177: National Public Data

Sponsor Introduction

0:00This episode is sponsored by Cohesity. Cyber resilience isn't just about getting systems back online. It's about keeping your business operating when disruption strikes. That's the idea behind the Minimum Viable Company, or MVC, a trusted operating core for recovery. Cohesity built the MVC to help organizations identify the essential applications, data, people, and processes required to serve customers, maintain communication, protect revenue, and meet critical obligations.

0:30By restoring this trusted operating core first, organizations can reduce downtime, accelerate recovery, and maintain continuity while broader restoration efforts continue. It also provides a clear recovery target, enabling teams to focus resources where they will have the greatest business impact. Learn more at Cohesity.com slash resilience. That's Cohesity.com slash resilience. Cohesity. Resilience everywhere.

Identity Theft Story

1:00So back in 1988, there was this identity theft incident that happened, which, when I read it, it infuriated me so badly. And, um, well, now I want to infuriate you. So check this story out. This all started in Albuquerque, New Mexico, like I said, 1988. And there was a hot dog stand there, which seemed to hire people who were really down and out. Like, if you had a past criminal record, that's fine. You hired a homeless. Homeless? Okay, here's a job, buddy. Get yourself together. William Woods was the homeless guy working there.

1:30And then they hired Matthew Kierens. Matthew had a long criminal record and was trying to separate himself from that past. And he was new in town, just needed, like, a little cash to probably just get him to the next town or something. But as soon as Matthew started working at this hot dog stand, he stole William Woods' wallet, the homeless guy that was also working there. William found out that Matthew stole his wallet and confronted him. And he threatened him, and he got the wallet back. But, jeez, what kind of jerk steals someone's wallet like that? Neither of them lasted long at this hot dog stand.

2:01William, the homeless guy, actually left town to find a new job. He went over to Texas for a while. He did some day labor jobs there. Then went over to Las Vegas and worked in a laundromat. And eventually he ended up in Los Angeles, scavenging for gems and metals.

Matthew's New Identity

2:14But little did he know, while he was struggling to get his life together, Matthew had started calling himself William Woods. See, since Matthew didn't have a house, he carried all his important documents with him. So when Matthew stole his wallet, his birth certificate and social security card was in his wallet. So Matthew copied those things down and then moved to another state and then started to register stuff in that name. He asked for an official birth certificate from the state and a social security card for William Woods and got them.

2:46And he got a driver's license with William Woods' name on it, but it had Matthew's picture on it. And he got a job as William Woods. Because remember, Matthew had a criminal past and he was eager to leave that behind. A fresh start was really great for him. But he didn't stop there. Matthew opened a bank account as William Woods too. By 1994, six years after stealing Williams' wallet, Matthew had completely took on this new identity. And William had no idea. Matthew even got married to a woman who thought his name was William Woods.

3:22And then they had kids and they called themselves the Woods family. Matthew wanted to know more about William, to have a solid backstory, and went on Ancestry.com and convinced them that he's William Woods and he learned all about his childhood and his family. And actually, this all had a huge payoff for Matthew. This was great for him because he had a criminal past, but that was essentially erased. And now, he got a $100,000 a year IT job at the University of Iowa and a car and even took out a loan for a house under his assumed identity.

3:54This fresh start was looking great for him. The real William still had no clue and was busy scavenging for gems and minerals in California. He was an off-the-grade kind of guy, so he wasn't filing his taxes or opening bank accounts himself. And he only used cash wherever he went and kept a pretty quiet life. And because of that, Matthew was able to use William Woods' name for decades without anyone knowing.

William Discovers Identity Theft

4:21In 2019, the real William started getting a hunch that someone might be using his identity and talked to someone about it and they gave him some money to do a credit check. And that's when William discovered there's loans out at a bank under his name. So he goes in the bank, identifies himself as William Woods, shows them his California ID, and they're like, okay, how can we help you? And he's like, well, I don't have an account here. Someone else is using my social security number or name or whatever because that account is not mine. The assistant branch manager walks over

4:53and he looks at William's account and there are some security questions associated with it and a PIN. William cannot answer any of the security questions and doesn't know the PIN, obviously. So the manager's like, okay, well, there's a phone number here. And William's like, that's not my phone number. So the manager's like, well, let's see what happens when I call it. So he calls the number and Matthew picks up over in Iowa. But Matthew abandoned that name, Matthew, long ago. He's like, yeah, I'm William Woods. What's the problem? And they asked him the security questions

5:23and he got it right. So now the bank has two people who have authenticated themselves to be the owner of this account and they have to figure out who's the real owner.

Bank Investigation

5:33The manager is still on the phone with Matthew. And since he knows all the answers to the security questions and the real William looks like some homeless guy, he's more convinced that the guy on the phone is the true account holder. So he tells Matthew, well, there's someone here in the bank claiming to be you. And Matthew's like, in California? I'm in Iowa. Nobody in California should be accessing my account. So William's standing there and the manager's looking at him and the manager starts thinking, this guy in the bank must be faking his identity

6:04to get into this guy's account. So he calls the cops on William for identity fraud. The cops call Matthew and they ask for proof that he's actually William Woods. And Matthew just sends him his driver's license, social security card, birth certificate. At this point, Matthew had been using Williams' identity for 31 years, which means he has tons of supporting evidence to prove he's really William. What do you want? W-2s, electricity bills,

6:35library cards, credit cards, a marriage certificate. I can give you supporting documents for days. I am the real William Woods. And in the meantime, the real William Woods has very little to show that he's actually who he says he is. He has an ID from the state of California, but that's about it. He just didn't have much documentation to prove he was actually William. But that's just the beginning.

USDOD Introduction

6:58Get this. Matthew must have known what was going on because when Williams went to court in California, he was tried under the name Matthew Kearans. So that must mean that Matthew told the cops that William is probably this guy, Matthew Kearans, which is so messed up and backwards. Now, William is going out of his mind. He is disgruntled. He is furious. He's confused and absolutely angry with the cops and the court. I mean, I would be too, but it's not helping his situation at all.

7:29He seems wild and crazy, which makes everyone in the court think he's actually nuts. Even his lawyer doubted the story. He got so wild and furious with everyone that they really did think he was having a psychotic breakdown and decided that he's not fit for court and sent him away to a mental hospital without even having a trial. So poor William got thrown in the mental ward and not only that, but they forced him to take psychiatric drugs.

7:59The whole time, they were calling him Matthew and he's like, no, I'm not Matthew. Matthew stole my identity. I'm William Woods and he was forced to stay in the mental hospital for five months and when he finally calmed down, they said, okay, now we can have your trial and the judge looked at the case and found him guilty for trying to steal William Woods' identity. So they sent him to jail. Not only that, but they charged him

8:30a $118,000 fee for his hospital bill. This is the stuff that makes me furious. I mean, like, absolutely furious that the victim gets treated like this and the actual identity thief got away with it. I'm sure William must have thought he was crazy at times and it's no fun when you start doubting your own reality and don't even know who you are anymore because the court forced him to call himself Matthew. He was admitted to jail as Matthew. The guards called him Matthew

9:00and they made him call himself Matthew. So poor William just had to serve his jail time. He didn't have any resources to fight this. So months go by in jail, a year goes by and after a year and a half he served his complete sentence and was able to get out. And when he gets out he is mad. So mad at Matthew for putting him through all this that he calls Matthew's work University of Iowa to report him. And this makes its rounds to some people

9:30at the University of Iowa and someone decided to do their own little investigation. They thought what if William is right and Matthew did actually steal his identity instead of the other way around. And surprisingly at this point no one had done a DNA test on either man. So the person from the University of Iowa figured out who William Woods his real father was which wasn't easy and was able to get a DNA sample from the father. And then he went to California and took a DNA sample from William Woods and bingo

10:01there was a clear match. The investigator called Matthew and asked him what his father's name was but Matthew had no idea. So after a year and a half in jail and five months drugged in a mental hospital everyone finally realized that William was telling the truth the whole time. Ugh! The courts apologized they exonerated him of all wrongdoing and they even canceled out his $118,000 medical fee that they charged

10:31him with like oops sorry that was our mistake and he was free to go on calling himself William once again. But then the cops turned towards Matthew in Iowa and were like uh bro you lied to us you lied under oath in court and you made a poor man suffer for years because of this? Not to mention you conducted identity theft? So they arrested Matthew and sentenced him to 12 years in federal prison. His expected release date is 2037.

USDOD's Story

11:06These are true stories from the dark side of the internet.

11:13I'm Jack Recider. This is Darknet Diaries. This episode is sponsored by ThreatLocker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome uses PowerShell runs a remote admin tool

11:44your IT team already trusts. There is no custom malware no dramatic movie hacker moment just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run what it can do and how systems communicate. If attackers get credentials or land on a machine they'll have a much harder time moving through the environment because security teams are realizing something important. The problem isn't always unknown software anymore sometimes it's trusted software being used

12:15by the wrong person. If you want to see how ThreatLocker works go to ThreatLocker.com slash Darknet and book a demo today. That's ThreatLocker.com slash Darknet to book a demo. This episode is sponsored by my friends over at Maze. GitHub saw nearly a billion commits last year. This year with AI agents writing code they're on pace for 14 billion. Code is shipping

12:45faster than ever and its vulnerabilities are piling up just as quickly. Legacy SCA and SAST tools weren't built for this kind of scale. That's why Maze just launched Maze Code. They're using AI agents to investigate every vulnerability in your dependencies and in the code your team writes. The agents use context from your code and cloud to prove what's really exploitable in your environment not just theoretically risky. Then they go further catching the business logic flaws other tools miss

13:15and when something's exploitable they find the fix and send it straight to the right developer or your coding agent. Check out Maze at mazehq.com slash darknet that's Maze spelled M-A-Z-E mazehq.com slash darknet A few years ago a friend messaged me and said look out an APT just followed you on Twitter and I'm like what? He's like yeah the U.S. government is classifying this account as an APT

13:46an active persistent threat to the U.S. government I'm like whoa which account is this? He said oh the account name is USDOD USDOD as in Department of Defense and they're they're in APT and they're following me no no that's just their hacker name could be a group could be a solo person but they're calling themselves USDOD to be funny edgy and confusing so this began my relationship with the APT known as USDOD he was active in the hacking scene and would post what he's doing right there on Twitter

14:17and I started commenting on his post and he started commenting on mine and we laughed and we giggled and we started forming some kind of weird parasocial relationship through Twitter I always had a hard time getting a good read on him he contradicted himself a lot he seemed a bit young in the way he was talking it was really hard to figure out if what he was saying was true or just something he exaggerated or even made up I think a few times I caught him talking to himself even like you know just some weird gibberish that probably only he understood

14:47I asked him for an interview he said okay but then I realized his story's just beginning if I interview him now I'm sure there's going to be much more that comes so I just held off waiting for the story to ripen more and I think a year went by and I just watched him do more and more crazy stuff and it was hard to tell what was real and what wasn't but then he suddenly disappeared the account was banned and I never heard from him again turns out his story is much more

15:18crazier than I realized are you ready so let me give you an example of how strange he is a few years ago the reporters at databreaches.net did in fact interview him and this interview is all over the place like here check out this one story he told them back in 2012 the hacker known as USDOD was living in Brazil and said he went to New York for cancer treatment during his time there he fell in love with one of the hospital employees they became deeply involved with each other

15:50they started talking about how corrupt the hospital is so him being the little hacker that he was he decided to hack the hospital and expose the corruption she said she would help him and with an insider well it's super easy to hack into a hospital so she helped him get into the network and he took incriminating evidence that proved the hospital was corrupt he said he was going to take this to the media and tell reporters and expose the whole hospital and together they were going to make a big deal of this

16:20but the day before he was going to meet with the media she suddenly disappeared his attention shifted entirely to find her he became frantic depressed emotional to go from a deeply involved relationship with her to hacking into the hospital together to suddenly being alone in New York he was distraught he hired a private investigator to try to track her down but even the PI couldn't find her she vanished like a ghost so with no reason to stay in the US

16:50he returned to Brazil and never blew the whistle on the hospital and this made him extremely bitter with the US it's not entirely clear why he's mad at the US government over this but says this was the thing that made him upset at the US government maybe he thinks they made her disappear somehow or kept them apart I don't know but this is what I mean what a wild story to start with right he came to the US fell in love with a hospital worker found corruption in the hospital

17:22hacked the hospital went to expose it but then she vanished and he was left holding the smoking evidence that could ruin the hospital but decided not to publish it due to a heartbreak it sounds like a movie plot and who knows how much of that is true since it was just a story he told reporters anyway he says her disappearance gave him a personal vendetta against the US and this is what started his decade-long campaign to attack the US he says it wasn't politics

17:52which is just wild because you decided to become an APT because you were heartbroken okay I've heard stranger things on this show let's go

Luan's Hacking Career

18:02let's see where this goes he joined dark web communities met criminals from far off places Russians Iranians North Koreans and learned more about hacking techniques from them he trained up by breaking into small companies that made easy targets he started making a name for himself among the hackers in the hacker community unknown to the rest of the world though until one day when he was approached by an associate a Russian who claimed to be developing some kind of AI platform named Tulip the Russian

18:32needed help asked DOD hey can you help us collect military data it would be useful for Tulip and I want to clarify whenever I say USDOD in the story I'm always talking about this hacker from Brazil that's the name he was going by so USDOD accepted the job and over the next six months some Russian folks he partnered with were able to build an exploit for an unknown vulnerability in the US army IT platform called the Program Executive Office Enterprise Information

19:03System PEO while the Russians did that USDOD discovered that a way into this network could be to impersonate one of the developers who made it so he discovered who developed PEO and started working on getting closer to them he tried getting access through the developer using social engineering techniques and this strategy worked humans are always the weakest link and it was a pincher move attacking the system from two sides together the Russian hackers and USDOD were able to steal source code

19:34and get different databases from agencies that use PEO agencies like the Department of Defense's Strategic Command Central Command Special Operations Command and Defense Technical Information Center and Army Specialist Operations Center the defense contractor Lockheed Martin too the Russians took what they wanted from the deal and USDOD got to take credit for the breach in three days in February 2022 he leaked lists of full military emails and passwords to the dark web and that is how he got the hacker name USDOD

20:05by breaching the Department of Defense and publishing tons of military emails talk about an entrance onto the hacker scene and it was here when the US considered him a threat you don't attack the military like that and expect them to ignore you they were working hard to figure out who USDOD was USDOD didn't stop there he went on a roll after that his next target was InfraGuard this is basically the tip line to the FBI if you have an important business you can register for an account in InfraGuard and then you can report incidents to the FBI

20:35directly and fast think critical infrastructure companies like gas companies dams water treatment facilities or banks that might need to contact the FBI quick to take action on an incident that's what InfraGuard is and that was the site that USDOD was trying to attack it's normal for companies to apply to join InfraGuard so USDOD figured why not try to apply himself but his plan was to steal someone's identity who would qualify to be accepted and submit them to join so first

21:06he looked around for a finance company that would qualify then he looked up the CEO's name got his personal information probably just bought it off the dark web and USDOD filled out an application on their behalf put in the CEO's information that he knew and just faked the rest InfraGuard replied back there's some errors on your forms these parts need fixing so he's like okay and so DOD fixed him and sent it back again and a few weeks later he got another reply his application was accepted

21:37and just like that he was in the InfraGuard system not quite hacking his way in but faking his way in he tricked the FBI that he was someone else and once there he saw that you could talk to other members so he started chatting them up and they thought he was a genuine CEO but then he started poking around the site trying to test the database or servers to see if there's something weak here and he found that the site has an API which is basically a way to query the database but he uses a different authentication mechanism and while he was examining the API

22:08he discovered that you can ask it for all the members contact information and it would give it to you like a big phone book basically but you had to be a member to see everyone else's details nobody knew about this huge vulnerability maybe because nobody who belonged to InfraGard would ever think to attack the site like this it was a perfect opportunity USDOD asked a friend to write him a Python script to grab the data then he used it to steal every InfraGard member's contact information 80,000

22:39CEOs executives and security officers and again he posted it all for sale on the internet and it was around here when he started following me on Twitter so you can see why they thought of him as an APT he was advanced enough to sneak into FBI's InfraGard and persistent to attack the US government again and again and definitely a threat advanced persistent threat title acquired which means the US government would be actively investigating him more now

23:09than ever and I'm not sure how they figured it out but they figured out his name and his name was Luan Barbosa he's from a small city in Brazil but Brazil doesn't extradite their own citizens so I think the US government had a hard time figuring out a way to take him down but despite being actively investigated by the feds his vendetta was just getting started he thought he was untouchable taunting the feds and anyone else I mean his Twitter photo

23:40was just a picture of the cutest kitty you ever saw he found a certain formula for hacking which was working surprisingly well for him step one search through data dumps on the dark web for someone he can impersonate to help him reach his target step two impersonate that target or use their account to get in step three profit using this formula USDOD or Luan broke into Cybersecurity Defense Center at NATO and a

24:10Washington DC club for politicians and the aerospace company Airbus and their 3,000 vendors in two or three years Luan breached so many US government and government related organizations that he was planning on building a business out of it a full-on company selling military intelligence he had some pretty wild access and information and he knew that people around the world would want to have this or buy it from him so why not make a business out of stealing this and selling it to get his

24:41business off the ground though he needed a steady supply of people to impersonate people with military connections and enough of their information to do it right he was buying identities from places on the dark web but this process had friction I think what he was doing was looking to see who worked in a US military place and then tried to search for their names on the dark web so that he could get their data and impersonate them but time after time the people he looked for weren't listed that data wasn't available so he thought what if

25:11I just had a big list of people's identities and then figured out who on that list worked in the military or intelligence and I could just go impersonate them but he didn't have such a list he knew lists like that existed though and went on a hunt to find one that he could have full access to we're gonna take a quick ad break here

Sal's Data Broker Business

25:30but come back because this story is about to take a whole new turn this episode is sponsored by Sentry.io applications break in all kinds of ways crashes slowdowns regressions the stuff you only see once real users hit it Sentry that's s-e-n-t-r-y catches all of it you get traces replays errors profiles and the details around them like stack traces commits releases and the developers who broke

26:01it all in one connected view so you're not jumping between tools trying to figure out what happened Sentry shows you how the request moved what ran what slowed down and what the user saw Seer Sentry's AI debugging agent takes it from there it uses all of that Sentry context to tell you the root cause suggest a fix and can open a PR it also reviews the PRs for you and flags breaking changes with a fix ready try Sentry and Seer free at Sentry.io they have a free dev plan and listeners of the show can use the

26:31code darknet for $100 in Sentry credits when you go to Sentry.io that's spelled S-E-N-T-R-Y go to Sentry.io and tell them I sent you by using code darknet for $100 in Sentry credits there's a new character who comes into our story now his name is Salvatore Verrini Jr. but I'm just going to call him Sal he wanted to get into the entertainment business and decided

27:01to produce and star in his own TV shows and he was swimming in it he owned a mini mansion near Miami with palm trees and a three car garage had a hot red 57 Chevy Bel Air and a hot wife he was a successful guy but I went and watched his biggest show which is called Country Days with a Z it streams on Amazon Prime it's a staged reality show starring him and his friends here's a clip from two minutes into the first episode see what you think hey everyone I'm Sal

27:31the CEO of Everything Country you know the best part about owning your own business you get to hire all your friends yeah baby that would look good hey what's up Sal what's going on Big Mike nothing much man what are you up to nah nothing what are you doing nah nothing hey man I gotta tell you something I got a video I got 100% proof the earth is flat you gotta take a look at this okay so a little backstory on Mike Mike is what they call a flat earther and well they think that the earth is actually flat I mean like really

28:02dude again with this I'm telling you it's round it ain't round Mike just take a look no I'm gonna lose five minutes of my life watching this again you'll probably gain five minutes oh dude come on I'm telling you I promise you you will Copernicus it's round Procurnicus Procurnicus is the guy that that guy you can't even say it whatever he's the guy who thinks it's round I'm the guy who knows it's flat okay I have to stop there

28:32because they just keep going on and on like this for a long time like way longer than they need to but I played this clip for you to give you a sense of what Sal is like and I think Sal is not only the star of the show but also the writer the director the producer the editor he did it all I was curious so I checked turns out nobody watches this show if you go on IMDB reality shows usually have like five maybe ten thousand reviews Country Days has eleven reviews nobody's watching it Sal's personal IMDB page lists his other shows and movies

29:05some of them don't even exist there's a few pictures of him in an action movie except if you go on his Instagram he admits that those pictures were just taken in a photo shoot that he paid for which I think about it I admit I did that once too in high school I somehow faked my way into the picture with the football team so if you open up the yearbook that year it looked like I made the football team but I was never on the team so who even is this Sal guy though where is all this money coming from if his shows don't have any audiences how has he got that big house

29:36and all the money to run a film studio well here's the truth he always wanted to be an actor he was in school plays and got on a Burt Reynolds show as an extra he studied theater in college but it didn't work out for him at all but his dad Sal Sr. is a prominent lawyer in Florida and when Sal crashed out as an actor Sal Sr. probably hooked him up with his next gig in a sheriff's office as a deputy yeah Sal became a cop and it was a huge setback for his dream but Sal didn't give up

30:06he believed in himself and he hatched a new plan to rekindle his Hollywood dreams and I think it was here while working in the sheriff's office that he noticed something which gave him an idea to make money to pursue his dreams again years ago if you wanted to get someone's photo or know their daily routine or who they're in a relationship with or get their phone number stuff like that you'd have to hire a private investigator who would tell the person and gather what they can but today everyone is posting their own private data

30:38voluntarily online especially social media we see photos of people's kids their accomplishments their vacation photos we see them with their new lover or their new home renovation sometimes you just see people post their whole day on social media we don't need a private investigator to get information about where people are and what they're doing and what they look like or any of that stuff anymore it's just all there on social media and so there are companies that go on social media and scrape all that data

31:09to provide it to cops like I remember a few years ago there was a whole controversy about a company called Clearview AI and they were raiding major social media websites they'd take Facebook for example grab every picture and bit of information they could off of everyone's account and then add it to a file that was created about them then they'd repeat for Twitter and LinkedIn and wherever automatically of course the social media companies got mad they're like hey that's our data you're profiting off our data then they sent Clearview AI a cease and desist letter but even those megacorporations

31:41couldn't stop it if anything Clearview is bigger today than they've ever been before I just saw that they signed a 10 million dollar contract with ICE so keep that in mind your social media posts are likely scraped and processed through AI and are easily accessible by ICE agents even if you deleted your post and for the record I don't think this is right the fourth amendment says we should have a reasonable expectation of privacy it says the government has to have a warrant to conduct a search yet ICE is able to get tons of data about us

32:12without a warrant and the loophole they found is that they're allowed to just buy data from data brokers it's the data broker loophole and the thing I hate most about this is we never gave them permission to exploit this loophole we never voted on this we never collectively agreed that data brokers are cool and it's totally fine for the government to buy data from them get around having to have a warrant to conduct a search this was all decided without our input or support and the government hides all this from us they hide how much they pay data brokers

32:42to get information on us I'm disgusted by how much the government spies on us without a warrant when it's clearly a violation of the fourth amendment the thing is this business model is very profitable for data brokers they are incentivized to gather as much private data about us as they can since the more they have the more the government will spend on it they are in the business of brokering your personal data and I think Sal saw how important these data brokers

33:12are to law enforcement and maybe he even caught a glimpse of how much the contract was with one of these and he might have been like whoa I'm in the wrong business so Sal quit his job as deputy and decided to start his own data broker service he created three almost identical websites records check criminal screen and the flagship site national public data he hired some cheap programmers in Bangladesh to code the initial

33:42website for him then he started collecting everyone's data you can think of the data he collected in two buckets there's what the government publicly posts about us such as bankruptcy filings court records motor vehicle records death records you'd be surprised how big this bucket is you ever buy property yeah you're in a public database got married yep that's public data too registered to vote in some states you're in a public database then there's bucket two the dirty work scraping it sneaking it stealing it buying it I'm not sure what the rules

34:13are here but it seems like data brokers treat rules more like guidelines than actual rules because they'll go to great lengths to get private data from people Sal either bought or scraped data from other data brokers subscription and marketing lists loyalty and rewards programs social media and other apps some brokers even collected the data leaked by hackers like USDOD eventually Sal had collected not thousands not hundreds of thousands not millions but hundreds of millions of Americans personal data records

34:44then he packaged it into individual profiles and sold access to law enforcement or whoever wanted to do people search and it worked unbelievably well in 2022 Sal made $750,000 from selling our data and in 2023 he made $1.15 million and he almost instantly turned around and used the money to make his own TV shows here's what he spent his money on I'm telling you it's round it ain't round just take a look

35:15no you ever watch those NASA videos CGI bro no please CGI

35:22I'm looking at Sal's financial records now and there's something telling about the way he spent his money the data broker company's total cash in the bank is $563 insurance expense $1,327 cybersecurity budget zero salaries

35:53yeah there were no salaries he ran it all by himself with two desktops a laptop and file servers in his home office to me the way I see it Sal's data broker business was only set up for him to make as much money as possible and didn't spend a lot of effort protecting this data or securing it so now

Luan and Sal's Connection

36:14that you know what Sal was cooking up let's go back and focus on Luan aka USDOD by this point in 2023 Luan was trying to get his military intelligence business set up and needed a lot of military identities to impersonate to get more data and decided to hunt around for vulnerable data brokers he found Sal's data broker site called Records Check Records Check advertised instant background checks social security number traces and more perfect

36:45Luan was now laser focused on this site locked in trying to look behind the curtain to see everything the site had on people he used the tool to try to scour the site and see every file and image that was publicly viewable on this site and one file stood out members.zip what is this file and why is it just in the open for anyone to grab and look at he grabbed it and looked at it members.zip had Sal's site's source code and buried inside the code were admin

37:16credentials Luan just got the email and password to access any corner of this site and all the data in it so Luan logged in to Records Check as Sal but then discovered the site was connected to two other sites and guess what Sal reused passwords which allowed Luan to log in to national public data which gave Luan access to the biggest set of data that Sal had

37:47and Luan took everything 2.9 billion lines of data 277 gigabytes worth personal information about hundreds of millions of people if you're listening to this and you're American chances are you were likely in this database then Luan does what Luan does and he posts it for sale online as USDOD with the cute little kitty picture and he put the data up for sale for three

38:17and a half million dollars TikTok was outraged this is a public service announcement to remind you to check your credit files I just received an alert from my credit card and also from my credit reporting agency about my data being leaked online 2.9 billion records one of the largest data breaches in recent time why is this one important because you're

38:47not a subscriber to this service this is for running background checks and fraud prevention and so they just randomly collect data about billions of people without your consent we have to protect ourselves now although we're going to have a lawsuit against NPD they did not protect our data sufficiently the problem is the data still got out into the public domain the problem with the NPT data breach is that it is a scraping company that was designed

39:17to find out everything it can about you now if they're a data brokerage company that has other information about you a hacker can start to put together an identity profile on you and then with that identity profile breach your security we all know that data breaches happen all the time but the most recent one has been with national public data it was over 3 million people's data was breached that's from the UK, US and Canada at the beginning of this episode I told you about how that guy Matthew Kieran

39:49stole William Woods' wallet and later his identity and all it took was for him to get William's name, birthdate and social security number and from there it was enough to impersonate William for decades national public data leaked full names birthdays social security numbers home addresses past addresses email addresses and phone numbers all in plain text a lot of it had errors but most of it was accurate the ramifications of a data broker having a data breach is huge catastrophic

40:19to some people listed in the breach researching this episode I came across all kinds of horror stories of people who had their identities stolen after a data breach like a bunch of people in Oakland California after the city was attacked with ransomware they interviewed one guy who was on the news and he said that criminals had impersonated his identity and they were taking tens of thousands of dollars in loans out and making purchases in his name and he was on the hook to pay it all back and so you can imagine the huge nightmare that he had to try to convince the bank

40:50that he didn't spend any of this money that hardly compares to this other girl I read about she was in Florida and she tried to sign up for her first credit card when she went to college but she got denied because they told her that she already owes one and a half million dollars and she's in huge debt apparently someone had been using her identity since she was nine years old another crazy story happened to an LA Times reporter after her wallet was stolen at a bar she knew it was gone minutes after it happened so she thought there was enough time to act before something bad happened

41:21so she called the bank she called the police she called everyone but it didn't matter the thieves used her info from her wallet to get her social security number online and for a whole year they opened dozens of credit cards in her name they rented cars in her name got new iPhones and wrote tons of checks sometimes more than ten thousand dollars and that's just a couple of things criminals can do if they get your information we've already talked on the show about sim swaps if a scammer knows enough about you they can convince the phone company

41:51to transfer them your phone number then they can log into your bank account or crypto accounts and steal all your money I read about multiple people who have lost millions of dollars this way so I'm sure the victims exposed in the national public data breach have faced a lot of similar nightmare scenarios and despite victims being hit with this they might not even have a clue that national public data is what leaked their data it's really hard to know how a thief got your info you know and the worst part is Sal isn't going

42:22to be on the hook for any of the damage done to the victims because how can you prove that the criminals got their data from this data breach when these criminals hide in the shadows of the internet and are seldom caught this is one reason why I despise data brokers they mistreat our private data and don't care how negatively it impacts us they're incredibly greedy for our data and then it gets abused in the worst way possible this is why I've become a privacy freak over the course of making this show I know these data brokers exist and are trying so hard to get my information

42:52and I know there's nothing I can do once they get it I can't opt out or ask them to delete me god I would love to send a cease and desist letter to Equifax and tell them please delete all my data and stop spying on me but no and I know it's just a matter of time before criminals get their hands on my data either from a data breach or buying the data somehow there's just no way to protect it and since I know if someone gets my data it can be catastrophic to my life so that's why I take extreme steps to hide from these data brokers even so much as wearing a disguise

43:23when I go in public sometimes in fact many of you even have met me in disguise and only know what I look like in my disguise it's the only way that I feel like I can empower myself to stay safe in today's internet age I use fake personas burner phones burner emails even burner credit cards and I'm super secretive about my personal life when I go online anyway god these episodes always get me ranting about privacy sorry I know some of you don't care about your privacy so I'm gonna move on but someday I hope to get through to you

43:53I mean I just want you to understand this one thing most companies won't protect your privacy even if they say they do they share it with data brokers and they'll profit off of it or they'll just lose it in a data breach the only one who can protect you is you a couple months after this leak he taunted CrowdStrike a cyber security company claiming he act into them and he got all their threat actor lists and their indicators are compromised and he has it up for sale well the thing is CrowdStrike has some pretty impressive cyber security researchers

44:24and investigators so they started looking to see who USDOD was and they discovered he uses the same email address for GitHub all the blogs and social media accounts he has everywhere it turned out that for years Luan only used one email for everything he did hacking or non-hacking so CrowdStrike was able to figure out his name address phone number tax registration ID and more basically Luan got doxed but privately in a CrowdStrike law enforcement some news outlets

44:54had his details and Luan admitted to what he had done and the dox were true but he wasn't done I saw him tweet this is not my end and then he offered his services to the Brazilian government but that didn't go well now that law enforcement knew his name and location the Brazilian police swarmed in on him and arrested him and took him to jail Sal was doxed too by reporters but he just lawyered up and went silent it didn't go well for him

45:24Congress wrote him a letter calling national public data's lack of transparency staggering now he's being sued for everything he's got and then some multiple class action lawsuits are against him by people who are in the data set unless country days takes off this year he will not be able to pay off even a fraction of that and you would think after having a catastrophic incident like this Sal would just shut down national public data and maybe go back to acting or something but if you visit nationalpublicdata.com it's still there

45:54the site's still up collecting our data and selling it Sal tried to declare bankruptcy to wipe out his debt to society but the judge just saw right through that and did not accept his bankruptcy plea so then Sal supposedly sold his data broker company to another company which is ironically called Perfect Privacy LLC which you won't find much about Perfect Privacy LLC online but you'll find plenty about yourself if you search your name on their website the revamped national public data

46:25advertises that you can find pretty much anything you need from someone's contact information location, age and birthday to workplace relatives and criminal records which has to be the craziest thing about this whole story like a data broker can have a total breach and then continue operating scraping my data storing it without my consent like nothing happened so what's the solution here I don't think politicians are an ally here they aren't going to enforce any kind of data privacy law

46:55since they're the customer for many of these data brokers themselves I mean the government is who mandates that Equifax must be allowed to collect data off of all US citizens without their consent and even if the government wasn't using data brokers they'd claim that they need our data for national security reasons so I think they are no help here but then I was caught off guard when I read that 85% of the members of Congress were also included in the national public data breach and a lot of them

47:26seemed pretty upset about this breach and wanted to do something about it so in April 2024 they did weeks after Luan put the 2.9 billion records up for sale Congress and the Senate proposed a nationwide privacy law called the American Privacy Rights Act it listed protections Americans should have but also had a rule where anybody could file a form with the government to prevent data brokers from collecting their information that is submit a single form and all the American data brokers

47:56would have to delete your information if you want to opt out Democrats and Republicans liked this bill it went up for a vote but then the day before they voted on it it was sabotaged lobbyists came in and put pressure on politicians who then started watering down the bill until most of the useful privacy protections were gone and after that the whole thing died so the American Privacy Rights Act never got off the ground and this is what I mean no one is going to save you no one is going to protect your privacy you have to do it

48:27and lucky for you there are easy steps that you can take to protect it I mean just thinking right off the bat stop using text messages those things historically have been insecure and they typically are end-to-end encrypted and they can be monitored by phone companies so a chat app like Signal takes extreme steps to never be able to see chats even if someone pointed a gun to their head they would not be able to read your messages and the same goes for end-to-end encrypted email providers like Proton or Tuda they cannot see what's in your emails compare that to something like Google who looks through all your emails

48:58to provide ads for you I also highly recommend a web browser that cares about your privacy Google Chrome is the worst on the list every character you type into the address bar gets keylogged and sent to Google they want to know everything about you so I use the Brave browser which makes enormous effort to not collect anything from me so those are three quick and easy wins use Signal use an end-to-end encrypted email provider and use a privacy-focused browser because it's not just about stopping Sal or Luan

49:29from grabbing at your data and exposing you you want to future-proof yourself from tyrannical regimes that are also trying to hoard your data you might be okay with who's in charge now in the world but that's going to change one day and whoever inherits your data next might decide that you're a criminal then it's too late for you to do something about your privacy in the end Luan aka USDOD is still in a jail in Brazil since Brazil

49:59doesn't extradite their citizens to the US he'll probably just serve his jail time in Brazil and is likely never going to go to the US and one newspaper speculated that he's facing about four years in prison but we don't quite know what his prison sentence was are you a premium subscriber of Dark Knight Tires if not why not listen

50:30I'm certain that you've bought a book or paid to go see a movie before you knew if that book or movie was any good I don't want to do that to you I want to give you this show for free in order to prove its value to you and show you that I'm worth pitching a few bucks at have I done that does this show bring you value do you learn from it do you get entertained does it help you get through a long car ride without being too bored if so I want to ask you to become a premium subscriber

51:01to show your things and hey if you do you'll get ad free episodes and bonus episodes there's actually 12 episodes in the premium feed that don't exist anywhere else so please consider signing up go to plus.darknetdiaries.com I really appreciate it the show is made by me the pasta pwner Jackry Sider this episode was written by the DDoS attack dog Nate Nelson sound design by the VHS vandal Garrett Tiedemann and this episode was assembled by the cruise controller Tristan Ledger

51:32mixing by proximity sound our theme music is by the mysterious Breakmaster Cylinder my data has been in many data breaches and once a hacker messaged me saying I have everything bro I have your name your password I'm like no way oh my god thank you I've been looking for that password for years this is Darknet Diaries you you you you you

52:02you you