Unspoken Security Ep 33: Know Your Enemy, Know Yourself

I'm very obsessed with my work, and I do a lot of rewrites. There's been times where I haven't had time to do those rewrites, but for the most part, I do a lot of rewrites, figuring out the structure, the flow, how to make it flow so that when you have a surprise or you don't know something, you don't see it coming. I don't want to start presenting too many hints before that. So, I, I really focus a lot, not just on the content, but on the way that I tell the story behind the content.

Welcome to Unspoken Security, the raw and gritty podcast where security professionals looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA, and I've been building and maturing intelligence programs in the private sector for about 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. Now, this podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not your typical polished podcast. My dog makes occasional appearances, although she's not around today. We'll see what happens. People argue and debate. We even swear here. I certainly do. And that's all okay. I want you to think of this podcast as a conversation, much like one you might hear at a bar after a long day. At any one of the larger cybersecurity conferences that we all attend. These are the conversations we usually have when nobody's listening. Now, today I'm joined by my good friend John DiMaggio. John is currently the chief security strategist at AnalystOne and a cybercrime hunter who doesn't just follow ransomware gangs, he infiltrates them. He's a former U.S. intelligence analyst with a background in signals intelligence, which we have in common. Of course, he spent his, his career going deep undercover inside some of the world's most dangerous cybercrime syndicates. This is where he and I differ. He investigate— he also has an investigative series, The Ransomware Diaries, which exposed Lockbit's inner workings, and it earned him widespread recognition. Beyond that, he's the author of The Art of Cyber Warfare, a two-time SANS Difference Makers Award winner. He's appeared on 60 Minutes and been featured in The New York Times, Wired, and Bloomberg, and he's a regular speaker at all of the major security conferences. But clearly this is gonna be the peak of his public appearances, as you can tell by that list. So, John, anything you wanna add to all that?

You did a pretty good job, AJ. Thank you for the wonderful intro and thank you for having me today.

No problem, man. I'm glad to have you here. What I didn't mention there, John and I have worked together before previously. We come outta the same agency. We've worked together in private sector and actually spoke together at RSA. John was on a panel that I moderated at one point. So I'm thrilled you were able to make the time, man. I really appreciate it. Your whole career has sort of just blown up. Since those days, you're, you're a big rock star now. So thanks for, for finding the time to chat with me. And so today the discussion, you know, we're gonna talk about the title is Know Your Enemy, Know Yourself, right? So, you know, capitalizing on, on some of the things we just talked about in your background, you know, about going undercover, for lack of a better word, you know, going into these ransomware gangs and infiltrating them. And I know you've made some friends along the way. I'm sure, I'm sure there's all sorts of foreign assets that are really excited about you. But I, I kind of wanna get off to a start here and say, okay, if you're gonna do all these things, like, let's go to the very beginning. Like, how do you start an investigation from scratch? How do you start? How do you— what's the first steps? What do you do to get going?

Yeah, so I mean, before you do anything, the— honestly, the most important part of research, especially research where you're going to engage with criminal adversaries, is to do your homework. You need to profile them. You have to figure out where they live, where they spend their time. And I don't mean like adversarial infrastructure, which of course you need to, to know and be aware of that as well, but I'm talking about like the forums that or social media places, whether it's Telegram or, you know, some underground forum or dark web forum or whatever it might be, you know, where they spend their time. So there's a lot of preparation. And that means, you know, not just profiling them, but profiling the people they work with, the people they buy attack resources from, but more importantly, the people they're friends with. And the reason that's important is you learn more about them and you need to know what makes them tick. So you want to identify whether there's you know, strong political beliefs, whether there's cultural or religious beliefs that they have, or what often really important is to identify who they don't like, who are their competition or adversaries. And then you have to figure out the approach. There's multiple ways to do that. But one of the most effective ways I found with, with a lot of criminals is playing on their ego. And again, sort of building a camaraderie based on who they don't like or who their adversaries are. So you have to put all this together, come up with a game plan, Make sure you have the resources, the, like, for example, if there's a language barrier, that's something you need to figure out ahead of time. All of these are important. And whether you're going to do something covertly or overtly, I've done both, but most people don't do, you know, overt engagements where you're directly communicating as yourself. I've had, I have, and, and, but my situation is a little bit different, but either way, both of them still require a lot of planning, understanding the person, what makes them tick. And, and then you, you actually do the engagements once you've done all your homework.

Okay. So that's, I mean, that's a lot of background information that you've gotta go dig into these guys, right? And you mentioned a couple things I want to kind of follow up on. Let's start with languages, right? So most, I don't know, maybe most, I'll say most, most cybercriminals don't, they're not native English speakers, right? There's, it's, US is not the number one country for cybercrime. Not that we don't have our own, but if you're dealing with Russian or Romanian, or I could probably name a bunch of other countries. So, you know, nobody accuse me of picking on anybody. You know, pick an Eastern European language, I suppose, as a place to start. How do you manage that? Like, do you speak 28 languages? Do you have good translation software? Do you have a lot of friends who are linguists? Like, how are you managing through that?

You gotta use the Duolingo app on your phone, man.

No, I'm kidding.

I do use that, but that's not, not for work.

Duolingo. Oh no, I wish I were a sponsor. I should, right? Or now Duolingo, learn everything or something like that. Anyway, go on, man.

No, but you do have to have a plan with that. I can tell you some of the things I've done, but, but one thing to keep in mind, at least, you know, with the past 5 years, I've been doing a lot of work with, you know, Russian underground crime, cybercrime. And the thing about that, especially with ransomware, is it's the one of the very few attack vectors where victims always have to talk to their attacker. So most of them can at least speak in broken English. So for example, what I did with LockBit when I began the COVID part of the operation, I approached them speaking a language after doing my homework that I was pretty sure they didn't speak, which was German. And when they said, I don't speak that, I was, well, we both speak a little broken English. Why don't we, why don't we try and communicate like that?

You sneaky bastard.

That's exactly what I did.

You sneaky bastard. You tricked them into leaving their language. You sneaky bastard. No wonder they don't like you. Right, right. That's, that's brilliant though. I mean, I, I, listen, I've been doing this a long time. I've been in the industry, you know, forever. I'm old. That's still brilliant. Like, that's the thing I was like, oh sure, of course you did that. Makes great sense. 'Cause a lot of people speak some English, so just pick something they don't speak either and then find a middle ground. And that middle ground of course is actually your ground 'cause English is your language. But that's, I mean, that's, that's interesting. I hadn't really thought about that. Is that, is that just a Lockbit thing or is that a common tactic you've done with other groups?

So I actually got that tactic from James Nival. Nival, I'm probably saying his last name incorrectly and bastardizing it, but he'll be upset. But, you know, he's a former Recorded Future guy, brilliant pentester, and he had done a bunch of work with Black Matter back in the day. And we were talking about this, you know, before I started this, and he's the one who gave me the idea, and it was effective. So, you know, it just like, you know, you have to have a good Rolodex of criminal entities to to who know you, can vouch for you, and things like that. You have to have the same resources with security researchers because you're always going to need help along the way.

Yeah, it's a, I mean, it's a small industry, and, you know, I tell people a lot of times, like, you're going to make your reputation, and there's a lot of things that come with that, right? If you have a bad reputation, eventually you have a hard time finding a job. Nobody wants to work with an asshole. But also, good reputations, people on a team, like, people want to help each other, right? A good example, right? There's a lot of things I don't do well. There's a few things I do okay, but I know a lot of people who do a lot of things well, and I've convinced them that I'm a good guy. They're easy to trick, apparently. And so it's that teaming thing, right? Being able to work with other people. And it's, that's an interesting thing in the industry is we're all looking to do good things, most everybody at least. And so if you, if you build that network, you know, of, of colleagues and friends and, you know, respected people who are like, hey, I do this, you do that, that's cool, we can team up. Bad guys do the same thing, right? I mean, they team up on things too. Somebody writes the code, somebody you know, is, is better at, you know, at, I don't know, getting into a system. Somebody's better at the egress process, somebody's better at cashouts, whatever it might be, right? So we do the same thing on our side, but it's going back into the, into the forums of discussion. So you mentioned in this, in the case of LockBit, right? That, and we're not gonna talk a ton about LockBit cuz frankly you talk a ton about LockBit already and it's, it's a cool topic. I'm just gonna give you other things to talk about. Appreciate that. Yeah, no worries. But I mean, you talked about, you know, moving to English, right? Were you emulating a victim at that point? Or, 'cause when you're emulating the bad guys, if you're trying to partner with these guys, you're trying to get in these forums and try to partner, like, it seems like, in my opinion, you'll tell me I'm wrong, less likely to work, right? So how do you, how do you do that? Or is it when you're investigating these groups and infiltrating, you're not trying to be infiltrating as a criminal, you're infiltrating as a victim?

Well, actually, I took a different take. I approached them as an upcoming eager hacker who wanted to join their ransomware group. And they, this was back, you know, 2021, maybe early 2022, can't remember. But, but that's where I started doing this. And, you know, I, I, I, they had, they had posted, you know, a bunch of things, recruiting propaganda and things like that. So, and I was again talking with a lot of their, their, their members and again, people who are friends with them, not just working with them. So I came up with this plan. I, I knew I wasn't going to get all the way in because at the end of the day, even if I did get, get in and they gave me access, you only have a certain amount of time where if you don't produce victims and gain a decent amount of money through extortion, they boot you out anyway. So, so I was doing it more just to— sounded like a fun idea at the time, and I wanted to see what I could learn and where it would take me.

It's nice to know they have corporate KPIs. You have to, you know, to produce, right? Otherwise we're not keeping you around. Like, it's, it's good to know that even in the criminal world, it all comes back down to profit margins, right? Like, Yeah, we're not, we're not carrying you around. You, you know, you gotta make some money for us. So when you're doing this, like two things that, that come to mind. First, we talked about some of this prep work, right? So for this, this ruse that you put on of, you know, being a German, native German speaker and, and moving, are you building like the full persona, a full sock puppet? Like how deep do you go and how deep do they challenge you? Are they, you know, they, they, are you challenging, you know, physical locations, education, background? Like, How, how deep do you go and how long does it take to build, you know, a really good persona that you think's, you know, virtually bulletproof is, is the first question. And then the next piece that goes along with that is the infrastructure to go with it. You know, so if you're building this persona that says, you know, you're German, you know, native German speaker and you gotta build all the things, the age and the, the gender and the location and the background, all this kind of stuff, right? I assume, and tell me I'm wrong, you have to build the infrastructure to go along with that or something that at least emulates it in case they check, right? I mean, they may, they may want to know that. So how did, how was, How long does it take to do all that stuff?

Well, so depending on the operation, there's different answers, but for anything where I'm going to do like covert engagements, I built myself a template that basically has everything a real person would have, would have kind of shopped that around with some other folks that do the same type of work, make sure I didn't have any holes. And what I do is I just spend time creating those accounts, building out those profiles, building out history and a backstory. What I do, or what, what I did— I don't have the same time today, but what I did for several years was I would have 5 accounts going. I'd have 3 that were in development and I'd have 2 that were operational. One would be a supporting account and/or a backup account for if I lost access, to still have some sort of access into the group. And I would use that also to support that, that primary account.

But it was a—

it's a lot of work. It's constant development. But at the end of the day, that's what keeps you safe. So you have to put the work in for that. It has to be believable. Has to be a history and there has to be, you know, a lot of supporting accounts and details. So if they do check you out, it does look real.

Mm-hmm. And then what about the infrastructure? Are you building, you're building a full virtual network? Are you using like, you know, virtual, you know, browser software, things like that? What are you doing?

No, that's a great question. So I, I used to build out my own virtual network. It's a lot of work. I used to be an engineer, but that was like 20 years ago. I don't have the time or the patience for that. So I use a great resource.

It's, it's, it's from a company called Authenticate.

And they have a tool called Silo. And it's the— and I don't get anything for saying this— it is the best resource for this type of work or any type of cybersecurity research that exists because it keeps you safe. It takes care of— you have hop points all over the world. And it also, like, for example, on forums, if an administrator goes and looks at the logs, they can see that you're translating everything as you go. What Silo does is it does all that outside of the session and presents it back to you. So in other words, there's no log or trace of evidence to follow you to figure that stuff out. And, you know, who has the time to try and figure all that out on their own? I know I don't.

No.

And, and for those who are listening, like, listen, I didn't know that was gonna be John's answer. I know there's people who go, wait a minute now, AJ works with these guys, you know, Authenticate, right? I've been a user of their tool. I've used Cyware for like 9 years. Oh yeah, yeah, I, I'm It's one of the few tools, like, I've been in sales meetings, conversations while working for other companies. I'm like, oh, you gotta see this tool. Like, I, I love it and I don't use it as often or as well as you do, frankly. I, but it was one of those things, it's the easy button to the dark web. So, but for anybody wondering, that wasn't intended to be a plug. John just uses it and that's just a, a convenience that I'm certain I will make sure the folks at Authenticate hear about. Cause they'll be happy to know.

The reason, if I could just interrupt real quick.

Yeah.

The reason I plug it or, or talk about it, well, one, you asked me, but the reason that, that I, I, I don't mind mentioning them because I don't normally mention vendors is because because it is something that keeps people safe. And there's a lot of people who do this type of work who don't necessarily know what they're doing, or they're, they're new at it and think they know what they're doing. And this will cover your ass a lot more than you trying to do it on your own.

Yeah, 100%. When I, I was introduced, I, I saw it briefly when I was still in the government space, but I really got a chance to play with it when I was in the bank. And because, you know, we had some brilliant people, and I'm not an engineer, I can't build shit really. And we had this guy who'd built this dirty network and it was, you know, hopping and VPNs, all this stuff. And I was like, oh my God, this is a lot of work and a lot of energy. And it was slow. And so I was introduced to the tool and I was like, all right, this just solves my problem. Like this is, I don't need to worry about the engineering stuff. It's there. So anyway, we're not here to continue talking about it, but in case anybody's wondering, it is a very cool tool and I'm happy to talk about it at length. And the CEO was just on a couple episodes ago.

So, okay.

Well, the other question I had besides, yeah, besides the, the front end of, okay, all this research you have to do, which is a ton to build, to build this persona, build these personas, these profiles. And obviously the engineering piece cut down because you use an app at this point, but in some cases people do build these big networks. But then you got the backend, right? You do all this work, like these projects sound like they take a long time to run out. And then, so how long can they take or do they take? And then what do you do at the end? Like what kind of, how long does it take to put together reports? What kind of output do you have and who does that go to? Besides writing books and doing public things to make yourself super famous and awesome, like you're almost as cool as the Batman sign behind you at this point. But, I mean, how long does it take to put all these things together? Like, what's the backend for all this stuff?

So the first Ransomware Diaries where I did the COVID part of that operation, or the most of the COVID part of the operation, that actually took about 6 months. Typically though, usually it takes me about, I put out like 4 reports a year with the Ransomware Diaries, or I did. And so that's about once a quarter. But yeah, it takes a lot of time. And not a lot of employers, you know, would be on board for that. And that's one thing where I'm glad that, you know, the analyst at one of the companies I worked for was patient with me because while everywhere I've worked, long-form reports don't do well. My Ransomware Diaries, each one, each volume is like, you know, between 50 and 70 pages for the most part. But they trusted me and that was a story. And I'm a storyteller. I love to make cyber work interesting and not just have a report with IOCs and details. I want to tell the story. That's why I wanted to get to know the humans behind it. But, but doing that, you know, it's had a ton of success and it wouldn't have had that when we— when I've written short blogs, they have not done well. So there's exceptions to everything. And when content's done well, I think even if it's lengthy, you can still have a lot of success with it. But they definitely take time. A ton of work. To answer your question about the writing phase. Yeah, that's, that definitely, honestly, that takes me anywhere from 1 to 2 months. I'm very obsessed with my work and I do a lot of rewrites. There's been times where I haven't had time to do those rewrites, but for the most part, I do a lot of rewrites, figuring out the structure, the flow, how to make it flow so that when you have a surprise or you don't know something, you don't see it coming. I don't want to start presenting too many hints before that. So I really focus a lot, not just on the content, but on the way that I tell the story behind the content.

Well, and that's, and that's interesting. And kudos to, to AnalystOne's leadership, because like you said, that's a challenge. Most organizations don't, don't want to buy into that. They, they just want things quick, right? Every— it's fast, and, you know, ROI, you know, return on investment's a really big thing. And, you know, if you say, hey, I'm going to do this thing, it's going to take months, and, you know, don't know for sure what we'll find, don't know what the output's going to be, it's hard to get somebody to see, to see that strategically and say, all right, you know, I trust you, this is going to be very cool, let's do it. So Yeah, it's pretty awesome. Go ahead.

On that, with Ransomware Diaries 1, it's funny because I wanted more time. I was unhappy with it. They insisted because that one I had spent so much more time than any other report on. And I had just come back. I had won the SANS Difference Makers Award for my book. And it was just before Christmas. And all I wanted to do was take some time off and relax and come back to this. And they were insistent that I finish it. And I just, I was like, okay, well, you know, I just won this award and it was I was like, you know, it's one of those things where you can sit and be like, oh, pat yourself on the back on how great it was, or you can just get back to work. So I was like, let me just do this. And we put it together and we got it out. But I was, I remember the first person I shared it with was Dina over at Click Here, the podcast. And she's a former NPR reporter and I'd sent it to her and she came back to me and she was like, she said to me, you have no idea what you have here. You're really underselling this. To me it was, you know, just another report that I'd written and, and it ended up being what will probably be the best work I've ever done in my career.

So that's incredible. Well, and it sounds like, like you said, you, you didn't want to release it that soon. You wanted more time. And I have a hunch, not to speak for you, but you know, I've seen this and I've seen this a little with you as well. It's that whole, you know, perfect is the enemy of good enough, right? And, and yeah, caring so much about the work and being so diligent, which is, you know, what we're all raised to be in the agencies, frankly. You also get to the point where it's like it's never good enough to publish, right? So sometimes it's nice to have somebody kick us and go, listen, it's got to get out the door, right? You can't continue to shuffle words forever. You know, is that balancing act— you want to rush it, bad, you know, bad intel, you know, rushed intel is bad intel and you get bad results. But, but it's good in this case. It sounds like it was the right balance of you, you were in a good spot and somebody had to push it a little bit. And, you know, as you said, it sounds like it's some of your best work, which is, which is saying a lot at this point, frankly.

Well, thank you. And that brings up another good point, you know, uh, it all depends on what the work is for. I spent, you know, 14 years in the intelligence community where everything has to be timely, quick. It's not about telling the story and having the layout, but at my current job, that's what, you know, this is a different process. It's a different end result to an audience. So that's the reason that with this, I'm different, you know, when I'm writing something that's for intelligence purposes, that's about time, speed, and accuracy. So there is a difference. And you do, for people listening, you do have to, cause I've worked with people that never make their deadlines, take forever. You know, it all depends on the dynamic of what you're writing, the purpose of it, and where it's supposed to go. And obviously your handlers on when they expect something to be done. I think I've only missed a deadline at AnalystOne once, but for the most part, I always try to make my deadlines and it always involves me working like the month before, 7 days a week, crazy hours, because I obsess about my work. But that's on me. No one makes me do that. That's just me. It's just how I'm wired.

Yeah. And I get that. I mean, I, I, I'm also somebody, a lot of my stuff comes outta the last minute cramming that has more to do with ADD and, and poor planning sometimes. But, but also it's a, it's a forced thing and there's a lot of people in our industry who have, you know, ADD or ADHD. And part of that is you don't perform well until you're forced to, you know? And so I don't know, I don't know if that applies to you necessarily in this case, but it, it applies to me a lot of times. So I always gamify my way, Jay. What's that?

I always perform well.

I'm just kidding. Look at you. That's well done. I'm gonna, I'm gonna keep that in. That's gonna actually be the clip that I'm gonna use. To promote this show. I always perform well. I'm actually going to pull back. We did mic check before this all started, and John also went to the microphone and said, I'm Batman. So I'm going to take that and I'm going to say, I'm going to put those together and we're going to have fun with that. But I can't wait. So maybe we can get it as like a mix. So listen, I want to move on to another, you know, piece of this, another big topic. When you talk about, you know, the research and putting all these things together, and it's a bit of a shift, but we run into this a lot, is Attribution is a big challenge, right? So now again, you're in these spaces. So in some cases, I'm sure it's less of a challenge as to which organization is involved because you're there, right? But it's really common that we run into challenges. I've seen a lot of, I know you have too, of there's this rush to attribution. Who did this? And sometimes it's important to know, like people ask, you know, why do you care? Well, attribution matters if you want to know, you know, if it, what might happen next, what their motivations might be. There's a lot of reasons to want to know who did it. Some organizations like, I don't care, just stop it, just make it go away. And that's, You know, are, are we likely to see it again? That may have to do with attribution as well. But there's also a lot of challenges with attribution. So I'm curious about your thoughts on how do you get to the point of attribution on adversaries when, you know, isn't direct access like this? And what do you see as a lot of common mistakes that, that others are making in this area?

Yeah, I, I am a, a stickler for attribution. You know, I, I learned how to do it with an intelligence value. I was trained how to do it in the government, transitioning to the private sector. I sort of learned how to apply it through cyber a little bit better. And in my book, I wrote a whole chapter on it with covering pitfalls and what to do and how to use case. And I'm going to answer your question, but in that use case, in my book—

You should hold up the book.

Which I should. Yeah, I don't have it right here in front of me, but yes, I should have. But in the book, I did a whole chapter and I had a use case. The use case was great for teaching because everything fit perfectly, but that's not what real-world work usually is for attribution. So I got a paper coming out. My next one is on the 22nd of April, and it's about how to do evidence— it's the same model from the book, but how to do evidence-driven attribution, applying weight, making assessments, having a hypothesis, being able to defend that, all that stuff before you actually make attribution. The reason I spent— and then I do a use case with BlackCat because there was a lot of people out there on social media, even in actual reports that, you know, were making comments about how BlackCat is this group or another group. And, uh, they would sort of take my word attribution, and that's becoming more and more popular. And it, it, it's a problem because you're not providing evidence. People get it wrong. Other people run with your attribution, and it's sort of a snowball effect. And I have a, I have a big issue with it. I want you to be able to give me evidence if you're going to make that statement. Otherwise, it's your opinion and qualify it as that. So, but, but the pitfalls that people make are, are just that, making an assu— letting their human bias or their assumptions lead to attribution. Not supporting that attribution, or using either too little evidence or the incorrect type of evidence to make that assessment. And I'll give you an example. You know, a lot of people make that with this BlackCat thing. A lot of people made attribution as to whether they rebranded or not based on a group having code overlap in their ransomware payload. And people are like, uh, BlackCat is, you know, they're, they rebranded into RansomHub. And then, you know, about 4 months later, another group appeared, Cicada 3301. And magically, they also had a lot of source code overlap, even more so than RansomHub had, and people made attribution to that. Well, here's the thing, you should never make attribution, or rarely make attribution, based off of sort of one, one vector of the Diamond Model, or, or one piece of evidence. You want to have a well-rounded, balanced attribution evidence to support that. So, so you want to have multiple vectors, and then you want to qualify it. You want to say, okay, I believe this with this is low, medium, or high confidence. You want to put weight to each piece of evidence, and you want to have somebody besides yourself help to, to qualify that. And what I mean by that is you get too close to it. So what I do is I have my team, or when it comes to me, or with them, but for like, for me, with it, we'll sit down and I'll have somebody take the, the other side that, that I'm wrong and do their homework and try and poke holes in it. And if I can't defend it, and support what I'm saying with, with, with the evidence, then, then we don't go with it, or, or we'll give it a, a lower confidence rating. So if something has a lower medium confidence rating, often I won't go public with it, but internally I'll, I'll put that assessment there and we can continue to work it. Sometimes I'll say publicly, okay, I believe this with medium confidence and here's why. But if I have high confidence, that's where I go with it and I run with it. But again, you'll not see me, at least not very often, I'm sure I've made some mistakes out there, but not very often will you just see me say, oh, such and such is this group, without providing evidence. With those exceptions, obviously, where it's, you know, the, the group has, has said that they did it, they've got the— they provided the evidence, they have the data, you've checked, it's not out there, there's samples of it, you can validate it, the victim may or may not have, have acknowledged that this is it. You know, those are those situations where it's a little bit easier. But when it comes to something where someone's trying to deceive you and they don't want you to know about it, like rebranding, for example, it's not gonna be that easy.

Well, and it's good. You made a lot of great points and a lot of 'em that, I mean, I, I'm sitting here smiling cuz it reminds me of, you know, the old days. Like for those who don't know the Diamond Model, it goes back a long ways. Kinda gives away how old we are. I remember like Diamond Model was created at the agency. I was there when it was being authored and the purpose of the Diamond Model, which I'm trying to try and remember the 4 sides of the Diamond Model now. I know infrastructure was one.

Infrastructure malware.

Yeah. Malware. There's a couple others. I, I'll look it up. I'll figure it out. Somebody will, will find it out. But yeah, there's lots of reasons we came up with it at the time was because this was, this was, we were trying to explain the leaders to executives how all this does, how all this gets done and put it in a, in a visual form, but also some justification of saying why attribution, how to do attribution, why it's done this way, et cetera. And you had to have multiple points, you know, it gave you better confidence as you said, confidence rating straight out of, you know, intelligence community directives. Low confidence, you know, maybe is kind of, kind of, I mean, there's statistics to it, you know, moderate, you know, medium confidence, you know, more likely than not, 50/50, that kind of a thing. But, but it was putting that out there. And I think one of the challenges that I've seen at least is, is in the private sector, listen, there's still, there are a lot of people who came outta the government space to the private sector. They were born and raised and trained in this stuff for years and years and years. And I'm not saying that you can't be an intelligence professional if you didn't go through that process. But I am saying if you did nothing, if you were a nothing intelligence related, to be clear, if you were an incident responder and maybe a great one, you're not suddenly an intel person, right? There's processes and standards and procedures, and it's easy to fall into those traps cuz every junior intel person did. That's why we were trained outta that stuff.

Yeah.

And even if you get, you know, the SANS course, which is a really, really good course, it doesn't give you the experience. It doesn't give you that, that knowledge, that background. It doesn't give you the, the hum, the humility frankly, to have been in a bad position. So you realize, hey, I gotta peer review this. You know, you gotta have somebody set up, like you said, the challenge. It's, you know, one of the analytic techniques to have somebody take the opposite position and try to push as far as they can there and see if they poke holes in it that you might not have seen. 'Cause you're so close to it that you, you have that bias, even if you're trying not to, you, you've come to believe this is, this is something, right? And those are things that you only experience through a lot of effort, through a lot of training. And also, like I said, the humility of being wrong and being so right determined to say it was definitely this, and then somebody proves it's not and you're like, oh, it's terrible. But I fear that part of it is, like I said, part of it is people that have intelligence titles but weren't put through these processes. It's not necessarily their fault. Companies said, hey, I wanna go into intel. And suddenly they took a team and said, you're the intel team now. That's not quite how it works. But also this push sometimes in the vendor space, I suppose, or sometimes through marketing of wanting to have the big splashy thing, right? I've worked with marketing teams and I've written stuff and they go, hey, can we get rid of this low confidence thing and just, you know, just say it's that? I'm like, no, you can't. You can't do that. There's a reason. Well, low confidence isn't really flashy. You know, it doesn't, it's not a good marketing piece. I'm like, well then don't publish it. It's low confidence for these reasons. You have to educate people that confidence matters, right? But it's challenging, I think, because you see people that either are misattributing things and they don't have enough evidence, as you pointed out, and they're either doing it because they don't have the experience and the knowledge, or worse yet, it's intentional. Like somebody's told them to do it. It's for marketing purposes. It draws attention.

Yes.

And it's sad because as you said, it snowballs. We're at a point now where that gets out and somebody else echoes it and repeats it. And next thing you know, you got hundreds of people saying it. And now it's circular reporting that people are saying, well, that supports it. Well, this guy says so too with this. And it all came back to the same thing. It all came back to one flawed analysis assessment based, you know, assessment based on one piece of evidence. You know, recycled code is far from, you know, conclusive. Bad guys are great recyclers. You know, they do more recycling than I do at the house for sure. So like, it's a terrible way to decide this must be them, right? It could be, but must be is, is far away from that. So. It frustrates me, and I— go ahead.

You hit on a point there. You know, when I, I spent years trying to, to get my book published, and I really wanted to go with a big publisher. And when I, when I began talking to, to No Starch Press about doing this book, I, I remember when I had, I just had an outline at that point, and I had a sample chapter, but I remember having a discussion about the, an entire, the, the, the publisher said to me, you wanna have an entire chapter about attribution? And I was like, absolutely. And I just remember having to explain to them almost like this conversation, but what you just said to me, not everybody comes from an intelligence background. But on top of that, through all the many, many years of experience now, you know, I altered sort of that process and I made it more applicable to be used in the private sector. And that's why I wrote that whole chapter is so that there would be a resource out there that tells you how to do this sort of, you know, analytically driven attribution because it didn't exist. You're right. And I think that's one of the reasons the book has done as well as it has.

Yeah. And that's, I mean, that's a service to the whole community. And if anybody hasn't seen it and you don't have the intel background, please read it. Please. And please understand, I'm not trying to insult people. I, I realize, and I'm also not trying to be a gatekeeper. I realize I get passionate sometimes about if you're not an intel pro, don't lead intel teams, et cetera.

Right.

I'm not saying that these are things that can't be learned. They can. Like there's, I know lots of people in the intel community that aren't special or brilliant, you know, myself included, frankly. But we, we were, we were in it like we wanted it. You know, I, I, we went through years and years of school and training a lot of times through the military or whatever it is. And it is a set of, you know, it's, you know, Liam Neeson, a certain special set of skills or whatever. But, but it is, you know, there's, there's something to it. I think a lot of people have lost that or didn't know to begin with. They think, well, Intel is just, you know, smart people using Google. And that's sometimes true, but a lot of times there's a lot more to it. And you get into structured analytic techniques and you start talking about intelligence community directives and you start talking about JP2-0 and people go, well, I don't, I don't know any of these things. Well, that's 'cause you're not an Intel pro. I mean, And don't feel bad, I'm not trying to insult anybody. I'm not an incident responder. I, you know, I'm not a malware analyst. There's a lot of things that I don't do. I think it's important that people understand the difference. And it's great that you have, you know, this book is one of these good resources where people go, okay, I get it. I can, I can learn these, these nuances. And then teaming with other people, as you said, which is always good advice. I, I don't know anybody who's good at this job who doesn't do that. I don't care how long you've been doing it. I've, I've done it for 20-some-odd years, whatever it is now. I'm old. You gotta have somebody, you gotta have somebody to peer review. You gotta have somebody to team up with, somebody to challenge you, somebody you, you respect to challenge you. You know, the best intel teams I worked on, there were fights. Like, not physical, but there were arguments and passionate fights. You're like, well, there are. Okay, you need that, right? I mean, that's how you find out what's real, because this shit matters.

And, and it's better to do that. And, and if you're right, some people do get upset about things like that because they're so close to it. But it's much better to have that bad day in the office with your peers than on a very public level where the whole community sees it and, and you're proven wrong there. That's a lot worse. I remember, so my book hadn't come out yet. It was getting ready to come out. And there's a, there's a, he's a good friend now, Will, Will Thomas. He, he, he goes by Bushido Token on, on, on X. But even after everything I just said, I had put something out there without just human bias. I had said something. This, this group is, is X and it did it. I mean, it ended up being accurate, but I didn't do all the things I just said to do.. And he, again, it was a public level and I didn't know him then. He challenged me and he kind of backed me back down. And, and I went to him offline and I was like, hey man, I, I thank you for doing that. You know, I am a stickler for attribution and I literally did what I always tell other people not to do. And we became really good friends after that. But, but it can happen to anybody. Again, it's just you, you have a bias. You don't even know it. It's so easy to say that group, group A is actually group B and, and and you might be right, it might not be, but if you don't provide the evidence, other people shouldn't use that as attribution, and you should get in the habit of not doing that.

Well, and you hit it on the head. I mean, that was the big piece, is that you had the humility. Like, we see this all the time on social media, whether it's, you know, whether it's our work or anything else. People having a position, it's not a supported position, and then you challenge them and they just dig in and, you know, throw a bunch of slurs at you or whatever it is, right? They get— and, and I'm a sucker, I admit it. I should stop being on social media because I Again, it's ingrained as an intel person. Somebody has something and I'm like, well, this— there's no logic to this conclusion. I should just go, yep, there's no logic, and move on because they don't want to hear it anyway, I'm sure, right? But sometimes I jump in like, well, hold on a second, what about this, this, this? And then suddenly I'm, you know, accused of a lot of things. Some people have the humility, but most don't. And I guess it's, you know, I've been doing this so long. Like I said, you have some of those bad days in the office, but everybody also understood we were all on the same side. It's all to get to the right answer. You know, if I ask you a challenge, challenge a challenging question, it isn't meant to be personal. I'm not trying to challenge you. I'm trying to get to the thinking. And I've also found, by the way, I don't know if you have, I'm sure others in the industry have at least, it's not always well received by friends and family as a way to live. Sometimes people do get tired of that shit and they're like, why is he constantly questioning me? I'm like, I'm not questioning you. I think there's a lot of pieces missing of this. Help me understand why you believe this or why I should believe this. Because you do it so long, it becomes who you are, right? It's ingrained. It's a habit. It is not necessarily the greatest way to win friends and influence people. So I've, I've found you, you kind of have to massage that in the rest of your life. Be like, you know, temper how you ask these questions. But it's very hard to just accept things at face value and it's hard to watch other people do it. Yeah. So I, I'm sure you've seen some of the same stuff.

Well, you gotta check your ego at the door as well. Mm-hmm. I mean, I don't care how long you've been around, I don't care how good you are, there is gonna be somebody regardless of their experience that's gonna be able to teach you something. And it's when you put your ego above that, that you stop learning. And it's also where you make the biggest mistakes. And that's very difficult to do, but it is very important to remember that we're all human, we all make mistakes, and none of us are perfect. And, and to back, get back off that ledge. You're not the greatest out there. There's always gonna be somebody smarter that sees things differently and it can provide a, an angle or a view that you didn't even think of.

Yeah, usually it's you, but usually it's you, but, but no, I, I'm with you. So. We've sort of leaned into the, the last question I wanted to ask on, on this topic, but we've already sort of started, but I'm curious of the thoughts on it. So you've been doing this a long time, like I said, we both have at this point. And so you've seen a lot, you've done a lot, you've done a lot of really amazing things, but what do you see as like the hardest part of doing the kind of work you do that people may not realize?

Yeah, so there's a couple of things. For one, when you're doing work with that involve engaging actual human beings, regardless of they're being criminals or not.

Mm-hmm.

There's two things. One, it takes a lot out of you. There's no 9 to 5, there's no taking off on the weekend, there's no taking your vacation and just leaving work. You know, I, I don't know how many vacations I've had to bring my research laptop and, and do work because I'm pretending to be somebody who's not on vacation. The fictional person hasn't taken a vacation, and they're in a different time zone, and I have to be available at certain times. And you've worked so hard to get there, you can't throw it away because you want to go chill at the beach with your family or your friends. But it's a lot of late, late hours. And then you've got your corp— regular corporate duties on top of that. And what ends up happening is burnout, especially because a lot of companies don't understand what goes into doing that type of work and the toll that it takes. In addition to the time and the resource toll, the other aspect is, and this is something I really have struggled with, is sometimes, you know, there's bad— well, there's— let me just preface it with this. There's two types of criminals out there. There's the ones that are just born bad, they're just bad human beings. And there's the others that are, have good in them and have chosen to make, have chosen, made poor decisions and chosen the wrong path. And some of those people are likable. And if they weren't criminals and you just met them under different circumstances, you'd become friends with them. And I have become friends with some of these guys. That does not stop me from doing my job, but it is hard. You know, when you've made a relationship with somebody, you, you, you do have an understanding of them. And, you know, then I gotta go write a report where, you know, I'm, I'm making their lives a lot harder. I've written reports where after the fact they've been like, you know, why did you do that? The FSB came to talk to me today, or people know who I am now, or things like that. And, and it makes it really hard because, you know, I'm, I'm a human being. And again, when you actually get to know some of these people, it's, you can't control who you like or you don't like. You can control what, how we, How you feel, you can't control. You can only control what you do with that information. And the day that I either stop doing my job or I don't do the right thing because of any influence or feelings I have will be when I stop doing this type of work. But I've always done what I need to do. But yeah, there's times where I felt bad. The other aspect is you get something with other people, the really bad ones, you can't tell them, you know, oh, I don't like what you just said. And I'll give you an example. A lot of the Russian bad guys are really racist. They're also very homophobic. And there'll be times where they'll say things and it definitely bothers me. But if I were to say, hey man, what the fuck is your problem? What kind of— what is this, like, you know, the 1920s? Like, who thinks like that? And, or, you know, what is being hateful gonna— how is that gonna help you? What did this person do to you? I can't say any of those things. And over time, seeing that, seeing the crimes, and again, pretending that you're one of them, it, you just feel like crap. You feel like a horrible human being. And again, you just get to where it's hard to get up and do your job every day. For the first time in my career, I took off like 6 weeks last year, and I was just at a point where I was just so burnt out. It was just, I mean, mentally, physically, I just, I couldn't do it anymore. And I just needed a break from all of it. And fortunately, you know, that this 2-year LockBit thing had come to a close and I was able to do that. But if it hadn't, I would have had to keep going. And again, a lot of employers don't get that. And that's where it's really tough with this job. High burnout rate for sure when you do engagements with human beings that are bad guys.

Well, yeah, I mean, it's hard on the family, obviously, too, then, right? So you're buried, you're doing work. Like, I remember going back to Intel days, some similarities, right? You can't tell people what you're doing necessarily. They have to trust you. You know, if you have a relationship where somebody doesn't trust you, if you're working late, at least, you know, you work from home now, which probably helps, but it was worse when you weren't. But if you have to work late hours or odd hours, you know, maybe they don't trust the activities you're, you know, online, et cetera. It can really play havoc on, I know, relationships, family, you know, friends, et cetera. And there's a secretiveness that's required. So there's a trust factor there. So, and then what you're exposed to, as you said, you know, there's, there's lasting effects to some of that. Some, you know, some things in Intel you get exposed to some some just horrible things, whether it's attitudes, whether it's words, whether it's visuals. There's some terrible things in the world that really eat away. You know, and I know lots of people who do really well to take advantage of, you know, support systems, therapy and other things where they have outlets that they, you know, use as opposed to just, you know, staying on the computer all the time. But a key piece that we didn't talk about yet that I kind of want to hint on, but again, only if you feel comfortable before you jump. Can I— yeah, yeah.

Though it's older, one of the best portrayals of, of what I just said about doing all this human stuff and, and pretending to be somebody else is, especially when you do it for a long period of time, all day, every day. If you remember the movie Donnie Brasco—

yep, I was thinking of that.

A guy acts, you know, he's pretending to be a gangster, gets in with these guys, lives and breathes it, and when he comes out, he struggles and he still acts like a gangster. That not, not the gangster part, but, but whoever you're trying to— like, that literally happens where you, you've made yourself this person and you start to become that, and you start to adapt a lot of these traits that aren't good. It's because you're consumed by it. And that movie portrays it really well in the effect that it has on you and the real you and how it can change you and make you become somebody you don't want to be. And I don't mean committing crimes, I mean your, your personality, your home life, the way that you act, your friends. Like, it can change you.

Yeah, no, it's a good point. I know in like the human circles and law enforcement, I think also uses it, but we used to talk about going native, right? Where you do get to a point where you lose yourself and sometimes it even includes like committing crimes and doing things that aren't even authorized as part of the work, right? And you just lose yourself, right? You get so enmeshed. Yeah, it can be really, really challenging. I know there's a lot of work that goes into to, that's why human agents have handlers. That's why undercover agents have handlers, you know, somebody you have to check in with occasionally to make sure you don't go over the edge. You know, the, the human psyche is not bulletproof, and you can find yourself going bad places.

So I don't have that. It's just me. I'm the only one in my company who does this. I don't know many— I do know people who do it, but I don't know a lot of people who do this work. So I, I don't have that. And that was one of the things I had to kind of learn through the experiences. I needed to find people who I could talk to and vent to. And I do have a good circle of, of people from government agencies as well as the private sector who do similar types of work for a different outcome, not necessarily to infiltrate a ransomware group, but they spend their days talking to criminals, whether it's buying malware or data or whatever it might be. But I do, I have those people to bounce things off of now, but I didn't for a long time. And that's also important to have that outlet as well.

Yeah, that's a good point. You can feel free to add me. I know we're on Signal. You know, we chat occasionally. Like, if you need somebody and nobody else is available, like, I appreciate it. I can do that for you as well, man. I mean, we're in the same circles. So I, one thing I did want to ask, and again, This one, it's up to you as to how much you answer, because this— I don't want to put you at risk. I don't want you to put yourself at risk. Not that you would for me, but what about the, the far end of the sketch? You know, when we talk about, you know, the, the things people don't think about, you know, the dangers with this job, what about just straight up threats, you know, to you from adversaries? You know, we've talked about obfuscation, you talked about all the things you do to, to keep yourself safe, et cetera, but eventually you go public with these things. So as much as you did all that, Lockbit's well aware that you exist.

Yeah.

Like these guys know who you are and these guys are criminals and there's a lot that goes with that. So, you know, do you want to talk, and you don't have to, but do you want to talk at all about how that, how that impacts you, how you mitigate that, how you, how you deal with those kind of things?

Yeah, I'm willing to talk about it because I think it's important for people to understand, especially people who want to kind of go this direction within the field. You know, the Lockbit one's a good example because that's one that's I've written, it's public, but there are even more crazy stories that are not public on similar things that I've done. But with the LockBit one specifically, you know, when things kind of took, took a turn there towards the end, you know, when, when LockBit, well, first off, when I wrote the Ransomware Diaries, they started using my, my avatar. That's been talked about a lot already, but, but, but that, that, that's kind of a, an oh shit moment when you, when you see a bad guy on a forum and your face is there. And then they're getting in arguments with other ransomware crews and they're staring at your face. At some point, these guys are like, fuck, is this guy staring at me? But, but, you know, the, the, the thing about it is when I, when the St. Anthony's Hospital breach happened and I, I was very close with, with the leader of LockBit and I had, I was naive. I honestly believe because previously he had hit this hospital called SickKids, which was a cancer hospital for children. He, he, not initially, but eventually he gave them the decryption key for free so they could get their systems back online. I believed I could get him to do the same thing. And, he had such a, uh, he had no empathy. He didn't care. He, all he wanted was the money and didn't care that he was hurting children. And I got so upset. And, and, you know, it, it led to the, to my falling out. But, but once, and I started going after him trying to figure out who he was, I, I, I started working with, with law enforcement, the FBI, NCA. It wasn't known as this at the time, but what's known today is Operation Kronos. And, and I, I was, I, I was putting myself on the line a lot more to try and, and get Lockbit at that point. I wanted to figure out who he was. I wanted to help with getting him indicted. And as well as some of the people who worked for him and they had picked up on that. And I still to this day, don't know exactly how they found out some of the information they found out, but yeah, they started making threats and I got the official, you know, notification where, where federal law enforcement shows up and says, knocks at the door and says, hey, there's a viable threat against you. Someone's trying to hire people to harm you. You need to be careful. We've got eyes out there for you, but you need to be aware of this. And, you know, my family's home when this happens and everything else. There's no hiding it, you know? And, you know, I mean, the only good part about my job is that I am divorced and my kids don't live with me. So there's less of a threat to them. But I still have friends. I still have family. And, you know, there's people have to be aware of it. The neighbors see stuff going on, they want to know. It just affects you. But, but the amount— it gives you a lot of anxiety. You know, I don't go anywhere ever without a gun, and I'm not— that wasn't the case before. I mean, yeah, I used to work in law enforcement, and I did once do undercover work and things like that, but, you know, my normal day life in doing cyber, that's not, not how I felt. And, and now I never go anywhere unarmed. I'm unbelievably paranoid. But, but it's the weight on your shoulders It's the anxiety, the paranoia. Not everybody can handle that, and you have to learn how to handle that and use it to keep you safe and not let it tear you down. And if I didn't figure out how to do that, I, I wouldn't keep doing what I'm doing. But it's tough. It really is something that, you know, mental health is a big thing. You know, I go every 2 weeks and have, for about 12 years now, to talk to a therapist. I was there this morning. You know, they think I have the craziest life. I tell them things that nobody else even knows. But, but it's like something out of a movie, but at the same time it's real life. So you have to be able to stomach it. And if you can't, you gotta stop doing the work because you can't let it destroy you or your family or your relationships or take a toll on your, your health and things like that. All of those things happen.

Yeah. I mean, that's a good point. And I'm, I'm glad to hear you mention, you know, mental health, you know, and, and taking care of ourselves. That was a challenge, you know, growing up in the agency, you know, in the generation we did. Like I remember when you didn't do that, you didn't, or at least you sure as hell didn't tell anybody. You'd lose your clearance. Yeah.

Couldn't tell anybody. That's right.

That's right.

Yeah.

You had to keep it to yourself. And if they ever found out, if you saw a therapist and they ever found out, you'd lose your clearance over it. You know, and which was super dangerous. It just made people endure more things and, and possibly end up with poorer results, you know, in their lives that could have been avoided if they just had somebody to talk to. But the thinking was if you needed help, then you know, you were flawed or broken or whatever.

Yeah.

And obviously we've matured past that, I think for the most part as a society because You do have to talk to people. You have to unload some of this stuff and quantify this, you know, some of this stuff and, and, you know, make sense of some of it. I'm not a bad person because I'm following bad people, you know, and, and, and dealing, like I said, with the far end of it. If they're mad at me now and, you know, people can, can hurt you, you know, I know lots of people who at least at one point in time have been on lists. You know, I, I'm not as serious as yours, but once for myself. But you, and yeah, like I said, you gotta manage that and then you gotta manage it with everybody around you. As you said, your family was home when this happened. It's very hard, right?

—right—

to, to help other people be like, it's okay, it'll be okay, I think. And please don't run away from me as a result of this. But the work's just so meaningful, right? So I appreciate you sharing it. I know that's, you know, that was one more thing. Yeah, yeah, absolutely, man. Anything you want.

You have to know how to channel that energy. As I mentioned, for me, the way I channeled that is I, I went taking on those motherfuckers. I doubled down. At this point, I'm already at risk, I'm already threatened. You know, I'm coming for you. And I know that makes— I'm not trying to sound like I'm all macho and other stuff, but I'm telling you that that's what got me through it is they came after me. I wanted to, I wanted to make sure they knew who I— that I knew who they were. I wanted them to have so many problems that I was going to be the last thing they were worried about and the world knew who they were as well. And I doubled down and I, and I told them that I told them that I was coming. And that was sort of the, the, the end of our relationship. But, but when that indictment came out and, you know, Minutes later, I released, you know, a 30-page paper with where the guy lived, all his information. I mean, I had stuff I didn't even put in there. I had his door codes to his building. It was hard to not call him. I had his phone number long before he was indicted and all that stuff. But I, but that's what I did. I used that sort of anxiety, you know, I don't know what, I guess you'd call it, yeah, fear. And I used that to channel to a good purpose. I put on, the Batman thing back there is funny. I, I, I, I'm like a half Boy Scout, half Batman. That's not necessarily who I really am, but, but in my work it is because you, you, it's not, you have to be fearless. You have to be, you have to be vulnerable and, and understand your feelings and understand how to channel them in a direction that's going to make it better. So not just sitting in your room and letting all this stuff eat you away, but channeling that back and using it to motivate you to make them feel the way that they made you feel. And that's exactly what I did and what I, what I continue to do when I find myself in these situations.

Yeah, well, that's a good point and it's empowering, right? Like you said, you're already at risk. So, you know, do I just stay in fear and cower? Do I say, okay, I'm at risk, but I'm gonna, I'm gonna make this difficult? Because not always— I'm not going to encourage how people want to act in these situations, but sometimes that's enough. Like, people will back down sometimes if it's no longer worth it. You know, it's the whole concept of, is, is the juice worth the squeeze? Hey, you're mad at me, I've outed you, I've damaged your business or whatever. But if I can also inflict more pain, if you bother me, maybe it's time to just pack it up and go on to the next. There's a long life. There's a lot of other people out there to victimize. There's a lot of things to do. Maybe this is no longer worth it. And criminals do tend to be a path of least resistance group. Yes, there's a code and there's retribution for some things, et cetera. But criminals also, successful ones, long-term successful ones, tend to be path of least resistance. There's a point where you just go, hey, it's just not worth it. The noise isn't worth it. The hassle's not worth it. I can be mad if I ever run into that person, whatever, but I'm not gonna burn down my entire world over this. And if they feel like, if anybody feels like this could cause me a lot of harm or more harm or more trouble, there's, there's a benefit of that. Now for most people, I wouldn't recommend it. Most people don't have your skillset, but I, I get it. If you're already at risk anyway, just saying the hell with it. I'm gonna, I'm gonna lean in and I'm gonna, I'm gonna make it clear that this is gonna be painful and then see if you still want to go.

I may not be able to kick your ass in a, in a cage fight UFC style anymore. I'm 48 years old, but goddamn, I'll fuck you up with a keyboard.

There you go. I mean, I've, I've had lesser experiences. You know, you get the bar fight type of thing. Somebody gets mad and they're upset and you just look at 'em and go, listen, you're gonna win. You're bigger and stronger than me. Do you want a limp though? Like, you know, do you want the pain that's gonna take away? Yeah. Right. Listen, I, I've had those discussions. I'm like, clearly you're gonna kick the shit outta me. There's no debate. You're big, you're strong, you're young, whatever. Do you want a limp? Do you want to have to get a tooth replaced? I'm going to take a piece of you. Is it worth it to you? And if it is, let's go. I mean, you're going to kick the crap out of me and I guess I'll deal with those consequences, but I will take a piece. And sometimes that's enough for somebody to go, yeah, it ain't worth it. I don't want to limp. I don't want, I don't want whatever's going to happen. Because reminding people you're going to inflict pain in return and they go, yeah, maybe it's not worth it. Please, if anybody runs into me in a bar, let's not challenge me to a fight. I'm not really interested in going down these paths. I'm not, I'm not a tough guy either. I'm not advocating for somebody to go pick a fight with me or whatever, but yeah. Well, sometimes you just gotta, you know, let people know. And, and, and I get it. Again, backed into a corner, like you said, it's not about being macho or whatever. This is, you didn't have a choice. You were already being threatened. You were already at risk. It's not like you went outta your way to say, I'm gonna go take on guys. It's, it's not about being, you know, fearless or foolish. It's about, you know, the courage to, to try to defend yourself. And sometimes a little bit of offense, or at least showing the possibilities is, is a really good defense. So listen, we're, we're running outta time. This is, I mean, I could do this all day. You're fascinating, but I do want to get to the end of the show for everybody else who probably wants to do something else at some point. So let's close this one out. Like the name of the show is Unspoken Security and, you know, with that in mind, I ask every guest the same question and you don't get a pass either. And the question is, you know, tell me something you've never told anyone, something that, you know, so far has been unspoken.

I have been, I've been fired 5 times in my career. You know, people see where I am today and make some assumptions. I've been fired quite a few times. Struggled in my career. I've had, you know, mental health struggles dealing with things. You know, that's why I'm a big advocate for it. You know, like you said, when we work for the government there, you're not going to talk to a therapist. You're not able to do any of that type of thing. You know, in the private sector, things get too stressed. I can light up a joint at the end of a day. You can't do that in those worlds. And, you know, so, but again, to answer your question, you know, like I said, it's really tough. I've talked about one event where I had lost a job. Which kind of set my path forward with writing a book. But, but, but yeah, even people think, oh, you're at the top of your, your game now and you're doing so great. Well, I got here because I made a lot of mistakes, but I learned from them. And one of the biggest things I learned from those experiences was to put my ego aside and then to take the whatever was behind it. A lot of times I didn't agree with things that led to that, but you take that and you use it to make yourself better and use it to inspire yourself and use it to motivate yourself. You know, the one that I have talked about publicly, I still, I'm not going to say who the company was. It's not on my resume, but, but when they, they, I was only there for like 2 months and it was one of the great, supposed to be one of the greatest jobs I could have gotten. And I was surrounded by really smart people and I, and I, but I'm very creative. I'm not like scientific in the way I do things and it didn't fit with their flow. And I remember they told me I couldn't write and that I wasn't a good analyst and, and it motivated me, and it's why I— it motivated me to prove that, to write a book, to get to be better at being a researcher and analyst. But I, but I had to put my ego aside with that and not just be like, you know, screw you guys, you know what you're talking about, I'm the greatest in the world. If I had done that, we wouldn't be sitting here talking today. So taking those and learning a little bit about yourself, feeding out what's, what's, what's not true, but, but actually being open to the fact that there's a reason that this happened, so some of it must be true., and trying to make yourself better. But, you know, I, I got fired. It was in DOD early in my career. I got fired because I had taken a job. I was there a week. I got the flu. I was out a week. I came back. I had not met the program manager cuz he had been out that first week I was there. And I walked in and this guy had his feet on my desk. I didn't know who he was. Oh, snap. And when I was younger, I was very, I was in the powerlifting. I'd come out of the military. I was all overly macho, if you will. I was, I was a pretty angry dude. Had a rough upbringing and I was angry about it. Anyway, this guy had his feet on my desk and I'm like, who? And he's like, we don't call out sick here. And I'm like, who the fuck are you? Get your feet off my desk. And I pushed his feet off and we started exchanging words. It literally ended with me putting the guy in a headlock in front of the government customer, everybody. I was escorted out by DOD. I was fired. Like, it was a whole thing. But people, you know, I don't share those stories. I hear now., but that doesn't make me cool. That, that showed that I, I allowed my emotions to get the best of me and I ended up costing myself a job. It, you know, it was, I was an engineer back then, you know, it wasn't like I had, you know, the namesake that I have now where, where it's easier for me to get a job. You know, that was stupid. It took me a while to get another job, you know, ego, man. It's, it's not, it's, it's not worth it. Yeah.

I mean, that's, that's a, I mean, I was gonna say it's a great story. It's, it's, I mean, it's an amusing story. I don't know if it's a great story, but But it's a great lesson, right? And I appreciate you saying that. I've had some amazing people on the show. You know, you're right up there, obviously. And I always appreciate, listen, anybody who gives anything at the end of this, I appreciate. But when it's somebody who reveals something like this where you go, oh, like, okay. 'Cause we get to a point on that where we start putting some people on a pedestal and you think, well, they're amazing and they're perfect and I could never be as good as them and whatever. And I've done this thing so I could never overcome it. You're like, listen, most of us have some kind of junk. In the past. It's, it's sometimes it's, it's what led us to be, I don't know, I shouldn't say us cuz I'm not in the category here, frankly. But it's like, it's what leads people to be better sometimes is to learn from that or, or worse. It's how you react to it. Right. But it can, it can lead you to be better. It can lead you to find, you know, how do I do this better next time? I could find, find humility or find peace or, you know, get some learnings out of it. Like I've been fired. I don't know anybody, I probably do, but most people I know, I think have been fired at least once. A lot of us have, you know, It may not say that officially. It's, you know, there was a mutual agreement, right? Yeah, sure there was. It was a mutual agreement right after I was told I was no longer gonna come in anymore. I agreed not to show up. You know, some of those happen where you, you, it's a negotiated thing. You can choose to resign or you're gonna be let go, or, you know, we'll give you a couple weeks to find something else to do, that kind of a thing. It's a nicer way of saying fired, but you know, it, it is what it is, right? And everybody I know has run into that at some point. And so I appreciate you mentioning that so that, you know, anybody who's watching, like, listen, you can overcome all sorts of stuff. Just learn from it. Figure out what it is. If you're getting fired repeatedly cuz you're an asshole, stop being an asshole, you know, or it'll keep happening. Sometimes you run into bad people and it happens too. But, you know, I appreciate you sharing that. It's, you know, for somebody who's done so much and is so well known now and is really one of the leaders in the industry to say, hey man, I was, I was far from perfect and I made some bad choices and learned from it and overcome, you know, and that's, I mean, that's a sign of just what kind of a person you are. So I really appreciate you taking the time to come on the show, man. I've been wanting to have you on for a while, so I'm glad we were able to sort this out. You're fascinating. Your, your career is fascinating. You know, I, I'd love to have you on again somewhere down the road. We'll see, you know, what comes out as you publish more things. I'm sure I'll see you at, at some of the upcoming events and we'll get a chance to hang out. Is there anything, any last words you wanna say before I close this out?

Just, just remember we're all people. Leave your ego at the door. Learn just to, to learn what empathy is and, and, and try to understand that that the better that you understand people, whether they're your colleagues, whether they're criminals, whether it's your neighbor, the better human and the farther in life you're going to get. I truly, I truly believe that in a world where we have a lot of, a lot of hate, a lot of bad things that happen out there, you know, we just need to stop with that shit.

Good words, man. I agree. I guess I can't add more to that, so I won't even try. I think those are, you know, strong and powerful words that people should, should take to heart. You know, it's a tough world. So again, thanks for, for coming on the show. Thank you everybody for watching and listening. If you like this, please, you know, leave feedback and subscribe and tell everybody. If you don't like this, shut up and go away. No, but tell people, you know, and tell me if you don't like it, we'll make it better. But I really appreciate it. We need more, more followership and more sharing of this information so we can have more of these great conversations. I can get more people like John to come on and talk about such important, interesting conversations. So with that in mind, I'm going to go ahead and shut her down for the day. I really appreciate y'all being here. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.