You're listening to the CyberWire Network, powered by N2K. The IT world used to be simpler. You only had to secure and manage environments that you controlled. Then came new technologies and new ways to work. Now employees, apps and networks are everywhere. This means poor visibility, security gaps and added risk. That's why CloudFlayer created the first ever connectivity cloud. Visit cloudflayer.com to protect your business everywhere you do business.
Welcome to SpyCast, the official podcast of the International Spy Museum. I'm Erin Dietrich and dear host, Dr. Andrew Hammond. Every week we explore some aspect of the past, present or future of intelligence and espionage. If you enjoy this week's show, please consider leaving us a five-star review. Coming up next on SpyCast. Oftentimes when we think of dark personality characteristics like psychopaths or narcissists or macchi-values, we tend to think of violent criminals.
But do the work that we did in the see back and they continue to do now, there's a really rich understanding of how these immersive personality constructs exist in cyber and counterintelligence offenders. Fans of criminal minds, mind hunter and silence of the lambs, we think you might enjoy this week's episode. You've watched the movies, you've seen the TV shows and now it's time to learn about the real deal, the FBI's Behavioral Analysis Unit.
And who better to take us through this world than this week's guest Cameron Maillan, the creator and founder of the FBI's Cyber Behavioral Analysis Center. After his over 20-year career with the FBI, Cameron continued to use the skills he learned in behavioral analysis in the private sector, founding the company Modis Cyber Andy, a particularly clever name for a fascinating line of work.
In this week's episode Cameron and Andrew discuss the origins of behavioral profiling, applying behavioral profiling to counterintelligence and cyber threats, nature versus nurture in criminal behavior, and the future of deception and cyber warfare. The original podcast on intelligence since 2006, we are Spycast. Now sit back, relax and enjoy the show. Well, it's a pleasure to speak to you Cameron. Thanks ever so much for taking the time to talk to us. It's a pleasure to be here, Andrew.
Thanks so much for inviting me on. So I think the obvious place to start is at the top, what is behavioral profiling. I feel like everybody that listens to this is going to have an idea of what it is, but that idea is probably disproportionately influenced by watching movies and TV shows. So from someone that actually did what is behavioral profiling. Yeah, it's a good question. There's a lot of names for this too. Some may refer it to psychological profiling or criminal profiling.
It's formerly known now that that was a criminal investigator analysis. And it's basic precept, it's an investigative technique to identify the major personality, behavioral and psychological characteristics of an offender based upon the crimes that he or she is committed. Just if we can break that down, what's the behavioral part? What does that mean? So we can discuss profiling in a second, but what does behavioral mean?
Yeah, so the behavioral aspect is assessing the way in which an individual acts. And that is cognition, it's emotion, it's a myriad of psychological and emotional and motivational and belief characteristics that the person has. So when we talk about psychological characteristics, it's a myriad of different things. It can be personality, attitudes, values, beliefs, motivations, self-concept culture.
And the idea there is from the behavior you're inferring facts about that during the investigation or you're interpreting those things from patterns that are evident in crime scene behavior. It must be quite hard to go on a date with this kind of scale set as a nod. Yeah, I mean, it's my wife is actually a behavioral profiler too, so I guess it takes two profilers to get along, I don't know.
Do you find it difficult to turn off when you're meeting people or I don't know if you have a kid that's introducing their part more to you or something? It really is, it is. You get a lot of training, you get a lot of experience and it's like anything else Andrew, once you have that knowledge and once you're so used to using those techniques, it's very hard to just fundamentally turn those things off and not make observations and then behind those observations make an assessment.
Which doesn't say that everyone I'm talking to or anyone I encounter, I'm assessing them, but you're going to pick up things, you're going to be very observant and it is hard to turn off and it's a fair way of describing it. And what is the profiling part of this? So we've spoke about behavioral, what's profiling?
Yeah, no, that's a good question and it's an important question because I think when people hear the word profiling, it can have a negative connotation, like stereotyping and that's not the case at all. This is on a basic level, this is developing the behavioral personality and biographical characteristics of an unknown offender as the traditional way you look at it.
At a deeper level, this is the process, this is the systematic analysis of an offender's behaviors, their decision-making processes, their emotional responses and their psychological characteristics.
And so you use these things to help predict how an unknown offender may act in a certain situation or a known offender if you're assessing them for a different reason and they can provide insights into their personality, their mental state and their underlying motivations, which is often a big part of what we're asked to assess. This also, I think it's important to bring up a couple of concepts with the notion of profiling. Oftentimes you hear inductive or deductive reasoning or profiling.
And so in behavioral profiling, there is both an inductive profiling process, which is essentially a bottom-down where you're looking at statistics or research, probabilistic knowledge or your anecdotal information that's gathered over the years. And the BAU does a lot of research and you may apply those things and start coming up with some general hypothesis.
And then you may use deductive profiling, which is more of a top-down process where you're using this type of analysis in the context of a case. And so those are different processes. It's both a bottom-up and a top-down approach. That's not one or the other, I think, historically people have looked at behavioral profiling. So it was inductive or deductive. It's both. It's both of those things. So you'd that this at the FBI, right? Right. Exactly.
So what are the originators of behavioral profiling and the FBI? Because this is probably one of the main places that people know through the police procedural shows and so forth where they bring in the FBI profiler to say X or Y. What are the sorts of origins of this and the FBI? Yeah, that's that's a great question. And no doubt the FBI has certainly been central and integral to modern behavioral profiling or this criminal investigative analysis process.
But there are some notable people, I think, are worth mentioning that your listeners would have some interest in and probably know about, but maybe didn't consider in this particular area. The first Instructor, Thomas Bond. And he was a English surgeon and in 1867, he was assigned to the London Metropolitan Police. People know that often as the Scotland Yard. And in 1888, he was asked to look at the inquest into the White Chapel murders or what notice a White Chapel investigation.
Some may know this as Jack Deripper investigation. So he was a surgeon. He was someone very steeped in psychology as well. So he looked into these respective victims known as the canonical five. He actually did the autopsy of Mary Jane Kelly, who is one of the canonical five in that case. And he assessed the characteristics and the psychology of the person who may have done those murders.
So he is often considered one of the founding fathers of behavioral profiling or criminal profiling as is another guy that was around in the late 1800s, early 1900s, Hans Gross and Hans Gross. He was an Austrian jurist and he was also a criminologist. He is often recognized as the founding father of profiling, which is weird because you can't have multiple founding fathers. But depending on the context of whom is deciding this or who the opinion comes through. But he wrote a book in 1893.
I have the third edition. I don't have a first, but it's called Criminal Investigations, a practical textbook. The original is in German and it was translated here. He really goes into a deep focus on human nature and the motives of a criminal. And he was a criminologist and a jurist. We basically investigated judge and Austria, but he really, really focused on human behavior. He's often considered a founding father of this discipline.
And then the last one in more modern times is Dr. James Brussels. And he was a psychiatrist and criminologist. He was oddly the assistant commissioner of the State Department of Mental Hygiene in New York City. But he was brought in on two very important cases where criminal profiling was used. The first is people are familiar with George Matysky or if he's known as the Mad Bomber. This was like a 17 year bombing spree in New York City from 1940 to 1957.
Dr. Brussels interviewed him, he testified in his trial and also he assessed the Boston Strangler Albert de Salvo who killed a bunch of women, 13 women in greater Boston in the 1960s. And so he really is considered one of the modern founders of criminal profiling because he did that very thing in those very central cases. So it started out with regards to serial killers, is that a fair statement?
Yeah, so serial killers certainly when you look at those respective people, the three I just mentioned, in terms of the FBI, this started off in the late, like 1972 is the data that's often used. This is because this was the creation of what's known as the behavioral science unit. It's now called the behavioral analysis unit. We can talk about that later if you'd like.
But originally it was called the behavioral science units or the BSU and it was created in 1972 and a lot of people often attribute the behavioral science units to John Douglas. And he is a very important person in the evolution of behavioral profiling. But it was originally created by two different agents, one guy Howard Teton and the other agent Patrick Mulaney.
Because these were special agents, they came in in the late 60s and Teton was teaching applied criminology at the headquarters building in DC starting in 69. The FBI Academy opens in 1972. Patrick Mulaney comes in and they start creating this unit where they're applying these behavioral principles towards investigations. And it's in the late 1970s where John Douglas comes in, Robert Ressler and a little bit later, Guy Nimroy, Hazelwood, very important.
They start bringing their own piece to this, their own efforts of understanding what drives serial killers. And they would do what's called road shows. They would go out and they would provide consultation to police officers and law enforcement around the country.
The other thing that they would do that was really important in this is they would go to penitentiaries around the country and they would interview convicted serial killers to figure out how to predict future crimes and how to apprehend them faster. And Ressler himself is often credited for coming up with the term serial killer. And you know, just going on to the FBI and behavioral profiling, can you help me just understand a more universal level?
Like how have the FBI contributed towards the development of behavioral profiling? Because obviously there's a lot of serious people there. There's been intensive training. I'm assuming the field has developed just like every other field, like help me understand the relationship between the FBI and behavioral profiling a more universal level. Yeah. So as I mentioned, that the behavioral science unit was created and then eventually evolved.
There was a lot of different training, a lot of different people with really steeped backgrounds in psychology came into the unit. There was an effort to create what's called a three-legged stool, which is the concentrated work, research, and then training using these to inform each other to continue to get better on the unit, to get more fidelity on psychology concepts and the application in assessing criminals. And over time, this evolved.
It got bigger, more units were created eventually in 1985. The behavioral science unit became known as it is now, is the behavioral analysis unit. And this expanded. From 1985, you had this Congressional Mandated National Center for the Analysis of Violent Crime. There were different units. There was crimes against children. There was a unit that was focused on terrorism. There was a unit focused on crimes against adult victims.
And through these teams that got a lot of experience, a lot of training, and a lot of collaborative analysis, these cases are assessed as teams with profilers over and over, more experience, more training, more research, these things, all feed each other to become better and better and better.
And what the BAU is known for is providing a lot of training to local state and federal law enforcement and bringing those folks in and giving them a background in this and creating more folks that are steeped in this space. And just briefly, can you tell me a little bit more about the training? So we're going to go on to discuss your time doing this line of work and the line of work that you've done it with.
But can you tell me a little bit more about how one becomes a behavioral profiler for the FBI? Sure. Yeah, it's a very competitive place to go. And I bet I suppose it would be helpful to kind of break down what exactly the BAU is. It's actually a bunch of subunits that have their own specialties. It's known as the BAU, but it's actually BAU's because the number that there are there.
But to get at its quite competitive, typically your first, your special agent, you're going to be doing your field work, you might go to different headquarters units or whatever your specialty is, and then you have to put it to one of the units. And it could be that you're someone who specializes in crimes against adults. It could be that you're somebody who specializes in cyber. You apply to be a part of that unit. It's very competitive. There's interview processes.
But once you get in, if you're selected, there's a very immersive level of training. Once in months, it's colloquially known as phase one training where you're classroom-based training. There are some field trips to other places where you're learning from specialists. But you're getting immersive deep training in different areas of psychology, emotion, sociology, abnormal psychology from experts all around the world. A lot of times you can say this is like a second FBI Academy.
Because certainly you go through an academy to become a special agent. But to become a profiler, it's this whole other aspect of training that goes on for approximately four months, give or take. And from there, you become a generalist. So you're not certified until you go through a very rigorous protocol. You're going to be rotating between units, carrying cases in another unit, becoming a lead profiler on a violation that you may not be going to that unit.
You have to do, say, if you're cyber, but you might have to do a case in the threat assessment side of the house. You may have to go over and you have to do cases in every unit until you go through this very rigorous protocol. There's a very, it's a credited process. And the certification is a rigorous training protocol to get through, to get certified. And how long is the final phase? I think in total Andrew, it's generally seen as two years.
Some people try to do a harder sprint to get through it. But ultimately, if you were to average it out, it takes someone between 18 months and two years to get certified. Sometimes a little bit longer. So when you were doing your training, for example, you would go on to the threat, you would use, so you would be the cyber specialist, but you would do some time with the criminal profiling on the assessment and so forth. Yes, exactly.
But even though I knew I was going to a home unit that I would be, you know, for my career would be assessing cyber, I was having to carry cases and be embedded for my period of time required in different units to carry cases and how involved with consultations in that unit. So I was assigned to crimes against the doll case and I would rotate over a crime against children.
And then over to the behavioral threat assessment center, the BTEC, which is VAU1, go over there and do a terrorism case or a threat assessment case. So yeah, you have to be a generalist. You have to, a good profiler is someone who understands people and isn't just somebody who is in a very linear niche of what they can do. And once they get out of that space, they can't assess people. You have to be able to assess people. And that's the point of that rotation.
And just for our listeners, when you say you have to be a field agent and spend some time in the field, this is essentially you have to be a co-on-core regular FBI agent. First, you have to do time in counterintelligence or counterterrorism or criminal work or something along those lines. And then you can apply to a different unit. Exactly, Andrew. Yeah. And then again, it is you graduate from the FBI Academy.
You're assigned to your field office as a special agent where you do investigations into your point. It could be counterintelligence, criminal, gangs, cyber, counterterrorism. There's so many different squads and violations. The FBI has jurisdiction to investigate and be a part of task force. So you do that work and the average time before you're even considered competitive to get into the BAU. There are some exceptions in either directions.
Some people apply very late in their career, maybe 15 years in. I've seen people come in later. Then there's some people that come in, say six to 10 years. But those people really have to have a storied background and have demonstrated some pretty exemplary work to be competitive. We'll be right back after this. And now a word from our sponsor, the Data Citizens Dialogues Podcast.
As a listener of this podcast, you're probably at least marginally interested in data, especially about all the different ways that it shapes our world. So I want to recommend the Data Citizens Dialogues Podcast. This is a forward thinking show brought to you by the folks at Calibra. They're the leaders in data intelligence.
You're going to hear firsthand from all sorts of people, industry titans, innovators, executives from some of the largest companies as they dive into the hottest topics in data. You're going to get insights into everything from popular things such as AI governance and data sharing down to more nuanced questions like how do we ensure data readability at a global scale. So while data may be shaping our world, Data Citizens Dialogues is shaping the conversation.
I want to encourage you to follow Data Citizens Dialogues on Apple, Spotify, YouTube, or wherever you get your podcasts. Check it out. We think Data Citizens Dialogues for sponsoring our show. If you're looking for a fresh new podcast, I can recommend the Jordan Harbinger Show. It's entertaining, informative, and packed with actionable content. The average podcast listener has six shows in rotation. So you're most likely not just listening to spycast, and that's totally okay.
Jordan dives into the minds of fascinating people from athletes, authors, and scientists to mobsters, spies, and hostage negotiators. For example, I can particularly recommend the episodes with Jack Barske, a former KGB sleeper agent who now lives here in the US of A as a proud American citizen. I can also recommend the two episodes featuring Terina Shaqil, a British woman who traveled to Syria to join ISIS in 2014.
Jordan pulls out tactical pieces of wisdom in each episode, all with the noble cause to make you a more informed, critical thinker to better operate in today's rapidly changing world. You can't go wrong with adding the Jordan Harbinger Show to your rotation. Search for the Jordan Harbinger Show that's H-A-R-B as in boy, I-N as in Nancy, G-E-R. An Apple Podcast Spotify or wherever you listen to your podcast.
So the time that you have to put in at the FBI as a field agent and then the training, all the different stages of the training, you could be talking the best part of 10 years. Yeah, I was there exactly around 10 years when I put it. That is a very scary moment about a time. Wow. And I'm sure this is a question that you can't ask all the time, but please indulge me.
So what do movies like the silence of the Lambs or Man Hunter, get most wrong about behavioral profiling or do you suck, you know, swearing at the TV when these types of things come on or you help me understand what you're taking as on these types of movies? So those are really interesting shows. They're cinematic productions and they're going to make things a little more exciting and traumatic at the expense of realism.
But there are two central things that when I see those shows, particularly, let's use the Man Hunter Red Dragon or the Silence of the Lambs as the date 2 that you referred to. There's two things right off the bat that make these kind of unrealistic, but again, they're fun to watch. Let's use Man Hunter Red Dragon. In that one, what's pretty unrealistic is the protagonist will grant. He's retired and he's asked to come out of retirement to help with the tooth fairy case.
What just doesn't happen when you retire from the FBI as a special agent, it's a whole process. It's a whole administrative process and you're not just called to come back in sort of at a whim to help out on a case. It's a very unusual thing if anything, someone else will inherit the case and the case lives on through whoever the new pro-pilot investigator is assigned to it. So that's very unusual. And the same thing goes with Silence of the Lambs.
If you look at that movie, Clarice Starling was a new agent trainee at the Academy. He's not even a special agent yet and all of a sudden she's doing profiling work, which get great movie. I think it's a cult classic. People love it, but that is not very realistic at all. And the other thing that is from these movies that's kind of funny is ultimately, if you look at the premise of these movies, the profilers are seeking behavioral consultation from Hannibal Lecter.
And so profilers don't see concentrated advice from a serial killer. There is a lot of research that's been done from speaking to serial killers going back all the way to the 1980s and interviewing them and learning from them. But there's a very stringent interview, institutional review board or IRB that applies to these. So you're not going over to a serial killer and asking them to help you consult and get their advice on how the best catch or understand the behavior of a different case.
Those aspects are pretty unusual and don't really stand up to realism too well, but they're fun to watch. So you're not going to get a local police department who are like, let's bring in the FBI's behavioral analysis people. And they're like, well, we can't help you, but we have a homicidal maniac. Can't let us go and talk to him. That doesn't happen. That's the best. That's the best way of describing why it's on real estate.
But look, let's face it, some of the best scenes from those movies are when they're consulting Hannibal Lecter. He's a really central character in Anthony Hopkins did a great job in those movies. And just help me understand the different units, the BA years rather than the BA years. So we've got the serial killers, which is well known. But there's also one for counterintelligence. And then there are some others. Can you tell me what they are? Yes, that's a really good question.
And one that I guess is a little understated when people think of the BAU, because it's referred to as the BAU. That is a very common way that it's described, but it is. It's a number of units. It's in a larger section known as iOSS. And then there's a national center for the analysis of violent crime that houses these five behavioral analysis units. BAU1 is also known as the behavioral threat assessment center.
And this is a multi-agency national level, multidisciplinary group that focuses on the prevention of terrorism and targeted violence through behavioral analysis. A fantastic group. Does a lot of cutting edge work for active shooters and other types of violent crime and targeted violence? BAU2, which is where I was that is the cyber behavioral analysis center.
The counterintelligence unit where the counterintelligence program is known as the behavioral analysis program where the bath is managed out of that unit. And I can describe that further in a moment. It sounds like you want to look at that a little deeper. BAU3 is crimes against child victims. BAU4 is crimes against adult victims. It also has what's known as the violent criminal apprehension program or by-cap.
When people think of BAU, they usually think of BAU4 because that's where science alarms and the red dragon and those kinds of things criminal minds, they all relate to that unit. And then lastly BAU5, which used to be BSU or behavioral science unit, got subsumed into the BAU in around 2015. And this is where there's program management, there's strategy, there's research and instruction. So those folks over there help manage aspects of the other units.
That's not an operational unit, that's more of a research program management strategy. And since we are an intelligence podcast and an intelligence museum, it would be interesting for our listeners to know a little bit more about the counterintelligence aspect of that. Of course. And the counterintelligence component is known as the behavioral analysis program. And this has a really interesting origin because it's not a behavioral analysis unit.
It was originated in the late 1990s in the National Security Branch, counterintelligence division. And it operated there for many, many years. It's different, the training is different, it's a collateral duty, meaning these are not people assigned as profilers.
These are people who are special agents in the field and as a collateral duty because of their experience in national security and counterintelligence cases, they consult on these to understand assets, they to understand potential espionage, insider threat kind of counterintelligence matters. And eventually, whether it's confusion or just lack of resources, eventually this became part of the BAU. And this was in 2013. It was brought over, it stays as the BAP.
So the behavioral analysis program, which does the counterintelligence assessment with the operators being in the field, is program managed out of BAU2. And the program manager gets the incoming cases and then finds the team of special agents in the field who go out and do the deployment to work on the case. And sort of the opposite model of the BAU where the case comes in and the profilers in the unit, do the assessment and work as a team.
But the way that it was born in the 1990s and the way that it's always run is that sort of opposite model because it wasn't born through the BAU's of the behavioral science unit and sort of has kept that original formation. I think this is the point where we should move on to your baby. With the speaker, with the cyber behavioral analysis center, you found it tells a lot about more about that. When was it set up? Why? Tells about the origins and the early evolution of it, please. Sure Andrew.
So this was created in the fall of 2012. And prior to this, over the years in the BAU, there were some efforts to stand up a cyber component. But there just was any traction and those groups didn't last. So when I came to the BAU in the beginning of 2012, there was no cyber component. I was in the field when I came to the BAU. So initially I was in Los Angeles Field Office, as I mentioned, for 10 years as a special agent on a cyber squad.
And I was selected for the BAU at the end of 2011 and specifically BAU1 because again, there was no cyber component. And I came in under BAU1, which is the behavioral assessment center.
When I arrived in January, this is when we were getting ready for our phase one program, that educational training to become a profiler, let's say the spring of 2012, I was fortunate enough to be asked to help create the cyber component, which became the cyber behavioral analysis center, which is known as the C-Back. And this was formally rolled out during a reorganization that happened in the fall of 2012.
So what ended up with those numbers I mentioned of all the different units was sometimes confusing. The C-Back became part of BAU2. And at the time when it was created during that reorganization, this consisted of the C-Back, but it also consisted of the behavioral assessment center. So those two centers, there's co-centres, work together in BAU2. And then eventually around 2015, 2016, it became its own unit. So BAU2 became the cyber behavioral analysis center.
It also had that FAC program as a management piece, and then the threat assessment component was brought back into BAU1. So initially I was thinking that maybe this was set up because of the Snowden leaks and the Chelsea mining leaks, but that comes, and I think that's 2013 or 2014, if I remember correctly. So this is actually set up before those leaks.
Yes. Yeah. So in the last few months, I think that the existence before both of those cases, it is interesting that the leaked ofism, type matters, really became central and very salient in 2013, 2014, but you're correct. This was stood up in 2012. The thoughts behind it were already percolating in spring time. That's when I was having those initial conversations, like, are you up for standing up and coming up with how this would look and feel? And that was in spring of 2012. So yeah.
And how many people were initially and where, as it now? Oh, this is a great question. It was a very small group when we were created. It initially started with three people. They were by self and another behavioral profile or an accrimanalyst. So it was three of us. And it was that subunit or center along with the behavioral threat assessment center, which had been pretty robust by that point. That was, I think, formally created in the early 2000s after 9-11.
And so, you know, at that point, the behavioral threat assessment center or the BTAC was a pretty large group, very experienced group, whereas we were in Nason. So there were just a few of us and slowly but surely that evolved to the point now where the CBAC currently staffs between 13 to 15 people, whether it's profilers, there's crymentalists, operational psychologists, and computer scientists. So it is definitely evolved and grown over the years of its existence.
And what are the boundaries of it, Cameron? Like, is it purely domestic? Does it do international work? Is it only people inside government? Is it people in industry as well? Yeah, just help me understand what the re-emat is. Yeah. Certainly, you know, the CBAC looks at insider threats, but the majority of cases are cyber-thread actors and it could be criminal or nation-state, national security cases that are responsible for conducting cyber attacks on outside.
And because cyber is ubiquitous and we're seeing it in so many different nation-states and criminals around the world, this is a global thing. So the investigations in many senses are global. There can be domestic offenders for sure or maybe they're co-conspirators or people around the world, but that's sort of the interesting and beautiful thing about cyber is it is ubiquitous. It's very interesting and it spans the globe.
So could you just give us a couple of examples so that our listeners can understand that a little bit more. Maybe one that's particularly memorable or meaningful or crazy is one. You choose a couple to help us understand the line of work. Yeah, so when I was in the unit, I had the privilege of working hundreds of cases. You're talking across 11 years. Interestingly, you know, that 11 years, as I mentioned, cyber is ubiquitous. So certainly, I had the privilege of working cyber cases.
With other profilers and BAU 4, 3, and 1, I had the chance to work on violent crime cases against adults and children and threat cases. Because a lot of this can be tricky with classification and also uneducated cases. I think it might be helpful to shape some of the things how behavioral profiling was pushed forward with this and give some examples of what came out of these cases. The first, I think that maybe people don't know about is something known as digital behavioral criminalistics.
And this is where you start seeing and assessing human behavior out of digital artifacts and evidence sources. So traditionally, people think of computer forensics or digital forensics. Digital behavioral criminalistics evolved out of cases, cases that we work, such as, say, the North Korean attack against Sony Pictures or serial murder cases like Todd Cole, I have bought a South Carolina. It would keep women and a conics container behind his house.
That's a process of meaningfully uncovering and reconstructing offender behavior out of digital evidence evolved out of working these kinds of cases. And I would say the other thing, Andrew, that BAU 2 and Cyber Behavioral Analysis Center in terms of the cases and its impact on the evolution of behavioral profiling, the other thing that I don't think the founders of the behavioral science unit would have ever imagined is it's not just looking at actual cyber attacks.
I think that might have been interesting to them. Generally, I had a chance to meet Robert Russell's daughter who was in the FBI and she was really, really complimentary about how proud her father would have been about where we took what he conceptualized in the 70s and brought up the cyber. But we also applied this to things like cyber deception and influence and disinformation.
So it's taking what started out of violent crime and evolving that in a space where we're assessing influence operations and cognitive domain attacks, which is a really awesome extension of behavioral profiling. And I'd say the last thing that came out of the work in the CBAC that continues in a meaningful way is a deeper understanding of dark personality facets in cyber and counterintelligence offenders.
I think oftentimes when we think of dark personality characteristics like psychopaths or narcissists, sadists or macchi-bellians, we tend to think of violent criminals. But do the work that we did in the CBAC and they continue to do now, there's a really rich understanding of how these aversive personality constructs exist in cyber and counterintelligence offenders.
And from my time there, I had a chance to directly interview and assess cyber offenders and spies that had these characteristics and certainly had a chance to indirectly assess these folks as well. And now a word from our sponsor, NordPass. NordPass is an advanced password manager from the team behind NordVPN designed to help keep your business safe from data leaks and cyber threats.
It gives your IT professionals control over who has access to your company's data and makes it easy for everyone else on your team to use strong passwords. Right now you can go to www.nordpass.com slash cyberwire for 35% off the NordPass business yearly plan. Don't miss out on that. I mean, it's a question that I'm sure you'll be unable to answer because I don't think anyone can ever definitively answer it, but I'm just thinking about nature and nurture and agency and structure.
Are these types, whether it be a serial killer or a cyber offender or someone that's performed a violent act towards a child which must be particularly tough work? Are these people and your experience made or are they created? This is a great question and I appreciate you asking that because that is actually one of the questions that Dr. James Brussels I mentioned and he was the psychiatrist who assessed the mad bomber and the Boston Strangler.
This was one of the questions he was asked back in the day on a radio program and he sort of demurred on that answer. I would say that it's both typically when you see individuals with a verse of characteristics that are doing things. People can commit crimes and they don't necessarily have to be bad people. There's all different reasons why people conduct and commit the acts that they do that the VAU would be involved.
And for the really heinous things that you're describing, the really challenging serial offense cases, whether it's serial spies or serial murders, there's usually aspects of nature and nurture. From the nature standpoint, you would expect to see individuating personality and predispositional issues like personality characteristics and versatility disorders. It could be something unusual about their self-conceptor, how they see themselves.
It could be their formation of attitudes, values and beliefs and their personality combined, all those things combined. And then from the nurture standpoint, it could be that their family history and their social relationships and their interpersonal engagements have been very challenging, abusive, problematic in many ways. So a lot of the individuals historically that have been studied or showcased, there's going to be elements of both.
There are so many people that you and I and everyone listening know that it has been through very difficult things in their lives, never go on to commit these kinds of crimes. So it's usually a consolation of both nature and nurture. It's usually not one or the other person. It reminds me a little bit of that.
X-Files episode, I think it's Clyde Brockman's final repose, where there's this guy who, if he touches someone, he can tell what the future holds for them, how they're going to die, that type of thing. And he bumps into this bell hop in a hotel who happens to be a serial killer and the two of them sort of recognize each other and sit down on the hotel room and have a conversation. And the serial killer says to him, you know, why do I do the things that I do?
And he said, you know, the other guy says, you just don't get it, son, do you? You do the things that you do because you're a homicidal maniac. You know? Yeah. I haven't seen that episode.
Yeah, I mean, when you're talking about people who don't feel and think the way we do Andrew, you know, when you're talking about people with subclinical psychopathy and whether it's their sadistic or our systemic or macchiaballion, the way that they see the world and the way they feel or how on an interpersonal level, how they perceive others, those people become instruments. They don't, they have callous disregard for others. They are seen as something to use and to get benefit from.
And so when you have those kinds of personality disorders, you act very differently and how you talk to people is different. There's the thing that many of us would see is profilers when we were asked to do an interview strategy.
And when you're assessing the offender, you can tell the offender has an isocial personality disorder or psychopathy and the type of rapport building that you would do, the types of things that might be normal to a person without those disorders is not going to register or resonate at all with someone who has psychopathy and an isocial personality disorder where that would not have any sort of connection with them. Wow, it's really fascinating.
And is there like one book out there that you would recommend or listeners go to look at? So we're going to discuss your book in a second, deception in the digital age. But if someone just wanted to understand behavioral analysis more generally, is there a book that you would point them to works?
I don't know if there's one book per se, but I would say that if people are interested in maybe some of the darker aspects of personality that I was just describing and getting a better sense of assessing people, I would say Dr. Harris, snakes and suits is a good book to read. I would say if you're interested in behavioral profiling and the origins and the evolution of it, certainly John Douglas's mind hunter is a fan. Fantastic book.
There are more, I don't want to say clinical, but more pragmatic books that Roy Hazelwood and Robert Ressler have written as well as John Douglas that are getting to the more nuts and bolts of behavioral profiling and then anything that Dr. Reed Maloy, if you're familiar with him, he's a threat assessor, but he has written a psychopathic mind and other books that really dive into the darker characteristics of me. Wow, and tell us a little bit more about Eurobook, which is quite fascinating.
So deception and the digital age, I mean it generates all kinds of questions. How's deception easier? How's it more difficult, you know, the amount of people that you can deceive, etc. But just tell us like at the broadest level what's your book about and what's the takeaway?
Yeah, so that book was authored in 2017 and that book is looking from the beginning of the book all the way through starting from the psychology of deception to how it's used and influence across nation states and then the future looks of deception and it covers down on all these various aspects of how deception looks and feels in virtual spaces.
I think that the psychology principles and the deception principles of that book are rock solid, but one thing I would say and why I'm working on a newer book is that that book really didn't try to tackle artificial intelligence because that really wasn't a burgeoning space as we're seeing it now. Artificial intelligence has changed the landscape of how people's perception and sense making can be manipulated. So that book didn't really cover that in a meaningful way.
To follow up to that book is the one I'm writing now. It's coming out in 2025 and that one is called synthetic media deep fakes and cyber deception, attacks analysis and defenses. And that is going to do a very deep treatment on how synthetic media and deep fakes are used to meaningfully shape perceptions and manipulate sense making. I would say to the idea of easier and harder Andrew these are really good questions.
To the idea of AI I would say it is made it easier for digital artifices whether it's text based things you can use chat GPT or even some of the more malicious versions like warm GPT that will help you write communications that are back in the day you'd hear we have to analyze the text. There's going to be misspellings. There's going to be this or that. It's going to be able to tell where the person's from. This has changed that fundamentally by using these AI platforms.
The other thing is synthetic media production deep fake for video and audio and generated AI images. These can really deeply manipulate perceptions and beliefs of the target audience. And to me the deep fakes and synthetic media are really game changing because you're able to shape entire narratives with these things and you're able to hold cloth able to fabricate what someone seemingly said or did that can change the way that people act or react to things. So those are very, very powerful.
I would say though that those that are listening in yourself is a scholar in the space that deception does have its benefits in the real world. And with digital deception you have this sort of primarily visual and 2D in audio is what you're getting from digital but there are some ways and perspectives through three dimension in real world that can't be leveraged over the internet.
And some of the biggest ways I would say if I had to give examples historically when you look at some of Barton Whaley's work and what's known as the Bell and Whaley Bruce Matrix, there's different deceptions and bruises. They're used one is known as hidden fictions or hiding the false.
And so where you would see this mostly is things like from World War I such as a Habersack Ruse or an Operation Vince Meade where the soldier had information and plans of where an invasion was going to happen but it was actually going to happen someplace else. So you're hiding a false thing to make the adversary move forward on what appears to be a misfortune. It's very hard to do great Habersack Ruses or what are known as hidden fictions in a 2D visual and audio space.
So there are some harder things that you just can't do digitally as elegantly or as powerfully as some of the older ways that deception is used in the real world. Wow. And it would be fair to say that one of the wars of the future is going to be the war for reality. People trying to create an earth was about the world and define what is real and what is not real and the general public's very difficult task of trying to tell the difference sometimes.
Yeah, we're already seeing evidence of that where you're seeing with disinformation and synthetic media information operations, whether it's in political processes influencing elections, hybrid warfare that's being used by nation states, being able to manipulate
perceptions and cause your adversary to have a runus since making a decision making can change the course of conflicts, we're seeing that now and I think we'll continue to see that as part of warfare in the future and it is indeed a battle for reality. And what are you up to now, Cameron? What have you done, central left AFBI?
So I really much continuing in the space of cyber behavioral profiling through a number of businesses, some focusing on deception and cognitive security, a company modus cyber rondi, which is a cyber behavioral profiling boutique firm that helps assess cyber attackers. The other business is known as psychological cyber labs or cyber labs and we have a SaaS platform known as a deep fake dashboard where we assess deep fakes through a psychological framework as well as a technical framework.
And with these, I also help out with experts, there's a team of experts known as Equavoke, which is a diverse group with artists and magicians and mentalists and architects and we help develop these very interesting cognitive security immersive experiences.
And then there's very pragmatic things that I do as well, Andrew, through behavioral profiling, it's very helpful, like a help out on cases as an expert witness for park deets and associates and another group called Eagle Security, where we're able to take behavioral profiling and help out in matters where there's needed expertise. Wow, what an incredible and interesting career.
Is there anything that you would, any parting words of wisdom for our listeners on cyber security and keep themselves safe and so forth? Yeah, that's a great question. And I think there's some really great positives with this. First, I would say that cyber security is inextricable with cognitive security. It's a human thing.
And yes, like a lot of companies and organizations certainly have strong policies, protocols and tools and platforms, but ultimately the cognitive security, the human aspect is critical and it's probably one of the most vulnerable elements in an organization. The other thing about that with the cognitive security part is cyber security is a mindset so a lot of times when we get these mandatory training things, I'm sure you get in this well, Andrew. Most organizations will have these.
It sometimes is perceived as something to be angry about or dread or at inconvenience, but it's important to be mindful and consistent with these security processes and have that mindset, see it more of a mindset and not be the weak link in the chain as a person versus it being a burden. And lastly, I think going back to something I said earlier with how the founding fathers of the BAU or the behavioral science unit when it was created would never have imagined this.
I think we need to think about cyber security is not just hacking in malware and the things that are the obvious tangible or known weapons that are used in these.
It includes mental malware and I use mental well where sort of is a motif here, but we're talking about cyber influence operations and synthetic media, like I mentioned, deep fakes and disinformation, things that can cause erroneous decision making that are just as powerful, the impacts of that are just as problematic as what we consider traditional cyber attacks. I think people considering cyber within the lens of not just the technical ways that happens, but the mental ways that happens. Wow.
This is great stuff. I like the idea of mental malware. This has been a really great conversation. I've really enjoyed speaking to you. Thank you so much Andrew. It was a pleasure to be on. Thanks so much. Thanks for listening to this week's episode of Spycast. Please follow us on Apple, Spotify or wherever you get your podcasts. If you enjoy the show, please tell your friends and loved ones. Please also consider leaving us a five star review. Coming up next week on Spycast.
I have been blogging for two years and I was so more and more people interested in open source investigation, so I wanted a site where people could not only write articles and have them published, but also learn how to do open source investigation. If you have feedback, you can reach us by email at spycast at spymuseum.org or on x at iNCL.
If you go to our page, this cyberwire.com, forward slash podcasts, forward slash spycast, you can find links to further resources, detailed show notes and full transcripts. I'm Erin Dietzczyk and your host is Dr. Andrew Hammond. The rest of the team involved in the show is Mike Minzy, Memphis, Valna III, Emily Coletta, Emily Rens, Afua Anakwa, Ariel Samuel, Eliya Peltzman, Trey Hester and Jen Eim.
This show is brought to you from the home of the world's pre-eminent collection of intelligence and espionage-related artifacts, the International Spy Museum.