Thread by @doctorow

The wildest forensic stories are the ones where you pull at a loose thread and discover that you've got hold of a the tip of the tentacle of some kind of cthulhoid monster from the depths of hell. That's the story of #Eliminalia, global fraudsters for hire.

1/

The story starts with Qurium, a secure hosting provider that focuses on at-risk civil society groups, the kinds of people who piss off dictators with their own snatch-squads they can use against their enemies.

2/

Two of Qurium's clients are @makaangola and @theelephantinfo, who had done extensive reporting on corruption in Angola related to Isabel dos Santos ("Africa's richest woman") and Vincent Miclet ("the Gatsby of Africa").

qurium.org/forensics/dark…

3/

These articles attracted a flood of fraudulent copyright notices claiming the articles were infringing, as well as fraudulent GDPR notices claiming they violated EU privacy law. The letters were signed by fake lawyers, with whom Qurium struck up quite a correspondence.

4/

Qirium also engaged in digital forensics. They found that the fraudsters had created lookalike websites that purported to be news sites, had plagiarized the real sites' articles, back-dating them so they looked like the real sites had copied THEM.

5/

This is an exotic, but not unheard-of, tactic for censoring the internet, and it's the kind of thing that generally works well.

6/

"Notice-and-takedown" laws like Section 512 of the US Digital Millennium Copyright Act exempt web-hosts from copyright liability if they "expeditiously remove" content upon notification.

7/

Web-hosts MIGHT do a little sleuthing to make sure the notice passes the giggle-test (checking to see if there's an earlier, identical article, say) but they're unlikely to do any real forensic work before removing content, and if there's any doubt, they'll take it down.

8/

This back-dating scam was augmented by filing false registrations with @SafeCreative, a Spanish copyright registry, to give the fraudulent representations a sturdiness that would survive secondary investigations.

9/

Qurium is exceptional in its censorship-resistance specifically because they host high-risk content for NGOs and civil society groups whom ruthless, powerful people want to censor in order to protect their reputations.

10/

In fact, Qurium is doubly exceptional, because they didn't just ignore the takedown demands - they also dug through the headers of the emails and found themselves tugging at a thread that turned out to be a tentacle of a horrific monster.

11/

Specifically, they found themselves unraveling the "Eliminalia" network, a grid of 300+ fake newspaper sites that exist entirely as part of a commercial reputation-laundering service that purges the web of damning evidence of terrible crimes.

12/

Exploring this collection of fake sites, Qurium was able to group Eliminalia's clients into six thematic areas:

I. People who committed business and financial fraud, including surgeons who maimed their patients and fake universities who suckered would-be students.

13/

II. Finance corruption, including money laundering.

III. Sexual abusers and harassers.

IV. Organized crime figures and groups.

V. Environmental crimes.

VI. Human rights violations.

14/

Naturally, the Eliminalia fraud service also operates a vast botnet of Twitter and other social media accounts that help to suppress certain news stories for their clients.

15/

All this begs the question, who is behind Eliminalia? Its corporate entities are registered in Spain (Eliminalia 2013 SLU), Maidan Holding/Eliminalia USA LLC in Florida and in Ukraine. All of these entities list "Diego (Didac) Sanchez Jimenez/Gimenez" as a director.

16/

A separate entity called "World Intelligence Ltd" - a UK company also registered to Sanchez - runs the 300+ cloned news websites with plagiarized articles sporting doctored timestamps.

…te.company-information.service.gov.uk/company/110952…

17/

The syndicate's fraudulent legal demands are sometimes signed by "Raul Soto" of "Legal Department of the Brussels EU Commission" (the address given is a "virtual office" location near a real EU Commission building).

18/

They send these fraudulent emails using ohv.fr servers, from the "abuse-report.eu" domain.

But that's just for starters. Things really get gnarly in Qurium's followup post:

qurium.org/forensics/dark…

19/

That's where the investigators describe what they found when they plugged all this intel into the @lumendatabase of takedown notices and legal threats. These are pretty hair-raising.

20/

For example, Eliminalia worked to remove articles from a Chilean website that identified doctors who worked in the dictator Augusto Pinochet's torture program.

21/

Advocates for strong copyright and privacy protection have pointed to notice-and-takedown as a workable compromise, an alternative to the lengthy court processes that would be required to get content removed from an offline source, such as a bookstore.

22/

But while notice-and-takedown may work well, it fails very, very badly. Torturers, mafiosi, corrupt officials and scammers can use these same expedited, low-evidence systems to remove material that truthfully describes their crimes.

23/

This was - and is - the utterly foreseeable outcome of a "streamlined" process for censoring content without due process. It's a lucrative business that produces enough surplus capital to support full-time professionals who do nothing but find ways to game the system.

24/

Today, we hear calls for an expansion of notice-and-takedown, often to remove content that I personally want to see obliterated: Holocaust denial, hate speech, etc.

25/

But each one of these exceptions to hard-fought-for due process protections for speech inevitable ends up swallowing the rule. Full-time Nazis have all day to figure out how to use these rules to get evidence of their bad acts removed.

26/

While the survivors of their bad acts struggle to master the arcane process for having their truth restored to the internet.

eof/

ETA - If you'd like an unrolled version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

pluralistic.net/2021/04/23/rep…