When companies hunt threats on the Internet, they typically look at what threat actors are saying online. But what about the content they’re looking at? Dragonfly’s sister company, Predata, analyses this “silent” activity to provide early warning of emerging threats. Josh Haecker, their CEO, explains how it works.
Before a significant Russian missile attack on Ukraine, there is often a recurring pattern.
Russian-language internet research on the intended target – say a power plant or bridge – spikes during Moscow working hours. There is no equivalent spike in English or Ukrainian research.
“Again and again, we’ve seen the object of research hit by missiles shortly afterwards,” says Josh Haecker, CEO of Predata, an AI-driven platform that tracks the research people conduct online. “But because we have learned to recognise this trend, we can give our clients early warning, so they can protect their people and their assets.”
For Josh, understanding what people research and consume online – as opposed to what they say – is “the missing part from most intelligence stacks.”
Predata, which like Dragonfly is part of the FiscalNote group of companies, scans highly trafficked sites on the Internet on an hourly basis, with a particular focus on sites like Wikipedia and YouTube where research is conducted. It uses changes in research patterns to analyse the correlation between events and predict intention.
The 90-9-1 Rule
Josh founded Predata after a 12-year career in the American national security community when he read a now-famous 2006 survey by the Nielsen Norman Group on the way people navigate the Internet. In most online communities, Nielsen concluded, 90% of users are lurkers who never contribute, 9% of users contribute a little, and 1% of users account for almost all comments and contributions.
“So if you’re looking at what people are posting online, you’re only looking at a tiny slice of how the general population is behaving online and focusing on the most vocal ones,” says Josh. “When [government or hostile actors] are making plans for the future, they may not be posting about it online, but they’re probably researching it. This is the other side of the Internet – the side that’s not immediately visible.”
Predata categorises online behaviour into proactive and reactive patterns: Proactive attention often indicates advanced knowledge from small groups of impending events, whereas reactive attention best captures how both online and offline events are being received by target audiences. Subscribers can create their own dashboards, allowing them to monitor research around locations, keywords and pages that are particularly relevant to them.
This is of particular interest to government agencies, who have used it, for example, to predict coups – you can access a Predata article here on Predata detected elevated online attention to coup indicators prior to recent coups in Sudan and Venezuela – and get other forward-looking insights on geopolitical matters.
“We’ve seen Chinese research into particular African villages go up before investment in the area. This has a serious effect on the security posture of a country.”
Get early warning of anomalous patterns
Another set of users are global companies and security teams, who can use it in an early stage of their intelligence cycle, to get early warning of anomalous patterns and get a more complete picture of the geopolitical landscape.
Companies also use Predata’s capabilities to get proactive intelligence relating to reputational risk.
“If, for example, there is misinformation being spread about your company online, we can see whether anyone’s reading and responding to it, so you can decide on the appropriate level of response,” says Josh. “In an era of rising disinformation, it’s not enough to know a lie is spreading; you need to know how it’s being read and whether it’s impactful.”
Looking to the future, Josh’s team is now working on leveraging advanced machine learning in order to auto-identify threats.
“At the moment, if a number of indicators that might show a coup is in the planning stages – for example – occur together, we still have to connect the dots manually. Our aim is for the technology to identify these patterns automatically.”
Ultimately, the increasing incidence of disinformation, as well as the growing prominence of content being created by bots and AI, will make Predata’s service even more essential, says Josh.
“The amount of content now being created online is endless, and we can’t read everything,” he says. “As the environment becomes more complex, Predata’s ability to identify the content that actually matters will become even more critical.”
We’re delighted to share with you a Predata article showing how the platform detected elevated online attention to coup indicators prior to recent coups in Sudan and Venezuela. Access it here.
To find out more about Predata, please get in touch with Predata’s experts today.
