OSINT in the Commercial Sector with LifeRaft

Audio: Welcome to the World of Intelligence, a podcast for you to discover the latest analysis of global military and security trends within the open source defense intelligence community. Now onto the episode with your host, Harry Kemsley.

Harry Kemsley: Hello and welcome to the latest edition of World of Intelligence at Janes. As usual. Harry Kemsley, your host and my co- conspirator Sean, Sean Corbett. How are you, Sean?

Sean Corbett: Hi, Harry. Good, thanks. Looking forward to this one.

Harry Kemsley: So Sean, you and I have spoken recently a great deal about the power and use of open source intelligence from open source information and its uses in the public sector around government agencies for example. What we haven't done, however, is speak about how open source information and intelligence that can be derived from it can be used by the commercial sector. So we and Janes, globally, have about 25% of our customers globally who are in that sector so it seemed to me that probably about overdue, we started talking about the commercial sector as well. So to that end, we've asked a colleague from a partner organization, LifeRaft, Neil Spencer, to join us. Hello Neil.

Neil Spencer: Hello gentlemen. Pleasure to be here. Thank you for having me.

Harry Kemsley: Thank you for joining. So Neil is the director of strategy and partnerships for LifeRaft. He has more than 20 years of security experience and during that time he's advised both corporate and government sectors so ideal for this conversation with his corporate background. His research focuses on the security and intelligence markets to understand how new technologies trends and online data sources, impact assets and operations. For those that don't know LifeRaft, it's a technology company that steps into bridge the gap between digital data discovery and traditional physical security, providing an evolving threat intelligence and investigations platform to the corporate security market which help companies better prepare for and respond to evolving security threats. Neil, again, thank you for joining.

Neil Spencer: Pleasure.

Harry Kemsley: Let's start then with a very brief discussion about what we mean, the three of us, about open source information and the intelligence we can derive from it. So Sean, I'm going to come to you first in terms of our understanding of it. Neil, you just confirm that you agree, disagree or add to that as you see fit and we'll pick up the pieces from there. So, Sean, how do we generally describe what open source means?

Sean Corbett: So four components predominantly for me. The first thing is legally accessible. We don't do stuff that is not legal of course. Second is this publicly or commercially available? Doesn't matter if you have to pay for it, but it's got to be able to be available by anybody there and then this sort of final thing is that it needs to be able to be applied to a particular problem, set or theme.

Harry Kemsley: Very good Neil, your views on that.

Neil Spencer: Yeah, absolutely, and you know, I think I align very strongly with that and the difference fundamentally between OSINF with the F and PAI, the fact that the OSINF and PAI drives the OSINT, you know, to get something tangible out of it, you need to overlay a layer of context there. So yeah, absolutely very much align.

Harry Kemsley: All right. Now, during the course of the conversation, Neil, I think we'll zero down into the social media world, but I want to be clear as we start this, we're keeping the aperture wide, we're looking at the range of open source information that's available and I want to start off by then just looking at how does the open source information and the intelligence we can derive from it, how does that impact the commercial sector? Let's look at it over recent times. I don't want to put two stringent a time band on there, but in the recent two or three years, what's been the impact of open source information and intelligence on the commercial sector in your experience?

Neil Spencer: Yeah, I think, Harry, in my experience, and especially us at LifeRaft, I think our corporate customers in particular, and I'm sure it's not too dissimilar in the government space either, have seen just the breadth and scope of online sources, especially in the social media world increase significantly. You know, if you go back, let's go back 24 months ago, you, it's a little bit further, you know, you had the big four, you had the Twitters, the Facebooks, the YouTubes, the Instagrams of the world and now we are almost not quite daily anymore, there was a period sort of a couple years ago where it was almost daily you had new platforms coming online, but monthly almost we start to see these new sources pop up and it's, I think, from a corporate security standpoint, beyond it's understanding, you know, how people are using those inaudible sources, what you can potentially get from them, what opportunities are there to be learned and also the risks and the pitfalls of exploring some of those.

Harry Kemsley: Yeah. Well-

Neil Spencer: So-

Harry Kemsley: We'll sort of come onto the risks in a bit later, so let's bookmark that one for later, for sure but in terms of the impact that it's had then, what, with all these new platforms coming in, what are the sort of things that the commercial sector are seeing is value out of these?

Neil Spencer: Yeah, absolutely. I think if you are looking at the threat landscape, so you're starting to understand doing some large voices come out of those areas so whereas potentially in some of the poor social media platforms, people may not have been keen to share some of their views. People maybe historically have been de platformed from some of those platforms as a result of sharing views so those particular newer platforms, those emerging platforms have created a safe space for some of those conversations. That means that the corporate security teams can start to pick up on those signals so having those sort of horizon- scanning approaches to seeing what's coming down the line, seeing what's there, seeing what they can get ahead of because you need to be able to preempt any potential threats coming your way, and that can be a direct threat or in the risk phase. So it might be things like geopolitical risk that might be impacting your business operations down the road. It might be something as simple as weather. So, you know, you folks are sitting in the UK sweltering at the moment and the richness of sources that are out there now and if we look at some of those newer sources and not just what we'd call the alternate social medias, but the emerging social media and even in the form of something like TikTok, so TikTok has really only been around in the grand scheme of things since 2016 so, you know, relatively new on the scene, a billion people out there are putting content out into TikTok so to be able to identify content, see all of those or something like TikTok, something like Telegram has a lot of images or videos associated with it. TikTok is a very video- centric platform. You know, that content is there to be understood, to give context to what's going on and to give insight to those OSINT analysts that need it. So I think to circle back, you know, it is the breadth, the impact of those platforms, some of the opportunities there are just identifying some of those nuggets that are out there because there is such a breadth and because now there's the, in some of those forums, people are brave enough to share maybe thoughts that perhaps historically they wouldn't have done and then in a day-to- day life, there are people out there, there is enough of a landscape, there is enough of a footprint to be sharing insights just as part of their day-to- day life and all of that is publicly available for people to go and look at, use and understand what's going on as a crowdsourced intelligence tool at that stage.

Harry Kemsley: Sean, I'm going to come to you just a second. I just want to come back on a point that I think I heard Neil say a second ago, but when I come back to you, Nick, Sean, I'm looking for you to just try and give me some comparison from what we've heard in our previous discussions about what is going on in the public sector space and how they're finding use. I certainly recognize the discussions about context and indicates and warnings that Neil mentioned, but I'll come back to that in just a second, Sean, if I may, but Neil, before I do that, there's just one thing you said towards the beginning of your answer there about a reluctance to engage. I think you said that some individuals have been put off platforms or taken off platforms'cause something that said. Are you saying that in the corporate world, there is a real reluctance to engage with social media because they don't want to be seen to be saying something that's perhaps incorrect or viewed as incorrect, or is it they just are told not to?

Neil Spencer: No, I think my point there is fundamentally that potentially groups of a certain thought process or individuals' certain thought process, maybe as anonymous as some of those mainstream platforms are, historically maybe the level of visibility that they had, they were not willing to share some of their thoughts-

Harry Kemsley: Oh I see.

Neil Spencer: ...into those platforms.

Harry Kemsley: Got it.

Neil Spencer: Now that some of those offshoots have been created and like- minded people tend to congregate towards those particular channels and those particular sources, it's the echo chamber effects.

Harry Kemsley: Echo chamber. Yeah.

Neil Spencer: Everybody else there is sharing those same thoughts so all of a sudden, somebody who might have had underlying thoughts and concerns and theories now has that, either that is amplified or then starts to come forward as somebody who is happier to share those underlying, online force and theories.

Harry Kemsley: And then so presumably it becomes potentially a richer source because they're being more open and more direct in that echo chamber they've created themselves.

Neil Spencer: Absolutely. Yeah, absolutely.

Harry Kemsley: So, Sean, let's talk about that in the public sector, your view in terms of the comparator there, that sounds pretty similar doesn't it? With indicators and warnings and the context piece that Neil mentioned?

Sean Corbett: Yeah, definitely. I think first thing I should say is this is a really important subject to discuss because you know, much as we spend a huge amount of effort on the government space and the public sector, open source intelligence is incredibly valuable for the commercial sector, but in my view, certainly in my experiences working with other companies, very rarely used to be the force multiplier that it is in the defense sector. So for example, you and I would be so used to, and probably hate, the mid risk matrixes we used to look at, but we used to pour over those to the nth degree, probably too much. Now I'm not saying that we always got it right in terms of you do your risk matrix, you shut it and then you move onto something else, but it actually means something. So if you sort of apply that to the commercial sector, it is still trying to optimize what you're doing and reduce your threat. And there's a difference between risk and threat obviously.

Harry Kemsley: Yep.

Sean Corbett: You know, the risk is something that the owner of the process makes a judgment of against a threat that they're given and so it's actually very similar thing. If you look at the scope right now that the commercial sector could be using for, it's everything from, I actually get threats and that could be cyber threats, it could be supply chain threats, it could be competitive threats and the competitive analysis is pretty poor actually out there in terms of the commercial sector, maybe they protect their information better, I don't know, Neil, I'm sure, will tell us in a moment. So the opportunities and the threats are as important, but getting down to specifically what can affect my bottom line, which is what it's all about.

Harry Kemsley: Yeah.

Sean Corbett: So, you know, it might be cyber threats, but it might be physical threats, but it might also be, is there somebody else in the market that does it better? So that competitive analysis piece, which is exactly what we do within the defense sector, but we're just in a different way.

Harry Kemsley: Yeah. And I think actually we just picked up on there. Sean is quite interesting. The idea of the traditional threat to an organization might well be something to do with physical threats, the infrastructure, for example, I think we also talk quite frequently these days about cyber threats, they've become increasingly the new traditional haven't they? But what about the non- traditional threats? Do companies perceive traditional and non-traditional threats, Neil, in your experience in terms of things they've got to worry about?

Neil Spencer: Yes, absolutely and I think traditional or non- traditional and more so almost at that convergence of things like physical and cybersecurity so historically, there is a clear demarcation between those two groups so these days, anything that appears in cyber domain can very rapidly manifest itself as a physical threat. So you have threat actors out there that are doxing executives, for example, doxing higher profile individuals within an organization or actually, in our experience, doxing, so if you're looking at media entities, so their talent, news reporters, actors, et cetera, and all of that so the sooner, or as soon as somebody has their name, address, phone number, et cetera in the public domain, because all of this is being released into the public sphere, that very quickly can manifest itself into a physical threat. So the sooner that a court security team can get ahead of that threat, absolutely the better and that is the difference, you know, between and sort of, I think to your point, Sean, you know, ultimately be it in the government space or in the commercial space, in the private sector space, it comes back to" business continuity" in inverted commas. How do you make sure that your business can continue to run as effectively and as efficiently as possible?

Harry Kemsley: Yeah.

Neil Spencer: Just on that one and talk about the nontraditional threat, sorry, I didn't mean to interrupt, there's one of the major multinational corporations that I sort of talk to sometimes. They've got one individual that just looks at their insider threat.

Sean Corbett: Yeah.

Neil Spencer: I was thinking what on earth do you mean by that? But that's everything from industrial espionage to theft, to disgruntled interview individuals just wanting to sabotage the company and that's the person's full time job. So clearly there's something in that.

Harry Kemsley: Then it's the unfortunate mistake that people make, you know, they, it's not just the malicious, it can be just the, oops, sorry, I didn't mean to do that moment.

Neil Spencer: Yeah, absolutely. Took the words out of my mouth, Harry and especially in the world of social media, people can be happily sitting at work, maybe very proud of what they're doing for a living, take a snapshot, something very sensitive in the background and all of a sudden that is out there in the ether for all and sundry to see. So yeah, how do you understand that and how to get ahead of that? It's yeah, that's really what we're trying to solve for people.

Harry Kemsley: Yeah. So let's just step into the social media, we've mentioned it several times in this conversation already. Social media often confused to mean open source information or intelligence. No, we mean that as a part of the bigger picture. What are the big, new changes, the new platforms that have happened in this space, or indeed the alternate platforms that perhaps we haven't heard about very much? What's really starting to impact the social media intelligence environment that might well become opportunities or threats for an open source intelligence analyst?

Neil Spencer: Yeah, absolutely. I think sort of what we'll drill down into a couple of them as part of this discussion, but I think to echo our discussions earlier, if we go back to especially sort of the 2019 presidential election in the US. I think that was a clear tipping point for the resurgence of some of these alternate and emerging social platforms. People were getting de- platformed, groups were getting de- platformed by some of the major social media providers out there and that's realistically because they started to enforce policies that have been in place for a long time and all of a sudden you started to have, actually, in many instances, some of these platforms have been around for a while, so the likes of Gab had been around for years, but, it suddenly came to prominence again because people not abiding by the terms of service that are laid out by some of those mainstream social media providers were being de- platformed and therefore they needed somewhere, those groups, those individuals needed somewhere to share their thoughts and have conversations, again, with like minded individuals so all of sudden, these safe spaces were created. Gab, if we touch on that one, seems to have been the largest winners over the past two years of the alternate social media space so we did a lot of research a few months ago, so to look into this, we're actually asking ourselves the question because we assumed that if you look at trends coming up over the past two years, you would see some of these have, some of these emerging channels, emerging platforms as having a massive trajectory'cause if you go back to again, the 2019 sort of timeframe, things like Parler, that was the number one downloaded app on the Google and Apple store and I'll touch on that in a moment. But if we circle back into Gab, so over the past two years, so they have had a 305% increase on monthly visits so realistically that is a shift away from those mainstream platforms into some of those alternative media platforms and that's in that two year period and I can see that starting to, or that trend, continuing onwards and I think they have probably been the largest, let's say winner out of this alternative media emergence, but let's remind ourselves about Gab. So Gab is where the Pittsburgh synagogue shooter posted his manifesto before undertaking that particular attack so it is a place that has a history of being associated with violence and certainly attracts some leaning of full process within that group. And I think that comes back to our earlier discussion about having a safe space that people can discuss and share those feelings with essentially like- minded individuals.

Harry Kemsley: So are they safe spaces because they're just less governed by the organizations that run them or is there some other aspect that makes them" safe spaces" for the one people?

Neil Spencer: Yeah, fundamentally, especially the likes of Gab and more talk sort of referencing Cham boards. They are, so it's almost quote Gab, they are" democratizing social media" in their words so they are not controlling that space. They are not putting any moderation, self, or otherwise across their platforms as a result of that sort of content or not any strong moderation. So they have a strong freedom of speech mantra which everybody absolutely should be entitled to freedom of speech, but when it transgress into acts of violence and hate speech, that's when there needs to be a line drawn fundamentally. But at the same time, when we look at the risk and opportunities, because it is self moderating, again, that's where some of these conversations are taking place and that's where you can help those early threat indicators of inaudible.

Harry Kemsley: Yeah, the indicators and warnings piece again. Sean, it also occurred to me that sounds a little bit like the ungoverned spaces, the physical ungoverned spaces of the world that we see national threats coming from, traditional and some non- traditional threats as well. Sounds very similar, doesn't it?

Sean Corbett: Yeah, it absolutely does. Yeah, actually, I mean, what what's fascinating about the social media space is the speed with which things develop. I mean, you just need to have kids to know that one week you are just sort of downloading the app that they've told you about and they're onto the next thing. Now I would imagine that that, well, I know that it provides both opportunities and threats because the less regulation there is, the more you've got a chance to interrogate if you like, and get into some of the metrics. The chance becomes then how much, how you have to adapt and how quickly to the tools and methods that are used but of course, even the sort of big ones, like the Facebooks of this world or the rest of it, you can tell I'm old, you know, they change their privacy details and they change their accessibility details and all sorts so when you could start to look at the data in there, sometimes it will disappear or you have to look it in a different way so I imagine this is really is a, to use the defense pile, this sort of act react into getting inside the noodle loop.

Harry Kemsley: Mm, yeah, that would be fascinating to try and get inside a noodle loop that's moving at light speed with 305% growth of population. That would be an interesting one to try and get inside the loop of that. Neil let's move on, because I want to get to a point where, by the end of this, we've got some tangible takeaways for listener who perhaps works in a commercial environment and maybe hasn't considered the open source environment. Maybe hasn't really considered the power of the social media environment as a source of guidance or threats and warnings, which I think we are talking about here, they could be doing. So, what are the sort of methods and tools that are becoming available or that are available that would help a business, a commercial organization optimize its use of social media, for example, or indeed wider open source information?

Neil Spencer: Yeah, absolutely. I mean, there are commercial providers out there. We are one of a few, let's be honest that are tasked with realistically making this process a lot more efficient. So us and other people in the space, we are ensuring that the laborious process of going to each and every individual site, you know, manually can be automated in some way, shape or form. It's never quite a silver bullet and I think that's to be noted and any sort of commercial provider that's not acknowledging that is arguably not being honest with themselves, but it's a good way of understanding as best you can what is out there and providing potential leaping off points to go and investigate further, potentially in platform if they need to. If you take a step back from sort of commercial, then every good OSINT in analyst has a list of Google dorks in their back pocket so, OSINT 101, break out Google and see what's indexed there and Google is a multi billion dollar corporation for a reason. They are very, very good at it. But fundamentally at some point, their coverage will stop at some point so when you move from online surface web content which a lot of the social media, so the house obviously falls into, but then move into the deep web so those areas of the internet that are unindexed by the likes of Google or other commercial search engines, then how do you access some that content? And there's fundamentally it comes to, in some instances, go into the native platforms, cannot using civil automation services. A lot of people in there, OSINT library these days, a lot of OSINT practitioners are flexing their Python skills to go and understand, places like Telegram for example. I know sort of the folks at Janes have had tremendous success using Telegram, as have many people security companies or corporate security teams utilizing Telegram, especially for Ukraine, Russia, conflict, some of the-

Harry Kemsley: Sure.

Neil Spencer: ...emerging content coming out there so how do you understand what's going on in places like Telegram? How do you potentially automate some of that process and how do you take insights away from that? And again, if you're not utilizing a commercial application, and if you have the wherewithal to go and do it, things like Python, and there's a number of online sources, Python Libraries, et cetera, essentially go and apply some of those techniques to those sources and/ or indeed to just surface up some of those areas, especially in Telegram, there's a good number of Telegram search engines out there that are freely available. So I think that there's a full spectrum of tools and they range from the commercially available through to the likes of Google, which depending on how much time and effort you want to put into it, and what level of coverage you want to achieve from it, realistically, the world is your oyster. You need to point your collection tools in the right locations.

Harry Kemsley: Yeah. And I'm just curious, how many, what percentage of commercial organizations actually have an open source information specialist within their ranks? Is this something that's a growing trend within commercial environments, or is it really still a very much a nascent stage of development for commercial organizations?

Neil Spencer: This is a great question, Harry, so I, and I wouldn't want to put a percentage on it, but I think anecdotally, if we go back to, if we take that sort of same two year time timeframe-

Harry Kemsley: Yeah.

Neil Spencer: ...if it goes back two years, I would say that especially in the sort of physical security space, the OSINT specialists, I would say is definitely an emerging emerging trade craft within a corporate security-

Harry Kemsley: Right.

Neil Spencer: ...physical security team. Fast forward two years, I would say there aren't many physical security teams that don't have a OSINT capability in house, especially when you look at things like enterprise and global footprint customers.

Harry Kemsley: Right.

Neil Spencer: Once you start to come down from there, then it depends whether or not they have that skill set in house. Something that is interesting, and especially we've seen this in places like the financial institutions when they are hiring OSINT analysts, things like Python skills or SQL knowledge and skills start to come as part of that job description so I think where we are seeing OSINT being operationalized that's realistically where those skill sets are being, the demand of skill sets, the quality of skill sets is being increased across the board.

Harry Kemsley: Sean?

Sean Corbett: Yeah, I was just going to say that's very much parallels what we're seeing in the government space as well.

Harry Kemsley: Yes.

Sean Corbett: That, you know, we're looking now as a specialist who understands both analysis and analytics as well and the two are very different of course, but I think the other thing is worth iterating as well is that, it's no longer good enough to say this is your, what I would term as the secondary duty, right? You do this as... You are now an open source information or open source intelligence analyst because it is a specialist thing to do. I mean, you talked about, initially about the echo chamber and disinformation misinformation. There is specific trade craft that is still being developed and worked on that you got to be a pretty good about this to get the open source intelligence right and that includes both for the commercial sector and of course government.

Harry Kemsley: Yeah. Let me come to the dis and misinformation in just a second here. I'm going to ask you to talk about that in just a second. Before I do, though, another thing that we've seen in this public space is the variable acceptance of insights from open source information at the higher levels and I'm not going to be ageist about it because I'm of a certain age, but I would say that those of us that didn't grow up with the data under our fingernails and under our thumbprint, as we were tapping away on our telephones, might find it more difficult to believe that the validity of the open source environment. Do you find the same in the commercial environment that the more senior, the less likely they're going to accept it, or is that an unfair statement?

Neil Spencer: I would actually say no and there's a reason for that. I think, in the public sector, I think, having listened to your podcast over the months and years, people have spoken to this a lot. There is a mistrust, I suppose, in many instances of social media intelligence and open source intelligence, because there are so many other sources closed sources to draw from and therefore the open source world and the social media world is sort of the ugly stepchild of the intelligence of the inaudible. I think in the commercial sector, whilst it is quite often the case, it is not always the case that somebody that heads up a physical security group for example, comes from a government background and therefore they often come into it from a potentially different lens and I think that would be true top to bottom of that organization while you do have some former government employees making or building out that security team, that security infrastructure, there is a mix of people who may have geopolitical science backgrounds or the degrees, and have come into the security team from slightly different backgrounds so it just opens up and sort of breaks down, I think, some of those prior conceptions about what open source media might be able to deliver to you.

Harry Kemsley: Yeah, I think you're probably right. I think the exposure, maybe indoctrination of the power of closed sources that exquisite capabilities the governments have may have persuaded them they don't need open source for such a long time that actually now it's more difficult for them to overcome that cultural position and Sean, you and I have certainly spoken a great deal about that. Conscious of time, I want to move on to the last couple of things and Sean, I'll come to you just a second about to what stage the human in the loop still remains a relevant part of it'cause I know it's a topic you and I have spoken on many times, but to get to that, what I'd like to discuss then is this disinformation misinformation. The big problem with the open source public available information environment is how much gets poured in there for deliberate deception or just accidental deception. So how do we guard against that in your commercial environment, Neil?

Neil Spencer: Yeah, absolutely. And I think if we're going to, if we ever come back to brass tacks, realistically comes back to sort of analyst 101, good analyst acumen. So if you see something that is from a single source, how do you triangulate that particular new intelligence you might be guessing? How can you reference that back to a known source? How can you potentially find two other sources that corroborate that information? So if that's sort of from the human analyst side, they had to just say sort of a good analyst acumen. I think from the commercial sector as technology providers, we can reference potential content against known disinformation and misinformation campaigns, but fundamentally that comes back to having a known source of truth so it's about source integrity and making sure that the sources are constantly being updated and checked and validated as we move forward.

Harry Kemsley: Yeah. And Sean, our favorite, given of men of certain age, we always believe that the human has to be involved in the loop, but actually I genuinely believe that's still true and I don't think machines have got to the stage yet where they do things that humans are uniquely capable of doing anywhere near as well as humans do but your view of the human in the loop debate?

Sean Corbett: I think as soon as you get to anything where you have to make decisions, it has to be human, particularly in the commercial well, in all sectors but when it will matter about which direction you take or what risk to take, you've got to have the human in the loop, but I'll go back to what Neil's just said actually. A lot of it, when you put the human in the loop will depend on the efficacy, trust and quality of the information that you've got so if you've got machine learning or artificial intelligence algorithms that stands the test over time, then you can rely on them more and include the human loop at a later stage of the process. But that requires a lot of trust so it really is a learned by doing and because I don't think we're as sophisticated yet with AI as we think we are. You rely on that at your peril to say, yeah, no, the computer says this, therefore that's what we're going to do so you're going to have to QC it at the very least but there is still a lot that the human brain can do by joining dots together that I still don't think that algorithms can do so of course it's important to still have the human loop. The art is when that happens.

Harry Kemsley: Yeah. Neil, any comeback on that?

Neil Spencer: Yeah, absolutely. No, I think I echo Sean's sentiment. I think AI today and sort of subsets of that machine learning etcetera are an important piece of the puzzle because it reduces the decision making time for the analyst, but fundamentally a machine doesn't know your business like an analyst does. If you want context around how does it impact your operation specifically? And I think to Sean's point to quality control that, fundamentally it needs a human eye over it.

Harry Kemsley: Yeah.

Neil Spencer: AI just isn't there yet. Whether it will be in 10, 20 years will be interesting to see, but it's not there today.

Harry Kemsley: Not yet. All right because time's going to now evaporate on us. I'm going to ask you both in a second to give me your one big takeaway for the audience. I'm going to offer you mine up front, which often therefore means Sean, I've stolen the one you were going to give, so apologies for that in advance if that happens. I think what I've taken from this conversation, Neil, and thank you very much again for helping us look into the commercial perspectives of things that we haven't looked at enough in the time that we're doing this podcast, the one I take away is the similarity of what you've described to what we've been discussing in the public domain, public sector domain, I mean, the number of times you said things that sounded almost exactly the same about how we've come to understand the power of open source information and the intelligence we can derive from it. The tools that have emerged that allow us to do that. The ability to understand now traditional and nontraditional threats as well as deal with disinformation and misinformation, for example, with good old fashioned trade craft, as you described it, but equally automating certain parts of the process by machinery that allows the analyst to spend more time doing the value added things the human can do better than the machine still. That all sounds very familiar. The one thing that didn't sound quite so familiar though, which is why I want to underline it, you said that the senior elements of commercial world were more ready to accept and I think there is a very interesting point to be made in there about the fact that it might be because of the way they've been raised as it were, in the commercial world, where the only available source was predominantly from open sources. I remember, Sean, for example, we spoke with the ambassador from the foreign office, the diplomatic world, and he said," It's funny you should talk about open sources as though it's something special. That's all we have in the inaudible world is the open source environment." So it is interesting. I think that exposure over a period of time has changed people's perspectives. The culture has been different, whereas in the military, government environment perhaps because you've got the exquisite, the closed sources you have perhaps been indoctrinated to believe that's the only source worth remembering, worth using. So my takeaway is the similarity, except in that one point there about perhaps the culture and the approach to open source. So Neil, your one takeaway for the audience?

Neil Spencer: Yeah, I think for the audience, realistically it's don't discount sources. People see, especially some of the mainstream, the newer mainstream sources as being full of things like dancing videos, et cetera, or if we come back to Telegram the purview of terrorists. There is such a wealth of information to be deemed from some of the harder to reach sources and some of the more easily available sources and realistically it's being aware and arming yourself with the ability to find those nuggets of information from those particular sources and then use them to the best of your ability. So they're there as an opportunity to detect those threats, to understand those risks, but you've got to get them first and you've got to get them efficiently and you got to get them effectively and realistically that's the key of it. Don't discount sources, they're there to be used, they're there to be harnessed. You just got to use it well.

Harry Kemsley: I'm going to post the bookmark for you and I, again, Sean, for the future, we talked about it twice before, Neil just reminded me again, the ethics of using these platforms and how we actually then derive intelligence is one of those things that we really must tackle one of these days on one of these podcasts. Now, thank you for that. Sean, you got the final vote this time.

Sean Corbett: Yeah, and I would sort of nuance something's been said already, maybe a little bit contradictory. I think we've a long way to go yet before the commercial sector really understands the power and the value of open source intelligence. You know, I talk to senior people and some of them still see it as an overhead" Oh yeah, it's nice to do but how much to set up the processes to actually get people in to do it, to professionalize it?" I think it's becoming not just a nice to do, it's becoming essential to do, you know, there's so much information available out there that can help companies make sensible decisions that will add to their bottom line, conversely, stop them going out of existence and I think there still are some way to go before some companies, at least, many companies go, where's my open source intelligence? Where's my risk matrix? Where's my threats coming from? So there's a bit to work on there I think.

Harry Kemsley: Yeah. I agree. I think actually the amount of power available to us for exploitation for the open source publicly available and commercially available environment, it would almost be, I think it could justifiably be described as negligent to not engage with it and to really extract the value that it's offering. So Neil, I'm going to finish the conversation here. There are about 54 topics probably, I could have dug into a great deal more, but I haven't got time for that but let me say, thank you again for joining us on this conversation. It has been-

Neil Spencer: Pleasure.

Harry Kemsley: ...really, really good to dive into the commercial world, we'll do it again so anything I threaten you with is we may want to revisit some of those topics and if you are willing, we'd like to have you back and talk again about some of these things, perhaps a bit more in depth. Thank you again, Neil.

Neil Spencer: Yeah, absolute pleasure and anytime it's been a thoroughly enjoyable conversation, so thank you gentlemen.

Harry Kemsley: Good. Thanks Neil. And Sean, as ever, my co- conspirator. Thanks for your time.

Sean Corbett: Welcome.

Audio: Thanks for joining us this week on the World of Intelligence. Make sure to visit our website, janes. com/ podcast, where you can subscribe to the show on Apple podcasts, Spotify, or Google podcasts so you'll never miss an episode.