I hello everybody I I'm gonna be speaking to about
open source intelligence and looking at how cognitive bias ease
and critical thinking I can impact open source intelligence analysis
so little bit about myself my name is Benjamin brown
I work for Akamai Technologies large content delivery network
and I work on the external network the Internet
essentially a doing system safety complex systems analysis
a novel security research for novel attacks
and threatened Telligent yes it's a buzzword but that's the world we're
gonna be swimming in here the threat intelligence
security intelligence APT that's what stuff I meant to give you some
a ideas and contacts about what we're talking about here the world is
cognitive bias ease
open source intelligence I metacognition we'll get into that a little bit later
critical thinking and then specific frameworks for structured analysis
open source intelligence art
so why should we care about this well
a lot of our decisions both on the strategic level and the operational
level
I are born out of I this sort of
actionable intelligence that we've come up with and we're suing that its
accurate conclusions that we that have been properly framed for us
I am but a lot of times we're not taking into account
is that cognitive bias ease also called faulty heuristics
are putting pressure on the intelligence analysis process
and having us the lead to inaccurate conclusions which
then have us make poor decisions so
what can we do about that well one place look is metacognition in critical
thinking
where they allow us to do is recognize and correct for his cock into bias
and they also allows to arrive at more accurate solutions
more often so
a higher level view here give you a picture you have bad data
and biased analysis and they're feeding into false conclusions
these false conclusions are generating bad intelligence
and we're making poor decisions
space on this bad intelligence what does that lead to
apocalypse an armageddon
yeah that might seem a little
you know over the top I into a bit over
hyperbole but if anybody here is familiar with
the Bay of Pigs incident where a cuban missile crisis: that's exactly what
happened
we're headed for a very very bad state of affairs
based on bad intelligence and poor analysis that was heavily biased
now I'm laid some groundwork for what i'm talking about. I say open source
intelligence
so the US Army
I they say that open source intelligence is intelligence that's produced from
publicly available information
what is publicly available information well
we're talking about publicly available information the typical quality
leaves a lot to be desired it's like
the inquire the sea at the grocery checkout store something like that
a lot of times it's crap so
what we need to do well when it's out there in the public
and it's crap it's usually just data it's not actually intelligence
they can be acted upon this is where we need to discern
for ourselves between information
or data in actual intelligence intelligence comes out
love analysis intelligence has three markers
its timely it's relevant and its actionable
I
so since this is open source intelligence where we getting this
information
we're not getting it from confidential informants or anything like that
um we're getting it from search engines like Google
or if you hate yourself being I social networks
read it people say way too much on Reddit about themselves
I am also communications services like ir see
so alive and well I if you're from the eastern bloc
ICQ still very much alive which is weird to me um
also e-commerce site profiles somebody's Amazon history especially there are
commenting history is very interesting
are also doing I'm business and tax
searches especially in the US these are very easy to find lots of information
about
business owners people who arco owners
in business entities themselves on the state level
the a county-level and federal level of course
another place to get open source intelligence
a is the media but you want to take that with a grain of salt because this is
information that is coming out love eighties very specific
viewpoint for a very upset specific said purposes
so you want to take the whole context into a cap so what kinda tools are
useful for gathering this what information the record in G
so I'm a bit of a cold here Enrique on angie is
a really cool framework mice just everybody here even if
arm open source intelligence isn't your thing go check out our econ and you get
a lot of fun
and really creepy on exit storm
you can get lots of cool stuff from accept data from photos and other
piece is a media things like the GPS coordinates and the device that was used
I take the photo the harvester
it's really good for analyzing E companies or entities
finding all the email addresses that are publicly available for them
which is great for social engineering or spear phishing on
multi go multi goes great because it allows our brain
disorder shortcuts sum up the buyer sees by looking at the data in a completely
different way
we're not seeing it in a traditionalist we're seeing it as a visualization
as a web of connections which allow us to come up with
other ideas are ways of thinking about the data right
so let's talk about cocking device and I tell you
what i'm talking about. with cognitive bias first time I tell you what I'm not
talking about
I'm not talking about anything to do with faith-based
or spiritual or religious cultural things like that
and those words have by Cesar heuristics are
but
are at issue here what I am talking about
is the way that our brain deals with the massive amounts of information
that are just pouring towards us all the time so
we've got information coming from all over senses just being fed and
constantly
and how our brain deals with all that stuff just having a stock analysis
paralysis
is we have the shortened patterns subjective judgment
the simplified processing strategies that allow us to take shortcuts with a
little bit of information
so I'll give an example
a on how we don't actually see things
as they are out in the world are bring the deuces them based on
different snippets of information so for be look at this
the photo appear I am sections
a in sections be that are marked the squares here
aids in the top left B is in the center looks like
a is darker than be is that pretty much what everybody else sees
you okay on so
what's weird about this is that a.m. beer the exact same color
if I were to take the color picker
or take this into Photoshop AMB would have the exact same color value
but that's not what I brain is is producing are telling us that is going
on there
is looking at the different information about the checkerboard pattern
the angle the dimensions it looks it's looking at the Chateau
being lane across by the subject and that's saying 0
well because I've always little bits of information
a must be dark and be must be light well that's not actually the case
if I can happen with her eyes
where else can that happen
right so I'll give you I'll start breaking down
cognitive bias and two some very specific subset supplies
sees this one a lot of people here have probably heard a confirmation bias
so a when you're going to do research
we're going to look for some information a
it's very normal for human being disorder have in the back
their head an idea Bell how it's probably gonna turn out
with the case probably is that's a little insidious and that
when that's working in your subconscious that idea about
this is probably what the right answer is you are
either consciously or unconsciously and denying
certain types of information that go against what you think might be true
endured just specifically looking for information that fits what you think is
our teacher in the world
you're really missing a lot and not really doing much for yourself in terms
of analysis
I another one
and this one we see Mario doing with Yoshi all the time
is self-serving bias always looking at self enhancement
self-preservation self-esteem and social
work free against and I want to be very specific and
and living you guys know that I'm not saying these biases are inherently bad
they're useful they serve a purpose they allow us to conduct ourselves as
beings in a social setting but
they also cause us to do act and think in ways that can be detrimental to
intelligence analysis
another one is the echo effect this one
we see a lot more lately with things like Twitter
Facebook a you gets these like it's a game
media telephone you get these little snippets of stories
we don't actually know where the sources but repeated over and over and over
again
and maybe changes a little bit each time it's repeated this causes things like
the bandwagon effect
it promotes groupthink and inherently humans as we're seeing this piece of
data
produce over and over and over again it's starting to gain weight and
credibility in our minds
even if it doesn't have anything to do with reality
um
this bias is a little bit more in-depth are involved
it's the representativeness bias this one is we're focusing on similarities
and we're neglecting the differences and systems and I'll give you some examples
a this specifically later but when the classic tales
representative and ness bias is the some
therefore blind men and the elephant well one is feeling the trunk and saying
oh this must be a snake
one is feeling the tail saying oh this must be a rope and so on and so forth
they're only looking at the very small section of the entire picture and making
an assumption about what's going on
I one other subsets of this bias
is the base rate neglect bias this one very call this one you'll sees
specifically when media tries to throw at you really scary-looking statistics
which you want to look at is the base rate what's the
actual rate for their base that they're using and
a specific tool that you can use for this is based here
so this is based here in here if anybody's taken
I don't know house high school or a you know
two-year college statistics you probably had to do something with us
it actually is useful especially in Summit Road 230 da statistics such
so availability bias this one is
one we don't really think about a lot um
and this has to do with things like I in a data anecdotal data
I where the human mind inherently
really really likes first or second hand accounts
to relate even if we read something into a well renowned scholarly journal
were less likely to give that the same way that we we would give a story from
our friend
even if our friend has no way of knowing anything close to
you know what the person who wrote that scholarly our local
and this is just how we develop a social creatures
and topics from power again
a hearkening back to where we talked about the
echo effect I inherently we're gonna start giving something that we see over
and over again more weight
on censorship what are we missing that we don't know we're missing because it's
being
start censorship are we actually making notes have that
gaps in information also
how many languages are you fluent and and
how many UHV the dialects and some context
and subcultures within those languages are you able to really pull out all
the meaning is this going to affect the type of data
I in the way you're analyzing your data if you only speak English
and you only live in the midwest you're only gonna be understanding
the context love you know people that are posting information from the midwest
speaking English
you're gonna miss out a whole lot of other stuff also
on this masking of ca this is something that
the russians have as a very specific part
love their core a military intelligence platform and
subjection have this is disinformation and
they employed it better than anybody else especially during the Cold War
and it was a ingenious how they did
I'm one of their main tactics was the flood communication channels
with lots and lots of false information okay
yeah let's care either you know overwhelming you with false information
but was really clever is they would also put in
true information why's that clever
well if it's just a bunch of false information you look for the gaps
that's probably where the truth is but if it's true information
and false information mixed together it's just noise which is really hard to
analyze
and you see this the and when
anonymous these days is being used as a false flag operation
or another of the spun up underneath another one you can start to see this
makes
love false information which you information two actors with false actors
art so I give you much a theory
let's look at these things in the real world now this is the
one that I was actually present for um
when I was in Boston during the past bombings
I was you know of course with everybody else looking for more information
trying to find out what's going on and a group on reddit
a very large group decided to play internet police
I'm not gonna figure out who committed the Boston bombings and
I am you know they can definitely do a much better job than highly trained
professionals
so
some other methodology they would look at
publicly posted marathon photos or videos and they would try and pick out
who they felt wasn't paying enough attention to the race
at that specific moment in the photo I also
they would take E snippets the police scanner
data out of context if anybody here
does a lot of %uh emergency service radio work
and then you probably know that yes
there arm open channels but they change
and there's also include two channels which have more data that goes with the
open channels
they have courses have access to that data source very much without context
they started naming multiple suspects based on this very bad
open source intelligence they were developing now
if it was n a a bubble or vacuum by itself that wouldn't be so bad
but what we're really got that was when international media started picking up
on
the people who they were claiming probably did the bombing it's a repeat
its are giving a credibility so the media outlets started running bad info
from Reddit
and I'll show you a there's
a a show newsroom they did a very good piece on the specifically
they just recently found
no Tripathi was a student at Brown he was reported missing about a month ago
as family set up a Facebook page for anyone who might have information about
where he is
yesterday 5 p.m. in response to Thursday's post front page miss
identifying
to innocent people as enemies of the state the FBI issued these photos of the
actual suspects now
here's what happened next within minutes users on reddit all got together and
decided that the best thing to do
step back and let the professionals do their jobs they began comparing the FBI
photo of one of the suspects in your capacity
by 10 p.m. to become a leading theory on reddit the capacity was suspect number
two
at 2:43 this morning a man named Greg Hughes tweeted that the Boston Police
can identify the names of the suspects as Mike really get a and similar path
earlier in the night Greg user tweeted 2013 all you need is a connection to the
Boston Police scanner and a Twitter feed to know what's up we don't even the TV
anymore
now it tells I just bought a new class a big play it is baby doll or
seven minutes after the Greg Hughes tweet Kevin Galliford a cameraman for
Harper CBS affiliate
picks up on you sorry the relays the same information to his followers
moments after that
reporter at BuzzFeed sends 2.2 is 81,000
follow her portrait BuzzFeed has eighty-one thousand followers
I know you have one him just funny I like your jokes
a folly and not on Twitter really really
wonderment phone guys peace the BuzzFeed tweet says while read it was right
suspect identified as cynical Tripathi
two questions do we know who Greg uses is a guy on reddit
second question is that by this point it 243 this morning is anyone in our
network checked on Samuel Tripathi course we have and
by senior officials with the FBI 3 with the justice department including one
from the attorney general's office another five from the Boston PD
all of them willing to be identified on the record all of them categorically
denying that's not too bad he is a suspect
also the Secretary of Homeland Security going to put their circle be up against
Greg you certainly I don't know who the hell do believe 2:57 a.m. 14 minutes
after the first week
NBC News correspondent weeks the sendmail Tripathi
theory is 180,000 followers a hundred
80,000 at least integrated with their half hour later press helped send the
dow
I didn't want to miss six million unit celebrates that readiness of the bombing
john king is a stooge posters are responsible and the FBI
is inept see you see how quickly that wildfire spread right
turns out a similar property
I am had been missing because he had drowned
so his family is not only having to deal with all this going on
across the media arm and harassment and
a you know people calling and threats to them but
other also grieving their dead son so there's a real world impact
to this right so what biases were in effect here
well the bandwagon effect for sure the actual fact availability bias
the ability of the information they had and didn't have self-serving bias
there's Carmen internet points to be had I also confirmation bias
which here was rather insidious because all the people that got to the top of
their list of people that they were naming a suspect's
where brown males surprise
turns out the guys were actually did it were as wide as you can get because they
were actually from the caucuses
they were Caucasian right
APT drink and so
in the US I don't know if it's the same here but in the US when somebody says
advanced persistent threat people
lebowe like oh my god China a
so a lot of companies who have put out
threat intelligence reports I'm calling out China
have looked at a lot of open source a information
a and connected the dots like the
the typeof wrap that was used remitted ministration pool
which anybody can use really the same type geolocation between the control
the used Macs mind really accurate right guys
I'm also looking at shared similarities with past APT's
what we say about representative nest that's just looking at shared
similarities
it name a single difference between past APT's
now two authors native language
was also brought into question this is the of their
a free tool that was posted online that these guys happen to use
I don't know why that has anything to do with anything essentially came down to
where expert researchers
just trust us but turns out the all these expert researchers
works for vendors that would also sell you a solution to a PT
yeah hey so some other things you wanna look at
is what's the population a base rate on
for the communicant role servers that they're using
in the population to the area's the ability of the information that they had
I and again as vendors this was very much a self-serving bias at work here
some other areas were in a run through quickly that
you can actually look and see these biases and a fact
doc Singh doc Singh is wrong
like it they get it wrong so often it's not even funny
and the call out real people who have to then
change the name change their job because they got about DAX dropped them
adidas attacks and
you know there's a lot of odd the uncertainty and doubt around that use
your
based there and look at the base rate your look at this this is cool
methodology that the use
what is the sample size how long have they been collecting the data you tell
me there's been
increase have 1,152 percent in
NTP reflection attacks 0 you've only been collecting data over the past three
months
well of course that numbers would be huge because there was a recent spike
but it starts normalize overtime a newsweek outing the quote-unquote
creator
pick one on yeah how's that going for them
there in their second-round uva being sued and the
search for the Malaysian Air Race flight image 370
the song was really interesting
and this is the culmination this picture the combination love hours and hours of
tedious research
on through open source information to find the downed plane
and when this group a outed that they had found it
turns out this photo they got from Google Maps
which is updated in real time right
right so what do we do
metacognition thinking about thinking
so you wanna ask yourselves
when dealing with any data that you're you know gonna assume to be true
USA what do I think I know how do I think I know it
and when would it not be true and this is just
generally good three good questions to ask you know throughout the day to
yourself and your regular life
what do I think I know how do I think I know it
and when would it not be true I
also there's another thing to look out for in this is getting a little matter
it's the bias bias or the bias blind spot this is the belief that your
personal bias
is actually insight and it gets worse
throughout the research by Emily prone and at the Princeton University
and she finds that a
a lot of people report being less susceptible to bias themselves
and they will be likely to infer bias and others especially
when they hold a contrary opinion so not only is my bias actually in sight
but you have some huge by is going on over there so you can actively seek out
your review
divers outside expertise in alternative mindsets that will help to mitigate some
of that
but doctor Richard sure says that similar to an optical illusion
not fair that you on on they remain compelling
even when you're fully aware their nature so we can implement frameworks
one is the structure checklist for analysts
and I can give you the extended slides for these you can actually go through
them slowly
and that one was developed by the CIA
I back
in the sixties to you helps have their
their intelligence become more and more useful up
and the second was a structured analytic techniques for improving intelligence
analysis
this one has diagnostic techniques contrarian techniques and imaginative
thinking techniques
and it tells you when to use things like doubles at BC
team 18b analysis which is a lot of fun I'll
a high-impact low-probability analysis Black Swan analysis
I'm sure some of you are aware of that also what if analysis
XL has a plugin for that one I
and they give you a time line for
when each of these things would be more useful and when you've got a lot of you
were
a lot of your data and analysis RTN you can play a really good devil's advocate
that's why that's towards the back and throughout the whole thing you wanna be
doing your key assumptions checks
what do I think I know how do I think I know it
and when would it not be true so what do we do in the application of these
well when we're putting out a reports or are
stating our intelligence we wanna say what's our goal here
make it very clear who were sources who's the audience were targeting
and please give your limitations on assumptions this one's missed a lot
but more important than any of these show me your methodology
I'm not gonna just take your word for it that you're an expert researcher and I
should just trust you
I want to be able to repeat what you did an hour other people to be able to
repeat what i've repeating
that's how science works so there's a for some further research that would be
great
i'm looking at the tools were talking about before
they have bake them bias looking at the cultural and economic context the data
arises
date is not in a vacuum so this data that we're using to build intelligence
it has its own historical context its own chain before got to us
and pressures on it before got to us so analyzing all of that
and a lot of times date is created by human beings
who also have their biases that work some mitigating for that as a whole
nother
realm of research so
I'd like to hear you know from from olive you
course hands you know I think we can really take
threat intelligence out of the realm I'll lining the pockets vendors
and into the realm actually doing good for the people in the world
and making an impact in protecting people and having a safer environment
online an essay for digital life I
thank you and I ready to take questions yet to be on the website also
if you email me on I I can give you even more extended slides
which give a allister on readings
there's one reading that's a lotta fun its it's called managerial decision
making but as a bunch exercises and
allow you to see your own bias ease right from your face at work
at a little freaky okay
so thank you so much for the presentation