I was on the run for four months, stole $600,000.

I was in Las Vegas, Nevada one day.

I had stolen the night before I had stolen 160 K out of ATMs.

Went in the next, the next morning I woke up signed on to cartersmarket.com,

which was ran by max butler, the ice man.

Um, and there's my name, us most wanted on it.

And, uh, that gets your attention.

It was my real name with us most wanted beside of it.

Nobody knew my real name in that environment at all, but then they did.

And it was talking about me being part of the secret service.

Operation angler fish, everything else.

So of course they're all, they're all like, everybody's after you like, oh, yeah,

we're going to get this son of a bitch.

The following is a conversation with Brett Johnson, a former cyber criminal who

built the first organized cyber crime community called shadow crew.

That is the precursor to today's dark net and dark net markets.

He's referred to by the United States secret service as quote, the original

internet godfather.

He has been the central figure in a cyber crime world for almost 20 years.

Placed on the U S most wanted list in 2006, before being convicted of 39 felonies

for cyber crime, escaped from prison and then eventually being locked up,

served his time and now is helping people understand and fight cyber crime.

This was a raw, honest, emotional, and real episode.

Brett has caused a lot of pain to a lot of people.

And yet his own story is full of trauma and pain and also redemption and love.

This is a good time to say that I have, and I will talk to people who have

served time in prison and perhaps people who currently are in prison.

I will try to do my best to both empathize with the person across from

me and not let them sugarcoat, explain away or dismiss the crimes they committed.

This is a tough line to walk because if you close your heart to the other person,

you'll never fully understand their mind and their story.

But if you open the heart too much, you can be manipulated to where the

conversation reveals nothing honest or real.

This requires skill and willingness to take the risk.

I don't know about the skill part, but I'd like to take the risk.

I always wear my heart on my sleeve.

If I get hurt for it, that's life.

As I've said, I want to understand what makes a person do these crimes,

the particular characteristics of their temporary or permanent madness,

their justifications, but also their humanity.

I believe each of us have the capacity to become both the criminal and the victim,

the predator and the prey.

It's up to us to avoid these paths or to find the path to redemption.

It's on each of us.

It's our responsibility and burden of being human in a complicated and dangerous world.

This is the Lex Friedman podcast.

To support it, please check out our sponsors in the description and

now, dear friends, here's Brett Johnson.

You were convicted of 39 felonies for cybercrime placed on the US Most Wanted List

in 2006, escaped from prison.

You built the first organized cybercrime community called Shadow Crew.

That is the precursor to today's dark net and dark net markets.

And for all this, the US intelligence service called you the original

internet godfather. So first question, how did your career as a cybercrime criminal begin?

My life of crime begins when I'm 10 years old.

10 years old, man.

Think about that.

I mean, you were probably playing the robots when you were 10, you know,

usually kids are doing the Lego bit, getting involved with sports, everything else.

And with me, it wasn't like that.

With me, I'm from Eastern Kentucky.

Eastern Kentucky is one of these, um,

it's like parts of Texas, parts of Louisiana, that if you're not fortunate enough,

have a job, you may be involved in a scam, hustle, fraud, whatever you want to call it, man.

I was, uh, my parents, my mom was basically the captain of the entire fraud industry.

So, uh, this is a, this is a woman that at one point, she's stealing a 108,000

pound Caterpillar D nine bulldozer, tramming it down the road, you know,

at another point, she's taking a slip and falling to a convenience store trying to sue the owner.

We had a neighbor.

She acted as a pimp for at one point.

That's my mom.

Uh, my dad, wait, wait.

The neighbor acted as a pimp.

My mom prostituted.

I mean, she, she acted as a pimp for a neighbor.

Um, her name was Debbie and, uh, my mom used to sell her out.

You know, Debbie needed money and my mom would find men for her to slip and

you know, Debbie needed money and my mom would find men for her to sleep with for cash.

And she'd take a, a part of the cash.

So Son is like, she diversified the methodologies by which she, uh, hustled.

Very bad, that entrepreneurial spirit.

Okay.

You know, we, we, we see that a lot with, with cyber criminals, you know, that,

that sense of being that entrepreneur.

So what was the motivation you think for her is that, uh, is it money?

Money is it basically the, uh, the rush of playing with the system of being able to,

um, know the rules and break the rules and get away with it.

My mom's a complex character.

She has, there's no one single motivation.

So my mom was the individual, she's still alive.

My mom was the individual who tested people.

She wanted to know how far she could abuse you and you come back and still love her.

So, and that was with every relationship she's ever had.

Um, she would cheat on the men she was involved with.

She would abuse the, uh, her children, me and Denise.

She would, uh, uh, psychological, physical.

Oh, it was mental, emotional, physical, um, everything, everything.

I mean, she, uh, she used to beat me and Denise with, uh, with belt buckles, you know, and

that ended when, uh, she was, I forgot what we had done.

It wasn't much.

I think that, uh, um, it may have been the part where she, she accused me of stealing

her marijuana, but, uh, she was hitting me and Denise.

We were living in a single wide trailer at that point.

She was hitting me and Denise.

We were, we were on the bed trying to get away from it.

And Denise kicks her through a closet is what happens.

And, uh, Denise stands up and she said, uh, you're through hitting me.

And that was the last time that mom hit us at that point, but, um,

So sorry to take us there.

You're, uh, for people who know you and people should definitely watch some of your lectures

online, you're extremely charismatic and fun and, uh, jolly and whatever word you want to use.

But, you know, if we look at that kind of life, it's, there's darkness there.

There's, uh, struggle there.

There's a lot of darkness.

So if you, if you, how did you feel if you go back to the mind of the kid you were with your mom, was,

uh, was there sadness?

Was there things like depression, self doubt, all those kinds of things?

Or did you see this crime, this chaos is ultimately exciting?

You know, I don't think, uh, back then I didn't view it as exciting.

Now it becomes exciting when I start being involved in cyber crime, cyber crime.

All right, but back then it was simply a means to an end was all it was.

So you take a 10 year old kid and the way I get involved in crime is like I said,

my mom was the fraudster.

My dad was, my dad was a good guy.

He just forgot he was this good guy and he was always, he always had these principles,

but his issue was, is he loved my mom so much.

He was scared of her leaving.

So if she wanted to do something, commit crime, cheat on him, whatever,

he would pretty much just put up with it.

Um, the, the one instant.

So, I mean, this woman used to, she used to bring men home in front of him.

Tell him that, Hey, I'm leaving you.

I don't love you anymore.

I want you to die, blah, blah, blah, blah, blah, blah.

This was my mom.

Um, there were two instances where the man, where he can't take it anymore.

And the first instance, I was, I guess I was seven or eight.

My sister Denise is a year younger than I am.

My dad actually files for divorce, files for divorce at that point.

My mom, um, kind of goes crazy.

Uh, my dad, I was with my dad.

My, my sister was with my mother because that's that Eastern Kentucky mentality.

You know, men stay with men, women stay with women.

So, um, he was filing for divorce.

Me and my dad, we were living in an apartment.

My mom was living with, uh, with her grandparents and with her parents bouncing back and forth between the two.

And I remember I was sleeping in the bed.

We had a single wide bed.

My dad slept on the sofa.

I woke up one night and there was some sort of ruckus in the living room.

So I wake up and I walk into the living room and my mom has a knife to my dad's throat.

And basically you're not going to steal my son from me.

My mom was this individual that when she knew she went so far, like I said, she was always this person that tested.

Well, can I do this to you and you'll still come back?

She knew she was always also this person that if she went too far, she knew it and she would always try to divert that into something else.

All right.

So she knew at that point she'd went too far.

So what does she do?

She gets up crying, goes to the bathroom and pretends to slit her wrists so that my dad Ray will respond to that, not responding.

To what she's just done to him.

That was my mom in a nutshell.

She had a history of doing this kind of stuff.

Motivations as far as fraud with her, I think with her it was she was an LPN.

She had a very good nurse, but she didn't want to work was a lot of it.

So with her, it was easier for her to commit fraud.

And when I say commit fraud, it was against businesses, against people.

I remember at one point she's buying over the counter capsules and emptying the capsules out and putting some other crap in there and selling it at a speed and people are buying it.

She did anything she could for money.

And of course, I get involved with that.

What happens is we were in Panama City at that point and my mom leaves my dad and the way she left my dad.

My great grandfather had died.

My mom tells all three of us, hey, I'm taking the kids and we're going back to Eastern Kentucky to attend the funeral.

Well, that was her leaving.

Me and Denise didn't know she didn't pack any of our clothes at all.

She stows her clothes in the trunk of the car and she leaves my dad and I don't get to see my dad again for I think five, six years or something like that.

My mom, like I said, she used to bring men home in front of my dad, he'd sit there and cry and beg her not to do it.

She'd do it anyway.

When she leaves him, she kept up that.

So we were living at my grandparents house.

My grandfather, he had converted the house.

He had raised the house up and built apartments underneath of it.

So me and my sister and my mom lived in one of the apartments underneath and that whole side of the family was just nuts.

My granddad, Paul, he would.

This is a man that he didn't want you to eat any of his food.

So there was no such thing as me and Denise going upstairs to eat.

If he found out me and Denise was taking a bath, we were allowed to bath and bathe in two inches of water one time a week because he didn't want to have to pay the water bill.

There's rules.

There are rules.

You know, if you couldn't have the TV on, when he went to bed at night, you had to have the television, the volume.

You could watch it, but without volume because if he heard it, he would, he would get up in the middle of the night and he would kick the power breaker, turn off all the power on you.

This is my, this is my, the family, right?

So my mom, she used to leave me and Denise at home for days, man, for days.

She'd go out and, you know, party and I mean, sometimes she'd take me to Denise with her.

She'd wait in the car.

Sometimes we'd wait in the living room as she went and partied and everything else.

Most of the time she left, left us at home and my entry into crime, Denise walks in one day.

She's, she's nine years old, man.

She walks in one day and she's got a pack of pork chops in her hand and looked at her and I said, where'd you get that?

And she's like, I stole it.

And, you know, it's like, show me how you did that.

So she takes me over and she shows me how she steals food, how she's stuffing it down her pants.

So we start stealing food.

I'm like, hell yeah, let's do that shit.

So start stealing food and we get to the point where we're wanting a sandwich.

Well, you can't stuff a loaf of bread down your pants.

So there was a Kmart in the shopping center.

I go over to the Kmart, get a hoodie off the, off the rack, take the tags off of it, wear it out, work just fine.

And the way you steal bread is you put the hoodie over your shoulder, stuff the loaf of bread down the sleeve and you walk out with it.

So we started doing that.

How'd you figure that out?

Just thought pattern.

So there's like, strategic thinking here.

Yeah, you know, you can't wear the hoodie and put the bread down here because you might mash the bread when you zip it up.

Yeah, we have to think through that.

You got to think through it.

But you got to realize that by this point, I'm, hell, I'm already seeing what my parents are doing.

You know, I'm already seeing.

So that kind of puzzle solving was something you were already developing yourself in division because you're pretty young.

Yeah, 10 years old, pretty young.

But seeing how they act, how they respond to things.

And my mom, I guess you could call it a good thing.

They never kept any of that hidden from the kids.

You know, there was no discussions behind closed doors.

All that happened in front of everybody.

And from your young minds perspective, seeing that kind of crime, you basically, you know, a lot of us kind of grow up thinking there's rules you're not supposed to break.

If you see other humans breaking those rules, then you realize those rules are just human made.

But it gets worse than that.

I was in an environment where there were no decent people.

I didn't really meet my first decent person until I was 16 years old.

Who's that?

That was a high school teacher.

So what happens is, is, you know, we start shoplifting food.

My mom finds out that we've been stealing stuff and, you know, she joins us.

What's that?

She joins us.

Yeah, she comes in.

You know, I've got the television, I've got the Atari 2600 play the hell out of it.

Oh my God.

She starts seeing this shit.

She's like, where'd this come from?

And I'm like, well, we found it.

She's like, you need to find that Denise.

Denise stands up.

We stole it.

My mom showed me how you did that.

And she gets her mom too to join in.

And she used to run me and Denise as these little shoplifters.

We'd take, you know, we'd steal stuff for her.

We would distract security and her and my grandmother would steal stuff.

They got caught doing that.

But that's the entry into crime.

And Denise, you know, I'm adamant and I kind of mean it.

But the truth is, I say, and I do mean it that I'm responsible for my choices as an adult.

All right.

I believe that when you're a child, you can't control that.

The adults in your environment control what you do.

All right.

Once you're an adult, though, your choices are yours.

Now, that being said, there's some, you can't dismiss that childhood influencing what I did as an adult.

You can't do that.

I mean, it was kind of written on slate that, hey, this guy's going to beat this guy when he grows up.

That's like sometimes that one person you meet, that decent person can turn the tide into life.

Absolutely.

Absolutely.

And what happens is, you know, the abuse, everything continues on when I'm 15.

My dad was in Panama City, Florida.

My mom was in, you know, we were in Hazard, Kentucky.

She was dating this guy.

And my mom was this woman that the abuse would, it was crazy abuse, man.

Just crazy stuff.

She would tell me and my sister, you know, that she gave up her life for us, that she was going to leave one day and never come back, that we'd find her dead in a ditch someplace.

She'd go out and date these men and she'd come back and she'd talk about how these men were abusing her.

You know, so she'd be dating this guy and she'd come back and then she'd, you know, start talking about how he had tried to rape her.

You know, trying to get me to respond to that.

And I would respond to that.

Make no doubt, I would respond to that.

Well, what happens is, and I knew that, I don't know if I knew it was abuse at that age.

All right, but I knew things were fucked up.

And I was talking to my dad in Panama City and I really had it in my head that I was going to go down and live with my dad.

And I call my dad one day.

I was set to go to, me and my cousins were going to go see Return of the Jedi and it came out again in the theaters.

So I called my dad.

It was a Sunday.

I called my dad and he told me he had either gotten married or he was about to get married to this woman.

And basically Brett Johnson wasn't going to go down to Florida.

You know, I was going to stay in a hazard.

I had to call my dad from payphone, but the result of that was I walked into a hospital, got in an elevator, and a woman got in the elevator at the same time.

And I snapped and beat the hell out of her right there.

And I was 15.

Didn't really know what the fuck happened.

Didn't really know.

But just anger came from someone.

Yeah, yeah.

And, you know, the elevator beat the hell out of this lady.

Turned out she looked a shitload like my mom.

But the elevator doors open.

One of the security guards, I played basketball with with his son.

So he saw me immediately.

I knocked the hell out of him, took off running, made it back to the house.

Where my grand parents were, they didn't know what had happened.

So I didn't say anything.

About an hour later, Kentucky State Police, they pull up in the front yard.

And two of them get out and I'm sitting on the front porch and me and my cousins are.

And they start walking up.

Everybody starts walking out of the house.

And I'm like, I just remember saying, what do you want?

What do you want?

Well, you know what they wanted.

They wanted to arrest Brett Johnson.

And then they arrested me, I went in and I told them everything.

Spent three months in a county jail.

They didn't have juvenile facilities in that county.

So I spent three months in solitary, went to trial, pled guilty to assault the first degree.

The judge sentenced me to time served and a psychological evaluation where they sent me to Louisville, Kentucky.

Spent 30 days up there and they cut me loose.

They wanted me to have counseling after that and never went to counseling.

You know, I wanted to, but mom was like, don't need it.

So never went to counseling.

And I became this pariah in the county.

It's crazy, man.

I mean, not a day goes by that I don't think about that.

That moment in the elevator.

Yeah.

And what happens is, you know, you're 15.

Fuck man, you're 15.

So I go back to the high school that I was in and I'm this piece of shit.

So everybody, you're not the outcast.

Everybody knows.

So I moved.

We moved.

We were in Weizberg at that point.

I finished up the year there and moved to back to Perry County.

We're just where hazard is.

So we moved there and they've got three high schools there.

They've got MC Napier.

They've got hazard high school and then they've got Dills Combs High School.

So I was within, me and Denise were within half mile of MC Napier.

Show up there the first day of school and I met me and my mom and my sister were walking

into the school and the kids won't let me in.

The kids stand out there.

He's not coming in.

So my mom starts raising hell and I'm like, no, let's just go.

Let's go.

So from there, it was, we went down to the city school hazard and the principal tells

my mom Denise can come.

He can't.

So my mom was to raise hell and I'm like, no, let's just, just take me to this other

school.

So this other school was like 15 miles away.

And you know, country, country school, country high school.

So I go there and they accept me and I walked in the first day and this English teacher

names Carol Combs.

I walked in and handed her the paper.

She was my homeroom teacher and she heard this voice.

And she looks up and she was like, son, have you ever done any drama before?

I'm like, no, ma'm, but I'm interested in the academic team.

I was this quick recall guy, right?

And she's like, no, she's like drama.

I'm like, no, I'm not interested in theater.

I'm interested in academics.

I'm the head of the drama department and head of the academics department.

So the deal was, tell you what, you can get on the academics team if you start with theater

too.

And I was like, okay.

So what happens is she was the only, she was the first decent person I met in my life

and she became this kind of surrogate mother to me.

So under her tutelage, I become the one of the top academic team guys in the state.

I was captain of the team.

I was just scourge across all the counties in that part of Kentucky.

If we had a meet, it was like, Jesus Christ, that's Brett Johnson.

She used to tell people they would, the high school that I came from was Whitesburg and

the first time that Whitesburg came against us, she told me, and I was talking to her about

a year ago and she told me, she's like, Brett, she said that first meet against

Whitesburg.

She said, the captain came in, looked at you and said, oh, you've got that Johnson boy

on your team.

And she said, my response was that Johnson boy is our team.

So, but I did that.

And then with theater, I ended up my senior year.

I was one best actor and actress in the state.

Only God ever do that in the state.

So did pretty well, man.

Did pretty well.

Had scholarships coming out of high school and everything else and I'm the idiot that

turned them down.

That's a funny question.

Yeah.

You'd make a hell of a, I mean, of all the many things you could probably do, you would

make a hell of an actor.

I'm very good on stage.

I'm very good on stage.

Have you acted professionally anywhere?

Not professionally.

We've done the college circuit and stuff like that.

What happened was is, so I turned down the, turned down the scholarships, you know, scared

of leaving.

I guess that's what it was.

Starting community college and the community college there hires a new theater director

out of California.

Well, he knew the guy that ran the San Jose state theater program.

Got him.

Edward Emanuel was his name.

His claim to fame.

He had written the three ninjas movie.

Remember that the three little ninja kids back in the eighties?

He had written this damn film and it had made a shitload of money.

So he invites Ed Emanuel to come down and see the play and Ed had written this civil

war piece.

So we put that on.

I was doing like, it was a multiple role thing.

I was doing like 18 different roles in the show.

So Ed sees the show and he was like, scholarship.

He said, look, he said, right now you're a big fish in a small pond.

We'll make you a big fish in a big pond.

I was like, deal.

So I took the scholarship, man.

And he was like, I'll be back in two weeks.

So he flies out two weeks later.

This guy flies back in.

He drives down to where I'm living.

I'm out shooting ball with one of my cousins and friends.

He pulls up and he gets out of the car and I was like, I'm walking over to him.

I was like, hey, man, I'll walk in.

You can meet my parents.

He's like, no, I got it.

I was like, okay.

So I keep shooting ball.

He walks in the house, stays about 15 minutes, walks out.

Why does a sheet doesn't say a word to me?

Gets in the car, leaves.

I don't hear from him again.

Had no idea what went on.

It takes me a couple of weeks.

What happened is my mom, he walks in and introduces himself.

My mom pulls a knife on the guy.

I will kill you.

You are not going to steal my goddamn son from me.

Scares the guy to death.

He bugs out and kind of broke my spirit at that point.

You know, I was like, okay.

So went into just full fledged into scams, crimes, everything else.

I had already been, when I was a minor, I'd already been kind of brought up on that side

of the family with the crimes that they were doing.

My mom was, you know, drug trafficking, the pimp stuff, illegally mining coal, charity

fraud.

Illegally mining coal.

Yeah, wild petting coal.

Can you explain that?

So to properly mine coal, you have to get a permit, all right?

Eastern Kentucky, a lot of people don't, they can't afford the permits.

You know, they can, they can get them a piece of equipment.

You know, you get a dozer or a loader or whatever you're going to get or an auger or what have

you.

So you start mining, but you don't get the permit.

So you don't have to find, do the, you don't have to pay.

Back then it was like $3,500 for a two acre permit or $5,000 for a two acre permit.

Let you strip behind the, the, the coal on that, then you have to pay for the reclamation

on top of that.

So once you uncover the pit, take the coal out.

You have to cover back up the pit, sow grass, make sure everything is environmentally friendly.

Got a silt pond, everything else at that point.

So the whole idea is you buy an acre of land or some area of land and then you can, there's

a whole process you're supposed to go through to find.

Tire process.

How many people involved in a mining, the smallest number of people required for a mining operation?

You can do it through four people.

Okay.

So you've got your loader operator, you've got your dozer operator.

You need, you can, you can farm out the trucking to someone.

If you need that or trucking company, if you need to do that, then you've got your, whoever

owns the business as well.

So very few people can run an operation like that and profit fairly well as long as you

don't have to do the reclamation, all that crap on top of it.

All right.

The reclamation gets pretty expensive.

So if you're uncovering a pit of coal, you know, a pit, so a ton of coal is basically

about 36 cubic inches is what, what a 2000 pounds of coal weighs.

If you're an Eastern Kentucky because it's that the weight of the bituminous coal and

everything.

The fact that you know this is awesome.

The fact that you know exactly the volume of a ton of coal.

I mean, you learn this shit, right?

Can you rattle this shit off?

So you uncover the pit and then you've got to sell the pit.

Well, the thing is, is that where are you going to sell the coal while you sell it to

these other coal tipples that knows that they're buying the shit illegally.

So back then a ton of coal was, that'd give you like 36 bucks per ton is what that is.

And you'd have to go out and you'd, you'd test the BTUs on it.

You'd take a sample to the lab, test the BTUs.

You'd take that into the company.

British thermal unit.

So you'd test how, what the BTU on the coal was.

How pure the coal is.

How pure the coal is.

What, what, what BTU it burns at.

And back then a good, a good BTU was around 12, nine was what you'd get.

So 12, nine coal, $36 a ton.

You'd take that sample over to the, to the coal tipple.

They'd say, okay, we'll buy this for you.

How many trucks you got or how many tons you got?

And you say, this is what we've got.

Then you'd hire the trucking company and where you get it out because, you know,

you've got the agents that are, that are looking for you by this point because the people that,

you know, you've, you've, you've bought the rights to whoever the landowner is.

You said you're going to give them, you know, $2 a ton or whatever this is.

Well, the other people there, are you paying them off or are you not?

Well, if you're not paying them off, guess what?

They know your ass is mining it illegally.

They're going to report you.

Well, all of a sudden you've got all these inspectors that are coming around

and everything that, hey, we know what you're doing.

So they're looking for you to get the pit out.

So when do you get the pit out?

Right in dead of night.

So, you know, you're loaded up two o clock in the morning, hauling this ass out is what

you're doing.

You sell it out from there.

So, and your mom ran operations like this.

Yeah.

And you said you worked the mine too when you were younger?

Yeah.

Learned how to run a loader, run a dozer, learned how to clean off a pit.

Everything like that.

So this is, this is the lifestyle you, you grow up in.

You know, you learn how to do this stuff.

And so knew how to do charity fraud as well.

Insurance fraud.

So charity fraud.

Can we, can we break down some of these are charity fraud?

It's much more romantic than what it sounds.

It was basically, it was basically standing beside the road with a sign and a bucket.

Yeah.

Taking up collections for homeless shelters, for abused women, for children, stuff like

that.

Then later on I branched off.

When I started off on my own, I would set up my own charity company and do some telemarketing

and go on by and collect checks and things like that.

You know, we're going to talk about that, but actually can we just step back and talk

about your mom, your dad, given all of that, given all the abuse, the complex ways that

she played with love, to see how far she can push you and the people around her.

And they still love her today.

Do you love her?

You know, I called my dad yesterday.

My dad, he's, he's dying now.

He's got a heart condition.

He's not going to get the operation to fix it.

So he's like, fuck it.

I'm ready to go.

I looked at him because hell, I'm 52 now and prior to 52, I'd have been like, no, you

need to do this.

But I looked at him and I was like, I understand.

I understand.

You're done.

And so he's not going to get the operation.

I was talking to him yesterday and he asked me, he's like, have you seen your mom?

And I was like, dad, I'm not talking to you for about two years.

And I told him, I was like, I love my mom, but my mom is not a good person.

She's not.

And he told me, I was talking to him on the phone yesterday and he told me that it took

him several years to really understand that, you know, he loved her too, but it takes,

when you're, when you're getting an abuse like that, especially my dad, my dad came

from a good family, everything else and, you know, upstanding family.

And I think that when you're that victim of abuse, you know, you've never seen it before.

You've never encountered it.

And then it happens.

Well, you're like that frog and water all of a sudden.

You know, you get to the point where gradually increases until how do you get out of it?

Everybody else sees what's happening, but you don't.

I grew up in that environment though, you know, so it took me a long time to come to

terms with that.

And my sister came to terms with it long before I did, you know, my sister, she, she's been

a decade without talking to my mom, like she had tried to commit suicide.

I didn't know that.

What got me so bad is she said at one point that she always thought someone was going

to come in and save us and my response and just immediate response, not even thinking

about it.

My response was, well, Denise, I knew no one ever was.

And looking at things now, I think that's the, that's where our paths diverged.

Me it was, if you want to do it, if anybody's going to take care of you, you got to take

care of yourself.

You're on your own.

You're on your own.

You know, it's up to you.

And Denise has always been that, that, that child that has expected someone to come in

and save her.

Well, and almost like it's all going to be okay.

Somebody.

Yeah.

And I knew it wasn't.

And no, no, you go.

Unless you.

Unless you make it okay.

It ain't going to be okay.

So, you know, I was, are you able to forgive her, your mom?

My boundary with my mom, the reason I've not spoken with her.

Over two years ago, I started this, this legal career of mine.

I've been the guy who has, I spent a lot of time thinking about my past and those choices

and what brought, brought those choices around.

So I'm big about taking responsibility for my actions.

I truly am.

I think it's really important you have to do that.

Well, my mom, not so much.

So I was talking to her, you know, and I, I would start saying, you know, she was,

she would start the conversation talking about, she didn't understand why Denise wouldn't

speak to her anymore.

That was one of her tropes.

So in my response, started to become, well, because you were the abuser and you spent

your life doing that to her.

So it's more healthy for her not to talk to you.

So she's still not able to see the flaws in, in her ways of the past.

No, not at all.

So my, my ultimatum to my mom was, look, when you're able to admit that you abuse the people

in your life, accept that responsibility and be able to discuss it with me, we'll have

a talk.

Other than that, I don't want to talk to you anymore.

So for the first year, it was, you know, calling, cussing my wife out, cussing me out.

You know, I don't need you out, blah, blah, blah, blah, blah, blah.

And then finally it started to taper off and she's never really contacted me after that

point.

Your dad is dying.

What do you take from the way he's taken on death?

Just saying, fuck it.

You know, it's the man and what have you learned from your dad?

What do you love about your dad?

He's one of these guys that, you know, like I told him, I told my dad about the, about

the abuse and everything else and there was a point.

So you know, I told you about the elevator stuff.

But before that, man, it was, it took me 40 years to talk about that, but it also took

me 40 years to, to talk about, there was a point that my mom and dad would leave the

house and I would urinate in the floor, all right?

And there's a, like out of anger, no, no idea why, all right, but I would piss on the carpet.

Carpet business like the little Bowsky, right?

It really tied the room together.

It really tied the room together.

I was talking about that and this lady comes up to me after the, after the presentation

and she had, she had a career previous to that where she dealt with abused kids and

she told me, she's like, Brett, she's like, it's a control mechanism.

The only control you had was that and she's like, kids do that.

And I was like, so I'm not unique.

She's like, no, you're not unique in that.

So that, you know, this whole history of abuse, Denise dealt with it by drinking, by trying

to commit suicide, things like that.

And then finally she escapes.

I'm the kid that didn't.

And not only that, my wife pointed out to me that it's again, it's that Eastern Kentucky

mentality stuff, you know, the males expected to do things.

So with, with me, it was, it was almost like I stepped up to, to take part in those crimes

so that Denise didn't, didn't have to.

And she, she was able to avoid all that other than that one shoplifting stuff, Denise doesn't

break the law anymore.

She goes off to be a, she's a, she's a good parent.

She's an angry parent.

She's a good parent.

She's a teacher.

She's a good citizen overall.

I was just the guy that kept right on going with it.

kept on going.

So let me ask you about that.

So your life of cyber crime and describing some of the things you did or knew about,

you said, quote, I once stole several thousand dollars worth of coins from a family trying

to sell them to put a new roof on their home.

Another time I sent a counterfeit cashier's check to a victim and he ended up being arrested

for it.

I had to family friends, everyone I knew, I was a truly despicable person.

True.

One of my Ukrainian associates script had someone who owed him money, kidnapped and

tortured.

He posted pictures of it online.

Another member, Iceman, used to flood his enemy's email addresses with child pornography,

then called the police on them.

That's some stories.

Can you tell some of these stories that stand out to you that are particularly despicable

or representative or interesting when you look back at that, that defined your approach

and who you were at that time?

Let me say that I did not care about my victim, all right?

I cared about me is what I cared about.

It's rough to admit that, you know, that you don't give a shit what you're doing anybody

else.

You don't care about you.

But that's the truth of the matter.

I didn't care about the victims.

The lady, that was, that wasn't even at the beginning of my career as a cyber criminal.

That was right at the last of it.

Which lady?

The coin lady.

I was, by that point, Shadow Crew had made the front cover of Forbes, August of 04, October

26th of 04, Secret Service had shut us down, 33 people, arrested six countries in six hours.

I was the guy that was publicly mentioned as getting away.

What happened was is I was the guy who was, I had kind of invented this crime called tax

return identity theft and was stealing a lot of money.

I went through all my state side savings and Shadow Crew gets shut down.

I don't have any way to come in with any money.

So I start running counterfeit cashiers checks, defrauding people with that, having them send

products or bullion collections, what have you by COD, collect on delivery and I would

pay with it with a counterfeit cashiers check.

This lady was on eBay.

She had been collecting these silver coins all of her life.

You know, the US currency used to be the coins used to be silver.

So she had a whole collection of these things, like I don't know, 80, 90 pounds of this stuff.

And I'm a very good social engineer.

So convinced her that I was a legitimate person that, you know, hey, send it to COD.

You can use my FedEx account to do that, to my UPS account to do that.

I'll pay with a cashiers check, you can take it in, same as cash.

She believed that.

She was even on the ad and we talked on the phone or everything else.

She had told me that she was a single parent and it was the only money that she had to

put a roof on the house for her and her kids.

And I didn't give a damn.

I didn't give a damn.

What was more important was me at that point.

Can I ask you a question about the social engineering aspect?

So maybe specifics like the methodology, email, you said phone.

Maybe you could discuss this process from a bigger philosophical perspective of what

is it about human beings that makes impossible to be social engineer, to be victims of fraud?

So first let me say that I became a social engineer as a child, all right, because the

adults in my environment as a child, I had to know exactly what they were thinking and

be able to try to manipulate that for survival.

So I became a social engineer for survival initially, all right.

And one of the things that I've seen with a lot of cyber criminals is the exact same

thing, the really expert ones.

They become a social engineer as a child, then later on, they use those tools to victimize

others, all right.

Which is fascinating because in order to understand what others are thinking, you have to be extremely

good at empathy.

So you have to like really put yourself in the shoes of the other person, and yet in

order to do cyber crime, you have to not care about the pain that might cause them once you

manipulate them.

So you have to empathize and yet not care.

Exactly.

And I would argue that that is not a sociopath because a cyber criminal, and I was no different,

most cyber criminals justify those actions.

So the justification becomes what's important.

With me, the justification was why I did it for my family, did it for my wife, did it

for my stripper girlfriend.

So and I believe those just because I care about love a lot.

So the big picture of that is trust, how do you establish trust with a potential victim,

all right.

Now, I would argue online that that trust is established through a combination of technology,

tools, social engineering, all right.

So we trust our tech, you know, we trust our cell phones, we trust our laptops.

A lot of times we don't understand how they operate, but we trust the news that comes

across the line.

We trust the phone numbers that show up.

We trust IP addresses if we're advanced enough to look at an IP address or a domain or anything

else like that.

Criminals use tools to manipulate that, spoofed phone numbers, spoofed browser fingerprints,

whatever that may be, whatever the tool may be.

Then that lays a base level of trust.

At that point, you shoot in with the social engineering and lay whatever story that is

in order to manipulate that victim to act not out of reason, but out of a motion all

of a sudden.

This is fascinating about the way humans interact with the world, which is you're almost too

afraid to not trust the world.

You have to find a balance.

Right.

You have a lot of conspiracy theories now about distrusting institutions and thinking

like everything around us.

It's like, I've been listening to people who believe the earth is flat and that conspiracy

theory is fascinating to me because it basically says that you can't trust anybody.

Right.

That like everything you hear is a lie.

That's one, you can live that life or you can live a life where you're just naively

trusting everything and we as humans have to, because that life is full of happiness

if nobody screws you over because you meet people with the joyful heart and you get excited

and all that kind of stuff, but if you do that too much, you're going to get burned.

So you have to find some kind of balance in terms of optimizing happiness where you trust,

I mean, but verify and on the internet that becomes really tricky.

You're almost too afraid to distrust everything because you'll never get anything done on

the internet, but then if you trust too much, you can get screwed over.

And so the social engineering comes in where you're like, I'm not sure if I should trust

this.

You kind of help them build the narrative was like, it's good.

It's good.

It's good.

So in a lot of the times that social engineering is just feeding into what the victim wants

to believe.

Yeah.

All right.

It's not really coming up with a brand new story at all.

It's just knowing what that victim is, what the motivations of that victim is, feeding

into it at that point.

So you have to, again, that social engineer has to almost immediately know what's driving

that person that they're talking about.

So I'm working on a phone, talking to someone over the phone.

I have to know within seconds what I need to say, how I need to act to interact with

that customer service agent or whoever I'm talking to on the other end of the line.

So fascinating because you truly are empathizing with the other person.

What is it?

This businessman, Stephen Schwarzman, I've talked to a few times, he mentioned this

thing that the way you build deep relationships is you really kind of notice the things that

people are telling you, like what they want and what they're bothered by, what are their

big problems in their lives, because everybody's saying that all the time and most of us are

just ignoring it.

Right.

But if you take the time to listen, you know somebody at that point.

Absolutely you do.

Then you have to be able to dismiss it.

You know, you're looking for that just to see how I can manipulate that is what you're

trying to do.

So the lady was one story, another truly despicable story.

We'll get to script in a second, but another truly despicable story.

We had, we were one of the really first groups that started phishing attacks.

What's phishing?

So that is a social engineering attack.

PH, by the way.

Yeah, PH.

That's another social engineering attack.

It's sending that fake email out that looks like it's coming from a website or your financial

organization or whatever and saying, Hey, we've got a security problem.

We need you to update your account information.

Well, back then no one had ever seen a phishing attack.

So you could ask for all the information.

You were getting just complete identity profiles on a phishing email.

Nowadays you can't do that.

Nowadays you look for basically credentials because everyone is aware of phishing.

But back then it was complete information.

We had a phished out, I don't know, 200,000 eTrade accounts is what we had the login.

Login password.

Yeah.

Login password, complete, you know, social, date of birth, mother's maiden, account information,

everything else.

So we had access to those eTrade accounts, eTrade initially had no security in place.

So you could cash out the account, ACH the money out to whoever, to whatever account

you wanted to went through just fine.

Ain't I'm alive on that for four to six months, eTrade got to the, to the point where they,

you couldn't do any ACH coming out, you know, you, they locked everything down.

Well, you're still sitting on thousands of eTrade accounts.

How do you make money on that?

Hmm.

That's a good question.

Yeah.

So what you do is you find some fat cat that's got his retirement, you know, invested in

blue chips.

At the same time, you find a penny stock, you open up a brand new account, buy into that

penny stock, cash the fat cat out, buy into that same penny stock, pump and dump schemes

all of a sudden.

So you're destroying people's retirement accounts for just a few thousand dollars.

Bam, bam, bam.

And of course, eTrade's response is not our problem.

It's your problem.

You shouldn't give up your password or what have you at that point.

And you still see that issue today with Zell scams and things like that.

Zell scams, Zell.

So you know, the instant payment that, that's the same kind of operation.

Same type of difference with the same kind of mechanism.

You find an easy way to exploit a system.

And typically the financial organization, not our problem, our system secure.

It's the humans.

It's their errors.

Well, not really.

You know, you've got some culpability in that and you're just trying to avoid paying

the part of the bill is what's going on.

One of the things just to stand fishing for a bit is it really makes me sad because there's

been people on all kinds of platforms like including YouTube comments, but emails too.

They figured out emails somehow.

So people are now seeing the followers of this particular podcast where fans, they're

finding them on platforms like LinkedIn and YouTube and so on.

And they are figuring out ways to get to those people by another channel, right?

Which I suppose is, it seems more authentic to those people.

So they send them an email from what looks like me and with this kind, like, like loving

them.

The interesting thing, the email sound like something I would write.

So these aren't even at this stage, it's not even, it doesn't feel automated.

Or if it's automated, it's, there's a human in the loop that's really fine tuning to specific

or maybe I'm very predictable, but it's very loving in the way I would write that message.

So think about that.

All right.

So when fishing first comes out, you could look at the language of the text or the website

and say, yeah, if you were paying attention to that, that's so okay.

So that's not an English speaker who wrote that typically, all right.

But as, as time has went on, as, as the awareness of what a fishing attack looks like, we have

people that are sitting down now and making sure that the language is proper.

It gets worse than that though.

If you look at business email compromise, all right, so the way a business email compromise

typically works is the attacker will find a payroll person, find a CEO.

He will, he will fashion a spearfishing email, which is, that's a fishing attack that's targeting

one specific individual, all right.

So he'll fashion a spearfishing email and the way he does that is he pulls all the information

he possibly can on that person, all right, that CEO.

Maybe he'll spear that CEO just to get their login credentials to their email, just to

read the emails and he'll, he'll go in there and he'll start reading all these emails.

He'll specifically read the emails to the, to the payroll department, see what that relationship

is.

Are they talking about their kids?

Are they talking about relationships, talking about vacation?

What are they talking about?

How are they talking?

Are they friendly?

Are they sterile?

What are they doing?

All right.

So then he decides, well, I'm going to go ahead and spear fish the payroll department

as well.

So then he spear fishes them, gets those credentials.

At the same time, he creates a Unicode domain in whatever the company name is, all right.

So instead of that English alphabet I, he's got that Russian letter that looks like an

eye, but without the dot on top, all right, comes back into the email, into the payroll

email, blocks the real CEO's email, replaces that with the Unicode email that he's got

and then sends out a message using the correct language, the correct relationships, everything

else and says, Hey, you know, we're updating our account status.

I need you to send this payment instead of the over here.

They've set up a new account, send all payments over here now.

And that is business email compromise in a nutshell, all right, works great.

Probably the larger the organization, the more susceptible to that kind of attack because

there's a, like a distribution of responsibility to where you're more likely to believe that,

okay, this other person is responsible.

I'm sure they, they secured everything.

Absolutely.

I'm okay listening to this.

So that's business email compromise and it's, it, those crimes and it's one of the things

you see about cyber crimes.

Cyber crime is not really sophisticated.

It's not the attacks are not sophisticated.

The stat is 90% of every single attack uses a known exploit.

It's not the, it's not zero day attacks.

They're out there, but if you're a criminal waiting on a zero day to profit, you're going

to starve to death.

The meat and potatoes are that 90% known exploits.

And the rest is, well, you're saying it's a, maybe you mean it's not technically sophisticated,

but it's social engineering sophisticated.

Very sophisticated on that end.

Very sophisticated.

It's a fascinating study of.

That establishment of trust and then using that trust to defraud that victim.

That is something.

I wish obviously all of these folks are really good at hiding.

I wish you could tell their stories in the way, which is why you're fascinating is you're

able to tell these stories now cause it is studying human nature by exploiting it, but

you get to understand like our weak points are our hope, our desire to trust others.

Also sort of the, the weak points and the failures of digital systems and at scale humans have

to connect.

Right.

It's fascinating.

This is a weird question, um, asking for a friend, uh, is, is spearfishing itself illegal?

What's the legality here?

Oh, it's all illegal.

Absolutely.

It is.

Is it absolute?

So here's what, okay.

Let me, let me construct an example.

So I, if, if my friend were to spearfish like a CEO, right, and get their information and

after they get control, save their Twitter account, they tweet something loving and positive.

What's the crime?

Unauthorized access of advice.

What will be the punishment do you think?

That becomes questionable.

So, so no monetary loss or was there a monetary loss?

Probably not.

All right.

So you have to figure out who the victim is before charges are pressed.

Now the crime would be unauth, unauthorized access.

All right.

But no real victim on that, unless, you know, the, the person whose account you took over

takes, you know, exception to that, um, no monetary loss.

There's not really standard, like fines.

Probably nothing's going to happen.

Right.

Right.

Right.

So, I mean, that, that's kind of interesting because it's, it's, so when I got the ransomware,

um, when I got, uh, with the zero day attack on the QNAP mask, you know, they, they basically

say the, the, the criminal is QNAP, the company for having so many security vulnerabilities.

They're, uh, like you are the victim of QNAP's incompetence.

That's the way they kind of phrase it.

And see, I don't agree with that.

I don't agree with that at all.

So solar winds, let's, let's, so I've got 130 page class action lawsuit printed

out at the house.

I've been going through it.

That catalogs how solar winds lied for years about their vulnerabilities and they lied

to investors.

The, uh, the people who came in, the auditors would come who they would hire would, you

know, they would, uh, not pay attention to them when they said, you know, you've got

these issues.

They would say go away shit like that for years until solar winds, you know, the attacks

become apparent.

Um, my view on that is that the only person responsible for the crime are the criminals

who did the attacking, the actual criminals, not, not solar with, now does that mean the

solar winds isn't, isn't all fucked up?

They are.

And there needs to be some accounting in place, but the, the, the only individual, the only

people responsible for crime are the criminals.

And that's either online in the physical world, what have you could be, it's being an idiot

is not a crime, you know, being, being, being criminally negligent is, and I think that,

that solar winds is certainly responsible, not, not responsible, they're culpable for

what happened.

Can you actually, uh, tell folks about solar winds?

What is it?

Um, what, what, what was, what are some interesting things that you're aware of?

I mean, solar winds was very, it was, it, it provided a background, a backbone of security

for hundreds, thousands of different companies.

Um, if you looked at a lot of security companies were using solar winds, that would, that would

allow you to get a snapshot of the entire system that they were working on.

So what happens is, is you get a Russian group that comes in and they basically, they hack

into solar winds and get access to it and it allows them to view every single thing.

I mean, every single thing about every single client that solar winds had at that point.

So entire snapshots of all the IP that weren't, that was going on, all the emails, all the

communications, every single secret that was going on with those companies.

If company had software like Microsoft, it allowed them to look at the source code of

everything that was going on, I mean, it's just a complete and total nightmare, all right.

And something that you are not going to recover from, you're not, I mean, it's done at that

point.

Um, you know, there's not been a lot of news lately about it.

But the fact of the matter is, is that's the type of attack that's a catastrophic attack.

So there's a huge amount of information that was read, saved elsewhere, probably.

And so now there's people sitting on information.

Absolutely.

So think about one of the attack vectors has been Microsoft Outlook 365, things like that.

This allowed the attackers to look at the source codes of that.

So they have the source code now.

So they go through it line by line or other vulnerabilities, let's find new vulnerabilities,

new zero days.

I said zero days aren't common, but this opens up an entire new threat surface all of a sudden.

So it's a, it's a completely catastrophic attack.

So all the chips are down, everything's tallyed up, people are going to be like, yeah, we're

done.

We're done.

Yeah.

All right.

This whole computer thing, we tried it, we're walking away.

We're done.

That's terrifying.

So you're saying that there's not been obvious, uh, big negative impact from that yet.

So but like, there's been a lot of negative impact, but we're just starting, right?

So that's starting the capacity for destruction is huge here.

How much involvement from nation states do you think there is on this?

You know, it's interesting.

So you've got Iran, you've got North Korea, China, Russia, you got the big four.

You also got Brazil.

You've got all these other countries that are interested in the United States as well.

Nation states are interesting depending on who the nation state is.

All right.

So Russia is very good about working with the type of criminal I used to be, you know,

they'll enlist these guys and steal information and what have you.

And Russia will take the information they want to, and they'll basically go off and

sell whatever you want to make some money.

Um, China is all about IP, um, North Korea is about stealing money because they really

don't know what, what the hell else to do right now, but, uh, to North Korea is actively

involved in cybercrime.

Absolutely.

They've stolen a shitload of Bitcoin, everything else.

So absolutely.

They're actively involved with that, um, very, very skilled attackers, very skilled.

But even if you look at, you know, I told you that stat about 90%, all right.

So even though SolarWinds is going to be the number one attack, the, the follow up to that

is this not pedia attack that happened.

And so that was the most sophisticated attack launched by the Russian sandworm group using

all known exploits throughout.

So it's not, again, it's not, you're right in the sophistication is typically not technical

sophistication, but it says social engineering sophistication.

How do you get these things put together in line to attack and succeed?

But when you get access to the source code, that's where technical sophistication could

really do a lot of damage.

And that's when you find out real quick, that's what separates the men from the boys in this

game.

All right.

Because all of a sudden it's not, I don't have to worry about social engineering.

I've got source codes and I've got professionals that are looking at that and that's your ass.

Which then enables probably even more powerful social engineering methods too.

I mean, it's just cascade of, is this terrifying to you, by the way, this, that this world

that we're living in, as we put more and more of ourselves on the, the internet into the

metaverse, that there's so many more attack vectors on our wellbeing.

What's terrifying to me, I used to preach it on Shadow Crew, is the idea that the perception

of truth is more important than the truth itself.

It doesn't matter what the facts are, it matters what I can convince you of.

That's what's terrifying to me.

So you look at deep fakes, you look at fake news, all this stuff that's going out.

That becomes truly terrifying.

Maybe there's an angle where it's freeing, if nothing is true and you can't trust anything.

But you see, we as human beings, we want to trust.

We do, we need human interaction and for that human interaction, you have to have a degree

of trust.

But it's more like, you let go of an idea of absolute truth and it more becomes like

a blockchain style consensus.

So you let go of like, you know what, there's this human dream, you get this on the internet,

you get like facts, as if there's at the bottom, at the bottom, there's one turtle

that's holding this like scroll that says, these are the truths of the world.

The problem is, I mean, maybe believing that is counterproductive.

Maybe human civilization is an ongoing process of consensus.

And so it's always going to be, everything is shrouded in, you can call them lies or

you can call them inaccuracies or you can call them delusions.

It's constantly going to be, it's going to be a sea of lies and delusions.

But our hope is to, over time, develop bigger and bigger islands of consensus that allows

us to live a stable and happy society.

Don't call it true.

Call it a stable consensus that creates a high quality of life for the inhabitants of

the island.

I like it.

I mean, I like it.

I mean, that's, we're going to agree on this.

And then don't use outlet.

No, I'm just kidding.

So maybe a step back, you mentioned, I'd love to talk about shadow crew.

Maybe this is the right time to actually, yeah, let's go to shadow crew because it's

such a fascinating story.

So tell me the story of building shadow crew, the precursor to today's dark net and dark

net markets.

This is why you're the original Godfather.

This is it.

This is it.

So I, I get married.

I faked a car accident to get married, got the money from that.

You're romantic.

I'm romantic.

It's like my dad, man.

I'm the guy that, you know, I get, from mom, I get the criminal mindset.

From dad, I get that, don't want him to leave.

So, you know, so.

To get married, what's that story?

Oh, dude, I was, how did you fall in love there?

My first girlfriend was a preacher's daughter and crazy over her dated her for five years

and she figured out pretty quickly that, well, not quickly, it took her five years to figure

out that Brett Johnson is not the man of God.

You know, I, I could, I could talk it, but you know, more of that agnostic than anything,

she breaks up with me.

So I was, I was at the community college.

We'd make one half a preacher by the best, but yeah, you know, I've got that Langston

Hughes problem.

You know, I'm looking for Jesus to show up and he just doesn't.

So I was, I was at the community college and I was, I was a straight asshole.

I was arrogant, conceded everything else and I had posted an advertisement on one of the

billboards looking for an adult babysitter, hot blonde, you know, come, come visit me

in the library.

He mine shows up and he's like, Brett.

And I was like, yeah, he's like hottest girl in school right down the hall.

And I was like, serious?

He's like, yeah.

And I was like, let's go see.

So walk over and there's these two guys that are hitting on her.

So I'm, I just walk up and me and Todd, that was my buddy, walk up and I'm just sitting

there and listening and they're, you know, they're giving the spill and everything.

And she's just kind of taking it in.

Finally, I looked over and I was like, you want to get out of here.

And one of the guys looks at me, he's like, Hey, we're talking to her.

I was like, well, you're talking at her.

You're not talking to her.

I'm about to save her ass from you.

Yeah.

This is a smooth pickup line, by the way.

If I ever heard one, that's good.

You want to get out of here?

So start dating and she was the girl that screwed my brains out.

And I felt I had over heels.

We got married six months later, six months.

That's what love does.

That's what it does.

And I had, I was, she didn't know I was a crook.

She had no idea, you know, she knew I was very bright.

She knew I would do a lot of theater, stuff like that.

Got a job at, I was in hazard, there was no jobs to be had.

So I got a job in Lexington because we were going to be moving to, to UK.

Got a job in Lexington at Lexmark testing printer boards, circuit boards.

So I would leave on a Thursday night, work three 18 hour shifts at Lexmark, come back

home on Monday, got married, faked a car accident to get that, the other, the rest of the money

that I needed to, to get married.

And the, the faking on that man, I had bought a Chevy Spectrum at a car auction, gave like

500 bucks for it.

My aunt had previously defrauded USA insurance on a car accident.

And she was telling me all about, she's like, look, go down to this chiropractor, make sure

you get the insurance where they'll pay for a rental car.

They'll pay lost wages.

And I was like, they pay lost wages?

She's like, yeah, they pay lost wages.

I was like, hmm.

She's like, by the way, you work for me.

And I was like, I work for you.

So, so.

And you get to define the, with the wage and you can also define how long you are unable

to work.

Exactly.

Exactly.

And the chiropractor will sign off on any damn thing.

All right.

So, my cousin Ronnie, he figures out that I'm going, he finds out I'm going to fake this

car accident, so he comes to me and he's like, hey, man, can I get in on that?

I was like, yeah, man, you get on that.

So this kid, he's five days younger than I am.

This kid, he goes to the dentist the day that we're faking it, has a tooth pulled, tells

the dentist not to numb it, not to stitch it.

Just pull it.

So he shows up, he shows up the day that we're driving out to fake the accident.

He's got blood all over his shirt.

He's still bleeding out of the mouth and everything else.

I'm like, are you okay?

And he's like, yeah, man, it's going to be good.

It's going to be good.

I'm like, okay.

My mom, by this point, I'm living with my grandparents.

My mom is up in the head of a hollow.

So we're like, we'll just do it up there.

We'll go act like we're visiting my mom on the way back out, ran over a mountain.

Okay.

So we go visit and everything, come back out that night, run over the side of the hill,

me and Ronnie walk back up.

Of course, it totals the car.

Walk back to my mom's acting like we've wrecked.

She knows what time it is and everything else and follow the claims.

So that gets the money to, uh, to get married and me and my wife move from hazard to Lexington.

And I'm the kid that, uh, my crime, usually if I was a single guy, wouldn't break the

law.

What?

And I would be all right.

You know, but females involved, oh yeah, oh yeah, gotta spend the money, gotta show

them gifts.

Everything else was never enough to show loved in some sort of healthy way.

Always had to go overboard.

Typically it was buying some or stealing some sort of expensive crap.

So that, that was the thing, that was the way you show love is by buying expensive gifts.

Right.

Or something overboard.

Back then with, with Susan initially, it was don't worry about working.

I got it.

You just worry about going to school.

She was a music major.

I was like, you just worry about going to school.

So don't worry about cooking and cleaning.

I got it.

I got it.

So not only was I this, this guy that was going overboard, but it's kind of a control

freak too.

Right.

So now I got it.

I got it.

I got it.

So here I am, you know, 60 hour a week job, 18 hour class load, cooking and cleaning,

something had to give.

I quit the job.

I couldn't do it.

Quit the job and start back in fraud and trying to hide that from her at the same time.

So it was initially telemarketing fraud started.

I was working at the first job I had was a telemarketer at a cemetery selling grave sites.

And then that ended, went over to work for the Shriners Circus Shriners Hospital.

And there was a third party company that was doing all the telemarketing made really good

money doing that.

That job ended and then they pivoted over to working with Kiwanis clubs, selling food

baskets to the food banks and everything.

So I stole the phone list and started at my own Kiwanis club and would do the telemarketing,

go out twice a week and pick up checks.

Well, what happened was is I'm going out picking up checks, go knock on a door, turns out one

of the persons that I had called was a law enforcement officer.

So he was like, who are you?

I'm like, I'm with the Kiwanis club.

He's like, no, you're not.

So got arrested, spent three months in a county jail for theft by deception, got out and we

had to move from Lexington back to hazard and live with Susan's parents.

They had gotten a desktop computer HP and I started surfing around online, found eBay

and didn't really know how to make money on eBay.

About the same time, I'm committing low level frauds online and I don't really talk about

that in the past.

The first time I've really talked about that, but I would pay for it with bad checks.

So some more person, so not using a platform like eBay and more.

I would find somebody that had like a stereo system on eBay, something like that and I'd

pay for it with bad check and would rely on them not to chase me because they were out

of state at that point and the dollar amounts were very low.

So got the money to move to finally did those schemes enough to get the money to move back

to Lexington, got to Lexington and by this point I'm doing these, like I said, these

schemes on eBay and I'm like, there's got to be a better way to make money on eBay.

Got to be.

So didn't really know how one night I'm watching Inside Edition with Bill Riley and their

profiling Beanie Babies.

So I'm sitting there watching the one they're profiling is this one called Peanut the Royal

Blue Elephant selling for $1,500 on eBay.

I'm sitting there going like, shit, I need to find me a peanut.

So my initial thought was, well, there's got to be one in one of these Hallmark stores

in Kentucky someplace.

So I skip class the next day went out around all the Hallmark stores looking for peanut.

No idiot.

He's on eBay for $1,500.

So after a few hours of that, I'm like, hmm, turns out they had a little gray Beanie Baby

Elephants for $8, picked up one of those for $8, stopped by Kroger on the way home, picked

up a pack of blue, red dye, went home, tried to dye the little guy.

So that was a nightmare.

Turns out they're made out of polyester.

Get them out of the bath.

Looks like they've got the mange.

And what happens is I saw, I'm trying to die the damn thing and I'm like, well, that's

not going to work.

That's just not going to work.

So I got online, found a picture of a real one posted it on eBay.

And I was like, well, what I can do is I can claim that's the one I've got.

And then maybe claim that it got messed up in the mail and work out like that.

So posted a picture of a real one online.

Woman thought I had the real thing.

She wins the bid that social engineering kicks in immediately.

I didn't want to, I didn't want to be on the defensive.

I wanted to put her on the defensive.

So as soon as she wins the bid, I send her a message, hey, we've not done any business

before.

I don't even know if I can trust you.

What I need you to do protects us both go down the US Postal Service, get two money

orders totaling $1,500, send them to me issued by the US government.

That way we're both protected.

Soon as I get the money orders, I'll send you your animal.

She believed that didn't ask any questions at all.

She believed that sent me the money orders.

I cashed them out, send her the creature immediately got a phone call.

I didn't order this.

My response lady, you ordered a blue elephant.

I sent you a blue fish elephant.

And she got pissed and she kept calling.

What I found out, and that's really the first lesson of cyber crime that most of these criminals,

including self, learns.

If you delay a victim long enough, just keep putting them off.

A lot of them, they get exasperated, throw their hands in the air, walk away.

You don't hear from them.

And none of them, to this day, none of them complained law enforcement.

They eat it.

So it's a mixture of like you were exhausted by the process.

So it's just easier to walk away.

One second, almost like an embarrassment.

So there's a whole slew of reasons, all right?

There's the exhaustion, certainly.

There's the embarrassment.

So if you figure out, if you look at it today, where does the embarrassment come from?

Well, the media, family members, we're all very good about blaming the victim for crimes.

Why would you click on the link?

Why would you send money to somebody you don't know, blah, blah, blah.

So you've got that's going on.

You've got the issue of who do you complain to?

Back then you didn't know.

Do you complain to local police because she's in another state?

So which local police do you complain to?

Do you complain to the feds?

Well, the dollar amounts aren't high enough to complain to feds.

Feds, you're going to tell you to go local.

Locals going to tell you, hey, it happened in Kentucky, complain to them.

Kentucky's going to tell you, well, shit, you're over there.

We need you to come in.

So there's this whole issue, the jurisdiction of the blame factor, everything else.

So I got away with that crime and did it under my own name at that point.

I kept going and got better at it, started to understand how to hide identities, things

like that.

Started selling pirated software, pirated software led into installing modchips.

It was for the initial pirated software was a Sega Saturn PlayStation one.

Well, you had to have a modchip in those to play the pirated discs.

So I started selling and installing modchips.

That led into installing modchips into cable television boxes so you could watch all the

pay per view, which in turn led into programming satellite DSS cards, those 18 inch RCA satellite

systems, pull the card out of it, program it, turns on all the channels.

Started doing that.

Can we just pause?

That is very entrepreneurial.

So just technically, so there's laws and rules that you're breaking nonstop.

So there's also legitimate ways of doing that, which is break the rules of the conventions

of the past.

That's the first principles thing.

That's what Elon Musk and his ilk do all the time.

That is guts and brilliance.

But when it's crossing the lines of the law, actually sometimes the law is outdated.

The thing is as a human being, you have to then compute the ethical damage you're doing,

like ethically the damage you're doing about other human beings.

That is fundamentally the thing that you're breaking is you're adding to the suffering

in the world in way where another and you're justifying it.

But in terms of me sort of as an engineer, that is some gutsy thinking.

That's how was and Steve Jobs thought.

That's innovation.

And maybe just think, if you can introspect your thinking process here, I like how you

remember that it's an HP, this is a totally new thing to you.

Computers is yet another domain.

How are you figuring these puzzles out, presumably mostly alone when you were thinking through

these problems?

Is there, this is a strange question to ask, but what is your thinking process?

What is your approach to solving these problems?

So the approach is, is you do something and you fuck it up and you're like, you think

back, okay, how do I fix that?

If you fix that aspect, you commit the crime again and it goes a little bit further and

it screws up.

Okay.

How do I fix that?

What's the issue on that?

How do I fix that?

So there's not a deep design thinking like later on, it becomes that once, once you, once

you lay that groundwork of the way these schemes are working, all right, it becomes that and

you can apply that to other things in, in cyber crime as a whole, all right.

But initially it's, it's basically trial and error, you know, you've got a problem.

How do you solve that problem?

All right.

So how do I, I'm committing these crimes under my name, how do I solve that?

Well, one of the first principles that we started to teach on Shadow Crew is all crimes

should begin with identity theft.

That's one of the main first principles that a lot of people to this day still don't really

get.

All right.

Why would I commit a crime under my name if I can do it under your name?

So that's, that's one of the big buffers and that takes trial and error to get to that

point where you start to understand that's the way crimes should operate if you're a

criminal.

All right.

But with me, it was, I mean, it's, it's trial and error.

It's, it's that childhood where that mindset is kind of ingrained in you, where you're,

you're looking for ways, non, let's say non traditional ways of getting around things

or getting through things.

I mean, one of the questions probably asked this later is there's also a unique aspect

to the outcome of what you were doing, which is you weren't, you know, you didn't get caught

for a very long time.

Right.

We'll talk about why that is.

And the thing is, it's so interesting.

All, all crime probably should, to be effective, should start with identity theft.

Right.

I like the identity theft because identity theft can take so many forms.

Right.

Right.

So, yeah.

So Shadow Crew.

So what's, so as we're, you started with love.

So now we're, we're, you know, doing these schemes online.

I'm selling, I'm selling to these, I'm programming these satellite DSS cards and you, one of

the interesting things, and you still see that to this day is something will happen

that will create an industry for criminals.

All right.

So what happened is Canada, Canadian judge rules about the same time that I'm doing these

satellite satellite cards.

Canadian judge comes out and says, Hey, it's legal for my citizens to pirate those signals.

And his reasoning was, is since RCA doesn't sell the systems up here, my citizens can

pirate it.

Okay.

So what happens is overnight, about the same time PayPal comes into play.

So PayPal is coming right online at about the same time.

Overnight little cottage industry pops up in the United States, you go down the best buy

by the system for $100, take it out in the parking lot, open system up, pull it open box

up, pull the system out, pull the card out, throw the system away, program the card, ship

it's ass to Canada, $500 a pop started doing that.

Business is good, making you know, $3,000, $4,000 a week doing that.

I'm like, yeah, that's good.

Have so many orders.

I can't fill all the orders and quickly think to myself, why do I need to fill any of them?

They're in Canada.

I'm down here.

You know, who are they going to complain to because I already found out people don't

complain.

All right.

They're not going to complain to anybody.

So I start not, especially in Canada, and I'm, I'm, I'm having them send money.

That's when PayPal's first into play and it amazes me that everybody is using PayPal.

It's like, you don't even have to really ask.

They're like, can we pay about, yeah, you can pay all day long by PayPal and PayPal had

no clue what they were doing with security.

So it's like, okay.

So they're sending money to PayPal.

I'm having the PayPal cashed out to, uh, to bank accounts in my name at that point and

I get scared because by that point I'm still in four to $6,000 a week and I'm like, somebody's

going to be looking at money laundering.

So get it in my head.

I'm like, best thing that I can do is get a fake driver's license, open up a bank account

using that driver's license, cash out of the ATM.

Good.

No idea where to get a fake ID, not a clue.

So I get online, looked around, spent a couple of weeks looking around, thought I found a

guy.

He went by the screen name of fake ID man, thought I found a guy, sent him $200, sent

him my picture.

Dude rips me off.

I'm like, what the hell?

Oh, I got played.

He had a, he had a little website set up with reviews and I'm like, oh, it's all legitimate.

He's building that trust that I talked about.

So the end result, I got pissed and there was no site that dealt with anything criminal

or really cyber crime related.

The only real avenue you had was an IRC chat session, internet relay chat.

And that, I'm sure you've been on that this, it's this rolling chat board.

You don't know who the hell you're talking to.

Most of them are full of shit.

You can't trust anybody and you're sitting there trying to conduct business.

So you know, if somebody claims they've got a product or service, do they have it?

Does it work?

Are they just going to rip you off?

Because in those channels, they remind us of criminal.

I kept looking around and I've happened upon a website called counterfeit library and counterfeit

library only dealt with counterfeit degrees and certificates as on a degree, no type stuff,

but they had a forum and no one was using the forum.

So I basically get on there and bitch every day.

I got ripped off, don't want to do, bam, bam, bam, bam, bam.

About the same time I started doing that, two other guys show up.

One's named Mr. X.

He's out of Los Angeles.

Other guys named BL's above.

He's out of Moose Jaws, Saskatchewan and we all become buddies.

So you know, a few weeks of me bitching, a few weeks of them responding, BL's above gets

me on ICQ and he sends me a message.

He's like, I went by the screen name of Gollum at that point, Gollum Fun.

And he's like, Gollum, I can make you a fake driver's license.

And I was like, well, motherfucker, do it.

And he's like, well, I'm going to charge you for it.

I'm like, yeah, you are.

He's like, I am.

I was like, no, you're not.

And he's like, look, man, he said, this business, if you're going to do this, you have to trust

people or you're going to fail.

He said, so I want to charge you $200, but I'm going to send you a driver's license.

Well, by this point, I'm friends with the people who own counterfeit library.

We're emailing, chatting, everything else.

When I tell him, I'm like, okay, I'm going to send you $200.

That way, when you rip me off, I'll have them ban you and I don't have to deal with you

anymore.

And he's like, bet.

I'm like, okay.

So I sent him $200, sent him my picture.

Two weeks later, I get a driver's license.

Name is Stephen Shwecky out of Ohio and a real guy worked at ADP payroll to this day, works

at ADP is where the guy works, got the driver's license.

And to me, at that point in time, it was the prettiest thing that I'd ever seen.

I'd never seen a fake ID before.

I thought it was great, it turns out, looking back, it's like, eh, so, but it is a kind

of a strong first step in creating a fake identity.

Very strong.

Very strong.

So that was like, can I ask you just on the point he made that if you're going to be

successful in this, you should have people you trust.

Is he right on that?

Always absolutely right.

He's absolute.

So you have to have, this is like mob.

You have to have an inner circle that you trust.

You know, I'm sure you've probably heard me say this before.

Successful cybercrime.

All right.

There are three necessities to being successful online if you're a criminal.

Three necessities are gathering data, committing the crime, and then cashing it out.

All three of those necessities have to work in conjunction if they don't, the crime fails.

The problem, and it's a huge problem, is that one guy can't do all three things.

You know, you've got the, you've got the people who gather the data.

Basically the, the general store sells people who sell PII credit card logins, data tools.

They always sell the spoofed phone numbers and the RDPs, stuff like that.

A lot of the times those people don't know how to commit the crime, and those people

certainly don't know how to launder the money out, put cash in pocket.

So you've got, either because of a skill level, sometimes a geographic location limits what

that individual can do.

All right.

So you have to rely on people who are good in areas where you are not in order for that

crime to succeed, and that means you have to trust those people.

So what happens with Shadow Crew, all right?

So Counterfeit Library is the start, all right?

Counterfeit Library transitions over to Shadow Crew.

Right before that transition, there's a Ukrainian guy by the name of Dmitry Golubov.

He was a spammer at that point in time.

He saw what we were doing with, with Counterfeit Library, and he liked it.

He was getting all these credit card details, and this kid.

I mean, he was a kid.

This kid has an idea, and his idea was, I wonder if people would buy stolen credit

card details.

It's pretty good, uh, Ukrainian Russian accent.

So he picks up the phone, he calls his buddies, they call their buddies, they have a physical

conference in Odessa.

150 of these cyber criminals show up, and they launched this idea, they launched a website

called Carter Planet, which is the genesis of all modern credit card theft as we know

it, all right?

So, remember I mentioned those three necessities of cybercrime?

Dmitry had all the credit data in the world, and he partnered with all these other Ukrainians

who had all this data as well.

The problem was, is so much fraud had been committed on that Eastern side of Europe,

that every card had been shut down.

Even if you were a legitimate card holder, and tried to cash it out, you weren't doing

it at that point.

So again, those three necessities, gathering data, committing crime, cashing out.

Dmitry had the data, they could commit the crime, they could not put cash in pocket.

So we were running Counterfeit Library.

One day I get this message, or not a message, one day, script shows up, and he posts, just

on the general forum, he posts, hey, I've got credit card data.

Give me an address, give me a burner phone number, wait five business days, order whatever

you want to.

We had never seen anything like that.

We were a PayPal fraud and eBay fraud side is what we were, and fake driver's licenses.

So then, and we had, I guess we had two, three thousand members at that point.

So the response from the members was, that can't be real.

You've got to be law enforcement, it's got to be trying to get us arrested and everything

else.

What, let me backtrack a little bit.

So the driver's license that I had got, BL's above had an idea.

What he wanted to do, is he wanted to sell driver's licenses.

He wanted to sell social security cards.

He made a very passable social security card.

Me, I didn't, I had no skill level on that.

I knew PayPal fraud and eBay fraud.

So BL's above was like, tell you what, you be the reviewer.

That way you get every product or service that comes in, they'll have to send it to

you or let you have access to it.

You can learn the entire game, and because you're not selling anything, it gives you

legitimacy on the reviews, all right?

So I started out as a reviewer.

The only reviewer on counterfeit library.

So over the next year, BL's above turns out he was a pot grower.

He goes back to growing pot because he wasn't making shit selling driver's licenses.

Mr. X, about a year and a half in, he gets arrested, cashing out driver's credit card,

not credit cards, cashing out to casinos, doing some shit with that.

So I'm the only guy left standing and I'm at the top of the heap.

So, and it becomes this thing where if I review somebody, they make a lot of money.

If I don't, you don't do business here.

So script shows up saying he's got this.

I'm the only reviewer on site.

People think he's law enforcement.

First week it goes like that.

After a while I'm like, okay, I got to do something and I'm scared, man, because I'm

like, he may be law enforcement.

So I get him on ICQ and I'm like, hey, you have to be reviewed.

He's like, what the hell is that?