dittguy

src/posts/adrian-dittmann.md

@@ -0,0 +1,91 @@
+---
+title: The Adrian Dittmann Story
+description: the evidence, from A to Z, and righting the wrongs
+date: 2025-01-05
+feature_image: /img/posts/adrian-dittmann/cover.jpg
+coauthor:
+  name: ryan fae
+  link: https://bsky.app/profile/ryan.staticnoi.se
+tags:
+  - analysis
+  - politics
+---
+Here's the deal: Adrian Dittmann is not Elon Musk, and we have concrete evidence.
+
+This began as a story with Jackie Sweet, a freelance journalist with history writing for *The Intercept*, *Mother Jones*, and so on. We found the initial lead and presented it to Jackie, but she was ultimately agreed to be our byliner — the actual writer for the story, the sole contributor being credited in the space under the title, and the one being paid for the piece. As such, Jackie got to choose the outlet we pitched to, and we ended up with an article in the US edition of the right-wing *Spectator* that was arguably poorly presented, cut out graphics and information crucial to the investigation, and crucially did not give credit to us.
+
+Here's the evidence in full, including a significant amount that the *Spectator* article missed, and how things fell apart from our point of view.
+## The lead
+It starts on December 29, when Adrian Dittmann was making a resurgence on X (formerly Twitter) after joining a Space sounding like Elon Musk. He had long been accused of being a Musk alt by folks on all sides of the political spectrum, including by the 'journalists' at InfoWars (who called him "NOT Elon Musk" in headlines and interviewed him multiple times).
+
+On the 29th, maia searched his name in a tool that scans through public data breaches — mass releases of hacked information often including emails, phone numbers, and names — and discovered an "Adrian Dittmann" in a breach for AI photo editing platform *Cutout.Pro* connecting to an email and IP address.
+
+![A screenshot of a search ui, the search is filtered to "name" with the search term being "Adrian Dittmann" there is one result in the cutout.pro dataleak showing an email that starts in adrian.dittmann and ends in @gmail.com, the IP location is fiji](/img/posts/adrian-dittmann/snusbase.png)
+
+The IP address was roughly geolocated to Fiji, and the email gave us more to work with. Its Google profile picture appears to show the account's owner, who appears young, and his partner; on Google Maps, he had once reviewed a restaurant on Denarau Island, western Fiji.
+
+![A screenshot of a Google Maps profile with a single five star review of the port denarau marina on denarau island, fiji, it reads: nice restaurant the steak was good as usual. the profile photo of the account shows a young white man next to a southeast asian woman who is hugging him. her eyes are covered by a white bar](/img/posts/adrian-dittmann/google.png)
+
+Of course, at this point, we didn't know if this was the same Adrian Dittmann as the one on X. We kept in mind his face, location, and a few extra clues dug up using the tool *osint.industries*, including two phone number hints in Fiji (+679) and Germany (+49) connected to the aforefound email address.
+
+![A screenshot of a UI showing two heavily redacted online accounts, one for paypal and one for samsung, both of them have a linked phone number, one of which starts with +49 (germany) and the other of which starts with +679 (fiji)](/img/posts/adrian-dittmann/osintindustries.png])
+
+A search of the @AdrianDittmann X account shows correlative evidence: the account operator claimed in June 2023 to be German ([link](https://archive.is/piY5B), left in below video), and he claimed in July 2023 to have grown up in Gibraltar and to have lived in Morocco but to currently reside in Oceania ([link](https://x.com/TO/status/1685141865274757120) via Trevor Owens, right in below video).
+
+<video controls src="/img/posts/adrian-dittmann/ethnicity.mp4"></video>
+
+Multiple screenshots showing the X account's time zone information align with the Oceania statement and the prior Fiji identification — one shows a *Business Insider* dateline with the timezone "GMT+12" ([link](https://archive.is/jWu8N), left), and another shows an X post made at 22:43 UTC with a Dittmann time stamp of "10:43 am" ([link 1](https://archive.is/NKtAV), [link 2](https://archive.is/pihZT), right). These align with UTC+12, a time zone consisting of far eastern Russia, New Zealand, and some countries in Oceania including Fiji.
+
+![Two tweet screenshots side by side, both of them are posted by adrian dittmann. The post on the left includes a screenshot of a business insider article with the post time localized to GMT+12. the Post on the right shows a screenshot of a tweet with a timestamp showing it was posted at 10:43 on june 4 2023, which matches what the tweet would look like in the fiji timezone.](/img/posts/adrian-dittmann/timezone.png)
+
+A scan of commercial "people-search" websites only showed one Dittmann family living in the entirety of the time zone, which gave us a tentative conclusion: the email and X belonged to the same Adrian Dittmann. But such websites rely on incomplete databases scraped mostly from digital activity, and it's very common to miss people; we instead searched for a concrete link.
+
+## Scouring social media
+A common strategy in investigative journalism is to run with all tentative links until you can't anymore, either by not finding any data at all (rendering the investigation inconclusive) or finding data that conclusively proves or disproves the link. It's a method that isn't foolproof to mental cherry-picking or similar fallacies, but it would do here.
+
+We decided to follow the social media trail from here: maia had found that a Google keyword search for Dittmann's name and supposed country, Fiji, brought up a private Instagram account under his name. When considering how to continue the investigation, maia decided to talk to the aforementioned Jackie Sweet, who is notable for her work in social media investigation; Jackie quickly found a *public* Facebook account with the same name and an edited and zoomed-in version of the profile picture.
+
+![A side by side of a screenshot of a private instagram account with the username adrian.dittmann and a facebook for an Adrian Dittmann, they both feature a near identical profile picture.](/img/posts/adrian-dittmann/accounts.png)
+
+After a later request for comment, the Facebook account was wiped and its profile picture was reuploaded to make it appear new. Prior to deletion, however, it had one photo of Dittmann and his partner facing one another on a trip to the Philippines, where his partner appears to be from. It isn't clear if they're the same people from the Google profile picture.
+
+![A photo of a younger adrian dittmann wearing a mask standing next to a south east asian woman, in the bottom right corner is his google maps profile picture again, showing a white guy next to a south east asian woman](/img/posts/adrian-dittmann/gfpic.png)
+
+Jackie found that the Dittmann X account had indeed referred to his "significant other" before and even made multiple AI-generated images resembling her, describing her in comments as "[F]ilipino, just more from the Spanish side" ([link 1](https://archive.is/Wg5kA), [link 2](https://archive.is/k3A18)).
+
+![A tweet from adrian dittmann saying: your imagination is only as precise as your perception. take the perceived and describe it, take somethign as captivating as your significant other, and form the curves and details of that person into poetry. abstraction is powerful, love is everything. attached is an ai generated image of a south east asian woman with similar features to his girlfriend wearing a black dress in a reply to a suspended account dittman says of the image "nope, that's a filipino, just more from the spanish side"](/img/posts/adrian-dittmann/aigen.png)
+
+That's nothing conclusive, but it doesn't disprove anything either. Tracing back a bit, however, the Instagram profile had another clue: the account repeatedly collaborative-posted with a number of accounts, including one appearing to belong to his partner, another appearing to belong to his brother (both with the Dittmann surname), and a couple belonging to the Fijian water company Aquam Insula.
+
+![screenshot of the instagram post collaborators ui showing 5 accounts: one with the last name dittmann, aquam_insula_au, another one with the last name dittmann, adrian.dittmann, aquam.insula.maritime](/img/posts/adrian-dittmann/collaborators.png)
+
+## The corporate ladder
+Lo and behold, Jackie found that at the opening of Aquam Insula's "Maritime Lifestyle Warehouse" on Denarau Island, B-roll footage from a recorded speech by the President of Fiji shows Adrian Dittmann and his partner in the foreground ([link](https://www.youtube.com/watch?v=WfdQrk84RE0), 3:05).
+
+![a photo of a white man with a beard and glasses (adrian dittmann) standing in a warehouse next to a southeast asian woman](/img/posts/adrian-dittmann/bored.png)
+
+It is in this recording that we find the first conclusive link: Adrian has a ring on his left ring finger (above link, 0:40, left), matching the same left-ring-finger ring that appears in multiple cooking videos and streams that he's posted on X ([link](https://archive.is/JUFDs), [video](/img/posts/adrian-dittmann/proof-of-medium-rare.mp4), right).
+
+![a photo of adrian dittman sitting at a table, through a glass on the table a ring is visible on his left hand ring finger, to the right is a screenshot from a cooking video posted to the adrian dittmann twitter account showing a similar looking left hand with a similar looking ring on the ring finger](/img/posts/adrian-dittmann/ring.png)
+
+And another conclusive link: within an hour following an email sent by Jackie on January 1 to the original email address discovered in the *Cutout.Pro* breach that mentioned the cooking videos, a significant amount of these cooking videos and streams were deleted from the Dittmann X account. The analytics platform SocialBlade documents that his total post count decreased by 38 that day ([link](https://archive.ph/YGcNI)), a stark outlier compared to the usual increase.
+
+![a screenshot of the socialblade statistics table over the last three weeks, it shows an increase of between three to 65 posts per day, except on the first of january where his total posts decreased by 38](/img/posts/adrian-dittmann/stats.png)
+
+At this point in the investigation, all links we'd found had been a match. But there was one end still missing: is there any indication this Fijian could be from Gibraltar?
+
+And yes, tracing back up the corporate ladder, there is: Aquam Insula, the aforementioned water company Dittmann is associated with, is a subsidiary of *Totoka Islands* ([link](https://archive.is/KoJ5K)), whose "sister company" *Framesoft* (with its primary registration being in Fiji) has a UK branch registered to a condominium in Gibraltar ([link 1](https://archive.is/QzpKC), [link 2](https://archive.is/hQRjn)). Its CEO is of German nationality, as Dittmann has been shown to be, and he shares the Dittmann surname.
+
+![a collection of three screenshots with arrows connecting them. the first one is from the aquam insula and shows a single sentence "aquam insula pte ltd, a proud subsidiary of totoka islands ltd" the next screenshot shows the totoka islands website with a single sentence "totoka island's sister company FRAMESOFT (FIJI) LTD" on the right is an excerpt of one of the framesoft company registrations showing the correspondence address for its director at a location in gibraltar](/img/posts/adrian-dittmann/gibraltar.png)
+
+Per the above, we're certain that Adrian Dittmann is from Fiji is not Elon Musk. Multiple subjects mentioned in this piece were contacted for comment by both us and Jackie, but all either refused to speak on the record and ignored us entirely.
+## How publication went down
+With Jackie responsible for writing and pitching, she decided to go with *The Spectator*'s US branch as her publication of choice, and we naively went along with it. A part of the conditions from the start was that we would get "appropriate credit" for our work on this piece, even outside of the byline.
+
+But that didn't happen. Jackie asked us how we wanted to be credited a few hours before the piece went live, and she told us that she had an italicized statement below the article body describing that we contributed to research — we were fine with that. Yet when the article went live, and as we (once again naively) shared it around on social media before having read it, we came to realize that we were neither credited in the piece nor in her social media posts.
+
+According to Jackie, *The Spectator* decided to remove the line describing our contributions without informing her, citing maia's "[notoriety](https://thespectator.com/topic/house-republicans-answers-tsa-no-fly-list/)" at the publication for the removal of its name and giving no reason for the removal of ryan's. But they still published most of the rest of the article as-is, minus at least one image that would have served as visual evidence, apparently blindly trusting the research of those names they couldn't bear to keep in the final article. Some of the blame may also lie with Jackie; the article rather poorly presents the research above, leaving out critical evidence (including many in visual form) and making it difficult to follow our reasoning.
+
+In short, we don't think the article is very good, and we're unhappy with how our work was used without credit. But despite not being proud of the piece, maia's posts remain up (as does ryan's [statement](https://bsky.app/profile/did:plc:lb5rzms2ky5fmp6clthjwuvx/post/3lewpsney6s2n)): we believe that credit is a crucial part of journalism and research as a whole, and if by leveraging popularity around the article's release is the only way to bring attention to that, so be it.
+
+*If you have any additions to this story, please text ryan on Signal at `rhinozz.1337`.*