Anomaly detection firm tied to numerous former CIA officials affiliated with Beacon Global accidentally published its confidential data brokerage and persona management agreements
Anomaly detection firm tied to numerous former CIA officials affiliated with Beacon Global accidentally published its confidential data brokerage and persona management agreements
Orbis Operations, which has been chaired by former acting CIA Director Michael Morell, deleted the list of data broker license agreements for its Discovery product after being approached for comment.
2024-01-15, 11:47 p.m. EST: The article was updated to note that former acting CIA director Michael Morell’s “Intelligence Matters” podcast was relaunched under Beacon Global’s umbrella on October 11, with former CIA Chief Operating Officer Andrew Makridis as a co-host.
Founded in 2008 and led by Josh Mayne, a former intelligence advisor for counterinsurgency efforts in Afghanistan, Orbis Operations has pitched the central idea behind its methodology as BAD, “Baseline + Anomaly = Decision”. As argued on the website for Orbis’s Situational Awareness Training: “All individuals and groups give off signals when they are measured against context, relevance, and the local societal baseline. In certain circumstances, these 'signals' can, with the proper training, be read as 'anomalies'.”
U.S. intelligence agencies use anomaly detection techniques to hunt for foreign spies, while major corporations apply similar practices to root out anonymous leakers and whistleblowers under the banner of “insider threat detection”, often with the help of former U.S. intelligence officers. Similarly, U.S. Special Operations Forces test such surveillance capabilities on themselves as part of minimizing their footprint — typically under the banner of “signature reduction” — when covertly operating in areas controlled by sophisticated rivals, such as 5G-connected Chinese ‘Smart Cities’ filled with facial recognition-enabled surveillance cameras.
Thanks to a previously unreported accidental publication of the End User License Agreement for Orbis’s secretive “Discovery” data fusion product, many of the underlying data brokers which have fueled Orbis’s anomaly-detection services, such as the cellphone location-tracking firm Anomaly Six (A6) and the gig-work surveillance company Premise Data, are now known. Orbis’s agreement with A6 fittingly comes first, as the two companies use strikingly similar terminology: “Anomaly Six” can be understood as a riff on the popular military parlance of ‘watching your six’, which translates to ‘watching your back’ due to the location of the six on a clock relative to its center. (The accidentally published agreement between A6 and Orbis claims to have been last updated on December 14, 2021.)
Orbis Operations did not respond to a request for comment and, instead, within 24 hours removed the revealing license agreement from its website. Data brokers included in the license agreement for Orbis Discovery, such as A6, Premise, the Australian social media surveillance firm Fivecast, and the New York-based information warfare firm Blackbird.ai, did not initially respond to requests for comment within 24 hours. After publication, A6 co-founder Brendan Huff stated that his company does not “comment on clients or other relationships” and that “Anomaly Six stands with America and its allies to support National Security interests.” Should others subsequently respond, this article will be updated to include their comments.
Orbis’s agreement with Fivecast is perhaps the most detailed and, beyond asserting itself as confidential, details Fivecast’s provision of “Online Persona Management Services” to Orbis, stating that “The Licensee appoints Fivecast as its agent to create the specified number of personas for each specified social media site.” Critics typically refer to such personas as “sock puppets”, as was the case when U.S. Central Command purchased “managed attribution” software from the Herndon-based firm Ntrepid.
Perhaps the most high-profile endorsements of Orbis have come from Michael J. Morell, a former acting director of the Central Intelligence Agency who hosted the popular CBS News “Intelligence Matters” podcast and has frequently noted his role as chairman of Orbis’s board of directors. Michael G. Vickers, a former Under Secretary of Defense for Intelligence (USDI) and Assistant Secretary of Defense for Special Operations and Low-Intensity Conflict (ASD SO/LIC), has similarly described himself as a member of Orbis’s board.
In addition to their roles at Orbis, Morell and Vickers are respectively listed as Senior Counselor and Senior Advisor to Beacon Global Strategies, a consulting firm which has worked for Israeli spyware company NSO Group and was co-founded by Jeremy Bash, the former Chief of Staff to CIA Director and Secretary of Defense Leon Panetta, who subsequently joined Morell as a Senior Counselor at Beacon. Morell and Bash were previously Director and Advisor, respectively, of the failing national security investment firm Chain Bridge, while Morell and Vickers have been members of the advisory board of the social media monitoring firm Dataminr, which was previously minority-owned by Twitter.
Orbis also hired as Senior Vice President Philip F. Reilly, a former chief of the CIA’s paramilitary organization who was the agency’s Chief of Station in Afghanistan when Orbis was founded and later worked as head of special activities at Constellis Group, the successor to controversial private military contractor Blackwater. Orbis also received an investment from a venture capital partnership headed by Hank Crumpton, who was chief of the CIA’s domestic activities arm, the National Resources Division, for nearly two years during the early days of the Global War on Terror. (Crumpton’s firm also invested in Morell’s Chain Bridge.)
Orbis did not respond to a request for comment as to how its board of directors has changed since its April 2021 acquisition by McNally Capital, an investment firm run by the family which owned and operated the famed geographic publisher Rand McNally, but Federal Election Commission filings state that Philip Reilly was still a consultant with Orbis on June 26, 2023, when he donated $1,041 to the now-aborted Republican presidential campaign of former CIA operations officer — and former OpenAI board member — Will Hurd.
Following McNally Capital’s investment in firms such as Orbis Operations and the Maryland-based FedData, which Mr. Vickers similarly disclosed himself as a board member of, last year Rand McNally announced its transition into a technology company “focused on providing innovative solutions for connected cars and advanced fleet management.”
Myriad national security data brokers
Despite the tendency of many journalists to focus on surveillance technologies in individual isolation, such as in the case of facial recognition, cellphone location-tracking, drone surveillance, or social media monitoring, companies such as Babel Street and the publicly traded Palantir have long focused on the fusion of disparate data sources into a single surveillance platform. The most basic form of tradecraft consists of “pivoting” between different datasets during an investigation, such as by identifying cellphone tracks which intersected with a geotagged and timestamped tweet, deanonymizing a cellphone owner by looking up the address it rests at most nights through Google Maps and then performing a LexisNexis query to determine their name, or by using an underlying advertising or device identifier to connect different accounts held by the same person.
In the case of Babel Street, which A6 contentiously spun out from in 2018, the company has combined corporate records from Sayari, personal records from Pipl, cellphone location-tracking data reportedly sourced from Gravy Analytics / Venntel, and has spoken with Fivecast about purchasing access to the company’s aggressive Facebook scrapes. Similarly, U.S. Army Green Berets have deployed the “tactical information warfare” capabilities of the Pulse platform of Two Six Technologies, which has included data from Flashpoint collected by infiltrating the chatrooms of target groups, as well as commercial social media surveillance and commercial cellphone location-tracking data, ostensibly acquired from the McLean-based firm Creative Radicals. In analogy with Orbis, former Director of National Intelligence and head of the National Security Agency Michael McConnell joined the board of Two Six, but the company is unique in its employment of the former head of the CIA’s Directorate of Operations, Elizabeth Kimber, as Vice President for Intelligence Community Strategy.
There is thus precedence for Orbis Discovery fusing cellphone location data purchased from A6 with social media capabilities from Fivecast. Further, both A6 and Fivecast have had close relationships with the UK-based intelligence contractor Prevail Partners, which has publicly announced the incorporation of Fivecast’s data into its “all-source intelligence” capabilities and, according to an apparent leak of internal A6 files, is a white-labeled reseller of A6 capabilities. A6 did not respond to a previous request for comment on the veracity of the leak or its relationship with Prevail, but the most recent LinkedIn post from A6 co-founder Brendan Huff is a reshare of a Prevail job ad.
The arguable outlier in the leaked data providers for Orbis Discovery is Premise Data, a sort of Uber-for-information-gathering which was exposed by The Wall Street Journal in 2021 as a covert human and signals intelligence collection platform for U.S. Special Operations Forces, including as part of the war effort in Afghanistan. Alongside the Pulse Platform of Two Six Technologies, which concentrates on developing informants through an analogue of the customer acquisition funnel of an advertising agency, Premise is a rare example of how the U.S. Government has modernized its human intelligence collection in the age of cellphones. As reported by the author earlier this month, Premise conditionally settled its nearly five-year lawsuit against alleged whistleblower Alex Pompe on January 5, one month after the company removed its embattled CEO, Delwin “Maury” Blackman.
One of Orbis’s larger payouts from U.S. Special Operations Forces came from a more than $1 million surveillance support subcontract with Special Operations Command Pacific (SOCPAC) on February 3, 2023 through the technology-focused defense contractor SMX. Fellow Orbis Discovery data provider Premise was listed as receiving roughly $49 million through four separate subcontracts from the same award, while Palantir was listed as receiving $766,236.80 and Elon Musk’s SpaceX received nearly $500,000.
While not a household name, SMX, which was formerly known as Smartronix, announced in November that its board of directors had been extended to include former CIA Chief Operating Officer Andrew Makridis, who is best known for leading the response to the WikiLeaks ‘Vault 7’ disclosures of the CIA’s hacking tools. Similar to Orbis board members Michael Morell and Michael Vickers, Makridis was announced as a senior advisor to Beacon Global in June, and on October 11, Morell relaunched his ‘Intelligence Matters’ podcast at Beacon with Makridis as a co-host. Just one week after becoming a senior advisor at Beacon, Makridis joined the advisory board of chatroom infiltration firm Flashpoint, which similarly accidentally disclosed its integration with de facto A6 parent Babel Street.