The Weekly OSINT Newsletter
The OSINT Jobs Podcast
Podcast: Aric Toler on finding a national secrets leaker
0:00
Current time: 0:00 / Total time: -53:55
-53:55

Podcast: Aric Toler on finding a national secrets leaker

We sit down with the best and brightest practitioners in the field to learn more about their careers and skillsets.

From pinpointing where Israeli airstrikes have landed in Gaza and Beirut to analyzing Russian troop positions— our next guest has helped New York Times readers see through the fog of modern warfare with precision and clarity.

Most famously, our guest discovered the identity of the Air National Guard member who was leaking national secrets, the biggest such leak since Edward Snowden. You can catch up on that 2023 story here.

Today, we’re joined by Aric Toler of the New York Times Visual Investigations team. Spend some time poring through his long list of bylines and investigations, or follow along to hear Aric discuss them himself.

Below you’ll find lightly edited and condensed highlights from our conversation with Aric.

On being an Internet obsessive:

I've spent way too much time on the Internet since I was a nine year old. I'm 36, so that's 25 years or so of poisoning my brain on the Internet, since I had an old gateway 2000 computer and as a kid with like 28.8k internet. So that’s a stupid basic thing, but just knowing how people behave online and anticipating how they behave and knowing where to look. 

On “piggybacking” off of others’ work:

Back in 2014 when I first started doing this, there weren't a lot of other people doing this, and so you're doing basically everything solo or within a small group. Nowadays, there's huge swaths of people who are doing this, who are geo-locating stuff, and who are grabbing stuff and finding it. And sometimes I'm the first to geolocate something, but usually I'm not.

I could be going through Google Street View and trying to find every building in Beirut, to try to find where this building was flattened. Or I can just check out what other people have done, and then piggyback off of that. And nowadays, in 2024 that's what you're doing a lot more. 

10 years ago, everything you had to do, every single video, you had to geolocate. There was a very small community doing this, but it wasn't really being shared. Now, you may be first, but you're probably not. There's no reason to duplicate work. So as long as you know you properly credit people, that's a big part of it. 

On collaborating with journalists in the Middle East:

Half the stuff we get just comes from the wire services, because AP, Reuters, AFP, most of the stuff comes from there. Especially in Lebanon, they have stringers everywhere. And so they just have people literally on the ground, and they're getting stuff as fast as the user-generated stuff you can see on Twitter and Telegram.

In Gaza, it's a different story. It’s unlike basically every other conflict zone with how you handle Gaza. But with Beirut, you have stringers on the ground take stuff, and within 15 minutes, you get photos on the AP photo wire, and there you go. It’s in like 12 megapixel photo ultra-detailed and they say what neighborhood it's in. And at that point, it's just child's play finding and verifying everything right. 

An excerpt from Aric’s account of tracking the documents leaker:

Who is this mysterious person? No one will say the person's name. We just know there's a guy who everyone kind of looks up to, and everyone talks to, who is the one leaking all this stuff. And he comes from this server called “Thug Shaker Central.” Who is he? So this is where the interesting stuff comes from. 

I think, okay, “how do I figure out who the candidates are?” So what I did is I went to Steam. Because this is Discord, these are all gamers. And it turns out that this server, “Thug Shaker Central,” was started from a bunch of friends who were on a different server. A lot of them were banned from it because they were using the N-word and posting racist memes and stuff in this other server, and they got banned, and so they started their own server to the side. 

So I think, okay, “these are all gamers, these are all friends.” Clearly, they all play together on Steam, because, for those who don't know, Steam is the gaming platform for PC games. So there's a social element to Steam where you can make friends with people, and you can game and be friend groups and all that stuff. And the other element is you can buy games. So it's kind of a dual marketplace and also social community. 

So I used a site called steamid.uk which is still up — wonderful site — which archives everything with Steam. All the profiles on Steam, all the history of it, friends, groups, historical name changes, which becomes important later on. Like everything, if you have a Steam account, your entire history of your Steam account is on steamid.uk. I checked this, since I've had a Steam account since 2004 because I'm old. When Half-Life 2 came out, I got a Steam account when I was like 16. And I looked there, and I have my Steam account, which is like, 21, years old. It can buy a beer or register for the draft. That's how old it is now. So I go through, I can see my entire history.

Discussion about this podcast

The Weekly OSINT Newsletter
The OSINT Jobs Podcast
We sit down with the best and brightest practitioners in the field to learn more about their careers and skillsets.