One week after Hamas’s October 7 attack, thousands rallied outside the Israeli Consulate in Los Angeles to protest the country’s retaliatory assault on Gaza. The protestors were peaceful, according to local media, “carrying signs that said ‘Free Palestine’ and ‘End the Occupation,’” and watched over by a “sizable police presence in the area.” The LAPD knew the protests were coming: Two days earlier, the department received advanced warning on Dataminr, a social media surveillance firm and “official partner” of X.

Internal Los Angeles Police Department emails obtained via public records request show city police used Dataminr to track Gaza-related demonstrations and other constitutionally protected speech. The department receives real-time alerts from Dataminr not only about protests in progress, but also warnings of upcoming demonstrations as well. Police were tipped off about protests in the Los Angeles area and across the country. On at least one occasion, the emails show a Dataminr employee contacted the LAPD directly to inform officers of a protest being planned that apparently hadn’t been picked up by the company’s automated scanning.

Based on the records obtained by The Intercept, which span October 2023 to April 2024, Dataminr alerted the LAPD of more than 50 different protests, including at least a dozen before they occurred.

It’s unclear whether the LAPD used any of these notifications to inform its response to the wave of pro-Palestine protests that spread across Southern California over the last two years, which have resulted in hundreds of arrests.

Neither the LAPD nor Dataminr responded to a request for comment.

Privacy and civil liberties experts argue that police surveillance of First Amendment activity from afar has chilling effect on political association, discourse and dissent.

“Police departments are surveilling protests which are First Amendment protected political activity about a matter of public importance,” Jennifer Granick, an attorney with the American Civil Liberties Union’s Speech, Privacy, and Technology Project, told The Intercept. “They are using taxpayer money to enlist companies to conduct this surveillance on social media. This is especially worrisome now that the Administration is targeting Gaza protesters for arrest and deportation based on protected activity.”

The alerts began pouring in on October 9, when Dataminr flagged a “Protest mentioning Israel” blocking traffic in Beverly Hills, citing a tweet. Over the course of the month, Dataminr tipped off the LAPD to six different protests against the war across Los Angeles. These alerts included information about protests already in progress and information about the time and place of at least one LA protest planned for a future date.

Emails produced by the LAPD in response to The Intercept’s records request show that along with its regular feed of information about constitutionally protected speech, it also provides the department with alerts curated through feeds with titles like “Domestic Demonstrations Awareness,” “LA demonstrations,” “LA unrest,” and “demonstrations,” indicating the department proactively monitors First Amendment gatherings using the platform.

The department also began receiving a regular flow of alerts about protests thousands of miles away, including a “protest mentioning Palestinian territories outside the Consulate General of Israel” in Chicago,” and tweets from journalist Talia Jane, who was providing real-time updates on an antiwar rally in New York City.

Jane told The Intercept that she objects to the monitoring of her reporting by police, and also said Dataminr’s summary of her posts were at times inaccurate. In one instance, she says, Dataminr attributed a Manhattan road closure to protesters, when it had in fact been closed by the NYPD. “It’s absurd any agency would spend money on a service that is apparently completely incapable of parsing information correctly,” she said, adding that “the surveillance of journalists’ social media to suppress First Amendment activity is exactly why members of the press have a responsibility to ensure their work is not used to harm people.”

On October 17, Dataminr sent an “urgent update” to the department warning of a “Demonstration mentioning Palestinian territories planned for today at 17:00 in Rittenhouse Square area of Philadelphia,” based on a tweet. Three days later, a similar update noted another “Demonstration mentioning Palestinian territories” planned for Boston’s Copley Square. Another warned of a “protest mentioning Palestinian territories” in the planning stages at the Oregon State Capitol. It’s unclear if the department intended to cast such a wide net, or if the out-of-state protest alerts were sent in error. Dataminr’s threat notifications are known to turn up false positives; multiple tweets by angry Taylor Swift fans aimed at Ticketmaster were forwarded to the LAPD as “L.A. Threats and Disruptions,” the records show.

Materials obtained by The Intercept also show that despite Dataminr’s marketing claims of being an “AI” intermediary between public data and customers, the firm has put its human fingers on the scales. On October 12, a Dataminr account manager emailed three LAPD officers, whose names are redacted, with the subject line “FYSA,” military shorthand meaning “for your situational awareness.” The email informed the officers of a “Protest planned for October 14 at 12:30 at Consulate General of Israel in Los Angeles,” with a link to a tweet by a Los Angeles university professor. It’s unclear if the LAPD has requested these manual tip-offs from Dataminr, or whether such personal service is routine; Dataminr did not respond when asked if it was a standard practice. But the hands-on approach undercuts Dataminr’s prior claims that it just passively provides alerts to customers about social media speech germane to their interests.

A company spokesperson previously told The Intercept that “Every First Alert user has access to the exact same alerts and can choose to receive the alerts most relevant to them.””

Dataminr pitches its clients across the private and public sector a social media superpower: What if you had immediate access tweet relevant to your interests — without having to even conduct a search? The company, founded in 2016 and valued at over $4 billion, claims a wide variety of customers, from media newsrooms to government agencies, including lucrative federal contracts with the Department of Defense. It has also found an avid customer base in law enforcement. While its direct access to Twitter has been a primary selling point, Dataminr also scours apps like Snap and Telegram.

The company — which boasts both Twitter and the CIA as early investors — pitches its “First Alert” software platform as a public safety-oriented newsfeed of breaking events.

It has for years defended its police work as simply news reporting, arguing it can’t be considered a surveillance tool because the information relayed to police is public and differs in no way from what an ordinary user browsing social media could access.

Privacy advocates and civil libertarians have countered that the software provides the government with visibility that far surpasses what any individual user or even team of human officers could accomplish. Indeed, Dataminr’s own law enforcement marketing materials claim “30k people working 24/7 would only process 1% of all the data Dataminr ingests each day.” 

Related

U.S. Marshals Spied on Abortion Protesters Using Dataminr

The company has this power because of its long-standing “official partner” status with both Twitter and now X. Dataminr purchases access to the platform’s data “firehose,” allowing it to query every single post and scan them on behalf of clients in real-time.

Previous reporting by The Intercept has shown Dataminr has used this privileged access to surveil abortion rights rallies, Black Lives Matter protests, and other constitutionally protected speech on behalf of both local and federal police. Dataminr sources told The Intercept in 2020 how the company’s human analysts, helping tailor the service to its various police and military customers, at time demonstrated implicit biases in their work — an allegation the company denied.

In its previous incarnation as Twitter before its purchase by Elon Musk, and today as X, the social media platform for years expressly prohibited third parties from using its user data for “monitoring sensitive events (including but not limited to protests, rallies, or community organizing meetings),” per its terms of service. Both companies have previously claimed that Dataminr’s service by definition cannot be considered surveillance because it is applied against public discourse; critics have often pointed out that while posts are technically public, only a company with data access as powerful as Dataminr’s would ever be able to find and flag all of these specific posts amid hundreds of millions of others. Neither company has directly addressed how Dataminr’s monitoring of protests is compatible with Twitter and X’s explicit prohibition against monitoring protests.

Neither X nor Dataminr responded when asked about this contradiction.

Related

Why Trump Is So Desperate to Keep Mahmoud Khalil in Louisiana

While Dataminr’s monitoring of campus protests began before the second Trump administration, it has taken on greater significance now given the White House’s overt attempts to criminalize speech critical of Israel and the war in Gaza. Earlier this month, former Columbia graduate student Mahmoud Khalil, who helped organize Columbia University’s student protests against the war, was abruptly arrested and jailed by plainclothes Immigration and Customs Enforcement officers. The State Department and White House quickly confirmed the arrest was a function of Khalil’s antiwar protest efforts, which the administration has described without evidence or explanation as “aligned to Hamas.” The White House has pledged to arrest and deport more individuals who have taken part in similar campus protests against the war.

Civil libertarians have long objected to dragnet monitoring of political speech on the grounds that it will have a chilling effect on speech guaranteed by the First Amendment. While fires, shootings, and natural disasters are of obvious interest to police, these critics frequently argue that if people know their tweets are subject to police scrutiny without any evidence of wrongdoing, they may tend to self-censor. 

“Political action supporting any kind of government-disfavored viewpoint could be subject to the same over-policing: gun rights, animal rights, climate change are just a few examples,” the ACLU’s Granick added. “Law enforcement should leave online organizing alone.”

The post LAPD Surveilled Gaza Protests Using This Social Media Tool appeared first on The Intercept.

This post was originally published on The Intercept.

by A.C. Thompson, ProPublica and FRONTLINE, James Bandler, ProPublica, and Lukáš Diko, Investigative Center of Jan Kuciak

This story contains references to homophobia, antisemitism and racism, as well as mass shootings and other violence.

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

“The Rise and Fall of Terrorgram” is part of a collaborative investigation from FRONTLINE and ProPublica. The documentary premieres March 25 at 10 p.m. EDT/9 p.m. CDT on PBS stations (check local listings) and will be available to stream on YouTube, the PBS App and FRONTLINE’s website.

The teen entered the chat with a friendly greeting.

“Hello lads,” he typed.

“Sup,” came a reply, along with a graphic that read “KILL JEWS.” Another poster shared a GIF of Adolf Hitler shaking hands with Benito Mussolini. Someone else added a short video of a gay pride flag being set on fire. Eventually, the talk in the group turned to mass shootings and bombings.

And so in August 2019, Juraj Krajčík, then a soft-faced 16-year-old with a dense pile of brown hair, immersed himself in a loose collection of extremist chat groups and channels on the massive social media and messaging platform Telegram. This online community, which was dubbed Terrorgram, had a singular focus: inciting acts of white supremacist terrorism.

Over the next three years, Krajčík made hundreds — possibly thousands — of posts in Terrorgram chats and channels, where a handful of influential content creators steered the conversation toward violence. Day after day, post after post, these influencers cultivated Krajčík, who lived with his family in a comfortable apartment in Bratislava, the capital of Slovakia. They reinforced his hatreds, fine-tuned his beliefs and fed him tips, encouraging him to attack gay and Jewish people and political leaders and become, in their parlance, a “saint.”

On Oct. 12, 2022, Krajčík, armed with his father’s .45-caliber handgun, opened fire on three people sitting outside an LGBTQ+ bar in Bratislava, killing two and wounding the third before fleeing the scene.

That night, as police hunted for him, Krajčík spoke on the phone with Marek Madro, a Bratislava psychologist who runs a suicide hotline and mental health crisis team. “He hoped that what he had done would shake up society,” recalled Madro in an interview, adding that the teen was “very scared.”

During the call, Krajčík kept repeating phrases from his manifesto, according to Madro. The 65-page document, written in crisp English and illustrated with graphics and photos, offered a detailed justification for his lethal actions. “Destroy the degenerates!” he wrote, before encouraging people to attack pride parades, gay and lesbian activists, and LGBTQ+ bars.

Eventually Krajčík, standing in a small grove of trees alongside a busy roadway, put a gun to his head and pulled the trigger.

The next day, Terrorgram influencers were praising the killer and circulating a PDF of his manifesto on Telegram.

This story is part of a collaboration between ProPublica and FRONTLINE that includes an upcoming documentary.

“We thank him from the bottom of our hearts and will never forget his sacrifice,” stated one post written by a Terrorgram leader in California. “FUCKING HAIL, BROTHER!!!”

The story of Krajčík’s march to violence shows the murderous reach of the online extremists, who operated outside the view of local law enforcement. To police at the time, the killings seemed like the act of a lone gunman rather than what they were: the culmination of a coordinated recruiting effort that spanned two continents.

ProPublica and the PBS series FRONTLINE, along with the Slovakian newsroom Investigative Center of Jan Kuciak, pieced together the story behind Krajčík’s evolution from a troubled teenager to mass shooter. We identified his user name on Telegram, which allowed us to sift through tens of thousands of now-deleted Telegram posts that had not previously been linked to him. Our team retraced his final hours, interviewing investigators, experts and victims in Slovakia, and mapped the links between Krajčík and the extremists in Europe and the U.S. who helped to shape him.

The Terrorgram network has been gutted in recent months by the arrests of its leaders in North America and Europe. Telegram declined repeated requests to make its executives available for interviews but in a statement said, “Calls for violence from any group are not tolerated on our platform.” The company also said that since 2023 it has stepped up moderation practices.

Still, at a time when other mainstream social media companies such as X and Meta are cutting back on policing their online content, experts say the violent neo-Nazis that populated Telegram’s chats and channels will likely find an online home elsewhere.

At first, Krajčík didn’t fit in with the Terrorgrammers. In one early post in 2019, he argued that the white nationalist movement would benefit from large public protests. The idea wasn’t well received.

“Rallies won’t do shit,” replied one poster.

Another told the teen that instead of organizing a rally, he should start murdering politicians, journalists and drag performers. “You need a mafia state of mind,” the person wrote.

Krajčík had found his way to the Terrorgram community after hanging out on 8chan, a massive and anonymous forum that had long been an online haven for extremists; he would later say that he was “redpilled” — or radicalized — on the site.

On 8chan, people posted racist memes and made plenty of vile comments. But the Terrorgram scene was different. In the Terrorgram chats people discussed, in detail, the best strategies for carrying out spectacular acts of violence aimed at toppling Western democracies and replacing them with all-white ethno-states.

The chats Krajčík joined that summer of 2019 were administered by Pavol Beňadik, then a 20-year-old Slovakian college student who had helped create the Terrorgram community and was one of its leading personalities.

A hybrid of a messaging service like WhatsApp and a social media platform like X or Facebook, Telegram offered features that appealed to extremists like Beňadik. They could engage in private encrypted discussions, start big chat groups or create public channels to broadcast their messages. Importantly, Telegram also allowed them to post huge PDF documents and lengthy video files.

In his Terrorgram chats, Beňadik, who used the handle Slovakbro, relentlessly pressed for violent actions — although he never took any himself. Over two days in August, he posted instructions for making Molotov cocktails and pipe bombs, encouraged people to build radioactive dirty bombs and set them off in major cities, and called for the execution of police officers and other law enforcement agents. “TOTAL PIG DEATH,” he wrote.

At the time, the chats were drawing hundreds of participants from around the world, including a large number of Americans.

Beňadik, who was from a small village in western Slovakia, took a special interest in Krajčík, chatting with him in the Slovak language, discussing life in their country, and making him feel appreciated and respected.

For Krajčík, this was a change. In his daily life outside of Terrorgram, he “felt completely unnoticed, unheard,” said Madro, who spoke with several of Krajčík’s classmates. “He often talked about his own feelings and thoughts publicly and felt like no one took him seriously.”

Krajčík started spending massive amounts of time in the chat. On a single day, he posted 117 times over the span of 10 hours. The teen’s ideas began to closely echo those of Beňadik.

In late September, two regulars had a friendly mixed martial arts bout and streamed it on YouTube. Krajčík shared the link with the rest of the chat group, who cheered and heckled as their online friends brawled. Beňadik encouraged Krajčík to participate in a similar bout in the future.

“Porozmýšlam,” replied Krajčík: “I’ll think about it.”

For Beňadik, the combatants were providing a good example. He wanted Terrorgrammers to transform themselves into Aryan warriors, hard men capable of doing serious physical harm to others.

In reality, Krajčík was anything but a tough guy. A “severely bullied student,” Krajčík had transferred to a high school for academically gifted students, a school official told the Slovak newspaper Pravda. Two therapists “worked intensively with him for two years until the pandemic broke out and schools closed,” the official said.

Beňadik created at least five neo-Nazi channels and two chat groups on Telegram, one of which eventually attracted nearly 5,000 subscribers. He crafted an online persona as a sage leader, offering tips and guidance for carrying out effective attacks. He often posted practical materials, such as files for 3D-printing rifle parts, including auto sears, which transform a semiautomatic gun into a fully automatic weapon. “Read useful literature, get useful skills,” he said in an interview with a podcast. “You are the revolutionary, so act like it.”

It was only a month after joining Beňadik’s Terrorgram chats that Krajčík first mentioned Tepláreň, the LGBTQ+ bar in Bratislava he eventually attacked. On Sept. 18, 2019, he shared a link to a website called Queer Slovakia that featured an article on the bar.

Beňadik responded immediately, writing that he was having a “copeland moment” — a reference to David Copeland, a British neo-Nazi who planted a nail bomb at an LGBTQ+ pub in London in 1999. The explosion killed three people and wounded nearly 80 others.

“I DON’T ACTUALLY WANT TO NAIL BOMB THAT JOINT,” Beňadik continued. He wanted to do something far worse. “Hell,” Beňadik wrote, would be less brutal than what he had in mind.

Another Terrorgrammer offered a suggestion: What about a bomb loaded with “Nails + ricin + chemicals?”

Krajčík sounded a note of caution. “Just saying it will instantly make a squad of federal agents appear behind you and arrest you,” he wrote. Beňadik responded by complaining that Slovakia wasn’t producing enough “saints,” implicitly encouraging his mentee to achieve sainthood by committing a lethal act of terror.

Two days later, Krajčík posted photos of people holding gay pride flags in downtown Bratislava. They were “degenerates,” he wrote, repeatedly using anti-gay slurs.

One chat member told Krajčík he should’ve rounded up a group of Nazi skinheads and assaulted the demonstrators.

Then Krajčík posted a photo of Tepláreň.

Beňadik responded that “airborne paving stones make great gifts for such businesses.”

In the chat, Beňadik repeatedly posted a PDF copy of the self-published memoirs of Eric Rudolph, the American terrorist who bombed the 1996 Olympic Games in Atlanta and several other sites before going on the run. The autobiography contains a detailed description of Rudolph’s bombing of a lesbian bar, which wounded five people.

Urging Krajčík to read the book, Beňadik described it as “AMAZING” and a “great read.” Rudolph, he wrote, had created the “archetype” for the “lone wolf” terrorist.

Eventually, Krajčík joined at least 49 extremist Telegram chats, many of them nodes in the Terrorgram network, according to analysis by Pierre Vaux, a researcher who investigates threats to democracy and human rights abuses.

While Terrorgram started as a loose collection of accounts, by 2021 Beňadik and some of his fellow influencers had created a more formal organization, which they called the Terrorgram Collective, according to interviews with experts and court records from Slovakia, the U.S. and Canada.

The organization began producing more sophisticated content — books, videos and a roster of potential assassination targets — and distributing the material to thousands of followers.

Krajčík was a fan of the collective’s books, which are loaded with highly pixelated black-and-white graphics and offer a raft of specific advice for anyone planning a terror attack.

By the summer of 2022, Krajčík had become a regular poster in a Terrorgram chat run by another alleged leader of the collective, Dallas Humber of Elk Grove, California, a quiet suburb of Sacramento.

Humber went by a series of usernames but was eventually publicly exposed by a group of activists, and later arrested and charged with terrorism-related offenses. ProPublica and FRONTLINE reviewed chat logs — provided by the anti-facist Australian research organization The White Rose Society — and other online materials, as well as court records, to independently confirm her identity.

Beňadik was arrested in Slovakia and charged with more than 200 terrorism offenses. He pleaded guilty and would be sentenced to six years in prison.

In his absence, Humber quickly slipped in as mentor and coach to Krajčík.

She was explicit about her intentions, constantly encouraging followers in her chats and channels to go out and kill their perceived enemies — including Jewish and Muslim people, members of the queer community and anybody who wasn’t white. Her job, she wrote in one post, was to embrace disaffected young white men and guide them “through the end of the radicalization process.”

On Aug. 2, 2022, Humber and Krajčík discussed a grisly incident that had occurred several days earlier: A white man had beaten to death a Nigerian immigrant on a city street in northern Italy.

The killing, which was documented on video, was “fucking glorious,” wrote Humber, using a racial slur to describe the victim. “Please send any more pics, articles, info to the chat as more details come out,” she posted.

Krajčík wrote that he didn’t know much about the circumstances surrounding the crime but was still convinced the murderer had chosen “the right path.”

The killer, wrote Humber, would make an “ideal” boyfriend. “Every girl wants a man who would kill a [racial expletive] for her 🥰 how romantic.”

Three days later, Humber’s chat was alive with tributes to and praise for another killer. Wade Page, a Nazi skinhead and former U.S. Army soldier, had murdered six Sikh worshippers at a temple outside of Milwaukee a decade earlier. (A seventh would later die of their injuries.)

When police confronted Page, he began shooting at them, hitting one officer 15 times before killing himself.

Humber was a big fan of the killer. Page, she wrote, planned the attack thoroughly and chose his targets carefully. “He even made a point to desocialize and cut ties with those close to him,” Humber noted. “No chance of them disrupting his plans.”

“Page did his duty,” Krajčík wrote.

During the same time period, Krajčík started doing reconnaissance on potential targets in his city, staking out the apartment of then-Prime Minister Eduard Heger, a Jewish community center and Tepláreň, the bar.

He posted photos of the locations on his private Twitter account. And in a series of cryptic tweets, Krajčík hinted at the violence to come:

“I don’t expect to make it. In all likelyhood I will die in the course of the operation.”

“Before an operation, you will have to mentally deal with several important questions. You will have to deal with them alone, to not jeopardize your mission by leaking it.”

“I want to damage the System to the best of my abilities.”

Then, on Oct. 11, 2022, he wrote:

“I have made my decision.”

The next evening, after spending a half-hour outside the prime minister’s apartment, Krajčík made his way to Tepláreň. The bar sat on a steep, winding street lined with cafes, clothing boutiques and other small businesses. For about 40 minutes he lurked in a shadowy doorway up the hill. Then, at about 7 p.m., he approached a small group of people sitting in front of the bar and began shooting.

He killed Matúš Horváth and Juraj Vankulič and wounded Radka Trokšiarová, shooting her twice in the leg.

Krajčík, then 19, fled the scene. He had just committed a terrorist attack that would shock the nation.

In court records, U.S. prosecutors have linked both Humber and another alleged Terrorgram leader, Matthew Allison of Boise, Idaho, to Krajčík’s crime. The pair were charged last fall with a raft of felonies related to their Terrorgram posts and propaganda, including conspiring to provide material support to terrorists and soliciting the murder of federal officials.

Krajčík “was active on Terrorgram and had frequent conversations with ALLISON, HUMBER, and other members of the Terrorgram Collective,” prosecutors allege in the indictment. In another brief, they say Krajčík shared his manifesto with Allison before the attack. Then, immediately after the murders, he allegedly sent Allison direct messages saying, “not sure how much time I have but it’s happening,” and “just delete all messages about this convo.”

The Terrorgram posts cited in court documents corroborate our team’s reporting.

Allison spoke with one of our reporters from jail against his lawyer’s advice. He said he did not incite anyone to violence and that prosecutors had misconstrued the communications with Krajčík. He has pleaded not guilty to all charges, and in a motion, his legal team indicated it would argue that all of his posts are protected by the First Amendment. Humber also pleaded not guilty. She declined to be interviewed and to comment through her lawyer.

While Krajčík was at large, Slovakian authorities tapped Madro, the psychologist, to try to communicate with the young man. “After 12 text messages, he finally picked up the phone,” Madro recalled.

The brief conversation ended with Krajčík killing himself. “The shot rang out and there was silence,” Madro said.

Within hours, Humber was making celebratory posts. Krajčík, she exclaimed, had achieved sainthood. “Saint Krajčík’s place in the Pantheon is undisputed, as is our enthusiastic support for his work,” she wrote on a Terrorgram channel where she posted a picture of the victims on the ground, blood streaking the pavement.

She and Allison also circulated his manifesto.

In it, Krajčík praised the Terrorgram Collective for its “incredible writing and art,” “political texts” and “practical guides.” And he thanked Beňadik: “Your work was some of the first that I encountered after making the switch to Telegram, and remains some of the greatest on the platform.”

While they were spreading Krajčík’s propaganda, the owner of Tepláreň, Roman Samotný, was mourning.

The bar “was kind of like a safe island for queer people here in Slovakia,” he recalled in an interview. “It was just the place where everybody felt welcomed and just accepted and relaxed.”

Before the attack, Samotný’s major concern was that some homophobe would smash the bar’s windows. After the murders, he said, “the biggest change is the realization that we are not anymore safe here. … I was never thinking that we can be killed because of our identity.”

Samotný has closed the bar.

The survivor, Trokšiarová, was left with lingering physical pain and emotional distress. “I was deeply confused,” she said. “Why would anyone do it?”

This post was originally published on ProPublica.

President Donald Trump doesn’t have fond feelings for whistleblowers.

During his first term, Trump’s Justice Department carried out a clandestine spying operation to try to catch leakers. On the campaign trail, Trump on multiple occasions threatened to arrest journalists who don’t reveal their sources — and suggested they should be raped in prison until they give up names.

For those who want to speak out against wrongdoing within the U.S. government, it has never been more critical to take steps to keep themselves safe. So we compiled these best practices for leaking information in public interest under the Trump administration.

Don’t Call or Text

Phone calls and text messages are convenient, but they aren’t safe for whistleblowers. As outlined in a December report from the Office of the Inspector General, the Justice Department in Trump’s first term repeatedly utilized “compulsory processes” — which include subpoenas, search warrants, and court orders — to request “non-content communications records” from phone carriers serving journalists at CNN, the New York Times, and the Washington Post. The requests were for both the reporters’ work numbers and their personal numbers.

Non-content records don’t include the communications themselves — such as copies of text messages or voicemails. Instead, government investigators were keen to gather metadata pertaining to the communications: for instance, who sent a message or made a call to a journalist’s phone and at what time.

Even if the contents of the conversation are not recorded, the metadata establishes clear links between parties.

If a metadata search turns up evidence of communication with journalists or rights groups, this alone could reveal who is behind a leak.

Don’t Email

Never use a work or personal email address when communicating with journalists.

In its attempt to root out leaks during Trump’s first term, the Justice Department also sought non-content information pertaining to reporters’ email communications from their email service providers. They wanted details such as the time an email was sent and received, as well as the sender’s email address.

Related

The Trump DOJ Loved Leaking, as Long as It Was to Rupert Murdoch’s Newspapers

While email encryption technology can encrypt the body of the email message and in some cases subject lines as well, the email addresses themselves and dates and times emails are sent and received are not encrypted.

This means it’s not hard for investigators to use email records to draw a clear line between a journalist and their source — even if they can’t determine what information specifically was exchanged.

Setting up a separate email account entirely for communicating with journalists or rights groups is an option, but there are a number of potential gotchas. For instance, care should be taken to not reveal any identifying information when setting up a burner email account: Don’t use your phone number for two-factor authentication, choose a throwaway username that is not linked to you in any way, and select a vetted VPN or the Tor network to mask your IP address. Considering all these obstacles, it’s often best to avoid email altogether.

Don’t Reach Out on Social Media

The owners of tech’s biggest social media platforms have shown varying degrees of fealty to the Trump administration. These genuflections include Mark Zuckerberg ending DEI programs at Meta, Andy Yen, the CEO of “privacy-first” email provider Proton, going on about how the Republican party today stands for “the little guys,” and Elon Musk, the owner of X, calling shots as a “special government employee.”

The fact that Trump’s richest fan also owns a popular social media platform should give pause about using X to share sensitive information. It doesn’t take an overactive imagination to see a scenario in which the companies that own communication channels are willing to provide user information to a government they’re eager to please.

Although social media direct messages are generally unencrypted by default, some social media platforms now offer optional end-to-end encrypted messaging, though this feature needs to be enabled manually. For instance, X direct messages can be encrypted if both parties are verified users, and Facebook Messenger can also be used to send encrypted DMs. But the metadata, or non-content information, would still reveal that your account was in contact with a reporter’s account.

Selectively Use Encrypted Communication Tools

Similar metadata risks apply to messaging platforms such as Telegram and WhatsApp. Telegram offers encryption, but it is not enabled by default and comes with a number of limitations. WhatsApp encrypts messages by default, but nonetheless reveals a variety of metadata about communications themselves.

Given the way government investigators typically demand non-content communication records, end-to-end encryption alone does not mask whether or not someone is talking to journalists or other entities.

Secure communication tools such as Signal and Session minimize the amount of metadata and user information that platform operators themselves can access.

Signal can identify the date a particular account was created, as well as when the account last accessed the service. It can also identify a phone number associated with an active username, which is vastly less metadata than other messaging platforms collect.   

If you’re concerned about your username being linked to your phone number, change your username at regular intervals, which would prevent past usernames from being tied to your phone number.

Signal routinely posts copies of the requests for user information it receives from the government. These disclosures show that Signal tends to share merely when a particular account was last accessed and first created. Government requests for information from service providers, however, may come with non-disclosure orders that could legally prevent operators from posting notice of these demands on their transparency pages and potentially bar them from notifying the affected users themselves.

Session, a messenger whose tagline is “send messages, not metadata” reduces the amount of information it stores about its users by, for instance, not using centralized servers to relay messages.  

Nothing Is a Substitute for OPSEC

But the best end-to-end encryption and metadata minimization won’t keep you safe without basic operational security.

Digital access logs may reveal who viewed, printed, or downloaded a copy of the file, and when. The more files you access, the more likely it is that you may be the one common individual who accessed all those files.

Avoid whistleblower communications while physically present at work. Aside from someone seeing your screen, your employer may also be able to identify that you accessed a particular communication service while on a company network.

Under no circumstances should you also use work devices when communicating with or transferring data to reporters or rights groups.

Equally risky are personal devices with any work-assigned device management apps installed. It might seem old-fashioned, but rather than taking a screenshot of a specific document or chat record on a work device, take a photo of the screen with a separate one-time use phone, or at least a personal device.

Make clear to anyone you might alert of wrongdoing that leaked photos or documents generally should not be published in their entirety. That’s because source material can potentially be linked to the specific device with which it was captured.

A photo showing a file on your computer monitor, for instance, might include a blemish or a smudge of dirt on the screen. More sophisticated forensic techniques, such as watermarking, can be used to trace the origins of a leaked email or video conference.

Even emails seemingly sent to a large number of recipients may be individually watermarked, with each message containing some unique change that can be traced to a single recipient. That’s why it’s safest for journalists not to reproduce emails verbatim and instead rely on selective quotes or summarizations.

After communicating with outside parties, ensure that no records of sensitive communications persist. Be sure to delete not just specific messages, but entire chat histories from all linked devices on which your messaging app of choice is installed. Request that anyone with whom you share sensitive information does the same. Remember to not save each other in your contacts lists, either.

Blowing the whistle can have a real impact in the world, but it also comes with risks — the threat of prosecution or losing your job among them. Although leak investigations may again become a priority in the Trump administration, these dos and don’ts can help reduce the chances of exposing yourself when you’re shining light on wrongdoing.

The post How to Leak Under the Trump Administration appeared first on The Intercept.

This post was originally published on The Intercept.

by Craig Silverman

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Hours after Donald Trump was sworn in as president, users spread a false claim on Facebook that Immigration and Customs Enforcement was paying a bounty for reports of undocumented people.

“BREAKING — ICE is allegedly offering $750 per illegal immigrant that you turn in through their tip form,” read a post on a page called NO Filter Seeking Truth, adding, “Cash in folks.”

Check Your Fact, Reuters and other fact-checkers debunked the claim, and Facebook added labels to posts warning that they contained false information or missing context. ICE has a tip line but said it does not offer cash bounties.

This spring, Meta plans to stop working with fact-checkers in the U.S. to label false or misleading content, the company said on Jan. 7. And if a post like the one about ICE goes viral, the pages that spread it could earn a cash bonus.

Meta CEO Mark Zuckerberg also said in January that the company was removing or dialing back automated systems that reduce the spread of false information. At the same time, Meta is revamping a program that has paid bonuses to creators for content based on views and engagement, potentially pouring accelerant on the kind of false posts it once policed. The new Facebook Content Monetization program is currently invite-only, but Meta plans to make it widely available this year.

The upshot: a likely resurgence of incendiary false stories on Facebook, some of them funded by Meta, according to former professional Facebook hoaxsters and a former Meta data scientist who worked on trust and safety.

ProPublica identified 95 Facebook pages that regularly post made-up headlines designed to draw engagement — and, often, stoke political divisions. The pages, most of which are managed by people overseas, have a total of more than 7.7 million followers.

After a review, Meta said it had removed 81 pages for being managed by fake accounts or misrepresenting themselves as American while posting about politics and social issues. Tracy Clayton, a Meta spokesperson, declined to respond to specific questions, including whether any of the pages were eligible for or enrolled in the company’s viral content payout program.

The pages collected by ProPublica offer a sample of those that could be poised to cash in.

Meta has made debunking viral hoaxes created for money a top priority for nearly a decade, with one executive calling this content the “worst of the worst.” Meta has a policy against paying for content its fact-checkers label as false, but that rule will become irrelevant when the company stops working with them. Already, 404 Media found that overseas spammers are earning payouts using deceptive AI-generated content, including images of emaciated people meant to stoke emotion and engagement. Such content is rarely fact-checked because it doesn’t make any verifiable claims.

With the removal of fact-checks in the U.S., “what is the protection now against viral hoaxes for profit?” said Jeff Allen, the chief research officer of the nonprofit Integrity Institute and a former Meta data scientist.

“The systems are designed to amplify the most salacious and inciting content,” he added.

In an exchange on Facebook Messenger, the manager of NO Filter Seeking Truth, which shared the false ICE post, told ProPublica that the page has been penalized so many times for sharing false information that Meta won’t allow it to earn money under the current rules. The page is run by a woman based in the southern U.S., who spoke on the condition of anonymity because she said she has received threats due to her posts. She said the news about the fact-checking system ending was “great information.”

Clayton said Meta’s community standards and content moderation teams are still active and reiterated the company’s Jan. 7 statement that it is working to ensure it doesn’t “over-enforce” its rules by mistakenly banning or suppressing content.

Meta’s changes mark a significant reversal of the company’s approach to moderating false and misleading information, reframing the labeling or downranking of content as a form of censorship. “It’s time to get back to our roots around free expression on Facebook and Instagram,” Zuckerberg said in his announcement. His stance reflects the approach of Elon Musk after acquiring Twitter, now X, in 2022. Musk has made drastic cuts to the company’s trust and safety team, reinstated thousands of suspended accounts including that of a prominent neo-Nazi and positioned Community Notes, which allows participating users to add context via notes appended to tweets, as the platform’s key system for flagging false and misleading content.

Zuckerberg has said Meta will replace fact-checkers and some automated systems in the U.S. with a version of the Community Notes system. A Jan. 7 update to a Meta policy page said that in the U.S. the company “may still reduce the distribution of certain hoax content whose spread creates a particularly bad user or product experience (e.g., certain commercial hoaxes).”

Clayton did not clarify whether posts with notes appended to them would be eligible for monetization. He provided links to academic papers that detail how crowdsourced fact-checking programs like Community Notes can be effective at identifying misinformation, building trust among users and addressing perceptions of bias.

A 2023 ProPublica investigation, as well as reporting from Bloomberg, found that X’s Community Notes failed to effectively address the misinformation about the Israel-Hamas conflict. Reporting from the BBC and Agence France-Presse showed that X users who share false information have earned thousands of dollars thanks to X’s content monetization program, which also rewards high engagement.

Keith Coleman, X’s vice president of product, previously told ProPublica that the analysis of Community Notes about the Israel-Hamas conflict did not include all of the relevant notes, and he said that the program “is found helpful by people globally, across the political spectrum.”

Allen said it takes time, resources and oversight to scale up crowdsourced fact-checking systems. Meta’s decision to scrap fact-checking before giving the new approach time to prove itself is risky, he said.

“We could in theory have a Community Notes program that was as effective, if not more effective, than the fact-checking program,” he said. “But to turn all these things off before you have the Community Notes thing in place definitely feels like we’re explicitly going to have a moment with little guardrails.”

Before Facebook began cracking down on content in late 2016, American fake news peddlers and spammers based in North Macedonia and elsewhere cashed in on viral hoaxes that deepened political divisions and played on people’s fears.

One American, Jestin Coler, ran a network of sites that earned money from hoax news stories for nearly a decade, including the infamous and false viral headline from 2016 “FBI Agent Suspected In Hillary Email Leaks Found Dead In Apparent Murder-Suicide.” He previously told NPR that he started the sites as a way to “infiltrate the echo chambers of the alt-right.” Coler said he earned five figures a month from the sites, which he operated in his spare time.

When people clicked on the links to the stories in their news feed, they landed on websites full of ads, which generated revenue for Coler. That’s become a tougher business model since Meta has made story links less visible on Facebook in recent years.

Facebook’s new program to pay publishers directly for viral content could unlock a fresh revenue stream for hoaxsters. “It’s still the same formula to get people riled up. It seems like it could just go right back to those days, like overnight,” Coler told ProPublica in a phone interview. He said he left the Facebook hoax business years ago and won’t return.

In January, ProPublica compiled a list of pages that had been previously cited for posting hoaxes and false content and discovered dozens more through domain and content searches. The pages posted false headlines designed to spark controversy, such as “Lia Thomas Admits: ‘I Faked Being Trans to Expose How Gullible the Left Is’” and “Elon Musk announced that he has acquired MSNBC for $900 million to put an end to toxic programming.” The Musk headline was paired with an AI-generated image of him holding a contract with the MSNBC logo. It generated over 11,000 reactions, shares and comments.

Most of the pages are managed by accounts outside of the U.S., including in North Macedonia, Vietnam, the Philippines and Indonesia, according to data from Facebook. Many of these pages use AI-generated images to illustrate their made-up headlines.

One network of overseas-run pages is connected to the site SpaceXMania.com, an ad-funded site filled with hoax articles like “Elon Musk Confronts Beyoncé Publicly: ‘Stop Pretending to Be Country, It’s Just Not You.’” SpaceX Fanclub, the network’s largest Facebook page, has close to 220,000 followers and labels its content as satire. One of its recent posts was a typo-laden AI-generated image of a sign that said, “There Are Only 2 2 Genders And Will Ban Atheletes From Women Sports — President.”

SpaceXMania.com’s terms and conditions page says it’s owned by Funky Creations LTD, a United Kingdom company registered to Muhammad Shabayer Shaukat, a Pakistani national. ProPublica sent questions to the site and received an email response signed by Tim Lawson, who said he’s an American based in Florida who works with Shaukat. (ProPublica was unable to locate a person by that name in public records searches, based on the information he provided.)

“Our work involves analyzing the latest trends and high-profile news related to celebrities and shaping it in a way that appeals to a specific audience — particularly conservatives and far-right groups who are predisposed to believe certain narratives,” the email said.

Lawson said they earn between $500 and $1,500 per month from web ads and more than half of the traffic comes from people clicking on links on Facebook. The pages are not currently enrolled in the invitation-only Facebook Content Monetization program, according to Lawson.

The SpaceXMania pages identified by ProPublica were recently taken offline. Lawson denied that they were removed by Meta and said he deactivated the pages “due to some security reasons.” Meta declined to comment.

It remains to be seen how hoax page operators will fare as Meta’s algorithmic reversals take hold and the U.S. fact-checking program grinds to a halt. But some Facebook users are already taking advantage of the loosened guardrails.

Soon after Zuckerberg announced the changes, people spread a fake screenshot of a Bloomberg article headlined, “The spark from Zuckerberg’s electric penis pump, might be responsible for the LA fires.”

“Community note: verified true,” wrote one commenter.

Mollie Simon contributed research.

This post was originally published on ProPublica.