hey thanks for having me today uh my
name is ray baker
um wundersmith underscore ray on twitter
if you are into that sort of thing
i'm really excited to be here this is my
first
talk at defcon recon village
my talk today is about using ocean to
combat human trafficking and smuggling
so i'm going to talk a little bit about
some statistics
and then how trafficking has permeated
our culture and then we're going to go
into a case
a case study i guess
so i'm not a huge fan of these interest
slides
um but i think it's kind of important to
talk about who i am and what i do and
then it will make a little more sense
why this is
uh such a passion so i've been
in osam for about two years now i work
as a senior recon
analyst and i also have the pleasure of
being involved in a few
non-profits and they're very close to my
soul
the first one is ocean curious where we
bring osint
content to the community we
kind of educate on tools and processes
and things
and just kind of talk about
the innocent lives foundation i
volunteer there in the
fight against child exploitation and
operation safe escape i assist domestic
violence victims and help them escape
from their
abusers using osint
um additionally i added on here that i
have a deep love for
maritime content and if you follow me
you
will find that out very quickly
so i think it's kind of good to outline
like what we're talking about when we
say human trafficking
um i think a picture we have
of human trafficking is
you know a shady kind of guy
tricking a woman or a child into doing
something that they don't want to do
um but it's not
just women and children uh who can be
trafficked so this
this could be anybody any age race
sex gender education level anybody
there are some groups that are
more vulnerable to trafficking and this
could be like
undocumented workers um the lgbt
plus community um
previous domestic or abused victims
um ethnic minorities
uh they tend to all be a little more
vulnerable
um people who don't speak english very
well or are here on asylum
um people who can be manipulated through
debt or things like that
so that leads us to why why are people
trafficked
we know about sexual exploitation and
sex trafficking those ones are
pretty much talked about everywhere
uh but there are some other reasons and
and that's
like forcing children to serve as
soldiers people are forced to
commit crimes for criminals um you could
be forced into labor so this could be
like domestic
servitude or some kind of like farm
labor or something
forced marriage sometimes even organ
removal
which is a thing that i was unaware of
until i
researched for this uh
so how are these people traffic
you might say like there's no way that i
would be trafficked i wouldn't fall for
that
but it's really easy once
these traffickers find your need
like maybe you have a substance abuse
issue or
you have unstable housing you have no
place to live
mental health concerns maybe maybe you
are offered a job and you're in
a lot of debt so there's a need
that they fulfill um
and then there and then there's an
ultimatum like you can't leave because
now you are
in debt with me um
so that's that's how people fall into
this situation
um and and when i was researching this i
did find some facts that i thought were
really interesting that i wanted to
outline
in 20 20 21
uh because of the pandemic there's
obviously an increase
in commercial exploitation and sex
trafficking
and this included csem material which is
child sexual exploitation material
so um it's not really surprising which
with a lot of people home and not
working
[Music]
but what did surprise me is that a
portion of the increase was due to
people recirculating misinformation
on social media so this was people
trying to share
things to raise awareness like they were
sharing
cesa material and basically distributing
it
and re-victimizing again to try and
raise awareness
there was that story about children
being smuggled inside of furniture
that blew up a while ago and
you know you laugh about it like that's
ridiculous but it
it takes away resources and time from
people who are actually trying to to
help
so spreading that misinformation
actually causes a lot of
of trouble so in 2020 there were 9876
prosecutions
in the u.s 5271 convictions
and 109 216 victims were identified
um there's kind of a disparity between
how many victims were identified and how
many were
prosecuted and convicted
i think we can do better
um so the idea of trafficking is kind of
ingrained in our society and
in our culture and to the point where we
might not even realize that it's
trafficking story we're just kind of
used to hearing these things happen
and the one that i always go back to is
the story of pinocchio and i'm sure
most of us have heard pinocchio if not
seen it
so the story is pinocchio he gets
abducted by strangers who kind of coerce
him into going with him
he gets sold to an abusive puppet master
who makes him be a puppet and perform
under duress and threats and then he
escapes but he gets caught again
and then finally he heads off to this
debaucherous pleasure
island um which you can see in this
picture like all these boys going to
this
pleasure island and this is a pretty
typical
trafficking story so you're taking
someone out of their
surroundings that they're familiar with
you're isolating them you're forcing
them to perform
threatening them hurting them and then
you're denying their needs
it's like a it's a cycle
so now that we've kind of covered what
human trafficking is
um i'm going to go into a fictional
scenario
so 100 fictional all these pictures are
fake
um not a real story but the idea is that
i want to
illustrate kind of how we can use open
source intelligence
analysis to aid in finding victims of
human trafficking
so this story starts with a woman named
naomi
and she lives in an unstable home she's
not really
doing well there she's reported missing
by her job
she left some clues behind that kind of
indicated it might be a human
trafficking case
so the police have looked into it
they've hit a dead end and
they've run out of resources and they
need us to help
so using ocean we will figure out how
she was lured
hopefully find some patterns that will
identify her and then we will find naomi
if we're lucky
so this story kind of starts with um
grooming
so the police was were able to provide
uh direct messages from
instagram uh
showing a conversation between crystal
and naomi
and so naomi's been having a hard time
she's been posting pictures online and
this
woman named crystal has been liking them
giving her support
kind of just talking her through it um
i think it's a misconception that
grooming is done mostly by
men um a lot of
trafficking starts with a woman seeking
out another woman to bring her into the
fold so if you think like elaine maxwell
kind of situation
where it's like a friendlier face up
front pulling you in
so this conversation crystal's giving
naomi compliments
um naomi says like i'm broke
it's sad um crystal showing her a gucci
purse that this guy named jay
brought her so she's getting expensive
gifts
um naomi's probably feeling kind of
jealous
and then crystal says you know i know
you need work
i have some work for you you know i
always say you're a model
you look like a model so my friend jay
can hook you up um he knows this guy who
wants
he'll pay for a date just a date nothing
weird um just go on the date you'll get
money and it'll be over
so she seems a little nervous about this
um but they continue to talk
and over time naomi has stopped talking
to all her friends
and she becomes completely consumed with
this relationship
she's formed with crystal and this guy
jay
so in this screenshot here
she posts a picture of herself and
jay posts oh i you know i told you you
could be a model
so he's now grooming her um
it's classic you know find the need
build rapport
be the one who can solve the problem but
it's a limited time offer
like you gotta hook up with this guy now
make some money because he's gonna be
gone and you'll lose the opportunity
so at this point this is where the
meetup between jay and naomi gets
started
as a notice and analysts um we always
look at social media
social media will
blow up everybody's um other social
media all their
connections all their other accounts who
they're talking to we can find a lot
through social media
so we use things like what's my name dot
app or
name check things like that to enumerate
all of these social media accounts so we
look at naomi crystal and jay and their
connections
and then what they're connected to and
it looks like pornhub
cash app instagram facebook
so these all will be good selectors to
to pivot through to find
every account that they own that is
available
so if we turn back to naomi's instagram
we are shown the last picture that she
made it was a photo of herself
um the comments are her boss being
worried
people are noticing her missing uh are
you okay you never showed up last night
call me
so everyone's worried we know she's gone
this is the last picture naomi took
it says las vegas nevada at the top
and again as an ocean analyst
we could look at exif data
which is data that is
put into pictures when you take a
picture there's data in green in the
picture
uh that tells you the camera make model
flash maybe gps locations um
what programs were used blah blah
so social media tends to strip that out
so instagram does not have exif data so
we can't use that in this case
but if we look closely
we can see a reflection in our glasses
and it kind of looks like a building
i think but let's reverse it and see
so okay flipping this image we can see a
building
and we can see it's a south point it
kind of looks like a casino
which would align with the fact that
she's in vegas
so using the instagram location of vegas
uh the reflection in her glasses the
name southpointe
and google maps were able to figure out
that her
approximate last location was
here at this south point uh hotel and
casino and spa
so this is where she was when she took
this last photo
know this scenario probably seems pretty
far-fetched
uh until you see news articles like this
one
uh in this news article a stalker
stalked someone online that they liked
zoomed in on her eyes and found the
reflection
um and used google street view to find
out what station she got off at
on her way home he also watched her she
had youtube videos up he watched her
youtube videos and noted the setup
of her apartment and which floor she
lived on
so he was able to follow her from the
station
to her house knowing which level she
lived on and then he ended up assaulting
her
so not too crazy i mean it's crazy but
not out of the question
so at this point we could send
information to law enforcement which
would be good
they could potentially pull the casino
footage uh
track her phone she has a verizon phone
we just know that so according to the
retention records um for verizon they
can provide the range to tower data for
seven to ten days
and they can provide live pings um
for about 400 bucks
so they could potentially find her here
so now that we've logged her last
location we've enumerated her social
media along the way we found this
website
so it's fake.net and it's an escort site
obviously and it has her image on it
so we're going to dig a little bit into
this site normally we would note things
like
servers uh ip addresses numbers
subdomains things like that
because we would want to pass that on to
law enforcement
but this it was not buried too deep
we found a registrant listed
his name is tabiru bulat bonus points if
you know who that is
and the organization is listed as
escorts international
super transparent guy owns an escort
company
so again we could provide law
enforcement with
domains emails names subdomains things
like that and they could try and maybe
shut down the website and prevent other
people from
being trafficked through the site
it's good to keep keep law enforcement
involved so this is a touch point
area
so back to social media because it is
the gift that keeps on giving
uh we are going to look at the
registrant and see what we can find on
his social media
um so we follow mr bulat and we can see
how he's connected to
fake.net um jay crystal naomi
uh we see he's also connected to a guy
named pieter bulat
who owns a company called bulat trucking
so that is something we note down also
connected to fake.net is victor small
so victor small has an account for cash
app
and he has an account for kik
so blowing this out a little bit we can
see victor small
and his kik account here
which has a profile image and the
profile image if you blow it up and you
reverse it
it's a rotterdam sports team so that's
of note that would indicate that he
probably lives near
rotterdam um or is at least from
rotterdam
so his kick account username is smalls
underscore vic
and what's interesting when we ran
because what we do is we go through each
username if there's
a username we try it everywhere to see
if maybe they're
reusing the username because that that's
a thing people do
so we search this username and it pops
on the dark web
so this guy's not very smart he uses
usernames across accounts um
outside and inside and we find
an interesting conversation
so this is a conversation we found
between uh
victor and two other people and this is
on a dark web
forum so it's a bunch of people
talking about how they hate women
um i'm talking about a video of
i don't know abuse or something and
um the
victor small says you know you think
this video is crazy my cousin i
literally bring ship loads of people
over here in containers
so let me know if you want one and i'll
hook you up keep an eye
out for the good old iron spire
so i'm not really sure what that means
yet but he mentioned shipping containers
and iron spire
so this guy's like no i don't believe
you um and he says so the trick
is to have them sealed up in the
container at the port so no one will
open it and no one will look
it will go across the ocean to the other
side and then it will get dumped onto a
truck
so poor victor small has told us
potentially the entire uh back end of
this escort company and human
trafficking organization
i'm hoping the iron spire makes sense
soon
so
we're going to pivot back quickly to the
escort site
so while we were on the escort site just
log all that out of their information in
your report
going back to the escort site uh we see
that there is another
picture under her account and this
picture is of a hotel room and she's on
the bed it's obviously
you know trying to solicit business on
the site
so we know social media strips out
exit data but if you take a picture and
you put it straight up on the web
it does not always strip out exif data
so this picture luckily enough when we
look at the properties
it doesn't have the camera it doesn't
have you know the brightness and all
that
but what it does have is a gps location
and that's
super interesting
so at this point i
would note down the latitude and
longitude and this photo
and i would drop in the latitude and
longitude
into google and when i do it shows us
500 west 4th street los angeles
california
which is very interesting since she was
in nevada
and now she's in los angeles
so we know she's traveling um the
the name is blurred out it's not a very
fancy hotel at all
but when we pivot over the or hover over
the little
picture thing there it just gives us the
name anyway
so i'm not really sure why it blurs out
but
uh so we have the hotel that she's in
it's called the all-star
inn so now to verify
that she is actually in the all-star end
and the gps was not
incorrect we can go to the all-star in
google page or the website and we can
look through the photos
and when we look through the photos on
google we can see the rooms
and we end up finding the exact room
that she is in
so now we have this picture we probably
could have reversed image search the
picture as well
and come across this but so this
verifies that the gps location
in the photo is actually at this hotel
where she was at when the photo was
taken and when we look
at the location of the all-star inn
on the map it is suspiciously close to
the lax terminal island
which concerns me because victor was
talking about putting her on a container
and being by one of the ports that is
known for trafficking
that is highly of note
so focusing on the dark web brag post
with our new information about her being
in lax versus las vegas
we could run a search of the ships in
the port
and when we do that it leads us to a
ship that is
docked called the iron spire
so now this makes sense uh and we look
at the destination it's
lax to rotterdam
so now that makes sense too so the story
is lining up
um he basically leaked all of his
information on the dark web
which would probably not happen um
so we know victor's sports team was in
rotterdam he's probably
in rotterdam working the organization on
that side
so now i want to see i want to see the
ship
so i pop over to the this lax port cam
and you can find these cameras
everywhere you can find street cams you
can find port cams
all over the place so this one
is a new dock street and we happen to
see
our ship getting containers loaded onto
it
so that's very interesting
and we could find one that says bubat on
the side
something like that
at this point i would let the port
authority know
or law enforcement they could probably
pull bills of lading for the containers
or the shipments
they could pop open the container
and search it if they needed to
now we know it's a shipping company and
we're going to research that specific
ship to find what shipping company they
use
and we see that
bula trucking has heavy connections to
this shipping company we see
um bula trucks going in and out of the
same location over time
um in rotterdam
so we know based on this location of
in this corporate record of bulat
trucking in rotterdam
we see a a picture of the bullet truck
it has a blue front it has blue
on the side um
just as a little tidbit organized gangs
usually smuggle
people in hard sided trucks while small
time traffickers use soft sided trucks
i'm not really sure why but
that's interesting to know
so following the connection between mr
billot and
peter billot and a lot trucking i find a
webcam
in rotterdam at the port
so looking at the terminal cam we watch
this we see our iron spire come in
while we're watching at the eta listed
on the shipping
um we see the truck come in we see it
get unloaded
onto a truck
we see this truck drive away and when we
zoom in we see the blue front
so this is a lot truck
we suspect that naomi and possibly other
people are on this truck
potentially more victims
and this is where the port cam was
on this map
so now we alert the local authorities in
rotterdam
they're able to rush out they stop the
truck they free all the victims
these victims had endured days inside of
a refrigerator truck packed on top of
each other they probably
were hungry and they didn't have
anywhere to go to the bathroom
it was probably terrible
cases are really not this easy um
this was a fictional scenario i
made all these connections very easy to
find
uh you probably would have a much harder
time tracking
uh these human traffickers in real life
and if you're good at police uniforms
looking at this picture you've probably
realized that this
policeman here and these investigators
are not
from the netherlands they're not in
rotterdam
this photo here sadly is not from our
fake scenario
this this case is a very real case
from essex where 39 trafficking victims
from china
were put on a container and sent across
the english channel
and onto this truck and none of them
made it so while our fictional scenario
they were rescued this one unfortunately
39 people were not
so now that i have thoroughly depressed
everyone
and um i'd like to
refocus a little and give you a place to
direct your anger and your emotion
um in how to help so if this has
uh made you mad if it
uh brought up emotions that you need to
deal with
or even if you just want to help
here are some things you can do so if
you see something say something
especially if you live in nevada if you
live in california if you live in
florida
high trafficking areas definitely keep
your eyes out
know what trafficking looks like know
what victims look like know what
recruitment tactics look like
and you can always call the 24-hour
hotline
it's better to be safe than sorry
another thing you can do is be informed
about the goods that you buy
so you don't want to support trafficking
by purchasing something from the supply
chain
that is made by trafficked laborers
it's just something to be aware of you
can always volunteer
for anti-trafficking efforts
you know operation safe and safe doesn't
directly
work with human trafficking but we do i
mean we would support
the efforts
there are plenty of organizations at
will and if you don't want to physically
uh volunteer you can always throw money
at these organizations they i'm sure
they need it
um or you could send a letter meet with
um government
ask for better laws to be enacted
some countries don't have great laws to
help victims of human trafficking and if
you're a business you can always
provide skills or a job to
survivors of human trafficking um and
give them
something to to hope for and work
towards
and finally if you're if you're just
someone on twitter with a loud voice
use your platform spread awareness
volunteer that way talk about it
there are plenty of ways to help i hope
my presentation here has
done something i hope it has invoked
some kind of emotion in you guys
um i hope that you now see like ways
that oceant
can be used to assist in these types of
cases
how we can supply things to law
enforcement how we can help
i want to thank you for for having me
today i
was very excited for this talk and i
will be in the chat to answer any
questions that you may have
thank you again for having me and you
can find me
on social media at wondersmith
underscore ray