How an AI image of a lion brought down an Albanian smuggling gang

To the average eye, it was a fairly inconspicuous account. The profile photo showed Big Ben and the person behind it didn’t appear to have posted any content. But this nameless account somehow accumulated 957 followers. It was one of more than 200 profiles connected to an organised crime gang, based in Albania, that reached thousands of viewers through the 900 videos it shared to promote illegal routes to the UK. One major giveaway helped bring down this criminal network that were behind videos luring migrants on to mega dinghies – AI-generated pictures of lions. Investigators from TikTok were able to use this “tell” to map out the vast network of accounts linked to the suspicious profile – first spotted by a National Crime Agency (NCA) investigator. All 200 have now been removed. Mike Hulett, head of the NCA team combating online organised immigration crime, said the adverts posted by gangs looking to move migrants across the Channel are “a key enabler” of smuggling. A migrant might have one digital point of contact or may engage with several adverts. “If you’re coming from Syria or Afghanistan, you might have one person organising one border crossing, then you’ll interact with another advert for the next stage of your journey, and so on,” Hulett said. Home Office data shows that 80 per cent of small boat arrivals into the UK interacted with social media posts during their journey. This is likely to be an underestimate, given it was recorded 18 months ago, according to Hulett. ‘Hiding in plain sight’ Criminal gangs are using increasingly sophisticated methods to avoid detection. Five years ago, smugglers would openly advertise routes across Europe on social media. Now they take pains to avoid triggers that would see their content automatically taken down. One of the accounts set up by an Albanian criminal gang smuggling migrants (Photo Illustration: Lucie Wimetz/The i Paper/TikTok) One method is to spread content across a range of accounts, according to TikTok. Another, the NCA says, is to misspell words and swap letters for punctuation or numbers, turning a word such as “Europe” into “Eur0p” so they can be understood by humans but, they hope, not by automated detection software. Adding text directly into the video rather than in captions or subtitles, and using symbols like emojis or images, are other techniques to try to dodge moderation, according to Hulett. Smugglers dangle small hints, wait for a person to contact them, and then they move the conversation off public social and into private, and often encrypted, messaging apps. “Several years ago we might have seen an interaction on Facebook or TikTok and the whole transaction [would] play out there, with the arrangement made… [now] they know it’s visible to law enforcement, just as it’s visible to a would-be migrant,” says Hulett. “They’re trying to hide in plain sight.” ‘The Golden Lion’ In the case of the Albanian gang, blank profiles were set up with visual signals they were promoting trafficking routes from Albania to the UK via the Calais–Dover crossing. Use of AI-generated lions is not unique to Albanian gangs, with The i Paper finding the symbol used in the Arabic-speaking world as well, as with this profile picture of a smuggler on a private messaging app (Photo: Sanya Burgess/The i Paper) The accounts were given the moniker “The Golden Lion” by researchers, because AI images or photographs of lions would repeatedly appear in their content. It amounted to a calling card: If users spotted a lion on a certain type of account, it gave a clue it belonged to a smuggler who could move them across Europe. Beyond a tentative link to the UK’s royal coat of arms, which features a lion and a unicorn, the symbol was not an obvious one for automatic detection software to pick up, and, if the gang had been luckier, might have slipped under the radar. Instead, researchers built a network of accounts that all interacted with one another to identify the smugglers. Much of this work has to remain a secret for operational reasons, but what can be revealed is that investigators could look at where accounts originated from. This has become more complex, with criminals using virtual private networks (VPNs) and proxy IP addresses to hide their location and what devices they use to log in. Similarly, the easy availability of eSims means phone numbers originating across Europe can be used to set up accounts even if the person behind the profile is based elsewhere. Social media firms can do more Exclusive figures shared with The i Paper reveal TikTok removed 10,000 videos breaking human exploitation rules within the UK in the first half of this year. This was the result of a “dedicated investigation” by teams including former NCA staff, according to Valiant Richey, head of outreach and partnerships for trust and safety at TikTok. Another mostly blank profile uncovered and later blocked by TikTok. (Photo Illustration: Lucie Wimetz/The i Paper/TikTok) These removals represent only 0.17 per cent of content blocked in that time in the UK – showing the scale of potentially harmful content on social media apps that relies on automated moderation to be dealt with. Hulett says it falls to social media companies to help take down these accounts, something law enforcement cannot do on its own. By removing key accounts at the centre of crime gangs, it is possible to have a much bigger impact, he adds. “They’re the ones with the ability to have an effect at scale. We can’t arrest our way out of this problem,” he says, noting that many of the gangs are based outside of the UK.