So I was looking through WikiLeaks the other day, as one does, right? And I came across something that I found rather fascinating. There's a thing that the CIA developed called weeping angel. So if you have a Samsung smart TV, there's a really odd feature in it. It's called fake off. And when the TV is on, you can push mute, 1, 8, 2, then power. And the TV appears to turn off, but it doesn't.
Now these smart TVs often have a microphone built in, so you can give them voice commands. And when the TV is off, the mic isn't listening. But when the TV is in fake off, the mic is still active. So what the CIA did was they developed some kind of spyware for the Samsung smart TV, where it would record the audio from the mic and store it on the TV.
So I imagine a scenario is that a CIA agent would want a listening device and someone's bedroom and goes in, but then sees, oh, they've got a Samsung smart TV, which is already a listening device. No need to leave behind a bug that might get discovered. Let's just live off the land, as they say. So the CIA agent uploads the spyware onto the TV and then puts the TV in fake off mode and leaves.
And the TV sits there recording all the audio in the room, but appears to be off. And then the CIA agent can remotely connect back to the TV and get the audio files or come back into the room later and retrieve them off the TV. It's wild. What spy gear is developed by the federal authorities, isn't it? These are true stories from the dark side of the internet. I'm Jack Recyder. This is Darknet Diaries.
This episode is brought to you by Forronis. So many security incidents are caused by attackers finding and exploiting excessive permissions. All it takes is one exposed folder, bucket or API to cause a data breach crisis.
The average organization has tens of millions of unique permissions and sharing links. Even if you could visualize your cloud data exposure, it would take an army of admins years to write size privileges. With how quickly data is created and shared, it's like painting the Golden Gate Bridge. That's why Forronis built least privilege automation. Forronis continuously eliminates data exposure while you sleep by making intelligent decisions about who needs access to data and who doesn't.
Because Forronis knows who can and who does access data, their automation safely remediates risky permissions and links. Making your data more secure by the minute. Even when you're not logged in, Forronis is classifying more data, revoking permissions, enforcing policies and triggering alerts to their IR team to review on your behalf.
To see how Forronis can reduce risk while removing work from your plate, head on over to veronis.com-darknet and start your free trial today. That's veronis spelled V-A-R-O-N-I-S. .com-slash-darknet. This episode is sponsored by Threat Locker. These days, one wrong click of a button can lead to a catastrophic cyber attack on your organization and nobody has time to keep training poor Doris and accounting on what not to click.
Cyber attacks are devastating to businesses and without the correct solution in place, your operation remains at risk. Threat Locker has built an endpoint protection platform that strengthens your infrastructure from the ground up with zero trust security posture that protects business-critical data while also mitigating cyber attacks.
Threat Lockers allow listing, ring fencing, storage control, elevation control, and network control solutions to name a few give you a more secure approach to blocking the exploits of known and unknown threats and application vulnerabilities. Working together to deny applications by default, block inbound network traffic and ring fencing your applications. Threat Locker provides zero trust control at the kernel level.
If you're looking for a proactive solution that will keep your business better protected in the face of cyber attacks, check out Threat Lockers Cyber Heroes at www.threatlocker.com. Why don't you start by telling us your name and what do you do? My name is Joseph Cox, I'm the author of Dark Wire and I'm also a co-founder and journalist at 404 Media. You know what 404 are doing?
So 404 is a group of four of us, myself, Jason Kepler, Emmanuel Mayberg and Samantha Cole, and we are all former staff members at VICE's Motherboard, the technology site. Unfortunately, VICE made some very poor managerial decisions from the executives and that company is now bankrupt, but we left to make our own company where we want to continue doing tech investigations, we want to continue telling stories and how about we do it in a way where we own the company.
You know, so we can not only make journalistic decisions in editorial ones, but we can make business ones as well in the hope that we can just keep on doing what we love doing, which is another thing, stories, verifying information and publishing stuff that's in the public interest. Well, you've created quite a name for yourself over the years. I always see your name popping up in other books, like an article by Joseph Cox at this and or another story here is quoting you and different things.
It's just really well done on your journalism. What this latest project you're working on, dark wire. So, so I started reading this dark wire and I was just like, oh my god, this is amazing. And I was hoping we could talk about it. So, I mean, I have been working on this book for three, maybe four years at this point, speaking to essentially every sort of person involved, you know, that's that's Laura Forstman, that's also a lot of very dangerous people.
But I don't think I've ever been more obsessed with a story. I mean, I'm sure of that. I've never been more obsessed with a story than this one. So, this is an incredibly nuanced story, which is going to fill your head with a lot of questions. I know it did that to me. Let's first start with some context. I am not a criminal, but I make a lot of effort to be private and secure. Then the first time I made an effort to have a privacy phone was after I read an article by Joseph.
He was using an iPod touch and did all his phone calls over Wi-Fi. The main advantage here is that there's no SIM card in an iPod touch. It basically has all the features of an iPhone, just no SIM card. So that means nobody can SIM swap you. But also SIM cards are notorious for beaconing out to cell towers and giving fairly accurate location data to cell phone providers.
And that's even if your phone is always using a VPN, because SIM cards communicate with cell towers using baseband technology, which operates completely outside of VPNs. So this iPod touch was the main phone that Joseph was using to keep private. That's been my life for years at this point. Yeah, you use that as like a secure phone, right? Yes. For years I use an iPod touch device and now I've moved on to an iPad mini, because the iPods no longer supported unfortunately.
When Apple stopped supporting the iPod touch, I switched over to Graphene OS, which is a fork of Android. It's an open source project, but there's a lot more privacy features added in and unlike Android, they don't send everything I do back to Google. My messaging app of choice is signal, which I can also make phone calls with because signal is end to end encrypted, which means the people at signal can't see my messages, only the receiver of who I'm chatting with can.
And I do so much more to remain private online. So you can see Joseph and I, we take our mobile privacy very seriously and we want the best there is. And then one day Joseph heard about this new privacy phone called a NAMM. So I call it an encrypted phone, which is simultaneously a helpful term, but then also not really helpful at all.
What we don't really have the terminology for it, but yes, it's a combination of things. It had a secure communications app that allows you to send end to end encrypted messages to one another with photos and voice memos and all of that very much like a signal or a modern WhatsApp or a freemer or whatever, right? And it also was a custom phone operating system. It is based on Android somewhat is actually a fork of graph EOS, the privacy focused operating system.
Apparently, a NAMM had also removed all GPS functionality so that there would be no way for law enforcement or Google or sort of third party apps to track the location of those devices. I think the features of a NAMM are amazing. I mean, it took graph EOS, the phone operating system I already use, which is considered great already for privacy and it made it even more locked down. What?
And the features just kept going like, for instance, a NAMM had its own little end and encryption chat app built in, but it was in a secret spot. The thing is there are all these dummy apps on the phone. Like if you look at the phone, it has Tinder on there and Candy Crush, they look like normal apps, but they're just decoys.
They didn't really work. And another app you'd see on the home screen was a calculator app, which worked just fine like a regular calculator except if you were to open the calculator app and punch in a certain code. That's when it would open up the secret NAMM chat messaging app. It was hidden beneath a few layers of obfuscation.
Which, hey, that's pretty good if you're having a private conversation. And I don't know an abusive partner snatches your phone trying to rummage through your messages or if you're a criminal, a police officer does this or a border official or something like that. So there's that. There's also voice scrambling. So you know how on signal you can send a voice note for one another and that's very popular on other messaging apps.
So if you're on a NAMM, you could do one way with ad-i for like a high pitch distortion or a low deep distortion to it as well. And that would mask what your real voice sounded like. Who is the brain child behind an arm who created this thing? So a NAMM was created by someone called AFKOO. I have to be a little bit careful about what I say about them for reasons that we'll get into.
They are from what I've learned a pretty sort of nerdy tech expert for the criminal underground. They were connected to a very well known criminal called Hakan Ayik who at one point was Australia's most wanted man. And this AFKOO character sells or did cell phones in this space before eventually deciding, well, I'm going to go make my like rather than working underneath other sellers and sort of other encrypted phone companies.
I'm going to create my own tech startup for the criminal underground for the criminal underground. Wait a minute. Like all the features of this phone, they're all fine. None of them are illegal. But if you're specifically making a phone for criminals knowingly and purposely helping criminals conduct their crimes. Now suddenly what AFKOO was doing was illegal.
Yes, legally it's very very messy because it's not illegal, generally speaking to sell or use an encrypted messaging app, which is a good thing to be clear, like that should not be illegal. But a lot of these companies in the I would say shadier part of the encryption industry.
The thing that differentiates them is that they deliberately facilitate crime as in it's not like signal who's used as well, of course include criminals or even apple I message or something just because they're very popular.
The taglines was I think it was designed for criminals by criminals, which is just asking for trouble really, but a norm had all of those sorts of bells and whistles you would expect, you know, wiping the phone all of that sort of thing and it really positioned itself as sort of the royals voice of the encrypted phone industry.
So I learned from the book that this is quite a lucrative underground criminal industry. A norm was not the only one here and you got to read the book about what happened to all the other encrypted phone companies like each of the competitors have just as wild and crazy of a story of what was going on with a norm.
So I'm going to give you a job of giving you a tour of this whole criminal encrypted phone industry. But it bugs me because like I said, I'm not a criminal, but I love having a highly secure phone with the best privacy you can get. So it's a weird line for me that this is even a criminal industry. It's kind of like if someone started a hammer company selling hammers, but it was just selling hammers to criminals to kill people with.
It had like features on it like non slip handle for when blood gets on it or blunt side for smashing skulls and fork side for stabbing through stomachs and really it's just a hammer that's no different than any other hammer, but it has the sole intention of being for criminals to cause pain and injury.
And the company works exclusively with criminals to find ways to improve it like why why not just make a great hammer that the whole world can use why make these secure phones for criminals privacy and security is important to the whole world, not just criminals. Anyway, so a nom was this really sleek super private phone that you could buy and have ultra secure chats with others and it was purpose made for criminals.
So it was pitching itself as to its customers and even to its sellers, it was saying your messages will be end when encrypted. We can't see what's going on. We won't turn over data to law enforcement, our servers are outside the reach of the five eyes, all of the normal sort of marketing and privacy benefits you would expect. Except of course, that wasn't true. And I was doing something else in the background. So where are they doing.
So it's very, very interesting on a technical level and what it is is that a nom basically created a ghost contact that was added to every conversation and it received a blind carbon copy of BCC of every message center cross the platform.
So when criminal A was talking to criminal B about a cocaine shipment that was secretly being sent off to the norm and the users were none the wiser it was like having a spy in everybody's pocket in their back pocket looking over their shoulder they could just see into everything. So while it's true, it was end to end encrypted. It was also ended and encrypted directly to a nom servers. Yes, it's almost is end to end to end encrypted doesn't have an end in there.
So the story just took a 90 degree turn the phone was not actually as private as it was advertising itself to be but hold on tight because we're taking another 90 degree turn right now you got to ask yourself why was a nom wanting copies of every message. No, I don't think a nom or afghoo cared about looking at people's chats. However, afghoo knew the value of these messages and decided to make a very odd deal to let someone see those chats.
And I'm not sure how all the logic went down here we really don't know how this deal was made but my best guess is since afghoo wasn't a stranger to being a criminal himself and he may have thought this whole encrypted phone business is actually illegal and could go very wrong for him at some point and he needed a plan.
I really don't know I mean I want to think he was a brilliant business person that just played everyone perfectly but afghoo's lawyer advised him to make a deal with the FBI and let them see the encrypted chats. This way the FBI would appreciate afghoo and not try to arrest him. So why not afghoo's lawyer tells the authorities would you want to use a nom in your investigations in exchange for you know leniency if afghoo ever faces charges right it became the ultimate bargaining chip essentially.
Okay so that's quite a leap you know it takes me and beat to just kind of be like okay that's how the new things going right it's it's your jump.
Yeah and this is very quickly done in the book and that's not because I'm sort of glazing over it is because it just happened really really quickly and that's just a series of events that happened now I don't know whether that was always the plan or something like that or was it maybe always in the back of afghoo's mind I don't know that but very very quickly.
And nom was put on the table to the FBI back in around 2018 I think is when these conversations were happening the FBI and Australian federal police. Yes and the Australian federal police for who for years they've been really stymied by encrypted phones like probably even more than the FBI in Australia.
These sorts of phones are incredibly common among organized crime groups you know you'll have the Italian mafia over there in Australia them using it yours to have the bike again like the cumber cheros and the hell's angels they all use these sorts of phones and for years if not you know more than a decade at this point the AFP in particular has been running into these phones again and again and again.
So the idea of a back door in an encrypted phone is incredibly attractive to them I mean why I've been told is that when the AFP agents were told about this possibility and the plan to go ahead they look like they were kids on Christmas morning. So a deal was made the FBI and AFP Australian federal police got access to all the encrypted messages going across an arm.
And this is where I start to have a million questions who the hell is this afghoo person an undercover cop acting like a fellow criminal but really working with the feds what kind of criminal makes deals with the feds like this. If this gets discovered his whole business is ruined or is afghoo a brilliant business person cashing in on both sides of the fence making money off criminals and federal police at the same time maybe he's playing some 40 chess trying to be a few moves ahead of everyone.
There's a lot of on answer questions here but the afp were the first to get access to this and they were looking through the logs and we're like there's nothing here because a non was just a startup company and didn't have any users yet with the product already in the infrastructure in place it was time to start marketing the thing the next plan was figure out how to get these a non phones in the hands of criminals specifically criminals.
And I guess now I'm starting to see why this phone was purpose made for criminals so the FBI and AFP could see what everyone was doing so it starts when afghoo the creator of a norm offers the phones to a particular phones hello slash drug trafficker in Australia his name is to menico cat answer atty and he used to sell Phantom secure phones one of those earlier companies and when that company was shut down.
He obviously doesn't really have any phones to sell well loan behold here comes afghoo with what looks like it's going to be the hottest new phone on the market so they he provides some of those phones to cat answer atty and just starts using them and just starts talking about them and spreading around I think initially the phones were actually just given for free to cat answer atty it's almost like a sort of Uber techniques Silicon Valley growth technique I don't know just just get it and I'm going to get it.
Just just get it out there for free and we'll figure out the laws will figure out the market later but we just want to get devices into people's hands basically. Early users were like in these phones word was getting out about him and more orders were being made chat messages started to show up and the afp could see what was happening at least for Australians the afp and it was relatively real time instantaneous you know they could see that
Oh the commentaros are talking about beating up this guy oh this bike again is talking about doing a weapons drop off of like high caliber assault rifles at this time in this location it was really like peeling back the curtain on these conversations. Was afp like actually resting people or were they just watching train and figure out what to do at this point.
At the start the afp as far as I know simply collecting the intelligence there is this massive trade off constantly throughout this entire story which is there okay you have a back door into a phone but how do you act on that do you act on it and when do you act on that information because if you go too loud too quickly you're going it's going to become obvious to the criminals that something bad is going on at least for them.
Yeah yeah I found this tension while reading the book quite interesting of oh my gosh there's there's some crime going on here we can see it happening what do we do. Do we got busted because you have to have some sort of good reason well how you knew that was happening and if it was well we've got an access to the you know the chats and your phone then that's going to just ruin the whole company so they really have to be very careful.
And I'm surprised it wasn't just some afp officer like well I'm not going to be careful I'm going to go stop this drug deal and just not understand the intricacies of it. Yeah it got to the point where the people I've spoken to the law enforcement officials around the world they had to do stuff like basically lie they had to make up a story where it's like okay we are finally going to strike on this drug lab or the drug.
We're going to have to act but we're going to write the intelligence in such a way. It looks like it's coming from an informant or a source like there's going to be no mention of a norm no mention of a back door and you know from a law enforcement perspective that's great you know okay we we managed to get the drugs and arrest the people or whatever while without revealing.
You know the the secret about a norm on the flip side there is a justice issue there you know that's basically parallel construction. It's very complicated it gets rain you once but I do think that civil libertarians would be a little bit a guest sort of the tradeoffs that were being made on the daily basis. I think everyone's a gas the whole story.
Yeah because here's a situation where the federal police are lying on the record about where they're getting their intelligence from are the citizens of that country okay with that here in the US during court you're asked to swear that you're telling the truth.
The cops weren't telling the truth here or I guess not yet telling the truth we learn later how they did get this information but the evidence in these earlier cases did not mention on the but additionally they were working with this criminal aff good to get these messages and I call them a criminal because if someone makes an app exclusively for criminals to conduct crimes with. Then historically that's criminal behavior.
So who's aff good and when did the police start making business deals with criminals is their proper oversight here is this within best practices for the feds points to the policy that allows this.
This just isn't sitting right with me and you might say to me Jack the ends just to find the means if all this results and a takedown of a lot of criminals then it's okay for them to lie and do back alley deals with criminals really what about fast and the furious this was a real operation done by the ATF alcohol to back on firearms where they set up weapons deals with criminals so they could track where these weapons are going and ultimately try to arrest a bunch of weapons sellers.
Yeah well it all went wrong the ATF made weapons deals but lost track of the guns that were sold they didn't make significant arrests and basically armed the very criminals they were trying to find an arrest. This ultimately resulted in a border patrol agent getting killed and at the scene of the crime was one of the guns the ATF sold to criminals.
The ends did not justify the means here the fast and the furious operation was a big mishap and it showed how the ATF was operating without proper strategy or oversight or following policies put in place. What is the deal did they did the FBI take ownership of it or how did they was there licensing.
Yes licensing and all and stuff is so the deal itself is between AFG and the US authorities and got paid something like $120,000 and then $60,000 for travel expenses I think is how it's phrased in some of the documents but a non basically became an FBI tech company from why I've been told from people with direct involvement you know.
The FBI was picking up the bill they were paying for infrastructure they were paying for hardware Android hardware for the phones for the app to be flashed on they were they were running a tech company and I think that's just the craziest thing here and beyond that they were running a tech company for criminals.
Yeah and it's fascinating to that AFG is somehow able to control the company in a way that all the developers and suppliers and shippers and everyone even the distributors had no idea that the FBI or AFP was involved right or even that there was a man in the middle I mean what was the what was the kind of the thoughts going on in the developers had did they know that they were building a man in the middle encrypted and encryption or what was what did they think.
So yeah I've spoken to people who actually coded the app and basically made the phone and these were completely ordinary developers you know when I spoke to who I call at it in the book I used a different name just to protect their identity but they found like a freelance and gig online about the secure communications app they get involved and they're doing normal coding like they've done a million times before for an Android app and what they're told is that.
We make this app and we sell it to businesses we sell it to corporations to protect their communications and as part of that companies like to be able to audit their messages you know and that's very common and banking very common and finance all that sort of thing for legal reasons yeah I found that part to be interesting I didn't realize how common that was so the other day I was looking to see if.
Google has any sort of end to end encryption in their chats and I didn't think they did but they're like yeah we do I was like we're sure shoots sign me up and it's like well what we have is for businesses for enterprise and what we the way we have it set up is that the admin of the count can see all the messages that your users are sending encrypted and I was like what hold on a second why would you have a man in the middle of an encrypted thing and then I read your book and I was like oh this is.
More common than I realize where companies do like for instance I think you mentioned you know federal federal agencies have to be able to pull up any communications emails chats messages and stuff in case there's indictments or subpoenas what it what was talked about federally or even state agencies at least in the US here.
This stuff has to be archived and if it's ended encrypted you can't archive it in a proper way so there is a reason to get in and take a look I don't know this this kind of just surprised me. Yeah I mean customs and border protection part of DHS they use wicker the encrypted apps that many people be familiar with but they use an enterprise or government version which yes it's encrypted but has that extra archiving function and the
developers of a norm that's what they thought they were building they thought they were building a communications platform for businesses to yes talk somewhat securely but have the messages archive to so then for whatever reason the administrator can go through the middle later date that's what they thought they were doing what they weren't told was that the phones are being sold to criminals and the archiving feature is actually for the FBI after
the FBI left that bit out when telling the developers about that and I mean just very briefly on that like the compartmentalization the aff gud did I think is very interesting as in like there were the people designing the app and they were sort of in their own silo there were then people making the custom fork of graph EOS the Android operating system and there was those people and then
the other else there were the you know the criminal resellers on the ground and like these groups never really communicated with one another and I'm surprised it didn't leak to be perfectly honest I'm genuinely surprised but somehow it managed to stay a secret at least for a long time too many secrets Ctech astronomy I mean think about it the
criminals think they're the ones being the most secretive here they've got these super private a non phones which you need a pin to unlock and then go through a dummy calculator app to punch in a secret code to get into the chat apps that are end to end encrypted right then they're doing things like disguising their voice and having disappearing messages and being super secretive about their crimes trusting a non with all their secrets then there's
a fgo who is secretly scooping up all these messages and lying to his developers of who these customers are and then there's the FBI and AFP who are secretly reading them all and secretly making business deals with the
AFK who I mean did you know that the FBI was operating a tech startup which was a phone purposely built for criminals to use message each other secrets were kept from you in this story too well criminals had no idea they were being played so a non phones just kept spreading they ended up making their way to some criminals in Europe and things
really started to heat up there the phone start popping up in Europe and that's when broadly sort of the Swedish police get involved and then also the Dutch they are the two main European agencies that first come forward because that's simply where the phones are ending up and obviously the AFP doesn't really have jurisdiction over Sweden or the Netherlands and the FBI
although they are reading the messages by this point they're not in English for a start and the FBI can't really go over and start arresting people in the Netherlands and you know not a nor should they so they decide to share some of the intelligence with their Swedish and their Dutch counterparts
but so it starts to mirror what's going on in Australia with you know more intelligence gathering and the rest here and the rest there but it's still very much under wraps even though more and more cops are being looted some crazy things started happening with the nom at this point it takes more and more 90 degree turns I'm not even going to get into what happened in Europe or South America or Turkey
I'll simply say that there were a few criminals that love this a non phone so much that they tried to purchase ownership of that company and eventually just started calling themselves the CEO of a non which when a major underground criminal is saying he's the CEO of a non it really legitimizes the phone for other criminals to want to buy it so the
non phones are starting to grow wings and take on a life of their own in Europe at this point I've read I think tens if not hundreds of thousands of a non messages and messages from other providers as well and what emerges through reading those is that a lot of people who sell these encrypted phones in a particular market or territory they treat it like having a drug territory like in the same way that somebody may be a the wholesale distributor for you know a certain part of Sweden or maybe
answer you know something like that these phone dealers treat their product in the same sort of way so I want to shift gears here to the FBI so I got a lot of questions about what the FBI is doing here first of all FBI handles internal threats to the United States they're not the CIA which is doing international investigations so I don't even understand why the FBI would be
looking at foreign messages in the first place yeah I think this is something that a lot of people reading the book are going to have an issue with basically I think that's the only way to put it which is like why is this US law enforcement agency intercepting and reading messages from all over the world and the best answer I have is that well there's two there's sort of the legal one which is that you know the
fourth amendment only protects people on American soil right where you have to get a search and seizure warrant to go through communications or a wiretapper order or whatever right not to get too technical the FBI does not need that for overseas and that's basically sort of the loophole that they used where they were able to go through all of the
data the second one is like sort of a how they see themselves and maybe a how they see their their ethical obligation as well but like the prosecutors I've spoken to who are involved in this case they just simply see this as a good thing and they want to go out and they want to shut down all of these criminal gangs they want to intercept them I think that there are valid questions about you
national sovereignty and all of that sort of thing but that is what the FBI set out to do they set out to wiretap the world essentially and they were very very successful other there's just so many questions I have at this point not many phones were in the US so the FBI couldn't really look at US citizens chats even if they wanted but the FBI was heavily involved with an arm creating this startup basically funding it creating an infrastructure actively monitoring the messages
and it just makes me wonder have they solved all the cases in the US already because to start a tech company and collecting and analyzing and reporting intelligence so that you could give it to other countries that takes a lot of time and resources so whose idea was it to divert FBI resources to focus on stopping crimes in Sweden and Australia I mean it it's partly they're doing it because they can they can monitor these communications they can yes they can't go arrest people themselves
but then they can provide that intelligence to foreign partners I mean it's sort of a overused cliche at this point you know the idea of America being the world police or whatever but there is there's an element of that stereotype here in that the FBI went out and they collect all these messages all around the world
even though they couldn't monitor what was going on in America this is sort of the future of policing that we're in now and there wasn't really a debate about it it was just like one day or several days over the past few years police have just decided that they're going to hack or ever ways intercept communications all around the world basically and we didn't really get a chance to talk about that as a society about whether that's something we want
maybe it turns out we do like I don't know but we can't have that conversation unless we know what's going on and that's kind of what I was hoping to do with this book pause and consider this the FBI's fundamental mandate is to protect and defend the nation from threats defend
however in this story they've gone on the offense in the name of defense and this difference is worth noticing I mean imagine you're defending yourself in some legal battle and you're worried you might lose because of some surprise thing the opposition might bring up
so to defend yourself better you decide to break into the other lawyers office and steal all their notes that they have on the case or hack into their phones and see their chat messages all so you can better defend yourself well this tactic would be unequivocally unethical yet the FBI's strategy here is to penetrate private chats in pursuit of criminal activity it's crossing that boundary from passive monitoring to active intrusion
and I think it's important to be aware when that boundary gets crossed because we never see them cross it since it's always done in the shadows if the FBI were to cross that boundary in the physical world it would be akin to them secretly breaking into thousands of homes rummaging through personal belongings because they're trying to detect crime
this wouldn't be acceptable so why then should our digital lives be subject to a lower standard of privacy I guess the FBI uses all kinds of spy care though to cross that threshold all the time like wiretapping and planting bugs they're always covertly reaching into someone's communication and taking it but I think what's different about this story is the mass surveillance aspect to it all messages for all users were being collected and stored
maybe it wasn't stored in the FBI's database exactly but the FBI was funding this company who was collecting it all I remember when the Snowden revelations came out the NSA and GCHQ were trying to collect massive amounts of data flowing over the internet not targeting a specific person just grabbing everything which means a lot of dawn criminals were getting their data analyzed
and I wonder is that offensive as well? It's mass spying at least and I for one don't approve of governments doing mass spying on their citizens but this is a crazy ethical dilemma because what if the mass spying is just on the criminals?
I think that's something that cryptographers and privacy experts I spoke to in the book were worried about which is that some of them are less worried about the specific case of a norm, what some are to be clear but they're more worried about well what happens now if we have a network that's 90% criminal
and 10% normal users is that a fair target? I don't know what happens when it moves to 50-50 you know and there's a really good quote in there from Matthew Green and the cryptologist and he says that well maybe 50% of the criminals on this network are doing really really bad stuff like trafficking or whatever and then 50% are doing like I don't know copyright infringement of song lyrics something that I don't think many people are really care about
in the eyes of law enforcement is that fair target and that's the discussion we're not having and we need to have that as quickly as possible because I've always law enforcement is just going to go ahead and do it people sometimes say to me when we're talking about government surveillance that they've got nothing to hide and they aren't worried about it well what those people are really saying is that they're always going to comply
with the government no matter what they're never going to have dissenting views or protest and honestly I've never met anyone who 100% agrees with the government no matter the leadership it's important that we preserve our freedom to have opposing views without the government watching us
because the thing is if we're being watched it changes our actions I mean gosh in this story the FBI themselves has stuff to hide and they can't spy on people in the US without proper warrants and stuff but they were circumventing this rule by providing intelligence to other countries and then those countries providing intelligence back to the FBI.
Yeah, yeah it's it's it's a worry and that's a big worry in the story and one's and in this case like even though the FBI can look at phoenix in America the AFP agreed to keep an eye on the ones on American soil for threats to life and you know on one hand you could say that well it's good the AFP were monitoring that so nobody got hurt hopefully on the other end well why didn't the FBI just get warrants
and do it themselves yeah we're going to take a quick ad break but stay with us because well clearly you can see there's a ticking time bomb going on at this point the enanthones were getting picked up by some criminals in Europe who were taking them to Dubai to try to sell them there.
Some of the phones landed in Dubai and you know part of the UAE and the UAE is very interesting because it's one of the very few places that you're not allowed to just go around and start selling an encrypted phone or an encrypted app if it is not approved by the government you can get into a lot of trouble you know I guess sort of in the same way as like the Russian Federation right? Wait why is encryption a problem there?
It has to be approved by the government is basically a combination of a censorship and a surveillance sort of posture whereas if you are selling an encrypted app that the local authorities and national authorities do not approve of you're not allowed to do that and the reason being is that well they want to be able to access that and somebody running around selling a non phones is not going to get on that good side.
See it's not completely out of the question for your government to ban encryption to force the people of the country to use certain apps so they can see into it. This I think is a huge violation of our privacy. Luckily in the United States we have the fourth amendment of the Constitution which states I'll read the whole thing for you.
I'll read the people to be secure in their persons houses, papers and effects against unreasonable searches and seizures shall not be violated and no warrants shall issue but upon probable cause supported by oath or affirmation and particularly describing the place to be searched and the person or things to be seized. The fourth amendment is needed to maintain a balance between national security interests and individual rights.
It's a tool to make sure that the government actions are subject to oversight and grounded in legitimate need. If we eliminate that protection it creates a really dangerous power dynamic and a slippery slope towards a government that could abuse its power with no accountability. If the US government did some kind of mass surveillance and was searching through all that data without a warrant it seems to me it would be in direct violation of the US Constitution.
And yet here's a situation where the FBI was running a tech startup with the entire goal to be snooping on other users' chats watching every message to see if there was criminal activity. There's no targeted search here. No individual warrants were being made at this point. They were analyzing all the chat messages going through ANOM. Is this in violation of the fourth amendment? I can make a case that it was.
And the FBI had that in their head too so they were trying hard not to peek into any Americans messages. The data was available in ANOM's database but they had to program their system to only show them foreign chats. I mean I walked through the same rooms where the FBI was reading the anonymous messages in. I've obtained screenshots of what the FBI interface looked like so I feel like I feel like I can put myself in the head of some of these FBI agents
because I've also read a ton of these messages as well. And the system itself is called Holler Hybot. You log in initially it was just from the San Diego FBI field office but then they made it remote as well for the European partners and also because of COVID people can go to the office as much. You log in and there's sort of a green and black interface and you can click on an individual ANOM user.
And it will show sort of a constellation of all of their contacts. There'll be a circle in the middle and it'll be another circle that they spoke to. And another circle which shows sort of the group chat you can then zero in on those. It's almost like a malty go sort of interface. And then once you go to a specific user you can see all of their messages. You can see all of their photos. And rather, handily there was also AI powered summaries of what was being spoken about.
Powered at least in some way by Amazon, the FBI used some Amazon capability there. So you can look on the right side of the screen and it's like Jerry is talking about a cocaine deal or whatever it is. And sometimes it's that blunt which was just always hilarious to me. But when it gets to the point where there are millions and then tens of millions of messages, the FBI had to turn to some of these AI capabilities
because otherwise they're going to be swimming in data. And by the end they were absolutely swimming in data. There was a real danger. But if they did not analyze every single message, well what would happen if the one message about a deaf friend got through and then somebody died? That was a constant threat and it really, really ramped up as a non became especially more popular. This tool that they were using was it developed by a nom or developed by FBI?
Hollow Eyebot was developed by FBI computer scientists who was made in house as basically like the surveillance interface of a novel. It sounds pretty advanced to be able to have this graphical view of who's connected to who and then also use AI to search for. Because a lot of criminals are using code words for different drug names and all this kind of stuff thinking they're outsparting the police. But they're able to find all that.
Yeah and I mean if you think about it like imagine a normal wiretapping like LA or something and it's one guy talking to another guy in a normal phone and they're talking about a drug deal. And if you're the FBI or whoever you have to figure out who these people are and that might be tricky. You know as you say maybe they're using code names maybe they're using pseudonyms and then you go about and you maybe get phone location data you figure out who they are whatever.
Now imagine doing that for something like 12,000 people in 150 different countries. It's like I almost can't picture the task in front of them and that's why they had to turn to these pretty sophisticated systems for figuring out not just what people are saying but who the hell these people even are. And they would do that and then even put you know the stereotypical graphs on the wall in the FBI with the layouts of different criminal organizations.
And in some cases the FBI doesn't even know who these people are at first. They're just like well we have a new crime syndicate on the platform this start mapping out how they're related to one another. So you said you know we're looking for that start to life or what was there what was like really what they were like let's not let this slip through and really trying to focus on.
Yeah so as well as the drug trafficking the main thing that flowed across a norm were what the FBI calls threat to life and this is where a criminal organization or just an individual criminal will want to harm torture or in many cases kill somebody else. And this happened across a norm constantly to the point where one of the FBI agents who was reading the non messages at first his task was just to go through every single image that was sent across the platform.
And often these were weapons or locations or targets. And the way it was described to me is that it's trying to figure out a puzzle basically as quickly as possible you have to take all these disparate pieces of information and maybe you only have a photo of a weapon.
So that indicates there's probably going to be violence here or maybe you only have a photo of the location is like what something's going to happen there and the FBI would have to very very quickly as best as I could figure out this puzzle. And then you have to find information to foreign authorities who could act on it and then maybe save people or maybe not. I don't think it was always successful but they did save lives in the process as well.
It's got to be really complex because when you when you just see two criminals talk to each other over. They're going to easily say I'm going to kill you man. That doesn't necessarily mean he's going to kill them. But it's just one of these this way our lingo is and then the opposite is when you're saying okay listen we really need to you know off this one person there's also like all kinds of you know.
Code messages in there just be like all right minus one this guy and like minus one what is minus one mean all means get him kill him right so you have to like decode this this that doesn't that must be incredibly difficult. Yeah there's a lot of posturing in there for the normal messages I've read where there are people doing exactly that like I'm going to kill him or whatever and then you'll come across messages where like they are talking specifically about getting a getaway car
to drive away from the restaurant after they've killed somebody then they need to rent an Airbnb to hide the assassin in like when it starts to get specific and granular at least to me that's when it's like oh okay we need to actually take this seriously and that's what you know the sweetest of
these did the Dutch as well and especially the FBI. Yeah and it's it's also wild because typically what we're talking when we're looking at the or when I was reading the book it seemed like this is criminal on criminal gang on gang activity right and so trying to save the life of a criminal is sometimes a strange you know moral situation you're dealing with here.
Yeah it puts the FBI in a complicated ethical spot and it puts the agents the foreign agencies and same spot as well what started to happen was that the FBI or his partners was intercept communications about a threat to life the authorities were then act on it you know they would somehow stop the killing and that could be in various ways but then what would happen would be there the criminals will continue talking and they would go how do the authorities know we were going to kill this guy
and they wouldn't assume it was a non they would assume there was a mole or a rat in their organization and then they would try to kill that person said then the FBI has another threat to life and they almost became like this endless cycle or spiral where it just started to become exceptionally difficult for the FBI to maintain tempo as is the way they described it.
There's so many ethical and moral dilemmas here I mean just imagine the AI tool that's out there scouring messages looking for threats to life but the tool has to be trained to ignore it if it's an American.
And the phone as I found through reporting this book they absolutely landed on American soil there were a number of phones being used inside United States there was a plan to start for the FBI to start reading those messages but it was very difficult for them to figure out what to do with all this information they collected.
They are basically stone ward in being able to look at us communications they just didn't seem to be the appetite to go after people inside the states even though the prosecutors and the agents on the case very very much wanted to they were ready to do it they were collaborating with a field office in Los Angeles as well.
It was just a matter of basically pulling the switch but higher ups the DOJ shut that down essentially what I mean what what are these chats look like does the FBI go to Congress or what and say like hey we've got this okay I sit down because I got some crazy story to tell you we've got this we've got this massive valence tool that we somehow bought from some guy.
It's now we now have like view into like the whole criminal world here in the US and or you know a large portion of it we would like to do a mass arrest because we can see this and but we don't have the the warrant we need to help like what is that what do you have any understanding of what those conversations were like.
Yeah so what happened when it was first approved for the FBI to gain access to the messages in general was that most drug prosecutors in San Diego in a specific meeting I describe they were like no this is a ridiculous idea you can't do this and then. But so on top of that they were like well don't even look at the US chats right like just look the other way because we don't have a approval to even look at it.
Yes exactly they were like please don't look at the US messages we will figure that out later and what happened was was that the prosecutors on that they they send their request to a specific part of the DOJ called the office of enforcement operations and they're the ones who basically approve every white
tab if you want a white app in the US they have to approve it and the prosecutors on the anonymous cases sent that and OEO just sat on it for months and months and months there was clearly like this
device between sort of the cowboys on the enormous case and then like the scene the more senior people in DOJ who's like we're absolutely not approving this and a norm obviously grew to a massive size even without that but it could have grown even bigger with potentially even more disastrous consequences. Like we've been talking you know it introduces so many ethical dilemmas within law enforcement of what do we need a wiretapped for this and all this kind of stuff.
What's allowed and what's not allowed and they're just like screw it we're going to just get all the data and we'll figure out what's allowed later it seems weird to go that direction.
I absolutely think there should be a debate around whether secretly running a company should be allowed there should be a debate on whether we want to be able to hack into entire telecommunications providers maybe the end result of that conversation is that we as a society are okay with the trade-offs but I don't think ordinary members of the public one first of even know this is basically happening the second of all
on to wherever those trade off see been are like how can we even have that conversation when this is basically done in the shadows and then everybody moves on. Yeah and I also just realized how if the FBI is running a tech company that is communication platform which is facilitating the murder and drug deal.
Are they responsible for we're the ones who made this communication possible we're the ones who put the phone in your hand to make this even happen there is there is some responsibility there. I mean there's no two ways about it the FBI facilitated crime with the development and the ongoing maintenance and the seeker running of a norm.
The FBI was a tech backbone of organized crime now yes of course they also have the surveillance capability as well but they were selling a product to criminals and the criminals making great use of it. It's like the ends justify the means in some way.
I think that is how people who worked in the operation would phrase it and as for the ethical responsibility from everybody I've spoken to they did take the ethical consideration seriously like we're running this communications platform and that's why if a murder does flow across the chats we need to respond to it aggressively and quickly. Now that didn't always work out unfortunately but that was the approach they were coming from but the end of the day.
Those messages were still on FBI chat up. I think about Afghu again he was making a phone for criminals right like he was working with criminals listening to their requests and adding in features like a remote wipe ability so because Afghu was making this for criminals it meant he was a criminal clearly right. Yet it was the FBI who was the true owners of this company so what is that make the FBI if they were making something purposely for criminals to use.
The implications of the story just keep going and going I'm telling you I have like a million questions I just love this book. June 7th 2021 yes what happens on this day sure so. The FBI and its foreign partners they decide on a date June 7th 2021 the reason for that is that the country there was sort of part of the technical infrastructure Lithuania they're caught order was running out but basically a norm which is getting too unwieldy it was starting to get out of the FBI's control.
Sellers were pushing into countries as they wished every time the FBI asked for more resources to monitor the messages which was eventually like 130 FBI agents in total then more messages came and they have to ask for more resources there had to be an end point and that was basically the date that was picked before it went over the edge. We spoke to multiple law enforcement officials who were part of that day and the pressure and the stress they felt was incredible.
The way it was set up was that it was almost a global line of dominoes starting in Australia and they would do their arrests first it would then move over to Europe and then they would do their arrests and then eventually when people woke up on the west coast in San Diego.
The FBI would come forward and they would take credit for running a norm it was the single largest law enforcement action in any one day something like 10,000 police officers were involved in that one day in this world spanning relay race domino track of activity. Good morning. I am Randy Grossman I'm the acting United States Attorney for the Southern District of California welcome thank you for being here.
We're here today to announce the unceiling of a federal indictment by a grand jury in the Southern District of California which charges 17 foreign nationals in facilitating drug trafficking money laundering and obstruction of justice. This is part of a worldwide law enforcement operation that has resulted in hundreds of arrests for drug trafficking money laundering firearms violations and crimes of violence.
These international arrests and the US charges were possible because of a San Diego based FBI investigation like none other in history. This investigation called operation Trojan Shield shine to light into the shadowy industry of hardened encrypted devices.
For the first time the FBI developed and operated its own hardened encrypted device company called anem a n o m as we allege in our indictment criminal organizations and the individual defendants that we have charged purchased and distributed. Anem devices in an effort to secretly plan and execute their crimes.
In fact, anem's distributors administrators and agents had so much competency and the secrecy of their devices that they openly marketed them to other potential users as designed by criminals for criminals. But the devices were actually operated by the FBI. The worldwide implications of this investigation are staggering. In total, the criminals sold more than 12,000 anem encrypted devices and services to more than 300 criminal syndicates operating in over 100 different countries.
This was an unprecedented operation in terms of its massive scale, innovative strategy, international coordination and investigative achievement. Operation Trojan Shield has shattered any confidence criminals may have through the use of hardened encrypted devices. Shattered any confidence that criminals may have in the use of encrypted devices? I'm not sure this is a good take because what about me who just wants a hardened encrypted device for privacy and security?
If you're an ordinary person and you're trying to figure out whether an app is legitimate or not, it can be really, really hard to tell. Yes, you look at the owners like all of that sort of thing and maybe some researchers dig through the code or whatever it is. But even beyond that, even beyond looking for specific answers, it's just that we know the FBI is prepared to do it now which changes the conversation. Someone even asked the FBI at the press briefing about this.
Is this something you can replicate and do again? Who knows? This will lead all of our criminals guessing of what company out there is actually a true secure company in which is run by potentially the government. We obviously have the technical capability and obviously the international partners to work these types of cases in the future. I basically believe the FBI is absolutely exploring more of this.
To get some of the information in the book, I snuck it into a law enforcement only conference in Vancouver where two of the agents were talking. And towards the end of that talk, one of them said they look forward to what the next version of Operation Trojan Shield, which the anomal operation looks like. That's not an agency saying, okay, job well done, this will go home. That's an agency looking for an even bigger thing to do next.
And as well as an arm, there was the sky hack, there was the encroach at hack as well. Absolutely. Law enforcement are continuing to push down this route. I mean, some of the police officers I even spoke to told me that the Dutch authorities told me we are doing this right now. Tanks, this is why I love Joseph so much. He's sneak it into law enforcement conferences to get the story.
We've skipped over so much of the book. I purposely left out some of my favorite parts of the book just so you can enjoy it still. This story goes deeper and deeper and deeper. And so you should do yourself a favor and go read Dark Wire by Joseph Cox. A big thank you to Joseph Cox for sharing this story with us. You can find a link to his book Dark Wire in the show notes again. It's highly recommended.
This episode is created by me, the bitbombler, Jack Reesider. Our editor is the silicon sorcerer, Tristan Ledger. Mixing is done by Proximity Sounder. Intro music is done by the mysterious brake master cylinder. One time, I went into a client's data center to do some work on their servers. And I found a computer that was so old. Its IP address was one. Just the number one. This is Dark Net Diaries.