Dispatch: The data stays on - piercing the Iranian blackout
Mapping the Iran blackout, the Greenland "Donroe" crisis, and a frame-by-frame analysis of the Minneapolis ICE shooting
Your weekly briefing on digital investigation, OSINT, and the information war.
⚡ The 30-second brief
The Debunk: Verified graphic Kahrizak morgue footage as contemporary by geolocation and analysis of visible date indicators, disproving claims it was recycled.
New Tech: Snowflake (Tor) now masks censorship circumvention as standard WebRTC calls to evade Deep Packet Inspection (DPI).
OSINT Stack: Sherlock (username tracking), Robin (AI Dark Web analysis), and RageCheck (linguistic manipulation detection).
Truman Show: An AI‑powered investment scam that uses apps from the official mobile app stores to steal money and identity data from victims.
🔦 In the Spotlight
Fact-check: Spotlight members collaborated to verify videos showing the fatal shooting by an ICE agent of Renee Nicole Good in Minneapolis. A frame-by-frame analysis challenged the U.S. administration’s claims that she attempted to run an officer over. Read ZDF’s full breakdown.
Monitoring
Iran: A near-total internet blackout continues as the regime attempts to mask a lethal crackdown on nationwide protests triggered by a December currency collapse. Connectivity remains at approximately 1%, with reports verified by the Spotlight network and human rights groups suggesting thousands of casualties and mass arrests since January 8.
Greenland: Tensions between Washington and Copenhagen have reached a post-WWII high following President Trump’s Donroe Doctrine declaration. Framing the island as a national security imperative to block Russian and Chinese Arctic expansion, the White House has actively drafted acquisition plans and refused to rule out “the more difficult way” — military action — to secure the territory.
🖋️ The Lead: Piercing the Kahrizak blackout
On January 10, 2026, as a state-mandated internet blackout blanketed Iran, graphic footage began emerging from the Kahrizak district. The videos, appearing to show a makeshift morgue overflowing with victims of a recent crackdown, shocked the diaspora. In a region where large scale protests and crackdowns have taken place repeatedly over recent years, verification was essential.
While the Iranian government maintained a narrative that the unrest was under control, members of the Spotlight network verified the footage as authentic and contemporary.
How we verified the Kahrizak footage:
The time: We corroborated footage from different sources and saw a date on a screen in one of the clips, proving the scenes were new and not from past protests.
The place: We confirmed that the buildings in the video are part of the Kahrizak facility using satellite imagery and an architectural rendering of the centre. Logos seen on body bags were linked to Tehran’s main cemetery.
The disinformation: We tracked state media for references to the situation in Kahrizak; reporters blamed ‘rioters’ for the killings. But Spotlight heard verified voice messages from eyewitnesses confirming a brutal crackdown on protesters.
The takeaway: Even when the internet is cut, the truth leaves a footprint. Although content coming out of Iran is scarce, verification on the little we can access is possible.
🇮🇷 Iran digital forensics field guide
Amid the blackout, the Spotlight network released a definitive digital forensics field guide, transforming how newsrooms can extract evidence from behind the firewall.
The three-step workflow:
Smuggled data: How to find and verify footage sent via mesh networks that don’t need the internet.
Network tracing: Using “leaks” in the system to prove exactly where and when the government cut the signal.
Physical evidence: Using shadows, sun position, and landmarks to verify a video’s location when digital data is missing.
⚙️ The intelligence stack
🔍 Snowflake: A pluggable transport from The Tor Project designed to bypass internet censorship by masking Tor traffic as a WebRTC video or voice call.
It works through a special system where "brokers" connect users who can't access the internet with volunteers using regular web browsers, making it very hard for governments to block it without also affecting real video calls.
💡 Quick tip: For journalists in high-risk zones, if Tor fails, go to
Settings > Connection > Bridges > Built-in Bridgeand select Snowflake. It is harder to block than standard VPNs because it mimics legitimate teleconferencing.
📍 YouTube investigations: Craig Silverman published a detailed look at more than a dozen free tools you can use to investigate YouTube videos, channels, and comments (via Indicator.media)
📍 Urban geometry forensics: Richard Irvine-Brown’s guide to geolocating via road curvature, "barcode" pattern matching, and multi-platform satellite verification. (via @richib.bsky.social)
📍 Sherlock: A powerful command-line OSINT tool used to track username footprints across hundreds of websites to uncover a target's digital presence. (via GitHub)
📍 Sentiment analysis for investigators: Derek Bowler’s guide on using NLP to measure changes in emotions and spot organised influence efforts. (via Eurovision News Spotlight)
📍 RageCheck: Open-source pattern detector that scores content for loaded language and us-vs-them divisiveness. (via GitHub)
📍 Robin: AI-powered Dark Web investigator with automated workflows for macOS/Linux. (via GitHub)
📡 Signal analysis
🎧 Minnesota ICE shooting: On The Media breaks down the frame-by-frame analysis of the Renee Nicole Good shooting, challenging official claims of an attempted vehicular assault. (via WNYC Studios)
🏁 Before we go…
The “Truman Show” scam: Trapped in a synthetic reality
Check Point Research has exposed OPCOPRO, a scam that builds a personalized, AI-generated “reality” where every expert and peer in your chat group is a synthetic persona.
The operation is a fully synthetic, AI‑powered investment scam that uses legitimate Android and iOS apps from the official app stores and AI‑generated communities to steal victims' money and identity data. (via Check Point)