Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Turning Leaks Into Leads With OCCRP Aleph

Ezana CemanKlil Eden

OSINTTalks51 minBeginnerOpen on YouTube ↗

Where

Talks
HOPE_16

Duration

51 min

Shows how the OCCRP Aleph investigative data platform ingests leaks and registries and turns them into searchable leads.

Summary

This talk from the Organized Crime and Corruption Reporting Project, given by two members of its product and development teams, introduces Aleph, the investigative data platform the group builds for journalists and researchers. The speakers explain that OCCRP operates as a network that supports more than 75 member media outlets, and that its reporters were repeatedly receiving large leaks, registries and court filings with no practical way to search them. Aleph was designed to collect and organize records in advance so they can be queried when a story needs them.

The technical section covers how data is gathered from scrapers and leaks, mapped onto the open Follow the Money ontology, and indexed for search. Records are linked through statements about entities, and properties marked as identifying let new data update existing records rather than create duplicates. Search indexes are tuned for name variants across languages, and lineage is tracked so journalists can see where data came from. A live demo then traced a company tax ID from a breaking news alert about a 2023 bombing in St. Petersburg to a registry record and the owners of the cafe involved, in about a minute. The presenters also showed investigation workspaces, network diagrams, and cross-referencing of a user's own CSV files against the platform's datasets.

Access is granted through a vetted application, with extended data limited to reviewed users and audited regularly. The presenters said a rewrite called ALF Pro is underway, that it will move to closed source with paid tiers for organizations, and that nonprofit journalism will stay free. The main takeaway for practitioners is the value of modeling and indexing messy records before they are needed, and of keeping lineage and identity resolution in the data pipeline.

Related talks