Information leak from chat group. How do we find out which user is sharing information?

Question

My friend is part of a business of about 10 people that provide stock and share advice to paying members in a Telegram group. It's a quite expensive pay monthly group of loyal enough customers who benefit from the group's secrecy and so a leak compromises the success of the group. There are over 200 members in the group currently. Recently a user within the group has been leaking this information to a Discord channel and charging non-members a fee to access to it.

My friend found out who the user was but it appears they have multiple accounts still running and hidden throughout the current 200 users. They appear to be using bots to glean information directly from the group.

How could we catch these information leaks using some kind of trickery and subterfuge such as a canary trap? A canary trap is likely not possible as each user of the group receives the exact same information via the group chat so that option is likely out but there must be some other sneaky way.

The vetting process to enter the group is very strict so once we can identify this user and all associated accounts we should be able to ban them permanently.

Answer 1

Attempting an 'Andropov' (revealing different information to several people and check what got leaked is said to have been a favourite technique of Y. Andropov) on such a group is impractical. Even if you created new different groups and assigned each user to one, leaking different information from the one supplied or skipping a leak etc. are obvious counterstrategies and the truth would be really slow in coming out.

You might try a countersting - subscribe to your own Telegram group with several fake names and, if possible (I don't know Telegram) ask for some information on specific topics, to establish a pattern. Supply this information to yourself. After a while, subscribe to the Discord channel anonymously and offer the unknown manager a lot of money for a different specific information (say, the dirt about Bill Gates). Then see whether someone asks for that information in the Telegram group. This, too, is obvious enough - but sometimes greedy people don't see the obvious.

Checking registration patterns could offer some valuable insights. I guess that whoever did it at a certain point decided to cheat, and that's when he created the additional accounts to keep his finger in - but they aren't probably very many, as they are paying accounts, are they not? You might try following the money. Or the times of payment. Or the date of account creation. Note that you might now have figured out who the fake account is, while the original account of the culprit was opened before it (i.e. your culprit is John Smith, who created a fake account under Joe Small. And you discovered that Joe Small leaked, and killed that account - but John Smith is still onboard).

The best move however would be to change dissemination strategy. Use a series of one-on-one connections, so that you can discriminate what information goes out.

Answer 2

Start moving over the members 1-by-1 over to a new group speaking to the individuals privately. Give slightly different info to the new group. There's your trap.

If the unauthorised Discord group starts changing to the new group's info, then the most recent members are your likely targets.

The added benefit is that you can re-vet your members.