Unspoken Security Ep 26: Let’s Talk about Executive Protection Intelligence

when it comes to that convergence, executives' physical security, or physical safety rather, and cybersecurity are no longer separate domains. They need to be interconnected and a part of this kind of security apparatus. And some of these proactive measures do come down to device security.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA, and I've been building and maturing intelligence programs in the private sector for about 8, 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! Off to a good start this year. And I continue to be deeply committed to servant leadership. Another podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide variety of challenging topics. It's not your typical polished podcast. My dog makes occasional appearances. I don't think I'll have one today. People argue and debate. We even swear here. I, I definitely do. And that's all okay. So I need you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. So today I'm joined by Jeff Dazley. Uh, he's Principal Security Intelligence Engineer at Comcast. And while Jeff's an expert who will refer to events and make recommendations based on his years of experience, nothing he says today should be interpreted as words on behalf of Comcast or seen as representative of their current operating procedures. So that's for all the lawyers out there. Now, over his 16 years in our industry, Jeff's had He served in various intelligence and security-related roles, uh, in support of government and private sector organizations. Additionally, he has a bachelor's degree in intelligence studies from Mercyhurst University, where he was a star basketball player. He is literally the tallest man I know, uh, and the only former professional athlete in my circle of friends. Jeff, is there anything you want to add to that?

No, I think you covered it, AJ, and definitely glad to be here and have a conversation with you about executive protection.

So before we go though, Jeff, how tall are you?

7'2". Yeah. On a good day.

Just wanna make— on a good day. 7'2". And for anybody who's never stood next to somebody who's 7'2", it's, it's wild, man. It's hard to believe we're the same species, to be honest. Yeah. You, you wanna feel tiny, stand next to Jeff sometime. Nice guy though. Super nice guy. Anyway, so today, listen, we're gonna jump in here. Today's topic is, you know, let's talk about executive protection intelligence. So everybody knows my background is Intel, like I said, and you come from, you know, a security intelligence space as well. And we've had discussions on this before. We've done webinars in the past. And so it's interesting, but now we have to kind of a more friendly, you know, laid back format. Although, to be honest, for anybody who doesn't know, Jeff must have brought like 60 pages of notes to this thing today. He's the most prepared person I've ever had on the show. Overwhelming content. So it's going to be a lot of fun. Anyway, let's jump right in, man. So when we're talking about executive protection intelligence, What are we talking about? Let, let's lay it out for people so they know we're all on the same page on what this topic is.

Yeah. So kind of set the tone on context here. We're going to be talking about everything from executives to other high-value targets that in today's kind of threat landscape are definitely becoming increasingly at risk and targeted individuals. You know, these type of threats can go anywhere from terrorism, corporate espionage, cyberattacks, and targeted violence. So it's kind of running the spectrum of both from a physical to cyber convergence. So that's kind of what we're going to be focusing on when it comes to executive protection, as well as, you know, explore some of the strategies, technologies that these individuals that we're protecting leverage on a daily risk, a daily basis and are, um, as a result at a heightened risk. So when it comes to it, mm-hmm, we are kind of beginning to talk about, you know, such things in a corporate environment. These can be threats that are physical threats, connect, kidnapping, assassination, assault, cyber threats, kind of data breaches, um, hacking and surveillance or psychological warfare. This can be, you know, your CEO, a public smear campaign or reputational harm. Um, as well as insider threats. This is the employees or the close associates with access to the sensitive information. So kind of, we're going to be talking about that in a nutshell to kind of look at ways to kind of further protect these individuals.

Okay. So listen, there's a lot to get through there, right? Physical threats, cyber, psychological warfare, insider threat. There's a lot there. Let's back up for a minute though. You mentioned high-value targets. Like, how are we defining— I mean, am I, am I high, am I valuable enough? Like, what's a high-value target? How are we defining that one?

Yeah. So when we look at high-value targets, this are, this can be the executives, this can be government officials, this can be people of high net wealth. So individuals, celebrities, or really just people who are in positions of power, of influence. Even taking a step further within a corporate environment, this can be your, you know, your domain admins. This can be your executive assistant, someone who is really maybe maintaining the schedule. And has close proximity to your executives. So these are the type of people who are those high-value targets, tradition in the traditional sense, and maybe people that are sometimes not even scoped into an EP program that should be.

Well, it's interesting you mentioned, you know, executive assistants, no main admins, right? So yeah, a lot of people don't think of that, right? So I, by the way, for anybody who's curious, I'm well aware that I'm not a high-value target, but, uh, but there are people that are, right? And as you said, you know, these executives, these, these high-powered individuals, whether, you know, if it's in the government space, maybe it's flag officers or politicians, things like that. The private sector, the C-level generally comes to mind, right? But I think you make a good point, you know, executive assistants, domain admins, you know, there's, there's a, an expanse to this that I think a lot of people don't think about is if you can't get to the target directly, the person next to the person can be pretty valuable, especially if that's the person who carries, you know, all the real information, right? EAs, executive assistants, they know the whole calendar, right? They have access to every part of somebody's life a lot of times, or they may have all their finances as well. You know, it's amazing how much people will, will trust them, or a domain admin has access to an entire organization. So I think it's interesting as we go through and we'll have some of these discussions to keep in mind that when we talk about executive protection, we gotta really kind of expand that out. It's not just the executive, it's really about whoever's gonna have the highest impact, right? And, and how to get to those folks. And that can be the person next to the person, so to speak. So, all right, so you talked about physical threats and cyber and, and psychological warfare, which I hadn't really thought about till today. On insider threats. Let's talk about, you know, where, where we're going with these, some of these trends, you know, rises in digital threats, for instance, or what the cyber threats are to executives. Do you want to go down that path and kind of talk a bit about what you know there?

Yeah. So in today's kind of threat landscape, in terms of cyber threats, there are the hacking by threat actors who are targeting them for financial gain, for access, from espionage to the data, intellectual property that these individuals may have. Social engineering is an avenue where it's the human element. So this can come in many different ways. This can come from the leverage— leveraging of AI to kind of impersonate a CEO, their voice. So it could be even targeting leveraging the persona of an executive to influence others. So that's something that needs to be kind of taken into consideration as well as the leverage of data breaches. Everyone's information is out there. So how are you gonna, what steps are you gonna be taking to kind of further mitigate that? So it's not a concern. But with that, you know, these are really just the kind of the gateways to these physical threats. Like I kind of alluded to, um, the cyber espionage, the targeted attacks, as well as even doxxing. So the publishing of that personal information to, you know, enable harm. But, you know, taking it a step further, kind of diving a little deeper into it from the cyber threat standpoint. You know, these can be spear phishing, these can be very kind of targeted crafted emails to kind of have the executive to click. They're busy, but then sometimes it's their EA who's managing the inbox, who's also the one kind of that could be vulnerable in that situation. But you know, there's a lot of things kind of going on in that, in that sense that we need to kind of take a look at.

Yeah, it's interesting. And so, I mean, you've talked about it, like there's a blend to a lot of this, it sounds like, right? The physical and the cyber. Seems like there's a fair amount of overlap. You know, you've got, you've got spear phishing and, and social engineering, which, you know, can lead to executive impersonation as well. And, and where AI might fit in there, but also being able to use that for the next step, right? Whether it's using social engineering to gather the information necessary to create a physical attack, right? Or to, to understand where somebody's gonna be, or maybe to understand how to, how to get into the location where they're at. Where do you see this convergence? And AI, you mentioned too, so we, we gotta throw it in at this point. Where do you see this convergence between, you know, the cyber component, the physical component, you know, cyber-enabled physical attacks, physically-enabled cyberattacks, you know, which is less common, and how AI, you know, sort of ties a lot of this together or makes it more challenging for people to defend against some of these things? You know, where, where do you see the, the components coming together?

Yeah, so good question, AJ. You know, kind of looking at the integrating of cybersecurity into the Executive Protection Program. You know, really just looking at that holistic security approach, you know, when it comes to this comprehensive strategy, um, that requires a lot of simultaneous consideration of both the physical and cyber risk. So, you know, when it comes to that convergence, executives' physical security, or physical safety rather, and cybersecurity are no longer separate domains. They need to be interconnected and, and a part of this kind of security apparatus. And some of these proactive measures do come down to device security. You know, let's just say your executive's traveling to China, for instance, that's known for targeting executives that are traveling overseas to their, to their country. What we need to do there is provide, you know, an executive with a burner device, smartphones, laptops, tablets, to ensure that they're not carrying over any kind of intellectual property that's on the device. And then also the full circle feedback for an intelligence cycle, bringing that device back to the forensics team, uh, for further analysis to see if there's anything that was kind of planted or, or on that device. Um, and then another, another component is the data privacy and encryption, right? Kind of implementing encryption for all kind of communication and sensitive data storage to protect against any kind of unauthorized access or potential data leaks from those devices. You know, from the executive or the protectee, um, as well as implementing, you know, kind of access controls and authentication, ensuring that the best cybersecurity practices are implemented, everything from MFA to biometric verification and secure passwords to safeguard from any kind of access to both physical and also digital environments. And then another thing to kind of consider is the remote surveillance and monitoring, um, using digital tools to monitor both physical security cameras and access points, making sure that they're secure, Wi-Fi networks are secure, um, so that there is no opportunity for a cyberattack in real time, kind of, you know, thinking along the lines of intrusion detection and network monitoring. Hmm.

Well, and so a couple things come to mind as you're going through this. I mean, first of all, a lot of these things require executives that actually participate. Executives aren't notorious for wanting to follow all the rules, right? So, you know, I'll ask you two questions. So don't ask this one 'cause I might kind of go through two at the same time, but I'm curious your thoughts on that, on challenges that you either know personally or have seen others experience in how do you get executives who don't want to be encumbered by security, right? And of, you know, multifactor authentication and, and things like that. Do you, how do you, how do you mitigate that if they say, hey, I'm just not doing that, and then you gotta, you know, work around around the boss or whatever it might be. But also, you mentioned encryption and you mentioned device security, right? So device security, sending burners if you're going to China, for instance. But at the same time, the encryption component could be a challenge because you gotta know where in the world you're allowed to use some of those things, right? As an Intel guy, I've done travel briefings for folks and said, hey, listen, in this country you can't bring anything in encrypted. It's a crime. You'll, you're gonna have an issue. You know, they're gonna check you at security at admin when they're gonna make you show 'em stuff and it could be even worse. So, you know, how does that figure in? Is that, is that part of a pre-brief going in? In some places it's non-encrypted, but it's, hey, you know, we'll give you a device and just here's the things you can and can't say, cuz the stuff's all gonna be available.

Yeah.

So I mean, how do you handle those two things together? Getting them to cooperate and working through international laws.

Yeah. And kind of when a lot of that stuff is covered, you know, when, when they are traveling to certain locations, really conducting a travel assessment, looking at everything from, like you said, if, are they allowed to bring in an encrypted device? Some countries don't allow that, like you, like you alluded to, but also kind of knowing the environment there, knowing any kind of concerns from a logistical standpoint. You know, you really have to have a whole kind of brief there prepared for the executive and, you know, where's the closest hospital medical, what do they need to have with them that, you know, for that individual, that predictee, is there any medication they need? But also having contingency plans for, you know, the routes that they're traveling, knowing if there's any kind of major events that may kind of be a concern, um, during that trip while they're at, while they're in country or anywhere for that matter. But when, but to kind of circle back also to, you know, an executive does need to buy into this and you need to kind of instill that level of trust. You have to be a trusted confidant to them. You know, you are kind of coming into their circle, their family, their personal lives, and You know, sometimes that's a tough sell, but you know, there, I think that level of building trust starts with such things as, you know, starting small baby steps and you build from there. And some kind of circumstances that could be security awareness campaigns. If you get their buy-in, maybe you're going to start sending spear phishing campaigns to them and use that as a learning opportunity and a conversation starting point to kind of build that kind of executive protection program from starting from a cyber standpoint and, and going from there. And also dry runs. You can do a tabletop exercise or an incident response drill, really kind of in partnership with a corporate security kind of personnel in a corporate environment to kind of train them and show them how to react to physical security threats, but from a cybersecurity point, how do they respond? How do they alert to ransomware, how do they alert and notify of phishing campaigns, BEC campaigns, stuff of that nature.

Well, and it's interesting, like differently, sorry to cut you off, but differently from a lot of things we do with training, right? A lot of our cyber training is, you know, I mean, you mentioned, you know, phishing campaigns, we do that with everybody. So that's, that's sort of the norm at least. But most of our cyber training is, is employees, right? It's people in the company and we're teaching them, you know, security, physical security, cybersecurity, annual training, ongoing training, whatever it is. But in this case, it seems like, I mean, you've got a team, you gotta, the protection team has to have their job, right? And they're, they're trained to protect just like cyber defenders are trained to protect or physical security, you know, uh, it's trained to protect it. They've got their own thing. But you mentioned it, you kind of alluded to it. It's not just the protectees, the executives, you know, and we talked obviously about the EAs and, and some of those, but also their families sometimes, right? So being able to actually, you know, are there different challenges in, in finding, I mean, there's, I assume there are, and how do you communicate this? You know, it's not just you're protecting., you know, the CEO, but maybe it's the CEO's wife and 3 kids of various ages. So this is a whole different group of people. How do you, how is that different? How do you, how do you manage those challenges of having to get multiple people, you know, finding that balance between, hey, you don't want to scare them too much, but at the same time, you do want them to understand this needs to be taken seriously. Real things happen. I know we have some war stories we'll talk about later on scary stuff. How do you balance that out to make sure that you get the right buy-in from everybody? Because if the CEO totally buys in, but the CEO's 12-year-old son or daughter doesn't, that's, that's, that's the avenue, right? That's the way in the door. That's a problem. So like, how do you, how do you see managing those things?

Yeah. I mean, and from a security apparatus standpoint, sometimes, you know, those around them are the weakest link, um, who is to protect you. And logically you do need to kind of scope that in, but it does open up a lot of kind of privacy concerns and, and things that may limit their freedom. For their family members and stuff of that nature. But, you know, there's, there's different things that you can kind of do, um, to kind of scope in, right? You know, you can kind of start to consider, you know, are they going to be monitored, um, 24/7 or just when they're on business hours and business travel? You know, you can start to kind of limit it and limit the scope until you kind of get by that trust for the auxiliary members. But for an effective program, it is kind of essential that you, you do begin to, the scope of that. And, you know, there is a difficulty in maintaining security without making the executive or, or the high-value target a target by their public exposure. So sometimes, um, the public versus private life, social, social media can be a double-edged sword there. Um, so you kind of start to see, you know, that auxiliary, that family member, that person in their core You know, if they're not scoped under the program, sometimes they can be a vulnerability in that by unintentionally disclosing location or plans, and that kind of can put that protectee in harm's way in some cases. And that kind of goes to a thought of, you know, the insider threat or, or trust issues as well. When they are, when the protectee does, you know, for instance, hire the lawnskeeper or the driver. Or a nanny for that instance, these close kind of associates to the predictee, you need to kind of start to vet them too, though. You know, ensure that you kind of not only doing an assessment or background on them, but, you know, kind of checking in and, you know, having multiple kind of checks into them. What this does is it allows to kind of ensure that there's no, um, it avoids like the insider threats, the selling of access, the kind of concerns around that and establishing layers of security even within that inner circle while respecting the executive's privacy. So you're starting to kind of ensure that everyone else in that inner circle is, is kind of covered and assessed and ensure that they are not an immediate threat from, from a background standpoint too.

So that's, I mean, that's interesting when you talk about background checks and so on. And like most companies do some kind of a background check, right?

But.

Obviously it's very different here. Again, you're talking about people who have really close access and it's not, it's not a corporate employee necessarily. It could be the, you know, the nanny or the, the, you know, the groundskeeper or whatever it is, as you said. Where does it come in, you know, the connection between the, the protection team and say, you know, local law enforcement or federal law enforcement, external agencies? Like how do, how do, how have you seen that in the past? You know, building those relationships, you know, maintaining those relationships. How important is that? How do those. How do those work in real time? Like how, how easy is it to work with local and national federal law enforcement, maybe international too, for all the, for all the travel? How, how hard or easy is that to do? How do teams put that together?

Yeah. So, you know, from that perspective, you know, it is kind of important to kind of put that as a part of your executive protection protocol. You know, a lot of times law enforcement will always be the first responder. They're the quickest to get there. Um, so you need to make sure that you, A, have a good relationship and B, know how to kind of ensure that you contact them, 911, right? But, um, but you know, other agencies can kind of help assist too for international travel, the State Department as such, kind of ensuring that you check in with them when you're traveling, um, as well and having those kind of connections even with local enforcement where you're traveling, right? Kind of. Letting them know like, hey, you know, being able to be able to get in touch with them. Maybe if, if it is a high-profile protectee, um, letting them know that they're going to be in their jurisdiction as well and any kind of steps that may need to be taken there.

Interesting. So we didn't mention it at the open, but you know, I, I just kind of glanced over the idea that you've done all this for a long time, obviously in private sector, government space as well. I mean, you work with the, you know, US Secret Service. So I mean, when I, when I, I glossed over it a bit, but Secret Service is kind of, everybody knows what Secret Service does. I mean, that's protective of, of highest value, you know, targets we have in the country, right? So, but I know you've done a lot in this private sector space too. What do you see as, I don't know, some of the, some of the differences between them? Like, is, is one group generally easier to get buy-in from? Like, I would assume, you know, high-level, the president, for instance, I would assume they understand there's threats to their lives, right? You know, high-level people at those levels, I imagine you don't have to spend a lot of time selling them on the idea that security's a thing, right? But have you seen, you know, more or less uptake? Is it easier or harder with government versus private sector? Is it just individualized? Are there, are there different levels or industries where it's easier or harder?

I, I would say, you know, obviously from a government perspective, that's a, that's an easier sell. But when it, when it comes to, um, the corporate environment, you know, I, I feel like it is a little bit, it goes both ways, right? But I've had experience where it is an easy buy, an easy sell, especially with the increased threat landscape and the high targeting from a cyber perspective. And the cost of the business that they're overseeing. So there is an easier buy-in from that perspective to kind of incorporate that into an EP program. But, you know, sometimes unfortunately I've also seen that it is retroactive. Something's happened where they need the, you know, they, they now they understand the real risk and they're willing to kind of buy into it now. I've also seen that happen multiple times and then that's the trickle-down effect, right? You know, from top down within corporations where it's kind of a mandate for them to buy into it. But on the other, other side, you know, you kind of do have to, in some cases have to, like I said, the baby steps and slowly roll out a program where they might be a little bit more adverse to allowing folks within the company to kind of dive into their personal life. Um, how, although, you know, cuz you, you do, uh, it's a very intimate personal matter and you know, when you kind of begin to scope it in, knowing those intimate details about an executive will only further harden the program by knowing everything from, mm-hmm, you know, the cars, the vacation homes, their travel plans. All of that stuff, the more that you know, the better you're able to protect them. Right. Um, but if they're not willing and able to share all those details, it does kind of allow you to kind of play with one hand and doing the best you can.

Yeah. I mean, that makes sense. I mean, if you've got a protectee who has a hobby that they're, they do, you know, I don't know, they do clay sculptures, you know, every Wednesday and they sneak away and nobody knows. I don't know why that would be their secret, but I'm trying to be kind in this case. You need to know, right? Hey, when's Wednesday night's clay molding night at, you know, at this place, right? I mean, it's a predictable pattern for an adversary. Like every Wednesday night, you know, our target's gonna be at this location. But if they're not willing to share that with you because they're, I don't know, they don't want people to make fun of 'em for the terrible clay models they make or whatever it is, it's, you know, it's a problem, right? So like you said, you gotta be able to build that, that trust factor so that they're able to tell you all the secrets, the things they don't want to tell other people. I talk about the show being Unspoken Security. We're gonna talk about your secrets later. It's, people don't want to share, right? People, people want to hold things back until they've built that trust. So in building the, the trust, building the relationship. So I'm curious, I mean, you've done this a long time obviously, and we've talked about the cyber component, this physical component. So if you were going to build a team, you were going to build an executive protection team today from scratch, you could have anybody you want as like a fantasy draft almost. You know, I know you'd want me, but I'm not available. No, I'm just kidding. But in terms of talent, like in types of talent for the cyber and the physical component, you've also got, you know, this global geopolitical piece comes into play and all this stuff, what would you build? Like, what were the skills you would look for if you were going to put together, you know, a team? And I won't ask how big, because I'm sure it depends on the organization, but you know, what are the skills you're looking to have? What are you looking for people to have on your team?

Yeah. So that team, that dream team would, would kind of include corporate security folks with former law enforcement background connection and, and kind of the experience of dealing with physical security situations where they need to kind of take action. Um, but from a cyber perspective, you would want to kind of partner with a threat intel shop as well as a threat hunter to kind of assess their external threats that may kind of present there. But also when it comes to cybersecurity, you also need a trusted IT professional who can ensure that when they are traveling to certain places and make, maintain their, their own corporate equipment. So you need a, a trusted kind of, um, entity there. So, I mean, it does kind of run the gamut. There's a lot of, a lot of folks that would kind of incorporate that, but I think the most important part is someone who has the soft skills to be able to communicate and, and be that trusted confidant. To the executive, to the high net value individual who can also ensure that they have some solid relationships with their inner circle too, and build their trust and let them know that you are a trusted advisor and have the best interest for them.

How do you, I said I wouldn't ask how many people and now I'm going to kind of go down that path because I'm just curious, but not exactly. But so assume you're a Fortune 500 company, right? So we talked about high value targets aren't just like the CEO, right? It's several C-levels. It could be some admins, et cetera. I assume you don't have a team for each one of them. I don't think you're going to have giant, you know, you're not going to have 150 people doing executive protection, I would imagine. So how hard is it to balance that out, to fragment it out? Is it, are some of the briefings just sort of standardized across the board? Like we have a bunch of stuff on the table ready to go and we can train people the same way and then just customizing as it comes. Like, how do you manage that workload when you're dealing with, you know, it could be dozens of people that are considered part of the program to protect. At such a deep level? And I can't imagine you're going to have a lot of people to work with in terms of the program.

Yeah. I mean, that's a tough question, right? But it is actually kind of tough to answer because, and you know, it varies, right? It varies on the sense of how intimate are you, how much is the company investing into it or how much into a corporation, a corporate executive, or even a high net value individual. Sometimes it can be very limited because you are so close. So you don't want, you know, the kind of the face of these initiatives may be limited, but there will be an army behind it. You know, whether it be from, you know, the cybersecurity standpoint, the IT standpoint, or the corporate security standpoint. But, you know, the, the face, you know, face-to-face kind of interactions is limited to a select few. But there are people kind of supporting that individual who's the face. Got it.

I mean, and the government side, and I don't know if you can share this by the way, but like for Secret Service, the high value target, the high value targets, the, the protectees, they have a team, right? I mean, those don't actually rotate. I mean, I'm sure over time they do, but like if I was, you know, pick a title in the government, which I'm not any of those, I would have the same team for a period of time. Right. In that case, they're the government actually invests and has teams for individuals, I assume.

Yeah. Yeah. It's very similar, you know, where you'll have individuals kind of very close to the predictee. And, you know, sometimes they are kind of selected by the predictee due to the fact that they have a good relationship and they're kind of leading those teams on that end.

Interesting. Do you ever see the show House of Cards?

I sure have. It's a good one.

I'm going to go ahead and assume that that's not a common occurrence with the—

yeah, yeah.

And their detail. For anybody who hasn't seen the show, I, I, yeah, recommend watching it. And if you have, And you, and you find that to be not an amusing joke, then that's on you because I think it's hilarious. But anyway, good show. So, all right, cool. So listen, we've, we've talked about like how to build a program. We've talked about the convergence of cyber and, and physical and, and some of the challenges of, of extending this protection to more than just your protected unit, the family, and some of the differences between the corporate environment and the government space. But I think what people really want, and this is, this is the question I like asking, you know, you more than anybody probably is, let's talk about some some cool things, right? Do you have some cool war stories you could share? Obviously not specific names, groups, companies, that kind of thing. If anybody's looking for that dirt, this is the wrong place. But talk to me about how, you know, when the rubber meets the road, we've talked about all these threats and all these risks. And I, do you have some cool stories that you're able to tell today that you probably used to help build some credibility with executives on things in the past? You know, what's the, what are some of the cool things, man?

There's, there is one that kind of comes to mind. It is a historical example. Takes place in DC. It was a financial executive, financial services executive living in DC, and it was a scenario where proactive intelligence and an executive protection program wasn't implemented for this individual, fortunately, and was not aware that there was an angry mob in the hundreds approaching their, their residence. At this time, that executive was going to go pick up their their child at a T-ball game and had left their child alone, um, at home. So as this mob approached, their child was kind of caught off guard. There's no future kind of early alert signs to this. And unfortunately it did kind of have to be, you know, there was no actions that were able to be taken to kind of prevent this. Law enforcement wasn't kind of there to kind of block it. It was kind of really raw, unfortunately. So lessons to take away from that though, you know, this, these are the kind of things that kind of can give you that early alert. Having an executive protection program, you know, removing your PII when you can from places online, on the open source, you know, some things are kind of mandated and, and needs to be reported. But in those cases, such as like political donations, right? You can use a PO, you can use a PO box, you can use different means to kind of mask your home address. And also to kind of ensure that the information that you can have removed or expunged, that'll help limit your attack surface so that you can't have, you don't have angry mobs coming to your home.

Was that mob like, was it, it wasn't, oh, so it was their home. I was gonna say it wasn't coincidental then. They were actually, were specifically targeting this individual.

Yeah. They're, they're specifically targeting, going there for, for for that purpose. Yeah. They're, they're, they're, they're targeting that executive.

Yeah. That's not, that's not good. What, I mean, listen, we, you've got a few others I think are really interesting. So I'm going to prompt you on some of these examples that I'm aware of at least. Listen, smart homes. Let's use that one as an example, right? So I, I have, I've gone all in on, well, almost all in at least on a lot of the smart home technologies, right? So, and people have asked like, you know, is it safe? Is it not safe? How do you handle that? Like most people I know have something in their smart home, whether it's whether it's just an Alexa or whether it's, you know, Google or whether they've got, you know, locks or whatever. But the further down that path you go, the more you have to worry about the security components. So when you talk about executive protection, you know, what have you, have you got any cool stories on that? What have you seen in the past or sad stories or scary stories, whatever it is, on how people have either protected well or not protected their systems well enough and, and what the risks were?

Yeah, I mean, from that standpoint, when you start kind of talking about technology within the home, I mean, there's basics that kind of need to be implemented, right? Um, your home router, let's not leverage the out-of-the-box kind of default passwords. Um, let's harden, let's harden these devices a little bit so it doesn't make it easy for adversaries to kind of do very easy kind of scanning for those default passwords and devices. Because when that does happen, it does put you at risk. You have all these devices that are connected. And they can be points of vulnerability for an individual or a family, especially when it comes to devices on the doors for access, um, as, as well as, you know, your home networks. So, but yeah, you know, we have seen situations where maybe these, um, protectees aren't really tech savvy and they need to kind of go through, you know, basic cyber hygiene because, you know, maybe in their day, you know, day jobs, they hire people to do it for them. So. You know, sometimes that kind of goes into inviting them into the home, more intimate setting to kind of ensure that everything's up to standard.

Do you have smart locks and cameras in your house?

I do have a Fortified. I do have some cameras around here.

Well done.

Yeah, I do.

I do as well. I have lots of discussions with people. There's always the debates, right? About what, what is or isn't secure. I also do. So another one that I was curious about, because I've seen stories like this is like the,— this is movies, right? About kidnappings, you know, people use cyber to track down, like, you know, where pattern of life analysis, for instance, and where the kids are going to be and where the executives are going to be. Have you seen any of this? And is this real? First of all, do you know anything about it in, like, real life? Does this happen? Is it common? Like, how do you protect yourself? I think you mentioned some of it, obviously keeping things, keeping your personal information off of social media or at least locked down. But I mean, is this something common that is something that is commonly being protected against with these teams or, or is this more of an outlier?

It is definitely something to be concerned about. I, I have heard of a lot of scenarios where, I mean, think about it, when these high-value individuals or executives are traveling, they have, they bring attention to 'em. They're kind of easy to spot out sometimes. And if they don't take security seriously, if they aren't implementing plans to do so with the right personnel around them, they can be easy targets. But with that said, sometimes it is not the actual pretty deal. Sometimes it is family members that they leverage. You know, you see it in sports, a lot of sports athletes, they'll target family members, unfortunately. And so that's something you really need to kind of consider when and why it is so important to kind of scope in family members and bring them in to ensure that they are, they don't fall victim to such, you know, kind of, kind of situations there.

Mm-hmm. Well, it's a good point. I mean, I hadn't thought about it with athletes, right? So a lot of athletes we have, I'll use baseball, I think is probably the best example, right? Baseball has a lot of athletes that have come from other countries that have a lot more turmoil, economics and political, et cetera. And places where kidnapping for profit is just a really common thing. You know, I don't want to overstate it. I'm not trying to, you know, make this, you know, some political discussion, but there are places where it is more common than others. And we have a lot of folks that happens to be, I think our baseball League is, is probably most affected by this. Latin America has a lot of issues with, with kidnap as a business, basically as a, you know, as an ongoing enterprise. So, you know, it's interesting that you mentioned that because I don't know, I don't know if you have any ideas on this. I, I don't know how MLB handles this and I'm not gonna call them out or anything like that, but I'm curious, like, how do you deal with that when you're, when you're talking about, hey, the family members live in a totally different country, they're not with the protectee, you know, how far can you extend the umbrella to try to protect folks that are just so far away? I don't even know if there's an answer to that one, by the way. So if there's not, I apologize for the impossible question.

Yeah, I mean, that, that is a tough question and, and hope, and hopefully one that they are taking into consideration. Yeah. You know, when they are outside of the US and vulnerable and, you know, sometimes it's a scenario where someone's coming from a certain situation and they're getting a lot of money and, and maybe not all the time, not everyone around them has the same economic situation and that they do kind of, um, unfortunately.

Well, yeah, I mean, you're talking about players that make millions and millions of dollars who've come from places where hundreds of dollars is a really solid living. So yeah, this is a challenge. Listen, we have that in the US too. There are people make billions of dollars and get extorted, you know, in the US or kidnapped too. So, all right. One more technology I'm looking for a case study on, cause I have, I have this, but I haven't done anything with it. I'm embarrassed to say. So a few years ago, this, this tool came out, FlipperZero, which is a super cool little handheld tool for those who don't know. And I'm sure most people listening probably do, but If you don't, you can Google the term Flipper Zero. It's a really cool little tool you can do a ton of stuff with. I have one that's literally still in the box. I've had it since they were new and hard to get ahold of, and I'm too dumb to know how to use the damn thing. But, uh, but I know you know a little bit about this and how it works in terms of proximity and, and some of the risks that go with it.

Yeah, this is something that's kind of come out, you know, it's a red teaming tool, but it's become very, I wouldn't say very accessible, but it is accessible to maybe folks that aren't really in that space, but it's also accessible to adversaries and people with, with bad intentions.

Mm-hmm.

And, you know, this is just kind of a use case where, you know, let's just say you have to be in close proximity to the individual for a lot of these use cases. But if you're traveling at a hotel and maybe your hotel card, maybe they're able to pickpocket it, or maybe you just leave it out, they can scan it, you know, get the, get access to your hotel, or it could be your badge. Maybe not so much for an executive, but maybe an EA, maybe someone might have left it on their desk. Whatever the case might be, it's that close proximity use case where access could be jeopardized, as well as other multiple use cases that Flipper has. But those are two that, you know, in the case that if someone is kind of tailing someone, they could probably potentially, uh, have a predicted moment of weakness where they leave something behind like that.

Mm-hmm. Well, yeah, I, I mean, I know you can use it to to clone key fobs, for instance, for like cars and things like that. Um, which, so I guess, I mean, I guess it's obvious, like a lot of people think about it, you know, we see executives, we see high value folks, you know, politicians, whatever it is. And generally people keep a distance, that's security's job. And I feel bad for the security folks because a lot of times, you know, especially with politicians, they want the opposite, right? They want to get close to the people that are, that's part of their gig. And meanwhile, the, the poor Secret Service person is trying to keep them from doing that. And it's not just about, hey, you're going to get stabbed or you're going to get shot or you're going to get attacked or something, but it could be something as simple as this, you know, something could get cloned or copied and, and information could be stolen. There's a lot of technology. Flipper Zero is just one that comes to mind, but there are others out there where people can quickly, you know, steal data from you, from your phone, from your credit cards, whatever it might be. And I don't know if, if executives all understand or, or take that seriously, which is what makes your job so hard, basically.

Yeah.

Yeah.

I, I did have another interesting use case that I kind of wanted to throw out there and it, it really kind of highlights the cyber to physical kind of overlap there. And it kind of comes down, it's a feature on Google. It's Google's location history. It isn't, it is an opt-in feature. And I do recommend that you disable it unless you have a good use case for it. But what, what this use case that I'm going to present kind of highlights is if an adversary is able to get access to your Gmail, maybe your Gmail address and password, and able to get access to your Google account, they now will have access to your Google location history, which tracks you know, your movement and kind of does a nice little, breaks everything down. But speaking of pattern of life, speaking of, you know, the time and they can really get a good idea of your movements, things you like to go to, where you travel to, all that kind of stuff. So it's something where they may be tracking you without knowing.

Hmm.

So that's just something that I kind of wanted to, you know, when you start to think of different ways adversaries may kind of target you from a cyber perspective, which can affect your physical, you know, kind of security.

Yeah, that's a good point. I mean, I spend a lot of time talking to folks about, about turning off technologies on all sorts of apps. Google obviously is a great example, right? Uh, a lot of other apps that people don't realize can track them. Exactly. They don't notice the, they don't bother to notice the, uh, the permissions that they give. You know, we download apps and, and, you know, you gotta look and go, well, why does this app have to know my location? Why does this app have to know, you know, I have to have access to my cal— my calendar or my, camera or, you know, my microphone, because a lot of apps ask for all sorts of accesses that don't seem to really tie to what you got the application for. And unless you, you know, dig into it there, they're already there because you've approved it, right? So, I mean, that's another good example is, you know, turning off history, turning off some of these tracking features, which can be useful sometimes, but the risk is significant, right? And I think a lot of people don't, don't take that into account. So I think that's a really good point. So listen, we got, we're going to start wrapping up here. It's, I know, you know, we could go on. There's, there's a lot of good stories to this. There's a lot of, I mean, this is, there's layers and layers to this, but it, it seems like ultimately it's the physical cyber component are, are overlapping. When you talk about executives having teams that are capable of handling and understanding all these different sides and going beyond just the, the protectee, as you said, the executive to the families, to the, you know, the second, third layers, to the technical component, to the, the corporate admins. It's, it's a big job, right? Uh, it's a big and challenging job. And, and I appreciate you being able to come in and talk about it a bit, you know, at a high level, how to build a program and some things to focus on and also getting into some of these, you know, use cases and real life stories so that people understand this is real. Like, this is not a hypothetical. This is not a, you know, a fantasy. These aren't all movie scenarios and everybody isn't going to have a superhero that's going to be able to save them. So we kind of have to proactively protect ourselves, but Now that we're getting near the end of the show, the last question I always ask everybody, uh, the name of the show is Unspoken Security. And with that in mind, you don't get a pass just because you're a friend of mine. So with that in mind, you know, I need you to tell me, the audience, which is probably 3 people, you know, tell us something you, you never told anybody before, something that so far has gone unspoken.

Well, one thing I would say, I, I do have a nice little hobby. I've done a few acting gigs. One of 'em, yeah. And one of 'em was for Nike where I was a body double for Dirk Nowitzki. And then I did another one with Adam Sandler here in Philadelphia where I was, it was background work, but it was on the movie Hustle, um, Netflix Hustle.

Oh yeah.

And, uh, you know, I was able to spend some time with, with Adam Sandler and Mark Cuban and, and everyone who's on that, on that set. So it was, it's kind of interesting. It's something I like to, kind of do on, on the side, but I haven't got any speaking roles yet though.

So you were Dirk Nowitzki's body double, you said? Like, was Dirk taking fouls and are you getting— are you taking all the charges for him? Like, what, what was the reason for needing a body double for, for a commercial for Nike?

It was— and it's really interesting how, how long they actually have and how many scenes they have to film and how long it takes. It took like all day. Um, so basically I kind of step into the things he doesn't want to do.

Uh, so it was taking fouls then. You're getting hacked around.

Yeah, exactly. Uh, but, uh, it was definitely, it was definitely interesting though. It was interesting. Uh, is—

how tall is Dirk? Is he 6'7" too as well?

Is he— yeah, yeah, he's like, he's 7'1", 7'1", 7'2".

Yeah, you're taller than Dirk. You actually, you actually look down on Dirk Nowitzki. Yeah, that's nice. Hunched down a little bit for his benefit. That's nice. I like that.

Yeah.

And then, so I'm gonna ask, I don't know if anybody else, I mean, I assume anybody would. So is Adam Sandler, you know, Mark Cuban, are they cool in person? Like, is, is Sandler has this reputation as just being a really laid back, normal, you know, guy, right? I've seen him do standup, I've seen him, you know, just talk to whatever. He seems like he's just like you and me except he has fame and money.

Yeah.

But is that true?

Yeah.

Is that how he is?

Yeah, it, it really is. Like, he was so humble. Kind of like the person you see and the characters he plays is the guy he is. Just really. Down to earth. He even had, he even had his daughter on set. So she was kind of like the director for that scene. He had, he kind of like let her be the director. Uh, which is kind of cool. It was cool to, you know, see that family dynamic. And then Mark Cuban, he's hilarious. Super humble, funny. Um, it was, it was just great spending time with him. And he's a cybersecurity kind of guy too.

Yeah, right. He came out of our industry right before he, he seems to have done a little better for himself. And I, I, I assume it's just coincidental that you, uh, you, you body doubled for Nowitzki and that, you know, Nowitzki played for Cuban's team. I assume that's just coincidental, but, but it's, it's a small world, I guess. So you, you, you got these guys' numbers. Are we trying, can I get Cuban on the, on the show? Can I get, do you think you can get Sandman to come on the show or?

It was, it was, it was, it was a missed opportunity.

Ah, damn. I really was hoping like that was gonna be the big push, right? I'm sure, you know, Mark Cuban and, and Adam Sandler have nothing better to do with their time than, than come on, you know, Unspoken Security and talk. At least Cuban's in the industry, but, uh, yeah, he is. Yeah, that's fine, man. Maybe that, figured you couldn't hook me up, but I gotta ask the question. You just never know. So are you still doing more acting? Like you, you're chasing these things? You have a, do you have an agent? Do you look for these or they just come to you or?

Yeah. So like I, I signed up for like some, um, kind of agencies I guess. And whenever they are looking for, uh, 7'2 guy, that's, it's a niche. Yeah. Like within proximity of Philadelphia or DC.

Um, is that, I mean, the good news is if they need a 7'2 white guy, I imagine the competition is very, very small. Like there aren't a lot of guys lining up for those roles, right? Like I can't get that gig. And like if I go in there in stilts, I still probably couldn't get it.

So yeah, I found my niche. I found my niche.

With, uh, I'm gonna ask, listen, what scene in Hustle should I be looking for you? And I haven't seen it yet. It's actually on my list of things to watch. Interestingly enough.

Yeah, it was, it was, it was one of the opening, It was the opening, um, scene. It was a funeral for the owner of the Philadelphia 76ers. Um, so, you know, all the, everyone, all the major main characters were on that set. So it was kind of cool to get to meet everyone like Dr. J, Kenny the Jet.

Uh, oh wow.

Like everyone, everyone was on the set. Yeah.

That's cool. Listen, that's one of the better, like, tell us something that goes unspoken stories. I've had a lot, you know, you're, this is the, I don't know, 20, 6th episode I think we've done of this. And you know, some of 'em are more interesting than others. I don't wanna call anybody out. Some of 'em are less exciting, but this is actually one of the better ones, to be honest. I mean, that's pretty neat. You got to hang out with cool people. That's a, that's a pretty cool hobby that, you know, in your free time you just go out and hang out with famous people and be the 7-foot-2 body double that takes a beating for Dirk Nowitzki so he doesn't have to hurt his, his knees or whatever anymore.

It's a good u— it's a good use of p— it's a good use of PTO.

Yeah, I, I, I would think so. I, I don't, I don't have that going for me unfortunately. All right, cool. Listen, again, I want to thank you. I think we're, we're pretty much up on time, but I want to thank you for coming, for coming in on doing this. This is, you know, I appreciate it. Like you, you've got a very cool background, a very interesting background. You're a busy guy. I know that. But there aren't a lot of people that have, that do what you do, right? There aren't a lot of people that have such a, a depth in the cyberspace, also in the physical security component. I don't know any of 'em who are also 7-foot-2 basketball players who hang out with Mark Cuban, but there aren't a lot of guys like you. So I appreciate you taking the time to come in and talk a bit about executive protection and, and what this all means and these holistic approaches. You know, before I do let you go though, is there anything you want to say? Is there anything we left out? Is there any, anything you want to, you know, talk about? Any pet projects, any plugs, anything at all, you know, that you want to say before, before we call it a show?

No, I mean, I, I think we covered a lot and obviously we could go on and on a, about this topic and, and the importance of it, but just continue to be diligent out there. Um, there aren't out there in this world, not everyone's the good guy. So let's, let's all be mindful of those out there so that they don't take advantage of us. And, uh, take the steps you can to further protect yourself and, and harden from a cyber and physical standpoint.

Ah, that's, I mean, it's good advice. It's a good point. You know, people who don't think they're at risk are, are probably mistaken. It's a dangerous world and most of us have something that somebody wants. So again, I just want to thank you for coming on and spending some time today, Jeff. Really appreciate it. For everyone else who's watching or listening, if you like the show, please, you know, like it and give good reviews and make sure you subscribe and tell all your friends and neighbors and, and see what you can do to, to help grow the show. Uh, if you don't like the show, don't tell anybody ever, but feel free to reach out to me. Uh, I'm happy to take feedback and try to make it better cuz the show isn't about me. The show's about guests and it's about the audience and, and I appreciate everybody taking the time to listen and watch. So with all that said, uh, it's been great being here and it's been great having you on the show. And for everybody else, this is another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.