other company they are associated with outside of Germany.

• Goal: Use the OpenCorporates filters (jurisdiction, status) to narrow the search and map the person’s cross-border business ties.

5.2. Advanced resources

• OCCRP’s Aleph: (Investigative Dashboard) A searchable database of millions of leaked and public records, sypecifically designed for following the money and corporate trails.

• Open Ownership Register: A register maintained by the Open Ownership initiative, providing official beneficial ownership data for specific countries (e.g., UK, Ukraine).

• FATF (Financial Action Task Force) Guidance: Provides international definitions and red flags on beneficial ownership and money-laundering schemes, helping journalists identify illicit patterns.

• UK Companies House: The gold standard for corporate transparency; all filings are free and publicly accessible, providing an excellent reference point for how an open registry should operate.

✅ 6. Key takeaways and investigative principles

• Follow the natural person: The investigation is not complete until you identify the Ultimate Beneficial Owner (UBO)—the real, living individual—not just another company.

• Map and visualize: Use a mind-map or network visualization tool to track complex, multi-layered ownership structures. This prevents confusion and highlights critical nominee or secrecy links.

• Verify the UBO criteria: An individual must meet the defined criteria of ownership or control (typically a $25\%$ threshold or significant influence) to be designated as a UBO.

• Beware the nominee: If an officer appears on the records of hundreds of unrelated companies, they are likely a nominee director/shareholder—a major red flag for concealment.

• Use OpenCorporates as a funnel: Use aggregated databases like OpenCorporates to quickly traverse the chain, but always verify critical details against the link to the original official registry.

👁️ Coming next week…

Financial tracing and sanctions OSINT

Unravel complex financial trails and asset movements. Learn to use public data for sanctions tracking, procurement fraud detection, and supply chain OSINT.

Investigating Coordinated Inauthentic Behaviour (CIB)—the organised manipulation of online discourse by botnets and troll farms—is one of the most critical and complex tasks in modern journalism. This tutorial provides the OSINT framework to identify, analyse, and attribute these hidden influence operations.

1.1. The investigative need (The “why”)

State-sponsored disinformation networks, as well as those fuelled by commercial interests, use synthetic amplification to give false narratives the illusion of true popularity. They establish networks of bots (automated accounts) and trolls (human operators) that engage in coordinated activities, such as simultaneous posting, topic hijacking, and targeted harassment.

It is paramount for journalists to distinguish between fake grassroots activity (astroturfing) and genuine public opinion, which will help reporters avoid publishing false premises, accurately report on foreign or domestic interference, and maintain the integrity of the public record.

1.2. Learning outcomes

By completing this tutorial, you will be able to:

• Deconstruct Coordinated Inauthentic Behaviour (CIB) into its constituent parts (Actors, Content, Behaviour).

• Formulate advanced search queries across platforms (especially X/Twitter and Reddit) to identify temporal and behavioural coordination.

• Utilize network analysis principles (social network analysis, or SNA) to map amplifier accounts and key nodes.

• Preserve collected digital evidence using Chain of Custody protocols, ensuring data is admissible and verifiable.

• Ethically apply AI tools to summarize large datasets for rapid entity and relationship extraction.

1.3. Case study hook

Think of a rapid, organized social media phenomenon flourishing and pushing a false narrative just ahead of a big election. Thousands of newly created accounts all sharing similar language and posting at exactly the same moment propagate this narrative. Your goal is not to just debunk the narrative, but to reveal the centralized source (a troll farm or political consultancy) that coordinated the campaign. This tutorial shows you how to find the digital fingerprints of that coordination.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Coordinated Inauthentic Behaviour (CIB): An official term for manipulation where multiple accounts or pages work together to deceive people about the identity, purpose, or origin of the entity behind them. Coordination and deception are the key components.

• Astroturfing: The practice of masking the sponsors of a message or organization to make it appear as though it originates from and is supported by genuine grassroots participants (e.g., a fake public opinion campaign).

• Botnet: A network of automated, often interconnected, accounts (software robots or bots) used to execute coordinated tasks like amplifying a hashtag, sharing links, or performing DDoS attacks.

• Social Network Analysis (SNA): A process and set of tools used to visually map and analyze the relationships and flow of information between individual actors (nodes) in a network, revealing centralized amplifiers and coordinated sharing patterns.

• Digital Signature: A unique, non-content-based pattern (e.g., common file metadata, shared IP addresses, identical account creation patterns, or specific custom URL shorteners) that links otherwise disparate accounts to a single operator.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy: The “stop at the login” rule

All intelligence gathered should be from publicly available sources (e.g., public social media posts, public databases).

• Rule of thumb: The “Stop at the Login” rule: Never attempt to bypass a login, paywall, or any other security measure. If the information requires unauthorized access, it is not OSINT; it is unauthorized access or hacking, and you should stop immediately.

• Privacy warning: If you are reporting on bots or troll networks, focus your reporting on the behaviour and source of coordination, not on the unintentional exposure of private data to possibly manipulated, unwitting, or low-level actors. Where ethically necessary, anonymize.

2.2.2. Legal considerations

The most significant legal risk in this field is the Computer Fraud and Abuse Act (CFAA) in the US, and similar legislation elsewhere, which criminalizes “unauthorized access” to computer systems.

• Risk: Using automated scraping tools to bypass a platform’s Terms of Service (ToS) or rate limits, even for public data, can be interpreted as unauthorized access by platform legal teams.

Mandatory Disclaimer: Consult your organization’s legal department before beginning a large-scale data collection operation, especially if that work involves scraping or accessing data via a developer API. This tutorial provides methodological guidance only; it is not legal advice.

🛠️ 3. Applied methodology: Step-by-step practical implementation

3.1. Required tools & setup

👷‍♀️ 3.2. Practical execution (The “how”)

The core investigative goal is to find accounts that exhibit coordinated and non-human behaviour.

Scenario 1: identifying temporal and content coordination on social media (X/Twitter)

Investigative Goal: Find a cluster of accounts that post the same controversial link or use the same niche hashtag within minutes of each other, suggesting automation or central direction.

Scenario 2: Revealing bot characteristics via network analysis

Use your initial query results (a list of 100+ accounts posting the same link) to feed into a Social Network Analysis (SNA) tool like Gephi.

1. Extract Data: Use an approved API or specialized tool (like Twint, carefully and ethically) to pull the last 200 tweets for each of the 100 suspicious accounts.

2. Model the Network: Import this data into Gephi. Create a network where:

   • Nodes are the accounts.

   • Edges (connections) are mentions, reposts, or replies.

3. Analyze Metrics: Look for key SNA metrics:

   • Degree Centrality: Nodes with an unusually high number of connections (often the central “botmaster” or key amplifier).

   • Modularity: Distinct, tight clusters of accounts that only talk to each other but not to the leading network (suggests a segmented botnet group).

4. Behavioural Audit: Check the accounts in the high-centrality clusters when examining bot features: high post frequency (e.g., 50+ posts/day), jumbled alphanumeric usernames (e.g., user7492931), and no profile pictures or bios.

💾 3.3. Data preservation and Chain of Custody

You must assume all collected data will be challenged. A strict Chain of Custody (CoC) should be mandatory.

1. Collect and archive: Use Hunchly (or a similar tool) to capture every webpage, tweet, profile, and search results page. This preserves the original context, date/time, and URL.

2. Generate hash values: For every key file (e.g., a spreadsheet of scraped accounts, a screenshot, or the Hunchly/web archive file itself), immediately calculate and record its SHA-256 cryptographic hash value. This mathematical fingerprint proves the file has not been altered since the moment of collection.

   • Command Line Example (Linux/macOS): sha256sum [filename.csv] >> CoC_Log.txt

3. Maintain a log: Create a running, chronological Chain of Custody Log document. This log should detail:

   • The date and UTC time of collection.

   • The Investigator (your name/ID).

   • The Method used (e.g., X Advanced Search, Manual Screenshot).

   • The Location/URL of the collected data.

   • The SHA-256 Hash of the resulting file.

🧠 4. Verification, analysis, and editorial integration

4.1. Corroboration strategy

Technical data (e.g., a cluster of accounts posting at 08:00:00 UTC) is insufficient on its own. It requires corroboration with at least two independent sources/methods.

• Method 1 (Technical corroboration): Cross-reference the identified key amplifier accounts’ metadata (e.g., profile pictures) using a reverse image search (like Yandex or TinEye) to confirm if the profile image is a stock photo or has been used on other now-suspended bot accounts.

• Method 2 (Behavioural corroboration): Use the account creation dates of the bot cluster. If hundreds of accounts were created on the same day or week, cross-reference this date with a known national/global political event to suggest a timeline of orchestration.

4.2. Translating data to narrative

The technical data must be translated into clear, verifiable journalistic facts.

🤖 4.3. AI Assistance in analysis and ethical use

AI/LLMs can be powerful, ethical accelerators for processing the overwhelming volume of data common in disinformation investigations, but they should be used with extreme caution.

• Summarizing large documents or log files: Feed an LLM a log file containing thousands of posts and ask for salient themes, repeated phrases, and emotional shifts (sentiment analysis). Prompt Example: “Analyze the attached log of 5,000 tweets. Group the posts by theme, identify the five most common keywords (excluding stopwords), and calculate the percentage of posts exhibiting negative sentiment towards [Target Entity].”

• Identifying key entities, dates, and relationships: Use an LLM for Named Entity Recognition (NER) on large text corpuses (e.g., thousands of inauthentic blog comments) to quickly extract all unique names, organizations, and dates mentioned, which can then be clustered into a more traditional analysis tool.

• Translation of foreign language material: LLMs are excellent for rapid translation of large volumes of foreign language social media posts or propaganda materials.

⚠️ AI warning: Hallucination and privacy

Hallucination risk: Never publish or present an AI-generated finding as a fact until it has been human fact-checked and verified against the original source data. LLMs are designed to generate plausible text, including false “facts.”

Privacy risk: Do not submit sensitive or non-public data, such as source-provided logs, non-public chat screenshots, or the names of confidential sources, to public LLM services like ChatGPT or Gemini. These services can use your input to train their models, potentially violating source protection and privacy. Use licensed, private, or locally run models for sensitive data.

🚀 5. Practice and resources

5.1. Practice exercise

Challenge: Investigate a potential astroturfing campaign targeting a controversial piece of proposed legislation (e.g., The Fictional Digital Policy Act).

1. Baseline search: Search X/Twitter for the hashtag #FictionalDigitalPolicyAct and the words “scam” or “threat” over the last week.

2. Filter for anomaly: Identify accounts that:

   • Have posted about the hashtag at least 10 times in the last 24 hours.

   • Were created in the last 6 months (use since:2025-06-01).

   • Have a follower count below 50.

3. Cross-platform check: Take a suspicious phrase used by the cluster (e.g., “The bill is a freedom killer!”) and run it as a search query on Reddit to see if the same phrase is being injected into political subreddits.

5.2. Advanced resources

• The OSINT Framework: A comprehensive, categorized directory of OSINT tools and resources (used to find niche social media or domain analysis tools).

• DFR Lab (Atlantic Council): Documentation and methodologies for tracking digital forensic research in influence operations.

• SNA visualization tools (e.g., Gephi): Essential for visualizing and quantifying network structures beyond simple lists of accounts.

• GHDB (Google Hacking Database): A repository of advanced search queries (Google Dorks) to uncover accidentally exposed files and data.

• Open-Source data scraping libraries (e.g., Python’s BeautifulSoup/Scrapy): Used ethically and compliant with ToS/rate limits for scaled collection of public data.

6. Key takeaways and investigative principles

• Prioritize behaviour over content: Focus your investigation on how a message is spread (coordination, timing, rate) rather than just the message’s content.

• Always capture, hash, and log: Treat every piece of collected public data as potential evidence. Utilize your dedicated CoC log and generate SHA-256 hashes immediately.

• Trace the digital signature: Look for technical commonalities that link disparate accounts (e.g., the same profile photo used elsewhere, identical post timing, shared infrastructure).

• Cross-reference in threes: Never conclude based on a single piece of evidence. Corroborate technical findings with behavioural and network analysis data.

• “Stop at the Login”: Maintain a strict ethical boundary to ensure your investigation is legal and your findings are admissible and defensible.

👁️ Coming next week…

Tracing corporate ownership: Beneficial & ultimate parent companies

Navigating global corporate registries (e.g., OpenCorporates). Understanding shell companies and identifying beneficial ownership to follow the money trail back to the ultimate, real-world actors behind corporate structures.

From exposing corruption to tracking extremist groups, the best investigative stories rarely rely on a single figure but on complex webs of connections among people, companies, and digital assets.

Manually analyzing such links takes too much time and often fails to reveal subtle, non-obvious relationships. Network mapping, or Link-Analysis Graphing (LAG), is a process that converts disparate facts (names, emails, domains) into a graphical map for you to navigate, find key actors, gatekeepers, and hidden structures in a web of complex investigations.

1.1. The investigative need (The “why”)

Journalists accumulate hundreds of data points from public records, documents, and search engine results during investigations. This data at its raw state can sometimes be daunting and obfuscate relationships. Tools such as Maltego and Gephi automate the query of public sources, as well as immediately visualizing the relationship and revealing the “who is connected to whom” and “how are they connected”. It’s essential for demonstrating coordination, naming major players, and turning a dense narrative digestible to the public.

1.2. Learning outcomes

• Differentiate between Nodes (Entities) and Edges (Relationships) in a network graph.

• Use Maltego to automatically gather OSINT and visually map connections from a single starting entity (e.g., an email or domain).

• Import structured data (CSV) into Gephi and calculate key network centrality metrics.

• Interpret the investigative significance of Betweenness Centrality and Clustering Coefficient.

1.3. Case study hook

A journalist investigates a global influence network. They begin with a single domain name from a shell company. Using Maltego’s Transforms, they map all associated email addresses, then pivot from those emails to find linked social media profiles, and finally use graph analysis in Gephi to identify a single, seemingly obscure individual who is the only connection (the “gatekeeper”) between the entire finance arm and the political messaging arm of the operation.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Node/Entity: A data point (e.g., a person, company, email, phone number, IP address) represented as a circle or icon in the graph.

• Edge/relationship: The line connecting two nodes, representing a link (e.g., “Works At,” “Owns,” “Communicated With”).

• Transform (Maltego): An automated query that fetches related data from a source (e.g., given a Domain, run a Transform to find associated Email Addresses).

• Centrality metrics: Algorithms that measure the importance of a node in a network (e.g., Degree, Betweenness).

• Graph visualization: The process of using algorithms (layouts) to arrange the nodes and edges for readability and pattern recognition.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy: Data aggregation risk

Maltego and similar tools aggregate public data quickly, which can inadvertently create a highly intrusive picture of an individual, even if each data point is publicly available.

The ethical boundary is heightened: Do not use these tools to map personal networks or expose private individuals unless their activities are strictly in the public interest and relevant to the investigation. Always ensure the collection remains passive (no attempted logins or network probing, such as aggressive Nmap scans).

2.2.2. Legal Considerations: Licensing and Intent

Maltego comes with a free Community Edition (CE), but has usage limits. Commercial editions have more features and data integrations. Using the tool improperly, especially running Transforms directly against systems or data sources in which you do not have authorization, could be considered illegal network reconnaissance. Tools such as Maltego must be utilized for OSINT (Open Source Intelligence) which is derived from publicly indexed or API-accessible information. Unauthorized access is illegal.

Mandatory disclaimer: Consult legal department to ensure your investigation’s scope and methods comply with jurisdictional laws regarding data collection, privacy, and unauthorized access, particularly when dealing with cross-border data.

🛠️ 3. Applied methodology: Step-by-step practical implementation

3.1. Required tools & setup

• Maltego CE (Community Edition): Free version for graphical link analysis (requires registration).

• Gephi: Free, open-source software for visualizing and analyzing large graphs (requires Java).

• Data scraper/parser: A tool or script to export collected data (names, emails, phone numbers) into a structured CSV file. Octoparse is a recommended no-coding solution.

• Isolated environment: A VM or dedicated clean machine for running these tools.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario A: Automated mapping with Maltego

Goal: Start with a domain name and automatically identify its registered owner, hosting details, and associated infrastructure.

Scenario B: Advanced analysis with Gephi (For structured data)

Goal: Import a spreadsheet of scraped data (e.g., leaked email communication logs, where each row is a “Source” email talking to a “Target” email) and calculate the most critical person.

💾 3.3. Data preservation and Chain of Custody

1. Maltego Export: Export the final graph visualization as a high-resolution image (PNG/PDF) and the underlying data as a GraphML file or a CSV of nodes and edges.

2. Gephi Export: Export the static image (PNG) of the final visualized graph, and the GEXF (Gephi Graph File) project file, which preserves all the applied metrics and layout.

3. Source Log: Create a table or spreadsheet logging the original source of every Entity (Node) added to the graph. If an email originated from a Google Dork search that led to a public PDF, log the exact URL of the PDF and the date and time it was collected. Generate an SHA-256 hash for all source files.

🧠 4. Verification, analysis, and editorial integration

4.1. Corroboration strategy

Network analysis only suggests a possible relationship; it does not prove why the relationship exists.

• Edge corroboration: If a Maltego Transform shows an “Affiliation”, you must verify the nature of that link. Is the link based on a shared phone number, a past job listing, or a public registry entry? Examine the original source document or API record to confirm the link’s validity.

• Cross-method verification: If Gephi indicates that "Jane Doe" has a high Betweenness Centrality score, this supports her role as a broker. Does her LinkedIn profile, public records, or the content of the documents you collected (Section 3 of the previous tutorial) confirm her intermediary role?

4.2. Translating data to narrative

Translate network metrics into actionable story elements.

4.3. AI assistance in analysis

LLMs can help interpret the context behind the graph’s structure.

• Summarizing log files: Input the source data (e.g., the text of the meeting minutes or email logs that generated the Edges) to an LLM.

Prompt example:

Analyze the provided source text (log files/meeting minutes/emails) that generated the network graph. 

Identify the dominant context and relationship behind the Edge between the nodes identified as [Node A Name/ID] and [Node B Name/ID]. 

Specifically, summarize the primary topic of discussion, the purpose of their interaction, and the tone/sentiment expressed in the source material related to this connection. 

Finally, explain if the source text supports the weight or directionality assigned to this specific Edge in the graph structure.

• Identifying Key entities and roles: Once a cluster of 15 names is found, an LLM can scan their publicly available job titles (if provided in the node attributes) and group them into functional roles such as “Finance Team”, “Logistics Support”, etc.

• Translation: Translate all foreign-language node labels or Edge descriptions (e.g., from a foreign corporate registry) into the investigative language.

⚠️ Critical warning: Privacy and hallucination

Never upload an investigative graph (GEXF file) or its associated sensitive data (node/edge attributes) to any public LLM service. The graph itself can reveal the structure of your investigation and potentially expose sources or targets. Always use private, secure tools.

All interpretations, summaries, or roles identified by an AI must be rigorously fact-checked by cross-referencing against the original public source documents/records that generated the graph’s Nodes and Edges. The graph is a map; the underlying facts are the territory.

🚀 5. Practice and resources

5.1. Practice exercise

1. Open Maltego CE.

2. Add a Website Entity using a public company’s domain (e.g., paterva.com).

3. Run the Transform: “To Email Address – using search engine”.

4. Run the Transform: “To Person – PGP Key” on one of the found email addresses.

5. Filter and rearrange the graph to clearly visualize the link from Domain $\rightarrow$ Email $\rightarrow$ Person.

5.2. Advanced Resources

• Maltego documentation/training: Maltego offers a robust series of tutorial videos and documentation for advanced features.

• NetworkX (Python): A library for advanced network analysis scripting, allowing for custom metrics and data integration beyond GUI tools.

• GHDB for network tools: Find dorks that specifically expose lists of names, emails, or servers to quickly generate bulk data for graph import.

6. Key takeaways and investigative principles

• Nodes & edges: The graph is only as good as the underlying data—ensure every Node and Edge is derived from a verifiable source.

• Pivot wisely: In Maltego, only run Transforms that will yield relevant data to avoid cluttering the graph with noise.

• Analyze centrality: Use Betweenness Centrality (Gephi) to quickly identify the crucial “gatekeeper” entities in a large network.

• Visualize the narrative: Use layouts, sizing, and coloring to make the graph tell the story visually—big nodes are important; tight clusters are closed groups.

• Security First: Never expose sensitive graph data to insecure environments or public AI models.

👁️ Coming next week…

Detecting bots, trolls, and disinformation campaigns

This tutorial provides the analytical framework to identify coordinated inauthentic behavior (CIB) in real-time. We cover key techniques like analyzing post frequency shifts, tracking user network centralization, and decoding rapid sentiment shifts to expose hidden botnets and troll farms.

The digital world we live in today is exceedingly temporary. Important information, including corporate filings and political social media posts, can disappear in an instant if it is deleted, altered, or retracted. For investigative journalists, this instability can significantly hamper their work.

The Internet Archive Toolkit—primarily the Wayback Machine—serves as the necessary countermeasure, enabling investigators to perform digital time travel to retrieve and authenticate content intended for erasure.

1.1. The Investigative imperative (The “Why”)

Getting back the original, deleted information is essential for proving deception or misrepresentation. It is important to report the act of deletion itself because it is a journalistic event.

Mastery of archival OSINT is critical because it transforms volatile digital fragments into durable, court-ready evidence suitable for publication, providing the foundation for reports that demand transparency and context.

1.2. Learning outcomes

• Master advanced query syntax and date-based filtering across major archival services.

• Differentiate between archival snapshots, Mementos, and Google Cache for corroboration.

• Frame archival retrieval within the necessary ethical and legal boundaries for publication.

• Implement mandated data preservation techniques (WACZ, hashing) to establish the chain of custody.

• Integrate archived findings into editorial narratives using structured analysis.

1.3. Case Study Hook

A large multinational company claims that it has never had a controversial environmental policy. An investigative team employs advanced archival methods to access a series of policy documents from the Wayback Machine. These documents reveal not only that the policy existed, but also that it was systematically removed in stages before the company publicly denied its existence.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Snapshot/capture: A single, timestamped, preserved copy of a web page stored by an archiving service (e.g., the Wayback Machine).

• Memento: A concept from the Memento protocol; a version of a web resource as it existed at some point in the past. It facilitates querying across multiple archives simultaneously.

• CDX Server API: The service component used by the Internet Archive to allow command-line searching of its index based on URL, date, and filter parameters.

• Robots.txt exclusion: A website file used to instruct crawlers (like the Wayback Machine’s) not to archive certain pages, often leading to investigative gaps in data.

• WACZ (Web Archive Collection Zip): A compressed file format for web archives, used to store the archived content and its metadata in a forensic-grade container.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & Privacy

Content retrieved from public archives is generally considered public record if it was publicly accessible at the time of the snapshot. The ethical constraint lies in the method of access, not the current status. Investigators must strictly adhere to the “Stop at the Login” rule.

Do not use archived links to bypass security measures, paywalls, or private forum/social media login prompts, even if the archived link inadvertently bypassed the security at the time of capture. The publication of Personal Identifiable Information (PII) retrieved from public archives must be weighed against strict public interest standards.

2.2.2. Legal Considerations

The use of archival tools is legal, but the subsequent publication of the retrieved content is governed by intellectual property, copyright, and privacy laws in your jurisdiction. Retractions and take-down requests are serious legal matters. Evidence must only be obtained legally from publicly available sources.

Mandatory disclaimer: Always consult your legal department before publishing deleted or sensitive archived data, as legal standards for journalistic privilege vary widely, especially when dealing with foreign entities or individuals.

🛠️ 3. Applied methodology: Step-by-step practical implementation

3.1. Required tools & system setup

• Primary Archiving Services:

  • The Wayback Machine (An initiative of the Internet Archive, founded in 2001)

  • Archive.is/Archive.today (A web archiving service founded in 2012)

• Caching/Alternative Services: Google Cache (cache:) and the Memento TimeTravel service.

• Archival Command Line Tools: Python packages like waybackpy (for CDX API queries) or wget (for bulk downloads).

• Data Validation Tools: A SHA-256 Hash generator utility (for local file integrity).

• Collection Management: Tools like ArchiveBox or Hunch.ly (for structured local saving and audit trails).

👷‍♀️ 3.2. Practical execution (The “How”)

The methodology focuses on lateral search extension—moving beyond simple URL input—and temporal narrowing to locate subtle changes.

Scenario: Tracking deleted social media and website assets following a crisis event

1. Event pinpoint: Identify the crisis event’s exact date and time ($YYYYMMDDhhmmss$). This is the anchor point.

2. Initial domain search: Input the domain (example.com) into the Wayback Machine to establish the capture frequency and identify gaps in data (often indicating a robots.txt exclusion or a cleanup attempt).

3. Advanced wildcard search: Use wildcards (*) to search for all pages/subdomains related to the target, bypassing basic URL blocks (e.g., web.archive.org/web/*/companyx.com/team/*).

4. Date range search: Use the 14-digit timestamp format to find snapshots taken immediately before the deletion time, focusing on the narrowest investigative window (e.g., web.archive.org/web/20250101000000/originalurl.com).

5. Archive.is High-fidelity capture: Use Archive.is as a backup. Since it is user-driven, it often contains snapshots of deleted social posts that the automated Wayback crawler missed.

6. CDX API search: For complex searches (e.g., finding all deleted .pdf files on a subdomain), use the CDX API via a command-line utility to pull the entire index history, bypassing the web interface limits.

💾 3.3. Data preservation and Chain of Custody

Preservation ensures the evidence or data is admissible and defensible.

1. Archiving (WACZ/WARC): Do not rely on simple screenshots. Use tools (like ArchiveBox or browser extensions) to save the retrieved snapshot as a WACZ or WARC file, preserving the original HTML source, metadata, and timestamps.

2. Metadata logging: Create a comprehensive log for each artifact: Original URL, Archived URL, Date/Time of Archive, Date/Time of Retrieval (your action), and the purpose of the capture.

3. Hash generation: Generate a SHA-256 hash of the downloaded WACZ/WARC file. This unique fingerprint guarantees the file’s integrity and is the core component of the chain of custody, proving the file has not been altered since your retrieval.

🧠 4. Verification, analysis, and editorial integration

4.1. Corroboration strategy

Academic and editorial standards require multi-source verification.

1. Tool Cross-reference: Verify the content across at least two independent archival sources (e.g., Wayback Machine and Archive.is) before relying on it.

2. Date/context corroboration: Cross-reference the archive snapshot time with external events (e.g., email timestamps, news reports) to verify that the retrieved version was publicly available at the time of the event.

3. Metadata and header analysis: Examine the snapshot’s HTTP headers and embedded metadata to verify the server status, ensuring the page was a ‘200 OK’ (live) capture rather than a redirect.

4.2. Translating data to narrative

Complex archival data must be translated into clear, verifiable journalistic facts.

🤖 4.3. AI Assistance in analysis and ethical use

LLMs offer powerful capabilities for processing large volumes of archived text.

• Summarization and abstraction: Use AI to process text from long-form archived documents (e.g., a PDF annual report or a large forum archive) to extract key findings or create an executive summary.

• Entity clustering: Feed the AI large volumes of retrieved text to identify, categorize, and cluster recurring entities (names, dates, organizations) and map relationships between them.

• Translation: Use AI for instant translation of foreign-language material retrieved from archives.

⚠️ Warning: Hallucination and fact-checking: Every output generated by an AI (summary, translation, entity extraction) must be fact-checked by a human against the original WACZ/WARC file.

Privacy Concern: Under no circumstances should sensitive, source-provided, or non-public data (even if archived) be submitted to public-facing LLMs due to the risk of privacy breaches and proprietary data leakage.

🚀 5. Practice and resources

5.1. Practice exercise

Identify a political figure with a strong online presence. Locate the oldest and newest archived versions of their official About Me page. Use the Wayback Machine’s comparison tool to identify text changes between two specific captures, and look for the real-world event that may have triggered the changes. Document the entire process in your log file with the necessary SHA-256 hash.

5.2. Advanced resources and further reading

• Memento-web TimeTravel service: A service that queries multiple web archives (Internet Archive, Archive.is, etc.) simultaneously for a specific URI, ensuring maximal retrieval.

• ArchiveBox documentation: Essential resource for self-hosting a local, structured, and reproducible web archival system.

• Wayback Machine CDX API documentation: For learning how to bypass the web interface and perform programmatic searches of the archive index.

• Journalism and legal ethics: Consult legal resources on data protection (e.g., GDPR, CCPA) as they apply to the dissemination of public records.

6. Summary and investigative principles

• Deletion is evidence: Never view a 404 error as a dead end; view it as evidence of an attempt to conceal information that must be investigated.

• Archive integrity: The gold standard of evidence is a hash-verified WACZ or WARC file, not a screenshot.

• Cross-validation is mandatory: All key findings must be corroborated across multiple independent archival tools (Wayback, Archive.is, Memento) for editorial and legal defensibility.

• Temporal precision: Leverage the 14-digit timestamp format to narrow the investigation to the precise moments before and after a key event.

• Think like a crawler: Understand the limitations of robots.txt exclusions and data gaps to formulate lateral, effective wildcard searches.

👁️ Coming next week…

Network Mapping: Visualizing Connections with Maltego & Graph Tools

The next tutorial will look into the powerful practice of network mapping, providing you with skills for visualizing complex relationships in your investigations. You’ll learn how to effectively use tools like Maltego, Gephi, and other graphing utilities to map connections between individuals, companies, and social media accounts.

In the digital age, individuals can conceal their true activities by relying on digital fragmentation, scattering their activities across multiple social media accounts, forums, and platforms with slightly varied or entirely different usernames (aliases).

For investigative journalists, the challenge is not just finding the data but confirming identity. For example, proving that “SecureNinja23” on a dark web forum and the writer of a leaked internal memo are the same person.

This skill of identity stitching, or alias correlation, is the most important one for creating a verifiable, cross-platform digital footprint that connects online activity to a person or organisation.

👁️ Goals for learning

• Master the use of automated and manual tools to cross-reference a single username across public platforms.

• Develop techniques for confirming identity through subtle digital patterns (e.g., bio reuse, profile photo consistency, writing style).

• Implement a rigorous process for capturing and preserving evidence that is correlated (Chain of Custody).

• Understand the ethical line between public data correlation and illegal/unauthorized access.

💡 Basic ideas

Key terminology

⚠️ Important for journalists: Ethical and legal limits

You must limit your research exclusively to publicly accessible data.

• The Golden Rule: Stop immediately at any login prompt. Any attempt to bypass a login, whether by guessing a password, using leaked credentials, or exploiting a technical vulnerability, crosses the line from ethical OSINT into unauthorized access/hacking, which is illegal and unethical.

• Data sensitivity: Information found in the public domain (e.g., a photo on a public social media profile) is fair game. However, publicly exposing highly sensitive personal data (e.g., unredacted home addresses, private medical information) must be justified by a clear, overriding public interest and vetted by your legal and editorial teams.

The laws governing unauthorized computer access (like the Computer Fraud and Abuse Act (CFAA) in the US) are broad. Being blocked by a website’s Terms of Service (ToS) or a technical gate could be interpreted as unauthorized.

• Risk Mitigation: Never use tools designed to force access or exploit vulnerabilities (like Shodan/Censys for non-public data) unless you have extensive legal guidance.

• Mandatory Legal Disclaimer: The information and techniques provided here are for educational and journalistic verification purposes only. Investigative journalists must consult their own legal department and editorial guidelines before acting on any information involving complex legal jurisdictions, data privacy (such as GDPR), or potential intrusion into private systems or accounts.

🛠️ The Method: Putting it into action step-by-step

Required tools & setup

👷‍♀️ How to put it into practice

Scenario: Resolving the Identity of an account linked to a misinformation network

Goal: Link a suspected misinformation account (Alias: @ShadowWhisper_007) on platform X to any other public profile to begin building a full identity.

1. Initial scan (Username enumeration):

   • Input the core username (ShadowWhisper_007) into WhatsMyName or Namechk.

   • Crucial step: Systematically test subtle variations: ShadowWhisper007, ShadowWhisper\_, S_Whisper007. An alias often follows a pattern.

2. Visual correlation (Profile picture pivot):

   • Download the @ShadowWhisper_007 profile picture (ensure it’s publicly available).

   • Run a reverse image search (Yandex is excellent for faces/avatars).

   • Investigative value: Finding the same picture on a platform like a forgotten LinkedIn profile or a niche gaming forum provides high confidence of correlation.

3. Content/pattern analysis (Digital footprinting) - manual techniques:

   • If a second profile is found (e.g., a blog or forum post), compare the content.

   • Focus on the pattern:

     • Do they use the same catchphrases?

     • Do posts on both accounts stop/start at the same time?

     • Do they both mention the same niche, non-public event or location?

   • Manual correlation checklist (The cognitive step):

     • Linguistic Style: Search for consistent, unique linguistic markers:

       • Unusual punctuation (e.g., excessive ellipses, lack of capital letters)

       • Repeated grammatical errors, or specific, niche terminology only used in certain industries.

     • Chronolocation: Analyze the time zone and consistent posting hours across both profiles. A user posting consistently at 2:00 AM EST on one platform and 7:00 AM CET on another suggests a specific geographic location.

     • Bio reuse: Search for exact, non-generic phrases used in the “About Me” or bio section of the first alias to see if they appear anywhere else.

   • Metadata pivot: If the correlating platform allows file uploads, check the public metadata (EXIF) of any uploaded images for camera models, software used, or even geolocation hints.

4. Data visualization (Maltego step)

   • For investigations involving more than two platforms, use a visualization tool like Maltego (or even a simple drawing tool/spreadsheet) to map the connections.

   • Execution: Input each correlated data point as an entity (e.g., Username 1, Username 2, Email Address, Profile Photo Hash, Unique Phrase) and draw the confirmed links.

   • Value: Visualization is key for complex identity stitching. It highlights the strongest, most complex linkages (e.g., two different usernames sharing a single IP address and profile photo) for fast, high-confidence confirmation.

Actionable correlation table: Linking data points

💾 Keeping data safe: The audit trail

For any correlated identity to be admissible evidence in journalistic reporting (and potentially a legal context), you must ensure a Chain of Custody.

1. Immediate archiving: Use tools like FireShot (full-page capture) or perma.cc to capture a snapshot of the source page immediately upon discovery.

2. Metadata logging: Document the following in a structured log (spreadsheet):

   • Date and timestamp (UTC): When the source was accessed.

   • Source URL: The exact URL of the publicly accessible page.

   • Method used: (e.g., “WhatsMyName check,” “Yandex Reverse Image Search”).

   • The finding: A precise description of the correlation point found.

3. Hashing the evidence: For every screenshot or downloaded file, generate a SHA-256 hash. This hash is a unique digital fingerprint of the file. If even a single pixel is later changed, the hash will change, proving to an editor that the evidence you collected has not been tampered with since collection.

   • Tool: Use a built-in command-line tool (shasum -a 256 [filename]) or a reputable desktop hashing utility.

🧠 Verification and analysis for reporting

Corroboration Strategy

A single correlation point (e.g., a matching username) is insufficient for reporting. Journalistic standard requires two or more independent sources or methods.

• Primary corroboration: The username match must be corroborated by a content/visual match (e.g., the same profile photo, the same detailed biographical information, or the exact unique quote).

• Secondary corroboration: The correlated identity must then be validated against a third-party source (e.g., a public record, a corporate registry, or a verifiable event timeline).

• Handling false positives: To eliminate common false positives (e.g., a common username shared by two different people), check the account’s creation date. If the correlated account predates the known activity window of your target by several years, the risk of a false match is high.

Translating a technical correlation into a clear, verifiable journalistic fact

🤖 AI Assistance in analysis

⚠️ IMPORTANT WARNING: The risk of hallucination and privacy

Journalists can use Large Language Models (LLMs) to process the publicly collected data, but only with extreme caution.

• Summarizing large documents or log files: Upload collected, non-sensitive documents (e.g., a long public forum thread, a public log file) and ask the AI to extract five key themes or summarize the discussion around a specific event/entity. Example Prompt: “Analyze this log file and identify all unique timestamps and IP addresses mentioned. Do not interpret the data.”

• Identifying key entities, dates, and relationships: Use AI for Named Entity Recognition (NER). Feed it large blocks of text and ask it to output a table of all unique names, organizations, and dates mentioned, helping to cluster data points.

• Translation of foreign language material: LLMs are powerful translators for large-scale social media analysis, helping you spot critical keywords quickly.

⚠️ IMPORTANT WARNING: Hallucination and privacy risk

Hallucination risk: LLMs can invent facts and sources. Every single data point, summary, or translation provided by an AI must be fact-checked and verified manually against the original source before it can be used in reporting.

Privacy Risk: Never submit sensitive or source-provided data (e.g., internal leaks, confidential emails, witness statements) to public-facing AI/LLM models. These models may use your input data for training, compromising your investigation, your source, and the security of your publication. Use only local, firewalled, or commercially vetted enterprise AI solutions if dealing with sensitive material.

🚀 Next steps and practice

Exercise to practise

The “Vanishing Admin”: You are investigating a now-defunct political blog. Your only lead is the former site administrator’s signature: “j_w_admin.”

1. Correlate: Use a tool like WhatsMyName to check the core handle and two logical variants (e.g., jwadmin, j_w_admin81) against public platforms.

2. Pivot: Assume you find a hit on an obscure image-hosting site. Pivot to reverse image search to see if the profile picture links to an active account.

3. Document: Capture a screenshot and generate a SHA-256 hash for all successful correlation points.

📖 More advanced resources

• The OSINT Framework: A comprehensive, categorized directory of thousands of OSINT tools and resources for deeper pivots.

• GHDB (Google Hacking Database): A list of advanced Google Dorks that can be adapted for finding specific file types or exposed data related to usernames/aliases.

• Maltego: A powerful visual analysis tool for mapping relationships between entities (usernames, emails, IPs) found during correlation.

• ExifTool: The gold-standard open-source tool for viewing and validating metadata in images and documents.

✅ Important things to remember and investigative principles

• Public is primary: Stick exclusively to publicly available information; anything behind a login or requiring a technical exploit is illegal and not OSINT.

• Correlate, don’t assume: A single match is a lead; a match corroborated by a second independent method (visual, behavioural, or content) is a high-confidence finding.

• Pattern over presence: The strength of correlation lies in identifying reused patterns (photos, bios, phrases, timing) rather than just the same handle.

• The audit trail is your defence: Document the Who, What, When, Where, and How of every discovery, and use SHA-256 hashing to prove the integrity of your collected evidence.

• AI is an assistant, not an editor: Use AI for data processing and summarization, but manually fact-check every output and never submit sensitive data to public models.

👁️ Coming next week…

Uncovering deleted content with the internet archive toolkit

The next tutorial will equip you with the essential skills to battle digital disappearance. We will cover the advanced use of caching and archiving services like the Wayback Machine and Archive.is to retrieve ephemeral or deleted posts, websites, and documents. Learn how to reconstruct timelines and capture evidence of targets believed to be gone forever, ensuring accountability even after an entity attempts to scrub its digital footprint.

In the age of deepfakes and mass disinformation, video evidence is a crucial, yet highly vulnerable, component of any major investigation. A journalist cannot responsibly publish a story based on an unverified clip. Chronolocation—the process of determining precisely when a video was recorded—is the defensive tool against misinformation, allowing you to anchor a breaking news event or an exposé in irrefutable time and space.

If you learn how to do this, shaky film that was once unverified content becomes a solid journalistic fact, which is necessary for putting together a correct chain of events.

👁️ Goals for learning

• Accurately geolocate a video by identifying key landmarks and unique features.

• Master the use of Google Earth Pro and Google Maps Timeline to establish a historical reference point for a scene.

• Corroborate visual evidence by cross-referencing weather, solar, or seasonal data.

• Implement a robust chain of custody protocol for video evidence and associated chronolocation findings.

💡 Basic ideas

Key terminology

• Chronolocation:
  The process of determining the specific date and time an image or video was recorded based on contextual clues (weather, shadows, construction, vegetation).

• Geolocation:
  Determining the precise geographic location (coordinates) where a photo or video was taken. The prerequisite for chronolocation.

• Pillars of Authentication:
  The three key elements for verifying a piece of media are source, date, and location.

• Shadow Analysis:
  An advanced chronolocation technique using the length and angle of shadows to calculate the sun’s position and, thus, the exact time and date a scene was captured.

⚠️ Important for Journalists: Ethical and legal boundaries

Consent & privacy: The “publicness” Rule

Your analysis only looks at media that the individual or group who posted it has made public. Do not try to bypass paywalls, hack into private accounts, or use tools to access APIs or data streams that are not public. The moment your research requires a login or password that is not your own, STOP.

Knowing when and where a video was made can help you find its creator. Your newsroom’s privacy policy requires you to be as ethical as possible when dealing with all such information.

Legal Considerations: Verification vs. trespass

Chronolocation uses publicly available tools like Google Earth Pro’s historical imagery, which is legal. The moment you use your findings to physically trespass or encourage others to do so, or use non-public databases/tools without explicit authorisation, you risk legal action.

Disclaimer: Before publishing any findings that include location or time data, especially if they go against official stories or involve sensitive figures, always talk to your organisation’s legal department.

🛠️ The method: Putting it into action step by step

Tools and setup needed

👷‍♀️ Practical execution (The “How”)

The core of chronolocation relies on identifying change over time at a fixed location.

Scenario 1: Geolocating the scene

Scenario 2: Establishing Chronology with Historical Imagery

The goal is to match a unique, time-sensitive feature in the video (e.g., construction or vegetation) with a snapshot from historical satellite imagery.

Scenario 3: Advanced Chronolocation with Shadow Analysis

Shadow analysis provides a very specific time of day and maybe even the exact date.

1. Identify a Shadow-Casting Object: Find a tall, clear object in the video (e.g., a traffic sign pole, lamppost, or vertical edge of a building) and its corresponding shadow.

2. Measure and Orient: In Google Earth Pro, measure the object's height and the length of its shadow. Note the shadow’s direction (bearing) relative to North.

3. Input Data to Solar Calculator: Input the geolocation (Lat/Long) and a plausible range of dates into an online shadow calculator (e.g., SunCalc).

4. Match: The calculator will tell you what time of day the sun would have to be at that angle to make a shadow of that length and direction on the date you chose. You have successfully changed the video’s claimed recording date if the timestamp on the footage differs between dates.

💾 The audit trail: Keeping data safe

Journalistic integrity requires an absolute chain of custody for all evidence.

1. Immediate Archiving: Use Archive.today to create a static, time-stamped, and verifiable record of the original posting/URL.

2. Local Backup: Download the video file and all extracted keyframes.

3. Metadata Capture: Log the following in a dedicated text file for the case:

   • Original URL and Archive.today link.

   • Include the geolocation coordinates (latitude and longitude) along with a screenshot of the annotated map.

   • Chronolocation range (e.g., “Must be between July 12, 2024, and August 1, 2024, based on construction.”)

4. Hash Generation: Generate a SHA-256 hash for the original downloaded video file. This hash is a unique digital fingerprint. If the file is ever altered, the hash will change, proving tampering. This is non-negotiable for court-ready evidence.

# Example command in a Linux environment: sha256sum videofile_original.mp4 >> audit_trail.txt

🧠 Verification and analysis for reporting

Corroboration Strategy

Never publish based on a single piece of evidence. Your chronolocation findings must be cross-referenced with at least two independent sources or methods:

1. Technical Cross-Check: Corroborate the Google Earth Pro findings (construction status) with third-party satellite providers (e.g., Sentinel Hub, Maxar public releases) if available.

2. Contextual Cross-Check: If the video is geolocated, look through local news archives or social media posts from that area around the time you think it happened to find events, weather conditions, or announcements that back up what you found.

3. Solar Cross-Check: If your historical imagery method gives you a date range (e.g., late summer), use a solar calculator to verify the shadow analysis for that period, providing a technical loop.

Linking Data to Narrative

Translating technical findings into accessible journalistic facts is crucial.

🤖 AI Assistance in Analysis

AI can significantly accelerate the processing of large amounts of related data, but must not handle sensitive, non-public source information.

• Summarising large documents or log files: If your chronolocation leads you to a large, public city council PDF about local construction projects, an LLM can quickly summarise the key sections, mentioning dates and locations.

• Identifying key entities, dates, and relationships (clustering data): Feed an LLM a batch of public social media posts about the area and time frame you’ve established. Ask it to extract all mentions of “construction”, “weather event”, or “unique landmark” to quickly cluster corroborating evidence.

• Translation of foreign language material: Use services like Google Translate or a non-sensitive LLM to translate foreign language signage, posters, or local news articles found during the geolocation phase.

⚠️ IMPORTANT WARNING: Don’t give public AI/LLM models source-provided or very sensitive data, like unredacted source interview transcripts or private internal files, because of the risks to data privacy and the source. Because of the high risk of hallucination, you should ALWAYS have a person check all the dates, times, and entities that AI finds. The AI gives leads and summaries, but it doesn’t give facts that can be checked.

🚀 Next steps and practice

Exercise to Practise

The “Construction Site Challenge”:
Find a recent, publicly posted video (e.g., on a local subreddit or Twitter) of a new building under construction in a major city.

1. Geolocate: Pinpoint the exact latitude and longitude.

2. Chronolocate: Use the Historical Imagery Slider in Google Earth Pro to determine the exact date range (month/year) when that construction status (e.g., structural steel complete, but no cladding) was achieved.

3. Corroborate: Search local public records or news archives for the groundbreaking/completion dates to confirm your window.

📖 More advanced resources

• Google Earth Pro Documentation: In-depth instructions on how to use the measurement, 3D viewing, and historical imagery features.

• SunEarthTools Solar Data: A powerful calculator for analysing shadows that gives you exact solar tracking.

• Sentinel Hub EO Browser: You can look at recent, high-resolution public satellite images from the European Space Agency (ESA) and compare them with other images.

• Heliacal Shadow Calculator: A specialised tool that focuses on checking the accuracy of shadow casting geometry.

• GeoGuessr (Pro Version/Challenge): Test your geolocation skills in a high-pressure setting that is like the real thing.

✅ Important things to remember and investigative principles

• Geolocation is the foundation: You cannot chronolocate until you have definitively geolocated the scene. The success of the entire operation rests on identifying the exact Lat/Long.

• Look for change: Chronolocation is the science of identifying unique, time-sensitive changes (construction, seasonal vegetation, shadow patterns) and matching them to historical records.

• The “stop at the login” rule: Never engage in unauthorised access. All investigative work must be strictly limited to publicly available data.

• Mandatory chain of custody: The SHA-256 hash is a requirement for all evidential media. It preserves the integrity of your findings for your editor and, if necessary, a court.

• AI is an assistant, not a fact-checker: Use LLMs only to process non-sensitive, publicly available bulk data (summaries, translations). A human journalist must fact-check all output to prevent the spread of AI-driven hallucinations.

  ---

🎓 Tutorials in the Deep Web, geolocation, and metadata mastery series

👁️ Coming next week…

👣 Tracking digital footprints: username & alias correlation
Uncover hidden connections! This tutorial explores identity stitching and resolution techniques. Learn to cross-reference usernames and aliases across platforms.

In a time when digital misinformation is everywhere, it’s just as important to find out where a photo, video, or event took place as it is to find out who and what it was.

Geolocation (geolocating) is a tool that investigative journalists use to turn a piece of evidence from a simple assertion into a verifiable fact linked to a specific time and place. Geoguessing (using subtle hints to figure out where something is) is often used alongside geolocation.

This expertise is important for finding out about human rights abuses, checking where protests are happening, keeping track of troop movements, and proving that false flag operations are not real. It gives a story a spatial context.

👁️ Goals for learning

By the end of this tutorial, you will be able to:

• Explain what photogrammetry, reverse image search, and geoguessing are all about.

• Use sun-shadow analysis (chronolocation) to make sure you know when and where a scenario happened.

• Use powerful mapping tools and visual databases to confirm a location within 10 meters.

• For Chain of Custody, keep a record of your geolocation findings and store them properly.

• Use AI ethically to process and group visual metadata so that investigations go faster.

💡 Basic ideas

Important words

• Photogrammetry

  • The science of making measurements from photographs is often used in OSINT to calculate object sizes or distances.

• Reverse Image Search:

  • A query technique (e.g., using Google Lens, Yandex, TinEye) that uses an image as the input to find other instances of it online and locate the original source or context.

• Geoguessing:

  • The practice of deducing a precise physical location from visual evidence alone (signs, architecture, terrain, etc.) without explicit coordinates.

• Chronolocation:

  • Determining the date and time a photograph or video was taken, often achieved through analysing the direction and length of shadows.

• Metadata (EXIF Data):

  • Embedded data in a file (like an image) that can contain the camera model, date/time stamp, and sometimes GPS coordinates (must be checked first).

⚠️ Important for Journalists: Ethical and legal limits

Privacy and consent
Just because an image or video is shared online doesn’t mean it’s okay to show the people in it, especially if they’re victims or private citizens. If you are giving away the specific address of someone’s house or business, you should always blur their face or other identifying features.

When data is made public and it leads to harassment, risk, or illegal surveillance, that crosses the ethical line. Instead of focusing on spectators' private lives, concentrate on the event and the places that are important to the public.

Legal considerations
Geolocation primarily uses publicly available data (passive OSINT), which is usually lawful. But the line is crossed if the method includes:

• Unauthorised access: Trying to get into private CCTV streams or street view archives that are password-protected.

• Terms of Service (ToS) violation: Mass-scraping mapping data or high-resolution images that go against a platform’s ToS.

Disclaimer: Journalists and news organisations must always consult their legal departments before publishing geolocated results, especially when they involve national security, ongoing conflicts, or people's safety.

🛠️ The Method: Putting it into action step by step

👷‍♀️ Practical execution (The “How”)

The central part of geolocation is iterative analysis, which means looking at minor hints to find the right place.

Scenario: Finding the place of a protest from a video on social media

1. First look and reverse search

   1. Action: Use Google Lens, Yandex or TinEye to do a reverse image search on a screenshot of a critical frame.

   2. Investigative goal: The goal of the investigation is to find the original source, date, and any previously known place or context.

2. Look at the big picture clues (macro clues)

   1. Action: Make a list of the most essential, unmovable things, including distinctive bridges, large public buildings, bodies of water, mountain ranges, or certain sculptures.

   2. Investigative goal: The goal of the investigation is to narrow the area down to a city or a small region.
      

      Example clues: “The signs are in Cyrillic, the architecture is Soviet-era brutalism, and the land is mountainous.” Focus: Concentrate on Central Asia and Eastern Europe.

3. Look at the micro clues
   This is the geoguessing step, where subtle details are critical.

4. Verification and measurement

Action: After identifying a potential location (such as a specific intersection on Street View), use Google Earth Pro’s measurement tools to align the heights and distances of objects in the video/photo with the satellite image (photogrammetry).

Investigative goal: Build high trust by making sure that important details, such as the distance between a lamppost and a traffic signal, are precisely the same.

💾 The Audit Trail: Keeping Data Safe

You can’t trust a geolocation until there is a clear, repeatable audit path that proves Chain of Custody.

1. Capture and archive: Use tools like SingleFile or a dedicated browser extension to preserve the original source page (e.g., a social networking post) as a full, unchanging HTML file. Don’t only look at screenshots of the original post.

2. Write down the steps (required): Make a chronological log file, like a notebook or spreadsheet, that lists

   1. Original URL: (The video or post on social media)

   2. When and where the picture was taken:

   3. Tools used: (for example, Yandex for R.I.S. and SunCalc parameters)

   4. Identified coordinates: (The last Lat/Long that was found)

   5. The Why: A short explanation of the main visual cues utilised to confirm (for example, “Matched unique church steeple at N48.8584, E2.2945”).

3. Make a Hash: Make a SHA-256 hash of the original video or image file that you downloaded and the archived HTML page. This digital signature shows that the file hasn’t changed since it was collected.
   
   Command Line Example (Linux/macOS): shasum -a 256 [filename]
   

4. Secure Storage: To prevent unauthorised access, save all log files, archival evidence, and hashes on an encrypted drive, such as Proton or VeraCrypt.

🧠 Check and analyse for reporting

Strategy for corroboration

1. Technical data check: To ensure the GPS coordinates are correct, verify them against at least two separate mapping sources, such as Google Earth Pro and OpenStreetMap. If you’re looking for a building, check old photos to make sure it was there at the time of the event.

2. External source check: Verify outside sources to ensure the broad area aligns with non-visual data, such as local news reports, government databases, or public documents that discuss occurrences in that area or involve the features found. For instance, if you observe a one-of-a-kind building, look for planning applications for that address in your area.

Connecting data to story: Geolocation findings must be transformed from technical data into journalistic facts that anyone can verify.

🤖 AI Assistance in Analysis

For advanced geospatial analysis, journalists need to use multimodal AI models (that can ingest and understand visual data) rather than text-based LLMs. An AI can’t “geolocate” a target image on its own (it needs maps and confirmation from a person), but it can quickly and efficiently analyse small visual clues, which speeds up the work of the human geolocator.

AI techniques for accelerating geolocation: R.A.F.T.

R.A.F.T. is a framework adopted by the Eurovision Social Newswire and Spotlight teams for a wide range of daily research and analysis tasks. From geolocation to web scraping to data analysis, R.A.F.T. is a portable, reusable asset that provides a solid structure upon which to build for non-editorial tasks and tailors the output to the journalist’s needs.

Role (R): Assign a persona (e.g., “Forensic Accountant,” “Legal Verification Expert”) - Ensures the AI uses the appropriate industry terminology and level of scepticism. 

Action (A): Define the specific, measurable task - Prevents generic text. Focuses AI on the immediate, time-critical task.

Format (F): Demand a specific, usable output structure (e.g., Markdown table, JSON, bullet points) - Makes data instantly ready for a spreadsheet, map, or article bullet list.

Tone (T): Set the language, perspective, or scepticism (e.g., “Neutral and objective,” “Sceptical”) - Prevents the AI from injecting hyperbolic or opinionated language.

• Feature identification and labelling: You can upload the picture and ask the AI to “Identify the utility pole structure style and compare it to documented regional standards,” or “Transcribe all non-English text visible on signs and posters.” Both of these give you instant keywords for map searches.

• Pre-analysis of temporal clues: The AI is asked to determine the azimuth (direction) of the main shadow and the altitude (height) of the sun from the length of the shadow. This gives SunCalc an initial hypothesis to work with.

For more on using AI prompting for geolocation:

⚠️ IMPORTANT WARNING: The risk of hallucination and privacy

Never send sensitive, source-provided, or private data (like private login information or parts of confidential documents) to public LLMs. This could expose the source and violate privacy.

Use only private, dedicated enterprise AI solutions or models on closed systems for sensitive information.

Because of the high risk of hallucination, people need to check all AI-processed data against the original source documents and pictures. A human journalist must verify every fact reported by the AI using a source other than the AI itself.

🚀 Next Steps and Practice

Exercise to Practise

The “tourist clue” challenge

• Get a vacation picture from a friend or family member that shows only a certain building facade and a small part of a road sign in a different country.

• Use the visual clues (building, language, sign colour/shape, and shadow angle/time) to find the exact intersection without asking them.

• Check your accuracy by comparing your final latitude and longitude with theirs.

🌎 Advanced Resources Geolocating Methods:

1. SunCalc is an interactive map that shows the sun's position and the shadow (chronolocation) at any time and place.

2. PimEyes and FaceCheck are advanced reverse image search engines that can help you find the original social media post if you can see the face. Be very careful when using this.

3. Sentinel Hub is an open-source platform that lets you view high-resolution satellite imagery (which is helpful for hard-to-reach areas).

✅ Important things to remember and investigative principles

• Put the micro clues first: A power line, a distinctive streetlamp, or a painted curb are just a few of the small, one-of-a-kind things that set a city apart from an intersection.

• Always double-check: At least two independent mapping sources, and your own derived Chronolocation, must confirm your final Lat/Long.

• Document everything: A chain of custody (logs, hashes, archival sources) is not up for discussion. Without it, what you found is just an accusation, not a fact that can be proven.

• Ethical constraint: Don’t tell anyone where private individuals or victims are, just because you can find them on a map. Privacy considerations must come after the public’s interest.

• AI is a tool, not a final check: LLMs can translate and process, but they can’t check facts. The journalist is responsible for the final check of all technical data.

👁️ Coming next week…

🧭 Mastering Video Verification and Chronolocation
We will go from still pictures to moving video and learn how to check its authenticity and timestamp. This tutorial will show you how to use Google Historical Imagery (Earth Pro, Maps, Timelapse) to compare landmarks, changes in construction, and cycles of vegetation. In the end, it will show you when a video was recorded and turn simple footage into reliable, chronological proof.

🎓 Other tutorials in the Deep Web, geolocation, and metadata mastery series

In a time when deepfakes and easy-to-use photo-altering software are common, being able to check the authenticity and context of a photo is not only helpful but also necessary for journalistic integrity.

You can change source photos to change the facts, trick people, or frame people in a deceptive way.

To determine where a digital image originated and whether it is real, journalists need to go beyond merely examining it and utilise forensic methods like EXIF data analysis and Error Level Analysis (ELA). This skill is essential for high-stakes investigations where photographic evidence is crucial to the story.

👁️ Goals for learning

• Learn how to get and understand Exchangeable Image File Format (EXIF) metadata.

• Learn how to find important geographical (GPS) and temporal (date/time) information in an image file.

• Learn the basics of Error Level Analysis (ELA) and how to use it to find fake digital documents.

• Establish a standard method to maintain the Chain of Custody for photographic evidence.

💡 Basic ideas

Important words

• EXIF data:

  • The Exchangeable picture File Format is a standard for storing metadata in digital picture files like JPEG and TIFF. It has details about the camera, settings, date and time, and sometimes GPS locations.

• Metadata:

  • Data that tells you about other data. In OSINT, it’s often file information that isn’t visible.

• Error Level Analysis (ELA):

  • A forensic method that looks at the small variances in the JPEG compression error rate across an image to find image manipulation. These differences are usually uniform in an untreated image but not in a manipulated one.

• Chain of custody:

  • The chronological record or paper trail that shows the seizure, custody, control, transfer, analysis, and disposal of physical or electronic evidence.

• Stenography:

  • The act of hiding a file, message, image, or video inside another file, message, image, or video. Sometimes, ELA can show this.

⚠️ Important for journalists: Ethical and legal limits

Privacy and consent
EXIF data might include very private information, such as the exact GPS coordinates (latitude and longitude) of where a photo was shot. This could put a source at risk or reveal a private location.

Ethical duty
Always hide or remove sensitive EXIF data before publishing to ensure privacy and source security.

The “Public Domain” limit
You can only use data that is available to everyone and can be shared legally. Don’t ever try to guess login information or get into private systems by looking at the filename or other metadata.

Things to think about legally
Verification is Required: All forensic results, including EXIF and ELA, are merely technical results. Before you report these as facts, you need to back them up with journalistic methods like interviews, records, and independent checks.

Disclaimer: Depending on where you live, using forensic tools and techniques on publicly available data could have legal consequences. Always talk to your news organisation’s lawyers about the best methods to handle, keep, and report digital evidence.

🛠️ The Method: Putting it into action step-by-step

Tools and setup needed

ExifTool Command-Line tool: The standard for reading, creating, and altering metadata in almost any file type. Put it on a separate OSINT Virtual Machine (VM) or Secure Operating System.

Browser Extension for dedicated browser: For rapid tests, use Exif Viewer extensions like FOCA for desktop or simple web viewers. Only use on photographs that don’t need a lot of detail; command-line tools are more dependable.

Online ELA Tool from FotoForensics: A tool on the web for rapid, basic ELA and signature analysis. Use only for photographs that are available to the public and are not sensitive.

Secure VM OS: A dedicated machine, like Tails or a regular OS that has been hardened with security settings. It is essential to keep personal information separate from investigative work.

👷‍♀️ How to put it into practice

Scenario 1: Checking an image’s source and time

Aim: Find out where and when a key piece of photographic evidence was made and what device was used.

Download the image safely: Directly save the original image file to your safe VM or isolated storage. Don’t take a screenshot of the picture because it makes a new file with new metadata.

To run ExifTool, open your terminal in the folder where the image is stored and type in the basic command.

Bash

# Command to generate SHA-256 hash on most Linux/macOS systems
sha256sum original_image.jpg > hash_log.txt

Important EXIF interpretation: Look over the output for the most useful fields:

• GPS Latitude and Longitude: The exact place where the snapshot was taken. Use a tool like latlong.net to find the coordinates.

• Date/time original/create date: The exact time the shutter was pressed. Be careful with your timezone settings!

• Make and model: This tells you what kind of device it is (for example, Nikon D850 or Apple iPhone 17).

• Software: This can refer to editing software (like Adobe Photoshop 2024), which clearly indicates that something has been changed.

Table of actionable EXIF data:

Scenario 2: Evaluating an image for digital alteration (ELA)

Goal: Find out if a part of the picture (such as a person or an object) was added or changed digitally.

1. Upload to ELA tool: Use a trusted online ELA tool like FotoForensics or a desktop program like GIMP with a plugin to upload the image.

2. Look at the ELA output: The ELA tool will create a new image that displays the error levels, typically using different colours or intensities. The error level over the whole image should be quite even and bright.

3. Modified/manipulated areas: The error level will be very different (typically considerably darker or lighter/sharper) in areas that have been cut, added to, or modified because of re-compression or a different original compression signature.

4. Examine: Look for a clear, sharp line between a bright area (the original image) and a dark or dull area (the inserted element or heavy re-save), especially around the edges of things or words that you think might be there.

💾 Keeping data safe: The audit trail

For all digital evidence in journalism, it is necessary to establish a Chain of Custody.

• Original file isolation: Move the file you just downloaded right away to a secure storage folder where it can’t be changed by mistake.

• Hash generation: Create a cryptographically secure hash of the original file and all subsequent files, such as the ELA picture. The SHA-256 hash is the standard.

Bash

# Command to generate SHA-256 hash on most Linux/macOS systems
sha256sum original_image.jpg > hash_log.txt

Comprehensive logging: Log every single action in a contemporaneous audit log:

• Date and time of file download.

• Source URL or method of acquisition.

• The SHA-256 hash of the original file.

• Every tool used (ExifTool version, FotoForensics URL/date).

• The results of the analysis (e.g., “EXIF data shows GPS coordinates...”, “ELA output is consistent with a re-saved original”).

🧠 Verification and analysis for reporting

Strategy for corroboration

Technical data is not proof; it is evidence. It has to be verified.

1. Geospatial corroboration: If the EXIF data gives you coordinates, utilise at least two different mapping services (like Google Earth/Maps and Bing Maps, or a satellite imagery resource like Sentinel Hub) to make sure the photo matches the real area and features (such as buildings and unique landmarks).

2. Temporal corroboration: Check the EXIF timestamp against local weather reports, aircraft logs, or publicly recorded activities for that date and time to ensure the photo could have been taken then.

3. Manipulation corroboration: whether ELA suggests manipulation, use a second analysis tool that is completely different from the first one (such a desktop ELA software) to process the image and check whether the abnormality happens again. A convincing manipulation finding must be robust enough to endure independent, expert examination.

Connecting data to story

It is important for clarity and effect to turn raw technical discoveries into verifiable journalistic facts.

🤖 AI Assistance in analysis

AI and LLMs can help with processing textual metadata, but they need to be used very carefully.

Summarising large documents or log files: If your OSINT operation generates extensive text-based logs, such as a large ExifTool output with thousands of items, you can use an LLM to quickly summarise the most important information.

Example Prompt using the R.A.F.T model:

Role: Metadata Analyst / Investigative Team Contributor

Audience: Lead Investigative Journalist / Editorial Board

Format: Data-Driven Analytical Report based on a provided CSV log of EXIF data.

Topic/Task: Analyze the provided EXIF data (CSV log) to identify trends in image capture, editing, and timeline anomalies. Ensure all foreign-language metadata for camera models and software is translated and presented in English.

Your analysis must address the following four deliverables:

Top Camera Models: List the five most frequently used camera models (from the ‘Model’ field).

Software Analysis: Examine the ‘Software’ field entries. Consolidate related software versions (e.g., ‘Adobe Photoshop CC 2021’ and ‘Adobe Photoshop CC 2022’ should be grouped under ‘Adobe Photoshop CC’) and identify the single most common editing tool used.

Timeline Anomalies (Grouping Data): Group the image records by ‘Date/Time Original’ and flag any records where the ‘Modify Date’ is more than three (3) months after the ‘Original Date’.

Summary: Based on your findings from deliverables 1, 2, and 3, provide a concise, two-paragraph summary outlining the dominant equipment (cameras), the primary post-processing software used, and any significant timeline anomalies noted. This summary should be suitable for inclusion in a preliminary investigative report.

⚠️ IMPORTANT WARNING: The risk of hallucination and privacy

Risk of hallucination: LLMs are likely to see things that aren’t there. Never say that something an AI found or summarised is true without having a human evaluate it against the original data.

Privacy concern: Don’t put private, sensitive, or confidential data from a source into public LLM platforms like ChatGPT or Gemini Public. You could lose your sources and your research if this data is used to train the model. Use AI technologies that have been checked out by the institution, or solely with data that is available to the public.

🚀 Next steps and practice

Exercise to practise

• Look for a current news shot of a big breaking story. Click the right mouse button and save the picture.

• Use ExifTool to get all of the metadata.

• Find the GPS coordinates. If you find them, put them on a map.

• Use FotoForensics (or a similar ELA tool) to look at the picture. Look for any bright or dark spots that don’t match up. This could mean that a logo, text, or item was copied into the picture.

• Write down what you found and make a SHA-256 hash of the original file.

📖 More advanced resources

1. ExifTool Documentation: The official manual is the best place to find information about every tag and command.

2. Forensic Wiki on ELA: A thorough, technical look at the principles and limits of Error Level Analysis.

3. Jeffrey’s Image Metadata Viewer: A great web viewer that often shows metadata fields that aren’t very well known.

✅ Important things to remember and investigative principles

• EXIF is like a fingerprint: When you see an image in the Exchangeable Image File Format, think of it as the image’s embedded, non-repudiable fingerprint. It has information about the time, place, and device.

• ELA is the truth detector: Error Level Analysis is the most essential tool you have that doesn’t harm files to find digital manipulation by looking for differences in compression.

• Stop at the Hash: The first thing you should do when you get a file is to make and record its SHA-256 hash to ensure a verifiable Chain of Custody.

• Check everything: Technical information (such as EXIF coordinates and ELA anomalies) is not a fact; it needs to be checked against at least two separate journalistic sources.

• Privacy first: Never share sensitive EXIF data (particularly GPS) without the source’s clear permission or a strong public interest reason.

👁️ Coming next week…

🌐 Pinpointing location with subtle visual clues
Next week, we’re diving into the essential art and science of geolocation—pinpointing a location using only subtle visual clues in an image. In a crisis or breaking news situation, knowing the exact time and place a piece of media was created is paramount. This tutorial will empower you to become a visual intelligence detective, transforming common image elements into solid geographic evidence.

🎓 Other tutorials in the Deep Web, geolocation, and metadata mastery series

Investigative discoveries are not often on the first page of a search. Advanced search tactics, sometimes known as “dorking,” are very important because they cut through the noise of ordinary search results, which are often full of commercial content.

They help journalists find and disclose files, database dumps, sensitive system configurations, and misconfigured assets that were accidentally made public but are still indexed by search engines.

This feature turns a regular search engine into a powerful forensic tool that can help find key evidence for tales about financial fraud, government mistakes, and cybersecurity breaches.

👁️ Goals for Learning

When you’re done with this tutorial, you’ll be able to:

• Learn how to utilise complex Boolean operators and Google Dorks to find specific file kinds and server information.

• Use Google Custom Search Engines (CSEs) and syntax that is specific to each platform to search social media and speciality sites like Telegram.

• Use Shodan and Censys to explore the open internet, identify an organisation’s digital footprint, and find services available to the public.

• Set up a chain of custody for digital evidence to make sure it stays safe and can be used in court.

• Use AI technologies responsibly to look at big datasets while lowering the chance of hallucination.

💡 Basic Ideas

Important Words

• Google Dorking:

  • Using advanced search operators (such as filetype: and inurl:) to find specific, often private, information that search engines have made public.

• Google CSE (Custom Search Engine):

  • A search engine that uses Google’s index but only searches a certain set of domains (for example, just .gov sites or a selected list of Telegram channels).

• Passive OSINT:

  • Getting publicly available information without directly interacting with the target system (for example, utilising Google Dorks, Shodan, or CSEs). This is the best and safest way to do things.

• Shodan/Censys:

  • These are specialised search engines that scan and index the Internet of Things (IoT) and connected devices. They provide you with information on open ports, services, banners, and data on hardware and software versions.

• Chain of Custody:

  • A very important written method follows digital evidence from collection to final presentation, ensuring it is real and hasn’t been altered.

⚠️ Important for Journalists: Moral and Legal Limits

Privacy and Consent
The “Stop at the Login” Rule is the most important rule for ethical OSINT: Don’t try to get around any password, login prompt, or access protection. Anyone can see publicly indexed content, and it’s lawful to use a Dork to access it. It is against the law and wrong to try to log in, scan, or probe a system directly to get access. Even if sensitive data is made public, it must be treated with the utmost care regarding the privacy of those who are not public figures.

Things to think about legally
It is okay to utilise tools like Shodan and Censys to look for their publicly available data. Still, you should know that scanning or port sweeping a target’s network without their consent could break anti-hacking or computer fraud laws (such as the CFAA in the U.S.). Don’t do anything that would be considered unauthorised access or a denial-of-service attack. You can only use these tools to ask questions about the data they have already collected.

Disclaimer: Before looking into any system vulnerabilities or disclosed non-public data, you should talk to your news organisation’s legal counsel.

🛠️ The Method: Putting It into Action Step by Step

Tools and Setup Needed

Dedicated Virtual Machine (VM) or Sandbox Browser: For all of your OSINT work, use a separate environment, either a Linux VM or a dedicated browser profile. This keeps your main computer safe and lowers the chance that your identity will be revealed.

VPN/TOR: To be anonymous and hide your location when searching, use a trusted commercial VPN or the Tor Browser.

Hashing Tool: A simple program that makes SHA-256 hashes, like built-in command-line utilities or a separate hash generator.

Web Archiving Tool: Use services like The Wayback Machine or specialist browser extensions like Hunchly or PageFreezer to save proof.

Accounts: You can get free or paid access to Shodan and Censys to learn more about devices and servers.

👷‍♀️ Practical execution (The “How”)

Scenario 1: Auditing a Company’s Exposed Internal Documents (Advanced Google Dorking)

Investigative Goal: Locate publicly available PDF, Excel, or PowerPoint files on a target company’s site that contain the keywords “budget,” “confidential,” or “Q3 earnings.”

Scenario 2: Using Google CSEs and Platform Syntax to Mine Social and Niche Platforms

A Google Custom Search Engine (CSE) is an invaluable tool for journalists, as it allows you to apply the power of Google’s operators to a hand-picked list of sites (like a list of activist blogs, a nation’s government websites, or, famously, a list of indexed public social channels).

Scenario 3: Checking the Security Posture of a Target (Shodan and Censys)

These apps work like “search engines for the internet of things,” giving you a quick look at services that are open to the public.

💾 The Audit Trail: Keeping Data Safe

Establishing a Chain of Custody is not optional; it distinguishes an unproven lead from evidence that can be used in court.

1. Capture the Artefact: Don’t just take screenshots of the search results page. You need to either save the page or download the file. To get the whole page (including the HTML source and headers) with a timestamp that can’t be changed, use a tool like Hunchly or PageFreezer.

2. Make a Hash: As soon as you download a file (such as a PDF or spreadsheet) or take a picture of a webpage, make a SHA-256 cryptographic hash of it. This one-of-a-kind alphanumeric string shows that the file is safe. Even a single space in the file will change the hash completely.

   1. Windows: Get-FileHash -Algorithm SHA256 C:\path\to\file.pdf.pdf

   2. For Linux and macOS: use shasum -a 256 /path/to/file.pdf

3. Log the Evidence: Make an unchangeable record of the following in a secure spreadsheet or database:

   1. Date and Time of Collection (in UTC): YYYY-MM-DD HH:MM:SS UTC

   2. Query: The precise query string was used for the investigation.

   3. Source URL: The complete URL of the artefact that was created.

   4. SHA-256 Hash: The hash that was made.

   5. Collector: Your name and investigator ID.

🧠 Check and Analyse for Reporting

Strategy for Corroboration

The first search result is a lead, not a fact. Always check technical results against other sources that are not related to the work:

IP Address: To ensure that an IP address detected by Shodan (for example, one hosting a susceptible database) belongs to or is associated with the target business, it must be checked against Whois information, DNS lookups, or Certificate Transparency logs (like those in Censys).

File Content: You need to check the primary claims and financial numbers in a file you found using Dorking against at least two additional independent sources, such as a public financial disclosure, a company statement, or a separate whistleblower document.

Geolocation: If a dork finds a social media post, you can utilise reverse image search, shadow/sun analysis, and comparison of satellite images (like Google Earth) to make sure the photo is real.

Connecting Data to Story

Technical data is not easily understandable. You need to turn it into facts that are easy to understand and verifiable.

🤖 AI Assistance in Analysis

AI/LLMs can be very helpful for analysts, but they should never be utilised as the main source or to check facts.

Summarising Big Documents: Upload a publicly indexed 500-page PDF (such a policy or legal filing) and tell the LLM to find “all mention of dates, people, and financial values over $1M.” This saves hundreds of hours of manual review.

Finding Important People and Grouping Them: Give an LLM a cleaned-up list of 1,000 email addresses you got through dorking and ask it to group them by department (for example, finance@, hr@, support@) to figure out how the company is set up.

Translation: Use AI to quickly translate documents written in other languages, such as a Russian log file or an Arabic contract, so the investigation can proceed smoothly.

⚠️ IMPORTANT WARNING: The risk of hallucination and privacy

• Hallucination Risk (NEVER Trust): LLMs are designed to generate language that sounds believable, not to verify facts. They often make up sources, dates, and even whole documents. Every piece of data, number, date, or entity name provided by the AI must be checked by a person against the original source document. You need to access the source file and check if the AI says the date is “March 15, 2025.”

• Privacy Warning (NEVER Upload): Don’t ever upload sensitive, source-provided, or non-public data (such as PII) to an AI/LLM service that is open to the public. Public models use your information to train their algorithms, which means that a lot of data is leaked, and your source’s security is put at risk. Only use enterprise models that are safe, self-hosted, or validated and have a policy that guarantees no logging or training for this kind of material.

🚀 Next Steps and Practice

Exercise to Practise

The Policy That Leaks:

• Goal: Find public documents on a big, well-known university’s website that talk about “COVID-19 policy” and include a staff member’s entire “personal email address.”

• Query: Use the site:, filetype:, and intext: operators to search for .pdf files on a big university domain (like site:harvard.edu) that have the words “COVID-19 policy” AND “@university.edu” in them.

• Task: Your first step in making a Chain of Custody log is to download any document you find and make its SHA-256 hash.

📖 More advanced resources

1. Google Hacking Database (GHDB): A carefully chosen and organised list of Google Dorks that have been able to find and reveal a number of sensitive files and system weaknesses.

2. Spotlight’s OSINT Toolkit (EBU members only): Tools and links to bespoke CSEs (like the Telegago CSE) for searching on social media and other platforms.

3. Censys Search Documentation: This is where you can discover the powerful, SQL-like query language that lets you look at internet hosts and certificates in great detail.

4. Hunchly is a commercial OSINT collecting and reporting program that automates preservation, hashing, and audit trails.

✅ Important things to remember and investigative principles

• Precision is power: Advanced operators (site:, filetype:, inurl:, intitle:) change search engines from libraries into tools for surgical intelligence.

• Always look for a wall: If you see a login or paywall, stop. You can only use publicly available information in your research. Don’t try to get around access limits.

• Document everything (CoC): To keep a verifiable Chain of Custody for every important artefact, you need to record the Query, the URL, the Timestamp, and the SHA-256 Hash.

• AI is an assistant, not a source: Use LLMs to summarise data, translate it, and extract entities. Do not trust facts made by AI or give private information to a public model.

• Translating technical data: A discovery like “Open MongoDB port” needs to be turned into a clear journalistic fact, such as “Unauthenticated customer database.”

👁️ Coming next week…

📸 Forensic image analysis: EXIF data & error level analysis (ELA)
Without proof in the form of pictures, the infrastructure intelligence you’ve obtained is worthless. The next stage is to learn how to use pictures as digital proof. We will show you how to get EXIF data (location, camera, date) and how to utilise advanced methods like Error Level Analysis (ELA) to find digital picture alteration, photo forgeries, and re-saves. This is very important for checking user-generated content in a crisis.

🎓 Other tutorials in the Deep Web, geolocation, and metadata mastery series

As a journalist, verifying the who, what, where, when and why of an image is paramount. Determining an image’s exact geolocation is a critical OSINT skill and forms one of the three pillars of social newsgathering verification.

LLMs can provide a wide range of research and analysis support for open-source journalists through targeted prompting.

Building prompts is not an exact science. Depending on the complexity of the task, few prompts will provide the format or output you require without iterations or continuous debugging analysis.

What is essential is adopting a structured framework that can be adapted across a wide range of different tasks, which will help you build consistency across your prompts.

The same can be adopted for geolocation work.

This tutorial breaks down an AI prompt that creates step-by-step analysis, transforming a simple AI response into a detailed investigative geolocation report.

R.A.F.T.

R.A.F.T. is a framework which has been adopted by the Eurovision Social Newswire and Spotlight teams for use in a wide range of daily research and analysis tasks. From geolocation to webscraping to data analysis, R.A.F.T. is a portable, reusable asset that provides a solid structure upon which to build from for non-editorial tasks and tailor the output to the journalist’s needs.

Role (R): Assign a persona (e.g., “Forensic Accountant,” “Legal Verification Expert”) - Ensures the AI uses the appropriate industry terminology and level of scepticism. 

Action (A): Define the specific, measurable task - Prevents generic text. Focuses AI on the immediate, time-critical task.

Format (F): Demand a specific, usable output structure (e.g., Markdown table, JSON, bullet points) - Makes data instantly ready for a spreadsheet, map, or article bullet list.

Tone (T): Set the language, perspective, or scepticism (e.g., “Neutral and objective,” “Sceptical”) - Prevents the AI from injecting hyperbolic or opinionated language.

The geolocation prompt

The prompt is designed to put the AI into an analytical mindset, mandate a Chain-of-Thought (CoT) process, and structure the output for maximum usefulness.

Assume the role of an expert OSINT analyst specialising in image geolocation.

Core Task: “Analyse the provided image meticulously to determine its geographic location. Aim for country, city, and, if possible, specific street address or coordinates.”

Guided Instructions:
1.Identify and list all significant visual cues** present in the image. Focus on: identifiable landmarks, architectural styles, landscape features (mountains, coastlines, vegetation type), visible vehicles (note make/model, license plate details if readable), all readable text on signs or buildings (transcribe text and identify language), flags, distinctive clothing or uniforms, and overall weather/environmental conditions.

2. Based only on the visual cues identified, provide a step-by-step reasoning process (Chain-of-Thought) explaining how these cues lead to a potential geographic location or region. Discuss ambiguities or conflicting clues if present.

3. State your most likely geolocation estimate(s).Provide coordinates if confidence is high.

4. Finally, explain the confidence level (High/Medium/Low) for your estimate and briefly justify it based on the strength of the evidence.

(Optional Context - Use with Caution): “Consider the following potential context, but prioritise visual evidence:.” (Use this section only if you have external, non-visual information that might guide the AI, like “The photo was posted by an account located in Europe.”)

Deconstructing the prompt: How it works

The prompt leverages several key AI prompting techniques: Role assignment, task definition, feature extraction, chain-of-thought, and confidence assessment.

1. Role Assignment and Tone Setting

   Assume the role of an expert OSINT analyst specialising in image geolocation.

   Assigning an “expert” role dramatically increases the quality, specificity, and technical depth of the response. It primes the AI to use specialised terminology and analytical rigour, rather than providing a casual guess.
   

2. The Core Task

   Analyse the provided image meticulously to determine its geographic location. Aim for country, city, and, if possible, specific street address or coordinates.

   This section directly addresses the Action (A) element of the R.A.F.T. framework. It sets a clear, ambitious, and measurable goal: Analyse the provided image meticulously to determine its geographic location. Aim for country, city, and, if possible, specific street address or coordinates. “Meticulously” encourages detailed analysis, and the required output hierarchy (country → city → street/coordinates) ensures the AI doesn’t stop at a vague region.

   
   The subsequent Guided Instructions (1-4) further break down this single “Action” into verifiable, step-by-step sub-tasks.
   

3. Feature Extraction and Data Structuring (Guided Instruction 1)

   Identify and list all significant visual cues present in the image. Focus on: identifiable landmarks, architectural styles, landscape features (mountains, coastlines, vegetation type), visible vehicles (note make/model, license plate details if readable), all readable text on signs or buildings (transcribe text and identify language), flags, distinctive clothing or uniforms, and overall weather/environmental conditions.

   This is the most crucial part. You are training the AI on what to look for, ensuring it executes the first step of OSINT before jumping to a conclusion. You’re essentially providing the AI with a checklist of features it is good at identifying (text, architecture, cars, flags).
   
   Tip: This structured list makes it easy to spot if the AI missed an obvious clue (e.g., a foreign-language sign).
   

4. Mandatory Chain-of-Thought (Guided Instruction 2)

   Based only on the visual cues identified, provide a step-by-step reasoning process (Chain-of-Thought) explaining how these cues lead to a potential geographic location or region. Discuss ambiguities or conflicting clues if present. 

   The Chain-of-Thought (CoT) technique is a powerful enhancer for complex tasks. It forces the AI to demonstrate its analytical process.

   • Cue 1: Text in Cyrillic. → Conclusion: Likely Eastern Europe or a Slavic country.

   • Cue 2: Specific vehicle model (Lada Niva). → Conclusion: Supports Eastern European region, common in Russia/Ukraine.

   • Cue 3: Distinctive mountain range. → Conclusion: Matches geography of the Carpathian mountains.
     

   This not only explains the answer but also helps you (the journalist) verify the logic.
   

5. Final Estimate & Coordinates (Guided Instruction 3)

   State your most likely geolocation estimate(s). Provide coordinates if confidence is high.

   This forces the AI to move from the analytical process (CoT) to a definitive, actionable answer. Requiring coordinates only when confidence is high prevents speculative guessing, ensuring that the provided geographical data meets a threshold of certainty required for professional use.
   

6. Confidence Assessment (Guided Instruction 4)

Finally, explain the confidence level (High/Medium/Low) for your estimate and briefly justify it based on the strength of the evidence.

A geolocation estimate is useless without a confidence level. This section forces the AI to self-critique based on the quality of the evidence (e.g., High confidence due to a unique street sign; Low confidence due to blurry text and generic architecture).

Optional context (Use with Caution)

Consider the following potential context, but prioritise visual evidence: (Use this section only if you have external, non-visual information that might guide the AI, like "The photo was posted by an account located in Europe.")

Use this section only if you have external, non-visual information that might guide the AI, like “The photo was posted by an account located in Italy”.

Example

On October 4, a video emerged on YouTube showing a appearing to showing a protest in Israel. The video was simply titled חי צילום כנסים צילום אירועים שידור חי SATVIEW.TV רחף (translated: “Live Conference Photography Event Photography Live Broadcast SATVIEW.TV Hover”)

At the time of the video’s publication, it was a live broadcast and offered few visual clues about the exact location, apart from blurred text in both Hebrew and English.

In the top right corner of the screen, the text “Tel Aviv Museum of ” was visible on one of the buildings. This could be sufficient for a manual search on Google to find the location. Additionally, it provides an opportunity to take a quick screenshot of the area and use a geolocation prompt.

Process

1. Upload content

   Start your interaction by uploading the image (in this case, a screenshot) you need to geolocate.

2. Paste the full prompt

   Paste the entire prompt into the AI’s chat box, including the role assignment and all instructions. In this instance, we are going to also invoke the Optional context section of the prompt to include “Tel Aviv Museum of” observed in the screenshot.

3. Step 3: Review the output

   Critically evaluate the AI’s output.

AI output (Gemini)

Based on the image analysis, here is the geolocation estimate:

Geolocation Estimate

The most likely location is is Sderot Sha’ul HaMelech, Tel Aviv-Yafo, Israel.

The demonstration is taking place in the plaza area along this boulevard, known as Hostages Square (Kikar HaHatufim), which is directly in front of the Tel Aviv Museum of Art complex.

Coordinates (Approximate Centre of Square): 32°04’37.4”N 34°47’14.6”E

1. Visual Cues Identification 🔍

Feature: Readable Text

• Description & Detail: The text visible on the image, including the text below the image, is in Hebrew. Banners and signs contain Hebrew characters.

• Clue Significance: High: Confirms the country/language of the event is Israel.

Feature: Flags:

• Description & Detail: Multiple flags are visible, predominantly the Flag of Israel (Blue Star of David on a white field between two blue stripes).

• Clue Significance: High: Strongly points to Israel.

Feature: Landmarks/Architecture:

• Description & Detail: The imposing and well-lit institutional buildings visible in the background, though partially obscured, match the architecture found in the cultural and civic centre of Tel Aviv. The building in the background is part of the extensive complex that includes the Tel Aviv Museum of Art and the surrounding cultural institutions on Sderot Sha’ul HaMelech.

• Clue Significance: Anchors the location to Tel Aviv’s institutional core along this boulevard.

Feature: Event Type

• Description & Detail: The large gathering of people, presence of a stage, organised banners, and a live broadcast setup strongly suggest a major political demonstration or rally, consistent with events held at Hostages Square.

• Clue significance: Medium: Consistent with frequent public gatherings at this prominent civic location.

2. Reasoning Process (Chain-of-Thought) 🤔

1. Country/City Identification: The presence of Hebrew text and Israeli flags definitively places the event in Israel, with the large scale suggesting Tel Aviv, the hub for major political gatherings.

2. Landmark Recognition: The location, Sderot Sha’ul HaMelech, is known for its large public plaza, which sits directly in front of the Tel Aviv Museum of Art (TAMA). This plaza, recently established as Hostages Square, is defined by the surrounding institutional buildings and is frequently utilised for massive public events and rallies.

3. Architectural Context: The visible background architecture is congruent with the complex that includes the Tel Aviv Museum of Art’s buildings and the adjacent cultural centres, establishing the exact location on this boulevard.

3. Confidence Level and Justification ✅

Confidence Level: High 🚀

Justification:

The combination of unambiguous national symbols (Israeli flags, Hebrew text) and the definitive identification of the location as Sderot Sha’ul HaMelech, a major civic location in Tel Aviv defined by the presence of the Tel Aviv Museum of Art and its public plaza, provides a high degree of confidence in the geolocation.

In this example, there are many visual clues to aid the AI’s response, with Google Maps confirms the location is correct. However, this will not always be the case, and in some instances, it will not yield the expected results.

It is vital to remember that detailed prompts won’t work miracles if the source content lacks distinguishable information. If an image is too blurry, too generic, or completely lacking in unique visual cues, even the best prompt can only state that geolocation is impossible and justify the low confidence level.

Always temper expectations based on the quality of the image itself.

However, the prompt shows how using the R.A.F.T. framework, you can move beyond simple guesses and obtain a robust, evidence-based OSINT report every time.

🎓 Other tutorials in the Deep Web, geolocation, and metadata mastery series

Master advanced investigative techniques in the “Prompting for Geolocation” session, part of the Specialised Context & Content module within the EBU Academy’s Advanced Prompting for Journalists course.

Instructor Derek Bowler leads this training, offering high-level skills essential for modern journalism. The full course curriculum also covers: Core Advanced Workflows, Editorial Integrity & Ethics, and Automation & Data Pipelines.

Demand is exceptionally high for the upcoming session on December 1, 2025. Spaces are limited—register today to secure your spot!