BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.troopers.de//tr26-cfp//speaker//CQLW9D
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-tr26-cfp-STKZXP@cfp.troopers.de
DTSTART;TZID=CET:20260624T174500
DTEND;TZID=CET:20260624T181500
DESCRIPTION:# Whodunit\n\nAs a reporter\, it is one of the main parts of my
  job to find out who is behind criminal enterprises such as ransomware gro
 ups. And while attribution might be hard\, in some cases it is doable. By 
 pivoting\, using leaks and correlating it with other publicly available in
 formation. I'll show many examples that will help the audience better unde
 rstand how reporters use techniques familiar within the threat intelligenc
 e landscape. During the last couple of years I was part of four investigat
 ions that ended up identifying people for the first time publicly.\n\nBut 
 the main part of the talk will deal with one question: Under what circumst
 ances does it make sense to publish? Because the decision to put out the s
 tory has immediate consequences. One of them being that law enforcement ag
 encies\, who might have been trying to catch the very same actors\, will l
 ikely no longer be able do to that. Since the actors also read our reporti
 ng stories and take precautions. For one\, they stop traveling to countrie
 s where they run the risk of being arrested and then extradited. Knowing t
 his\, I'm going to make the case that it is important and in the public's 
 interest to publish such investigations.
DTSTAMP:20260510T025717Z
LOCATION:Track 1
SUMMARY:ETA when? Reporting on cybercrime - Hakan
URL:https://cfp.troopers.de/tr26-cfp/talk/STKZXP/
END:VEVENT
END:VCALENDAR