Can OSINT demystify the man who died on New Year's Day?
"My life has been a personal hell for the last year…” – Message from MSgt. Matthew Livelsberger to his ex-girlfriend. [Source: AP]
Matthew was a ‘Rambo type’ – or ‘not a violent person’. He was ‘a patriotic American’, or he wanted to put his ‘terminally ill’ nation down. He was ‘bizarre and unhealthy’’, but also a normal guy’. He ‘loved Trump’’, but bragged he could ‘take down the entire Trump hotel'.
Who was Matthew Livelsberger? That depends on who you asked.
Matthew rented a Tesla Cybertruck from a carsharing service, woke up early, and parked in the main entrance of the Trump International Hotel Las Vegas in Paradise, Nevada. Reports of fire in the vehicle came in two minutes later. A mixture of firework mortars, gas tanks, and camping fuel formed a crude detonation system that responders put out within an hour. Inside, the perpetrator’s body was charred beyond recognition. He was identified by his tattoo – a bullet piercing two skulls. A handgun lay at his feet.
He had shot himself in the head.
When Matthew Livelsberger’s vehicle detonated in front of a Trump hotel, his persona fractured into a million very public pieces.
Authorities took time to pin the true Matthew down. A ‘soldier’s soldier’, a married man and allegedly a new father of one. Livelsberger was no ordinary soldier either; this decorated active-duty Green Beret was a master sergeant in the Army’s 10th Special Forces Group, and had served for 19 years. He was a five-time recipient of the Bronze Star – before the age of 40 – including a V-device for ‘valor under fire’, and had deployed nine times: to Tajikistan, to Ukraine, to Georgia, to the DRC, and five times to Afghanistan. In one three year stretch, he had deployed three different times.
"He awed us — most of us were on our first deployment to Afghanistan and Matt had served in combat multiple times and had fought the Taliban on the ground… Return[ing] home, I also mourned for Matt and his teammates: I knew they would keep fighting until the war was over or until it killed them…" – Nathan Lowry, Marine Ground Intelligence Officer [Source: Newsweek]
The Matthew his brothers-in-arms knew was a hero. There was also a caring, hilarious, smart Matthew, who liked to hike and camp and play fetch with his dogs. This was who his then-girlfriend, Alicia Arritt, had met in 2018. An Army Nurse, Alicia had worked at Landstul Regional Medical Center in Germany, the largest U.S. military medical facility in Europe. She treated here some of the worst combat injuries from Iraq and Afghanistan before their transfer back home.
However, Alicia began to see signs in her new boyfriend that reminded her of her patients. Matthew began to drift away mid-sentence. He stopped remembering words, became an insomniac, with migraines and jags of depression that confined him indoors for days. He was becoming somebody else. Alicia remembered treating traumatic brain injuries (TBIs), hidden wounds inflicted by concussion from IEDs and bullets – TBIs can take years to rupture through the facade of a healthy psyche. ‘I saw a lot of bad injuries’, Alicia said, but ‘personality changes can happen later’.
‘He was just a really loving guy with a deep well of integrity… I think he wanted to get help, but he thought if he said anything, he wouldn’t be able to do his job anymore… I don’t know what drove him to do this, but I think the military didn’t get him help when he needed it.’ – Alicia Arritt, Army Nurse and Matthew’s ex-partner [Source: NYT]
Evidence suggests this mental decline was key in what transpired. The notes Matthew left behind on his phone discussed his need to ‘cleanse the demons’ of taking lives and losing fellow soldiers. Matthew at least suffered from post traumatic stress disorder (PTSD), and possibly an injury to the brain. His spiralling mental health even led to his tattoo: the skulls were intended to represent his guilt for the lives he took in Afghanistan. In the end, this guilt would be all that remained of who he was.
The role of mental health in these events had already made Matthew’s motive hard for some to understand. The messages released by law enforcement seemed to suggest this potential attack was a complicated suicide.
“Fellow Servicemembers, Veterans, and all Americans, TIME TO WAKE UP!... We are being led by weak and feckless leadership who only serve to enrich themselves…This was not a terrorist attack, it was a wake-up call. Americans only pay attention to spectacles and violence. What better way to get my point across than a stunt with fireworks and explosives… Why did I personally do it now? I needed to cleanse my mind of the brothers I’ve lost and relieve myself of the burden of the lives I took.” – Matthew Livelsberger’s ‘manifesto’, released by the LVMPD. [Source: Independent]
Despite directly stating otherwise, ‘patriotic American’ Matthew Livelsberger now took on another role in the public mind: a terrorist. If this was a ‘wake up call’, then to what? In the time between the discovery of the charred Cybertruck and verification of the truth, the contents of Matthew’s notes sparked another firestorm – of speculation and misinformation.
Livelsberger’s actions had come within hours of tragedy in New Orleans, Louisiana. That same early morning, 42-year-old veteran Texan Shamsud-Din Jabbar rammed Bourbon Street partygoers with a Ford F-150, killing at least fourteen people and injuring at least double that number. Police shot Jabbar dead at the scene; even before an official motive was announced, reports disseminated of a black ISIS flag found in the truck bed.
The same date, two Army veterans, assigned to the same base and both serving in Afghanistan, both intending to utilize explosives and trucks – and the same car sharing app, Turo.
Some quickly exploited these coincidences to flesh out a new Matthew. Racist, antisemitic and extremist influencers began exploiting the situation, stoking the flames of hysteria. High-profile – and even government-adjacent – accounts like Charlie Kirk, Elon Musk, Jack Posobiec, and ‘Electronic Intifada’ founder Ali Abunimah took to X to promote some of the most damaging disinformation narratives: that these attacks were connected, “orchestrated” by Jewish-Americans or Israelis, or perpetrated by migrants who had crossed the Southern US border.
“A lot of us are just sitting around waiting to die. No sunlight, no steps, no fresh air, no hope. Our children are addicted to screens by the age of two. We are filling our bodies with processed foods…” – Matthew Livelsberger’s ‘manifesto’, released by the LVMPD.
Other debunked conspiracies included exploding Tesla car batteries, ‘false flag’ attacks, Q-Anon theories, and anti-Musk protests.
FBI experts have since proven the two attacks to be ‘strangely similar’, yet absolutely unconnected. The base both men served on, Fort Liberty, is one of the biggest in the world, and the two had never met. At least 1.9m US soldiers deployed to Afghanistan. Turo is one of the most popular car rental apps in the States. As for the date – New Year being an auspicious day on the calendar, both attackers had simply had the same idea. In the same way two people can share a birthday by chance, Livelsberger and Jabbar shared an attack date.
The FBI response was clear. However, the hateful lies and misinformation needed to be disproved faster than they were. Evidence arose that could have proven the truth, and brought the fragmented character of Matthew Livelsberger back together before he’d been reassembled into something worse. This evidence was OSINT.
"Although this incident is more public and more sensational than usual, it ultimately appears to be a tragic case of suicide involving a heavily decorated combat veteran who was struggling with PTSD and other issues…" – Spencer Evans, FBI Special Agent [Source: NPR]
Meet Colby, OSINT Expert and CEO
Colby S. is an expert OSINT analyst, CEO of digital executive protection firm ObscureIQ, and an OSINT Industries user.
On January 4th, in the aftermath of Livelsberger’s Cybertruck attack, dev and data analysis YouTuber Ryan McBeth put out a reaction video that caught Colby’s attention.
In the video, McBeth reacted to an email that had purportedly been sent by Matthew Livelsberger to veteran and right-wing influencer Sam Shoemate. The email was filled with paranoid beliefs about Chinese drones and submarines, American ‘war crimes’ and ‘cover-ups’. These preoccupations weren’t present in the official ‘manifesto’ released by Las Vegas Police, which focused primarily on American health, if this email was legitimate, it showed the truth about Livelsberger’s state of mind.
Unable to confirm the email’s origin, McBeth labelled this crucial evidence a ‘fake’.
Colby specializes in understanding people with OSINT. His daily work at ObscureIQ includes extremely advanced digital footprint auditing, mapping vast threat surfaces that span an individual’s every movement and trace online. As a result, this analyst is acutely aware of the powers of OSINT and SOCMINT for identity verification, profiling – and countering misinformation.
Earlier that week, Colby had been conducting OSINT work on the perpetrator of the New Orleans massacre, quickly putting together a digital criminal profile for interested individuals and agencies. OSINT, Colby knew, is first-response intelligence; often ‘the first information you get’ after-the-fact. Applying his expert OSINT skills to McBeth’s claims about the email would not take long, and could be immediately effective in cutting through to the truth – and preventing misinformation.
Was this email really a fabrication? Was Ryan McBeth correct? The reasoning seemed sound: this email came from a source that McBeth had investigated for email misinformation before, would boost the profile of whoever created it, and the email appeared to be in ‘edit’ mode with ‘the “squiggly” spellcheck lines under specific words such as graqvitic, sigint, isr, CENTCOM, WH… etc.’ Still, Colby wasn’t sure.
With OSINT Industries, he was swiftly able to verify that the crucial Livelsberger email – a glimpse into Matthew’s true state of mind – was in fact real.
The Email: Unmasking the Real Matthew Livelsberger
The Matthew Livelsberger of this email suggested that he was not ‘under duress or hostile influence’, and was heading towards the Mexico border. He believed he was tracked by the FBI, Homeland Security and more to prevent his border crossing, explaining his choice of Las Vegas as an attack site.
He then began to delineate a paranoid conspiracy theory about ‘the most dangerous threat to national security that ever existed’: Atlantic-launched drones, using gravitic propulsion systems, as a Chinese ‘show of force’ – including a theoretical attack on the White House. However, the most significant element of the email is his claims of knowledge about DoD, DEA, and CIA ‘war crimes’ and subsequent ‘cover-ups’ in Afghanistan; these extreme claims reflect the burden of Matthew’s trauma, and the depth of his feelings of guilt.
Lastly, he urged the recipient to elevate the information to the media to ‘avoid a world war’ and ‘mutually assured destruction.’ Surprisingly, he signed off with a reference to a LinkedIn profile under ‘Matt Berg’ or just ‘Matthew’.
This email, packed with toxic guilt and apocalyptic paranoia, is a window into the psyche of the real Matthew Livelsberger. It’s a vital in-road to the truth of what happened that morning, as Las Vegas rang in the New Year.
“I’m gonna plug this into OSINT Industries…” – Colby S., OSINT Expert and CEO [Source: OSINT Industries]
Colby got to work. He isolated the sender email that claimed to be Livelsberger, ‘dabergmlb@protonmail[.]com’, and ran it through OSINT Industries.
Immediately, Colby received results that clarified the character of the man who sent that email. It appeared to be Matthew Livelsberger; this search on OSINT Industries had made the crucial step that Ryan McBeth had been unable to take.
This OSINT search revealed several accounts, including past account registration with Tesla. Significantly, this not only proved that Livelsberger’s use of a Cybertruck was not a political or ideological statement, but corroborated known information about the subject’s positive attitude to Tesla vehicles and Elon Musk. Alicia Arritt, Mathew’s ex-girlfriend, recalled Livelsberger ‘fixing up’ a Tesla with her as a hobby. She reported her ex-partner texted on December 29th, apropos of nothing, to discuss how much he enjoyed a gold Cybertruck he rented. He clearly had no animosity towards the brand.
"I rented a Tesla Cybertruck. It’s the shit... It matches my Kobe 2 shoes I had when I was little… I feel like Batman or halo." – Texts from Matthew Livelsberger to Alicia Arritt [Source: Fox News]
Colby’s OSINT search also revealed a Facebook result with a crucial lead: a phone number hint, ending in ‘84’. Thanks to the data transparency particular to the US, he was able to use a regular people search platform to identify a number ending in ‘84’ – that belonged to Matthew Livelsberger.
The Magic Number: Unveiling the '84' Identifier
Not only was this ‘84’ phone number a clear and inarguable identifier, but it also connected via Colby’s OSINT Industries searches with more pivotal details.
Inputting Livelsberger’s number, Colby was able to find an Apple email hint, likely a GMail account, beginning with ‘M’. Our phone-to-facebook module, more importantly, delivered another email hint: beginning with ‘d, it ended with b’. This was more than coincidence; it solidified the link between Matthew Livelsberger, all of these contact details, and the sender email ‘dabergmlb@protonmail[.]com’. Facebook had taken down any identifying content quickly, but Colby was faster.
Colby’s final step demonstrates how a ‘simple, rudimentary workflow can do a lot’. Checking out the ‘M’-initial GMail address on his regular people search platform, Colby assumed Matthew would go with the most unimaginative email address possible: ‘matthew.livelsberger’.
This sharp guess search delivered a Microsoft account – named ‘Matt Livelsberger’, with the magic ‘84’ phone hint. Apple hints ended in ‘84’ and ‘19’. Lastly, a Samsung hint – the most convenient for investigators, presenting the most uncensored numbers with a country code attached – delivered too.
Colby’s results with OSINT Industries were undeniable truth. These accounts, emails and numbers all belonged to Matthew Livelsberger. Cutting through the cloud of hysteria, conspiracy-theorizing and misinformation, Colby had verified an email that provided evidence of motive and profile from the man in the Cybertruck.
First-Response Intelligence: A Case for OSINT
"I’m a civilian with no clearances… if I can go out and create a quick profile on both of these individuals in the New Year's Day attacks, OSINT is not being utilized nearly enough by law enforcement." – Colby S., OSINT Expert and CEO [Source: OSINT Industries]
In his line of work, Colby speaks to many people in the government sector, with vast capacities for data collection. However, OSINT is ‘way cheaper, and sometimes the most effective’.
Colby’s investigation is a great example of the power OSINT provides for criminal profiling, identity verification, and fighting ‘fake news’. Simple searches on OSINT Industries verified evidence that could have put numerous harmful Livelsberger conspiracies to bed. Verifying this email could quickly prove the lack of connection between Las Vegas and New Orleans, illuminate Matthew’s state of mind, and prevent wild speculation.
Early media reporting had utilized OSINT, but without the skill of a skilled, expert analyst like Colby. Accounts with the same rental car app, Turo, had been identified; those finding turned out to be coincidental, needed more investigation to avoid fuelling the fire of misinformation. This is a prime example of how, as Colby says, ‘verification is so vital… verification trips investigators up the most, and it takes practice’.
Open-source information – in particular social media (SOCMINT) — is almost always the first quality information accessible in the wake of a crisis. However, Colby emphasizes that the power of OSINT can’t be harnessed without significant change to the way the United States supports its law enforcement.
“The guys on the ground aren’t funded enough… OSINT is going to be the first information you can get, and it’s quality information…” – Colby S., OSINT Expert and CEO [Source: OSINT Industries]
Underfunded and underresourced, law enforcement agencies are relying on traditional people search sites without OSINT tools; they might be, as Colby says, ‘getting 13 phones and maybe the one on the bottom’s the right one.’ The task of verification is long and arduous manually, and is often too expensive and difficult a hurdle to overcome without a trained OSINT investigator. OSINT specialists should be a mainstay, but are presently a luxury few forces can afford.
OSINT Industries hopes to change this. Verification is where Colby finds a tool like OSINT Industries excels. In Palette, Colby finds a Maltego-style tool “that’s serious, it's the most affordable way to get good link analysis”. If support stays unforthcoming, tools like OSINT Industries and Palette present a way for underfunded law enforcement agencies to stay ahead of the game – and affordably, too.
OSINT vs. Online Hysteria: The Battle for Narrative Control
“I got it wrong, but confirming the email opens different questions…” – Ryan McBeth, Data Analysis YouTuber [Source: Ryan McBeth/Substack]
With Colby’s analysis, Ryan McBeth corrected his mistake and apologized. However few share his impressive humility in doing so. Most people spreading misinformation online aren’t willing to be proven wrong, Worse, those spreading disinformation – the Jack Posobiecs, Elon Musks and Ali Abunimahs in the aftermath of New Year’s Day – are likely to double down on their campaign to propagandize or exploit a tragedy.
In this case, Colby’s OSINT was able to unmask the real Matthew Livelsberger, independent from the monsters and boogeymen created on platforms like TikTok and Twitter (X). This opens a door for a possibility in OSINT practice: if OSINT, first-response intelligence, can be deployed to prove Matthew Livelsberger was not a conventional terrorist, could it be used to avoid future hysteria and ‘fake news’? Could OSINT’s capacity to isolate truth deprive bad actors of oxygen, and prevent them controlling the narrative?
Revisiting his Matthew Livelsberger investigation after Colby’s OSINT correction, Ryan McBeth traced Livelsberger’s now-verified email to a Yelp account. Here, he uncovered a review for a water rehabilitation center that Matthew had left years before he died in the porte-cochère of the Trump International Hotel. In this review, Livelsberger mentioned ‘anxiety, depression, PTSD, TBI… behavioral issues.’
OSINT investigators like Colby can fight for the truth to be paramount, and can provide evidence to clarify ‘motiveless’ crimes before conspiracy takes over. The signs were there, and OSINT could have found them; after the fact, OSINT could stop the lies.
“If you have the tools and a trained analyst, you really have to go to a lot of effort to poison the well…” – Colby S., OSINT Expert and CEO [Source: OSINT Industries]
To find out more about Colby’s work, visit:
ObscureIQ: Site
LinkedIn: Colby Scullion, CEO
For more about Colby’s Livelsberger investigation, read:
Our Research on Matthew Livelsberger & the Cybertruck Explosion - ObscureIQ
Reveal what's behind any contact, instantly.
We want to hear your story!
Inspire Others
Educate about what OSINT can do.
Positive Publicity
Share your success with the world.
Support #OSINT4Good
Be part of the OSINT story.
