 Hey, thanks for having me today. My name is Ray Baker Wondersmith underscore Ray on Twitter if you are into that sort of thing I'm really excited to be here. This is my first talk at Def Con recon village My talk today is about using OSINT to combat human trafficking and smuggling So I'm gonna talk a little bit about some statistics and then how trafficking Has permeated our culture and then we're gonna go into a case a case study, I guess So I'm not a huge fan of these interest slides But I think it's kind of important to talk about who I am and what I do and then it will make a little more sense Why this is such a passion So I've been in OSINT for about two years now I work as a senior recon Analyst and I also have the pleasure of being involved in a few nonprofits and they're very close to my soul The first one is OSINT curious where we bring OSINT content to the community We kind of educate on tools and processes and things And just kind of talk about OSINT The innocent lives foundation I volunteer there in the fight against child exploitation And operation safe escape. I assist domestic violence victims and help them escape from their abusers using OSINT Additionally I added on here that I have a deep love for maritime content and if you follow me you Will find that out very quickly So I think it's kind of good to outline like what we're talking about when we say human trafficking I Think a picture we have of human trafficking is You know a shady kind of guy Tricking a woman or a child into doing something that they don't want to do But it's not just women and children Who can be trafficked so this this could be anybody any age race sex gender Education level anybody there are some groups that are more vulnerable to trafficking and this could be Like undocumented workers the LGBT plus community Previous domestic or abused victims Ethnic minorities They tend to all be a little more vulnerable People who don't speak English very well or are here on asylum People who can be manipulated through Debt or things like that So that leads us to why why are people trafficked we know about sexual exploitation and Sex trafficking those ones are pretty much talked about everywhere But there are some other reasons and and that's like Forcing children to serve as soldiers People are forced to commit crimes for criminals You could be forced into labor. So this could be like domestic servitude or Some kind of like farm labor or something forced marriage Sometimes even organ removal, which is a thing that I was unaware of until I Research for this So how are these people traffic you might say like there's no way that I would be trafficked I wouldn't fall for that but It's really easy once that these traffickers find your need like maybe you have a substance abuse issue or you have unstable housing you have no place to live A mental health concerns paper. Maybe you were offered a job and you're in a lot of debt So there's a need that they fulfill and Then they're and then there's an ultimatum like you can't leave because now you are in debt with me So that's that's how people fall into this situation And and when I was researching this I did find some facts that I thought were really interesting that I wanted to outline and 2021 Because of the pandemic there's obviously an increase in commercial exploitation and sex trafficking This included CSEM material, which is child sexual exploitation material so It's not really surprising which with a lot of people home and not working But what did surprise me is that a portion of the increase was due to people recirculating Misinformation on social media. So this was people trying to share things to raise awareness Like they were sharing CSEM material and Basically distributing it and Revictimizing again to try and raise awareness There was that story about Children being smuggled inside of furniture that blew up a while ago and You know, you laugh about it like that's ridiculous But it it takes away resources and time from people who are actually trying to to help so Spreading that misinformation actually causes a lot of trouble So in 2020 there were 9,876 prosecutions in the US 12,271 convictions and 109,216 victims were identified Just kind of a disparity between how many victims were identified and how many were prosecuted and convicted I think we can do better So the idea of Trafficking is kind of ingrained in our society and in our culture and to the point where we might not even realize that it's Trafficking story we're just kind of used to hearing these things happen and The one that I always go back to is the story of Pinocchio and I'm sure most of us have heard Pinocchio if not seen it So the story is Pinocchio. He gets abducted by strangers who kind of Coerce him into going with him. He gets sold to an abusive puppet master who makes him Be a puppet and perform under duress and threats and then he escapes But he gets caught again and then finally he heads off to this debauchers pleasure Island Which you can see in this picture like all these boys going to this pleasure Island And this is a pretty typical trafficking story So you're taking someone out of their surroundings that they're familiar with you're isolating them You're forcing them to perform Threatening them hurting them and then you're denying their needs. It's like a it's a cycle So now that we've kind of covered what human trafficking is I'm gonna go into a fictional scenario. So 100% fictional all these pictures are fake Not a real story, but the idea is that I want to illustrate kind of how We can use open source intelligence Analysis to aid in finding victims of human trafficking So this story starts with a woman named Naomi and she lives in an unstable home. She's not really doing well there She's reported missing by her job She left some clues behind that kind of indicated it might be a human trafficking case So the police have looked into it. They've hit a dead end and they've run out of resources and they need us to help So using OSINT, we will figure out how she was lured hopefully Find some patterns that will identify her and then we will find Naomi if we're lucky So the story kind of starts with grooming So the police was able to provide direct messages from Instagram Showing a conversation between Crystal and Naomi and so Naomi's been having a hard time She's been posting pictures online and this woman named Crystal has been liking them giving her support Kind of just talking her through it I think it's a misconception that grooming is done mostly by men a lot of Trafficking starts with a woman seeking out another woman to bring her into the fold. So if you think like the Wayne Maxwell kind of situation Where it's like a friendlier face up front pulling you in So this conversation Crystal's giving Naomi compliments Naomi says like I'm broke. It's sad Crystal showing her a Gucci purse that this guy named Jay brought her So she's getting expensive gifts Naomi's probably feeling kind of jealous and Then Crystal says, you know, I know you need work. I have some work for you You know, I always say you're a model you look like a model So my friend Jay can hook you up. He knows this guy who wants He'll pay for a date just a date nothing weird. Just go on the date. You'll get money and it'll be over So she seems a little nervous about this But they continue to talk and over time Naomi has stopped talking to all her friends and She becomes completely consumed with this relationship. She's formed with Crystal and this guy Jay So in this screenshot here, she posts a picture of herself and Jay Posts. Oh, you know, I told you you could be a model So he's now grooming her It's classic, you know, find the need build rapport be the one who can solve the problem But it's a limited time offer like You got to hook up with this guy now Make some money because he's gonna be gone and you'll lose the opportunity So at this point, this is where the meetup between Jay and Naomi gets started as an ocean analysts We always look at social media social media will Blow up everybody's Other social media all their connections all their other accounts who they're talking to we can find a lot through social media So we use things like what's my name app or name check things like that to enumerate all of these social media accounts So we look at Naomi crystal and Jay and their connections and then what they're connected to And it looks like Pornhub cash app Instagram Facebook So these all will be good selectors to to pivot through to find every account that they own That is available So if we turn back to Naomi's Instagram We are shown the last picture that she made it was a photo of herself The comments are her boss being worried people are noticing her missing Are you okay? He never showed up last night. Call me So everyone's worried. We know she's gone. This is the last picture Naomi took it says Las Vegas, Nevada at the top and Again as an ocean analyst, we could look at exif data, which is data that is Put into pictures when you take a picture there's data and green in the picture That tells you the camera make model flash maybe GPS locations What programs were used blah blah blah? so Social media tends to strip that out So Instagram does not have exif data, so we can't use that in this case, but if we look closely We can see a reflection in her glasses and it kind of looks like a building I think But let's reverse it and see So okay flipping this image. We can see a building and we can see it says South Point It kind of looks like a casino Which would align with the fact that she's in Vegas? so Using the Instagram location of Vegas The reflection in her glasses the name South Point and Google Maps were able to figure out that her approximate last location Was here at this South Point Hotel and casino and spa So this is where she was when she took this last photo. I Know this scenario probably seems pretty far-fetched Until you see news articles like this one in this news article a stalker Stock someone online that they liked Zoomed in on her eyes and found the reflection And used Google Street View to find out what station she got off at on her way home He also watched her she had YouTube videos up He watched her YouTube videos and noted the setup of her apartment and which floor she lived on So he was able to follow her from the station To her house knowing which level she lived on and then he ended up assaulting her So not too crazy. I mean it's crazy, but not out of the question So at this point we could send information to law enforcement, which would be good They could potentially pull the casino footage Track her phone She has a Verizon phone We just know that So according to the retention records on for Verizon They can provide the range to tower data for seven to ten days And they can provide live pings For about 400 bucks So they could potentially find her here Now that we've logged her last location, we've enumerated her social media Along the way we found this website So it's fake.net And it's an escort site, obviously And it has her image on it So we're gonna dig a little bit into this site Normally we would note things like servers IP addresses numbers subdomains things like that because we would want to pass that onto law enforcement But this it was not very too deep We found a Registrant listed his name is Tiberio Boulotte Bonus points if you know who that is And the organization is listed as escorts international super transparent Guy owns an escort company So again, we could provide law enforcement with domains emails names Subdomains things like that and they could try and maybe shut down the website and prevent other people from being traffic through this site It's good to keep keep law enforcement involved. So this is a touch point area So back to social media because it is the gift that keeps on giving We are going to look at the registrant and see what we can find on his social media So we follow mr. Boulotte and we can see how he's connected to fake.net Jay crystal Naomi We see he's also connected to a guy named Piotor Boulotte Who owns a company called Boulotte trucking? So that is something we note down also Connected to fake.net is Victor small So Victor small has an account for cash app and he has account for kick It's a blowing this out a little bit we can see Victor small and and His kick account here Which has a profile image and the profile image if you blow it up and you reverse it It's a Rotterdam sports team So that's of note that would indicate that he probably lives near Rotterdam Or is at least from Rotterdam So his kick account username is smalls underscore Vic And what's interesting when we ran because what we do is we go through each username if there's a username We try it everywhere to see if maybe they're reusing the username because that that's a thing people do So we search this username And it pops on the dark web So this guy's not very smart. He uses in user names across the counts outside and inside and We find an interesting conversation So this is a conversation we found between Victor and Two other people and this is on a dark web forum So it's a bunch of people talking about How they hate women I'm talking about a video of I don't know abuse or something and the Victor small says, you know, you think this video is crazy my cousin I literally bring shiploads of people over here in containers So let me know if you want one and I'll hook you up. Keep an eye out for the good old iron spire So I'm not really sure what that means yet, but he mentioned shipping containers and iron spire So this guy's like no, I don't believe you And he says so the trick is to have them sealed up in the container at the port So no one will open it and no one will look it will go across the ocean To the other side and then it will get dumped onto a truck So poor Victor small has told us Potentially the entire Back end of this escort company and human trafficking organization I'm hoping the iron spire makes sense soon So We're gonna pivot back quickly to the escort site So while we were on the escort site just log all that out of their information in your report Going back to the escort site. We see that there is another Picture under her account and this picture is of a hotel room and she's on the bed It's obviously, you know trying to solicit business on the site. So We know social media strips out of exit data But if you take a picture and you put it straight up on the web, it does not always strip out exit data So this picture luckily enough when we look at the properties It doesn't have the camera. It doesn't have, you know, the brightness and all that But what it does have is a GPS location and that's super interesting so at this point I Would note down the latitude and longitude and this photo and I Would drop in the latitude and longitude into Google and when I do it shows us 500 West 4th Street, Los Angeles, California, which is very interesting since she was in Nevada and now she's in Los Angeles So we know she's traveling The name is blurred out. It's not a very fancy hotel at all But when we pivot over the or hover over the little Picture thing there. It just gives us the name anyway. So not really sure why it blurs out, but So we have the hotel that she's in it's called the All-Star Inn So now to verify that she is actually in the All-Star Inn and the GPS was not incorrect We can go to the All-Star Inn Google page or the website and we can look through the photos and When we look through the photos on Google, we can see the rooms and we end up finding the exact room that she is in So now we have this picture. We probably could have reversed image search the picture as well and come across this But so this verifies that the GPS location in the photo Is actually at this hotel Where she was at when the photo was taken and when we look at the location of the All-Star Inn on The map it is suspiciously close to the LAX terminal island Which concerns me because Victor was talking about putting her on a container and Being by one of the ports that is known for trafficking That is highly of note so Focusing on the dark web brag post with our new information about her being in LAX versus Las Vegas we could run a search of the ships in the port And when we do that it leads us to a ship that is docked called the iron spire So now this makes sense And we look at the destination it's LAX to Rotterdam So now that makes sense too. So the story is lining up He basically leaked all of his information on the dark web, which would probably not happen So we know Victor sports team was in Rotterdam, he's probably in Rotterdam working the organization on that side So now I want to see I want to see this ship So I pop over to the this LAX port cam and you can find these cameras everywhere You can find a street cams. You can find port cams all over the place So this one is a new dock street and we happen to see our ship Getting containers loaded onto it So that's very interesting And we could find one that says blue lot on the side something like that at this point I would let the port authority know or law enforcement They could probably pull bills of lading for the containers or the shipments They could pop open the container And search it if they needed to So now we know it's a shipping company and we're going to research that specific ship to find what shipping company they use and We see that Bulat trucking has heavy connections to this shipping company. We see Bulat trucks going in and out of the same location over time In Rotterdam So we know Based on this location of in this corporate record of Bulat trucking in Rotterdam We see a picture of the Bulat truck. It has a blue front. It has Bulat on the side um Just as a little tidbit organize gangs usually smuggle people in hard-sided trucks While small time traffickers use soft-sided trucks. I'm not really sure why but that's Interesting to know So following the connection between mr. Bulat and peter Bulat and Bulat trucking I find a webcam in Rotterdam at the port So looking at the terminal cam We watch this we see our iron spire come in while we're watching at the ETA listed on the shipping We see the truck come in we see it get unloaded onto a Truck we see this truck drive away and when we zoom in we see the blue front. So this is a Bulat truck Um, we suspect that Naomi and possibly other people are on this truck potentially more victims and This is where the port cam Was on this map So now we alert the local authorities in Rotterdam They're able to rush out. They stop the truck. They free all the victims These victims had endured days inside of a refrigerator truck packed on top of each other. They probably Were hungry and they didn't have anywhere to go to the bathroom. It was probably terrible Cases are really not this easy This was a fictional scenario. I made all these connections very easy to find You probably would have a much harder time tracking these human traffickers in real life And if you're good at police uniforms looking at this picture, you've probably realized that this Policeman here and these investigators are not from the Netherlands. They're not in Rotterdam This photo here sadly is not from our fake scenario This this case is a very real case from Essex Where 39 trafficking victims from China were put on a container and sent across the English Channel and onto this truck and None of them made it So while our fictional scenario, they were rescued this one Unfortunately 39 people were not so now that I have thoroughly depressed everyone and I Like to Refocus a little and give you a place to direct your anger and your emotion in how to help so if this has Made you mad if it Brought up emotions that you need to deal with Or even if you just want to help Here are some things you can do so if you see something say something especially if you live in Nevada if you live in California if you live in Florida High trafficking areas definitely keep your eyes out Know what trafficking looks like know what victims look like know what recruitment tactics look like And you can always call the 24-hour hotline It's better to be safe than sorry Another thing you can do is be informed about the goods that you buy so you don't want to Support trafficking by purchasing something from the supply chain that is made by traffic laborers It's just something to be aware of You can always volunteer for anti trafficking efforts You know operation safe and safe doesn't directly Work with human trafficking, but we do I mean we would support the efforts There are plenty of organizations at will and if you don't want to physically Volunteer you can always throw money at these organizations. They I'm sure they need it Or you could send a letter and meet with government ask for better laws to be enacted some countries don't have great laws to Help victims of human trafficking And if you're a business you can always Provide skills or a job to survivors of human trafficking and give them something to to hope for and work towards and Finally, if you're if you're just someone on Twitter with a loud voice Use your platform spread awareness Volunteer that way talk about it There are plenty of ways to help I Hope my presentation here has Done something. I hope it is invoked some kind of emotion in you guys I hope that you now see like ways that oscent can be used to assist in these types of cases How we can supply things to law enforcement how we can help I Want to thank you for for having me today I was very excited for this talk and I will be in the chat to answer any questions that you may have Thank you again for having me and You can find me on social media at Wondersmith underscore ray