Tracing Disinformation With Custom Tools, Burner Phones and Encrypted Apps

How do New York Times journalists use technology in their jobs and in their personal lives? Matthew Rosenberg, who covers political disinformation and is based in Washington, discussed the tech he’s using.

You’re covering disinformation in politics ahead of the 2020 election. That’s a busy beat, aided by the prevalence of social media.

Where to begin? That we live in a world that seems to be awash in disinformation? That no one seems to have a good answer for countering it? That Americans are being bombarded with warnings that foreigners — the Russians! the Chinese! the Iranians! — are coming to confuse us with all sorts of misleading nonsense?

On top of disinformation, the beat includes hacking and election security and political digital malfeasance in general — yes, campaigns know a lot more about you than you think.

It’s enough to make anyone feel paranoid. So I find it’s helpful to take a deep breath and break it down.

Let’s start with disinformation, which implies intent: Someone is trying to mislead when spreading it. Misinformation is simply information that’s wrong, though the person spreading it may not realize that.

Neither is a new phenomenon. For as long as humans have been, well, human, we’ve been misleading one another, and politicians have typically been among the worst offenders. But now, of course, falsehoods spread at the speed of social media, and the internet makes it easy to take deception to the next level.

Russian trolls can pose as Black Lives Matter activists. Democrats can help elect one of their own by pretending to be conservatives. A Republican political operative can anonymously troll Democrats with fake campaign websites that seek to pit liberals against one another. And any event, no matter how small or insignificant, seems liable to produce its own community of truthers.

Covering it all is tricky. Writing about every little conspiracy theory and fake news story circulating in the dark corners of the web risks amplifying the nonsense. Better to focus on the people behind the disinformation. Technology can help find them. But once you know who they are, it is about old-fashioned reporting — drawing them out and getting them to explain why they are in the disinformation game, their motivation, whom they are working with and who is paying the bills.

What tech tools do you use to discern or trace disinformation?

In all honesty, I rely on the expertise of others. There’s a big community of researchers who have serious engineering chops and are building all kinds of helpful tools. They’re finding bot networks, tracking online political advertising and flagging nearly identical social media posts by people who seem to have no apparent connection to one another.

Me? I once learned enough code to try building a Twitter bot. It didn’t work.

Even the best, custom-built tools can get you only so far. The technology can help spot a particularly nasty conspiracy theory that is making its way from 4chan to Twitter, or uncover how the Trump campaign has posted more than 2,000 ads on Facebook about immigration that include the word “invasion.” But once you find the disinformation, you need to dig into it.

The tools for that work are simple: You need a phone, and you need something to write with.

How do you protect the confidentiality of your sources and the security of your communications with them?

Before I got into the disinformation game, I covered national security in Washington and spent 15 years as a foreign correspondent in places where the government is really good at listening to your communications, like Pakistan. On those beats, a lack of security can get a source thrown in prison or killed.

Discretion is crucial. The first rule of source protection is Do Not Talk About Your Sources. It is also the second rule.

Meeting sources in person is always best. But since it is often not feasible, there are tools to mitigate the risks. Apps for encrypted calls and messaging are essential. I rely on Signal, as do most of my sources. For encrypted emails, Protonmail is popular. Strong passwords are a must, too, and I use a password manager to store all those long strings of letters, numbers and symbols. It also helps to turn off location tracking on your phone, and to not use ride-hailing services like Uber when going to meet sources.

Then there are burner phones. They’re useful, and you get to sneak around like a secret agent when you’re buying one. To make sure it cannot be traced, you need to pay in cash, never register it with your own name or real email and never connect it to your home or work Wi-Fi network. I have two at the moment. One is a cheap smartphone, and the other is a flip phone.

What other tech do you find useful for your job?

CrowdTangle is incredibly useful for tracking how information spreads on social media. SimilarWeb is great for web analytics. DomainTools is essential for online forensics. LexisNexis is crucial for finding phone numbers and home addresses.

If I had to pick one account to keep, it would be my professional account on LinkedIn. The network is invaluable when you are looking to track down people inside a specific organization or industry. And it is amazing how people will sometimes use their LinkedIn pages to describe in detail specific projects they worked on, including highly classified government programs. There’s no single better place online to ferret out sources.

You broke the Cambridge Analytica story last year. Have you modified your own social media use since?

I’ve definitely had my paranoid moments. After the Cambridge story broke, when Facebook’s stock price was in free fall, I got to thinking about how Facebook had 11 years’ worth of my private messages, photos and posts. I panicked and started deleting things. It took about an hour for me to chill out and realize that if I wasn’t going to delete my whole profile, a couple of half measures were not going to make a difference.

I’ve since found that keeping the profile was more useful than not. I still have old friends messaging me there, and I need it for reporting. Facebook is simply too good at connecting people. It’s why it makes so much money off our data.

I have cut back on social media, though not because of the Cambridge story or other reporting on big tech companies. Some of my reasons were not particularly unique: I found it less and less satisfying, and I began to worry about the immense amount of time I was wasting. If you think Instagram is a time suck, wait until you’re the oldest person on TikTok.

But the real tipping point was when I found myself having to explain what a conspiracy theory was to my son and daughter after they mentioned something they had heard on YouTube. They were 11 and 8 at the time. At that age, I had no idea what a conspiracy theory was, because I had no reason to know. It was time, I realized, to start setting a better example.

Outside of work, what tech do you love and why?

I just spent an obscene amount of money on Sonos speakers. They were my birthday gift to myself. The app is not great — why, Sonos, cannot I not just play music straight from Spotify or Apple Music? But the speakers sound great. My neighbors may not feel the same way.

I spend a lot of time outdoors, and I love my Leatherman — the needle-nose pliers alone are worth their weight in gold when you need them. I’ve had it for 25 years (gulp), and it has the smooth action of a well-worn tool.

I cook a lot as well, and I own the mother of all rice cookers. It has lots of settings that I never use and tells me what is happening as the rice cooks, in a woman’s voice that speaks Korean.

Mostly, though, I have been trying to pare back my tech use. Cast iron and stainless steel rule in the kitchen, and I write down recipes in an old black-and-white composition book. When I go out, I’ve gone back to my old habit of grabbing a magazine or a book; better to read an interesting story than scroll through mediocre witticisms on Twitter.