CSAIS reads news from media and official agencies every day, extracts victims, actors, and attack types, and groups articles that describe the same event. Every article is hashed at collection time so its evidence can be re-checked.
Threat intelligence from open reportingHow Israeli spyware used ‘zero click’ hack on Al Jazeera staff
Attack type, victim, actor, and time are extracted from text; articles about the same event are merged into one incident.
Hashes of article text, original URL, and collection time are batched daily and anchored on-chain.
Source history, recency, independence between articles, conflicting information, and institutional attestations.
At-risk groups are mapped to attack patterns and preventive measures.
Package hash and signature, linked to the evidence batches it was built from.
preview of the next phaseBSSN, OJK, Komdigi, and Polri receive incident queues within their mandate and issue signed attestations: confirmed, refuted, under investigation, or annotated.
Attestation portalWhich groups are being targeted, which tactics are in use, and which preventive steps can be passed on to customers, students, or staff.
View findings