Big Tech companies are famously tight-lipped when it comes to their algorithms, which can influence millions of people around the globe. That’s where journalists come in.

Data journalist Surya Mattu aimed for accountability with his Facebook investigation “Citizen Browser” for The Markup.

“There’s no easy way to independently audit what’s happening on the platform, and this was our attempt at doing that as journalists,” he told NPF data privacy fellows. [Transcript] Mattu and his colleagues had to build a browser and recruit volunteers in order to collect data on what Facebook was amplifying in people’s feeds. They found that they were advertising credit cards to users under 18 and that they continued recommending political groups after they said they’d stopped; in Germany that included the right wing party AfD.

“When you build a whole system like that, this is the kind of reporting it enables you to do,” Mattu said. “It’s important to have independent audits and methods to do the kind of data collection … there’s an interesting intersection between journalism and security research that comes into play here, of really having to have best practices in what we are doing with data so that we are reputable sources of information when you bring it out to the public. Because all the stuff like this technically can be against Facebook’s terms of service. They do a lot of stuff in the background to try to make it hard to collect this data, but that’s where the tension tends to lie.”

If you’re not at the point of building your own platform, a separate “Your Body, Their Data?” session included tips for building up sources — inside and outside Big Tech:

5 takeaways:

➀ Journalists, first ask yourself “who is my audience interested in?” That’s what FedScoop tech reporter Nihal Krishan does when trying to approach powerful and opaque companies. “Is it their civic integrity team, their elections team, anti-trust? Which part of a company is your audience most interested in getting sensitive or unique information about? And then go about trying to find sources.”  [Transcript | Video]

➁ “It’s trying to find a needle in a haystack,” or at least that’s how Krishan describes trying to find contact information. He suggests reaching out to former and current employees at a company even if it’s just through LinkedIn. He uses ZoomInfo and LexisNexis to find contact information. When someone answers, he starts off by asking to chat off the record. Building trust and building rapport are what he calls a “slow burn, not something that happens overnight. Krishan has also tried going through family members, or close friends of someone who works within the company, who can show you their internal documents and policies. But you have to be very careful doing this, he said.

➂ Pay attention to whistleblowers, Ryan Blaney, a partner at Proskauer Rose LLP and the head of the Global Privacy & Cybersecurity Group, said. More and more employers use artificial intelligence to track employees’ communication – which can include that with journalists.

“Technologies allow for the use of AI and the use of other monitoring tools to be able to say, ‘Okay, Ryan Blaney is sending an email to this email account … [which is] flagged as a potential data loss,’” Blaney said. This may be “especially true if that individual has access to more sensitive company-related information.” Another trend Blaney notes in employee compliance is the restriction of information by a team rather than an employee ID number being an all-access key to documents.

➃ Talk to people on the Hill, former AP reporter Marcy Gordon suggests. In recent years, Gordon has focused much of her reporting on covering tech policy and the Federal Trade Commission. “You can find out what the FTC is doing or what people want them to do by talking to people on The Hill who are active in this area,” she said, especially people like Richard Blumenthal and Edward Markey. The FTC holds open meetings, and you can try to get to know the staff people and the commissioners.

➄ FOIA requests can help get “hidden” information. Gordon spoke on how The Associated Press is currently doing an investigative series called Tracked, which is supported by the Pulitzer Center for Crisis Reporting. A recent article “Tech tool offers police ‘mass surveillance on a budget’” found that local law enforcement in California was using a cell phone tracking tool called Fog Reveal, which gives them the power to follow people’s movements months back in time. They obtained these public records and internal emails through FOIA requests. “I think that’s a good example of getting information from opaque and powerful institutions.”

This program was sponsored by Arnold Ventures and Medtronic. NPF is solely responsible for the content.