Turning Leaks Into Leads With OCCRP Aleph
Where
Talks
HOPE_16
Duration
51 min
Shows how the OCCRP Aleph investigative data platform ingests leaks and registries and turns them into searchable leads.
Summary
This talk from the Organized Crime and Corruption Reporting Project, given by two members of its product and development teams, introduces Aleph, the investigative data platform the group builds for journalists and researchers. The speakers explain that OCCRP operates as a network that supports more than 75 member media outlets, and that its reporters were repeatedly receiving large leaks, registries and court filings with no practical way to search them. Aleph was designed to collect and organize records in advance so they can be queried when a story needs them.
The technical section covers how data is gathered from scrapers and leaks, mapped onto the open Follow the Money ontology, and indexed for search. Records are linked through statements about entities, and properties marked as identifying let new data update existing records rather than create duplicates. Search indexes are tuned for name variants across languages, and lineage is tracked so journalists can see where data came from. A live demo then traced a company tax ID from a breaking news alert about a 2023 bombing in St. Petersburg to a registry record and the owners of the cafe involved, in about a minute. The presenters also showed investigation workspaces, network diagrams, and cross-referencing of a user's own CSV files against the platform's datasets.
Access is granted through a vetted application, with extended data limited to reviewed users and audited regularly. The presenters said a rewrite called ALF Pro is underway, that it will move to closed source with paid tiers for organizations, and that nonprofit journalism will stay free. The main takeaway for practitioners is the value of modeling and indexing messy records before they are needed, and of keeping lineage and identity resolution in the data pipeline.
Related talks
Talks·27 min
Matthew Wollenweber
Shows how to catch lookalike domains from public registry data before attackers start phishing or sending fake invoices.
Talks
Focuses on MISP, the open-source threat intelligence sharing platform, as the subject of this talk.
Talks·44 min
Josh King
Shows how Bitpart runs one-to-many Signal bots for tiplines, help desks, broadcasts, and eSIM and VPN code distribution.


