How North Korea Infiltrated American Companies With Fake Tech Workers - EP 29 Bob McMillan

Are you still doing the crazy swimming?

I am.

So you're like a, you're an ice, you're like a cold water. You go in the San Francisco Bay.

I do. I just did the Bay to Breakers. Wow. I did the Bay to Breakers last year, the race as a fish running. You, you go the wrong way. Oh, like salmon going upstream. So you wear a fish costume and you go the wrong way.

Do you actually wear a fish costume?

Yeah, I wore a fish costume.

Okay.

Yeah. I did a story on, um, what's it called? Race banditry. Where, where people who run in races without the official, without registering basically.

Oh, okay.

And the whole premise was in, in, I found this guy in Miami who like hated race bandits and he like pulled them out of his marathons and just shamed them. He like had a, you know, a wall of shame kind of videos he would take of these race bandits.

Why are there race, they just don't want to pay the fees.

They don't want to pay the fee. Yeah. And so I'm kind of, I'm on team race bandit a little bit. But so they, so they, so, so I was like, okay, so I've got this guy that just hates the race bandit. I need somebody who loves the race bandits. And at the Beta Breakers, they're these salmon that have, that have run the wrong way since for like 20 years. And they're treated like gods. They're race bandits. But everybody like, I mean, I did it with them. I got high-fived like 140 times in one block.

So, and you were a race bandit?

I, well, actually, Wall Street Journal ethics. I, I paid to register, but I ran with the race bandits.

Okay.

So then, so I did that. And then this year I swam from the Bay Bridge to the end of Bay to Breakers, 10-mile swim.

Jesus.

Which was—

And the water's what temperature?

It's like 60s now. It's nice.

Then you've been doing this for years.

I have, yeah.

How, like how many times a week do you go in the bay?

3 times. 3 or 4, maybe.

Jesus.

Yeah. Yeah, we're actually doing a journalism swim. All the journalists who want to swim, you're invited.

That sounds horrible. Bob McMillan, you go by Bob— Robert McMillan when you're a dignified reporter on the Wall Street Journal.

Yes, to separate the people who know me from the people who don't. It's what we call a hack.

Well, we have known each other for a long time. We kind of covered very similar stuff for many, many years. Enterprise. Yes, that's right. Our technology. And I followed your work. I've known you as a friend and, and, well, I'm going to set the stage for people a little bit. Yeah. So we've known each other for a long time. You're a fantastic reporter. I know people don't all love reporters, but Bob's one of the good ones. He actually, he does his, does his work and does his homework and great reporting for, for years. Years on all kinds of different subjects, which you've been doing security, focused on security for a while now.

Yeah. Yeah. It's been off and on 15 years or so.

Yeah.

Probably.

Yeah. And so I just thought this would be a, you're always doing great stories, but there are a couple buckets of stories you pursued over the last 18 months or so that really jumped out at me. And I wanted to kind of get into these, get into these pieces in a way maybe you could do on a podcast. This will be a little different than our usual fair. Um, but yeah, I wanted to dig into a couple of these worlds, you've— these underworlds you've, you've, you've uncovered. And, and just to give people some context, I mean, this first one, we're going to spend a lot of time on it, but it's, it's North Koreans sort of pose like becoming remote workers in the United States through these, these like surrogates in the US and doing these remote jobs at at— I mean, the number of the companies are not— their names are not disclosed, but it's companies like Nike is disclosed, and pretty prominent, um, U.S. corporations.

And I think pretty much anyone that hires a remote worker in the U.S. has at least, at very least, received an application from a North Korean fake IT worker.

Okay, and so, and then there's this— so there's a ton to get to in here. Another part of this is this odd, uh, fascination with Despicable Me that these workers seem to have.

You want to talk about that?

Yeah, I'm glad. Online minion personas. So, so let's get into it, man. And then there's a whole other set of stuff that I want to get into after, but let's start, let's start in North Korea. So what, what you, you just mentioned, like anyone who may have received an application for these remote workers, they, they might have got— like when I read your stories and you read what the FBI is claiming, um, in they are saying this is a massive, massive thing. Why don't you— I mean, set us up on the context. Well, how you, how you've started to learn about this.

Yeah, I mean, North Korea is cash-starved, right? And they have been for a long time. And so they've been getting very innovative in how they dig up money. And I think this story really kind of goes back to like 2017, and around that time North Korea figured out that like a great way to get around international sanctions was cryptocurrency. And so they started getting really into crypto. They did like— there was this outbreak, I don't know if you remember, it's called WannaCry. It was like this global worm outbreak that, um, raised like a quarter of a million dollars in cryptocurrency apparently for the North Koreans. And a lot of people were like, what the hell was that? It was maybe a test.

Okay.

But it made some money for them and they got deeper and deeper into crypto. And, um, around 2020, something very interesting happened. We had COVID, and the, um, in, in the, in the United States, the Department of Homeland Security has these guidelines for like when you bring, when you onboard new employees, and they change them. And they said, you know what, it's crazy, you don't have to like verify people's identification face to face, you can do it remotely because we're all remote working.

Yeah.

So those two things, North Koreans were like, we can make money via crypto, and, uh, suddenly you didn't have to like confirm the people you were hiring were in fact, like, people you had met with face to face and looked at their documents. You could do that all remotely. Those two things really created the— they sort of opened the door for this scam. So at first, what was happening was the crypto companies— like, the North Koreans quickly figured out the best way to hack a crypto company is to have an insider. So all the crypto people, they're very aware of the North Korean IT workers scam. They've been dealing with it for years. And what would happen is North Koreans would, like, get jobs at these crypto companies, and they'd like start coding away, and they'd maybe write a little backdoor into the code, and suddenly like a, you know, $100 million would go missing or more. And they started pulling off these like incredible scams. Even just in January, there was, um, a, uh, I think it was a one more than a billion dollar heist that happened. North Koreans related to this, they got good at, very good at stealing cryptocurrency, and, and part of it was involving insiders.

Hi everyone. Sorry for stopping the pod. We'll get you back to these weird North Korean remote workers in one second. I just wanted to take a moment to thank everyone for supporting Core Memory through these first few months of our adventure. The numbers on the podcast have suddenly started to spike way up. So thank you for spreading the good word. Thank you for tuning in. Thank you for going to our Substack and our YouTube channel. It means the world to us. And I just wanted to give an extra special thanks to E1 Ventures. They have been backing us since the very beginning. It's a wonderful group of people at this venture capital firm that backs some of the most interesting companies and, and people out there. So, um, thank you to E1 Ventures. Thank you to all of you for giving us your attention and, and believing, um, in what we're trying to do. All right, back to the show. One question on this. I mean, they— because we'll get to this a bit, but when they're doing the stuff you're talking about right there, they're physically in North Korea doing this job?

Well, um, at, you know, they can be, but, but at this— the way, the way things are right now, they're all over the world. They're actually these teams of people that are fake workers. So when, when, um, when the DHS changed its, its guidelines for, for onboarding employees that's when it suddenly, I think a light bulb went off and they were like, hey, you know, we have all, we have this sort of army of people out there doing, doing whatever they can to raise money for the, for the great leader. Let's get them some jobs, some remote jobs. And so, so then it's, it started seeping beyond crypto companies. So just like regular companies, like you mentioned Nike, Nike was, was definitely affected by this. But like household names, you know, are, are, are now, now starting to come in their sights. And there's, there's small companies big companies, all— anyone who will hire somebody for remote work and give them a paycheck, they will do that.

So you're like, you're on LinkedIn or you're on some other job site and there's just these, these fake personas that are applying for the job and they just get hired?

Yeah, they do. And they, and they've, they've actually, um, operationalized it to, uh, a very, uh, amazing extent, right? So now Um, you— so this is— so the— I— you, you think you're dealing with one person during the onboarding and the interviewing process, but you're probably dealing with like 4 or 5 people. This is like a corporate kind of structure. There are these teams of, uh, the North Koreans who— some of them whom travel around the world. Like, we found some in Laos, and they then they moved to Vladivostok. Um, so they have a boss and they're a bunch of, a bunch of employees, and some of the employees are great at at doing sort of the letters, the initial letters, and maintaining the LinkedIn and doing all this stuff. Some are great at coding, some are great at interviews. And so you might— so when you go through the process of hiring, like, let's call him Kevin, which they do too, because Kevin's their favorite minion, right? He's my favorite minion. But yeah, he's a top minion. But anyway, so, so, so when you're hiring Kevin, You get, you know, you might get approached or you might even approach these people. You might see their resume on LinkedIn or something like that. They typically have a good LinkedIn, good GitHub account. And then you, you know, you set up an interview. You might get another person. You might actually get an AI avatar. There's, there are pretty interesting just examples of people interviewing North Koreans. And in some of the interviews, they're not actual real people they're interviewing.

Like, it's not, it's like a like a fake face on a real person or it's just a—

It's like AI-generated image of a creature that looks like a human. And it sort of is answering, you know, they're saying like, well, are you a good, you know, can you, what's your programming like? Can you do this? Can you do that? And the AI-generated image is answering everything. It's, and then in some of the interviews I've seen, the interviewer will just be like, this doesn't seem real. You know, you can tell they're getting a weird vibe just from this AI avatar.

But is there like a human that's answering the questions?

Yeah, there's a human and it's just the AI is just replacing their image with a fake image.

Okay.

And then the interviewer will say something like, could you just put your hand in front of your face? It's like, uh, then the, you know, the interview will end. Okay. Because they can't do that, right? The AI can't handle like a, an arm going in front of the face.

And like, do we know in some of the other interviews, I mean, do they, it's, it is just some North Korean person who's up there, or do they get stand-ins for this?

Well, they— okay, so it used to be that they would actually do the interviews. They all, interestingly enough, in their private communications, like some security researchers have uncovered like their private, their Slacks and things like that, they all communicate with each other in English, which I found fascinating. Like it's almost like they're in character, you know, like I'm Kevin, I'm a, you know, and so even when they're not being monitored by people in the West, or they don't think they are. They speak to each other in English. But so, so some of them would do these interviews, but lately they've actually been hiring people who will do the interviews for them and ace the interviews. And then they, then they, that's it. They just ace the interview and then they transfer to another, to another person who actually does the coding or does the work or things like that.

Okay. And then there's this part. I mean, we'll get the, There's this woman, Christina Chapman, who's— who features in a couple of your stories and who I think was just sentenced to, uh, 8 and a half years. 8 and a half years. So, so we were just talking about like the whole kind of North Korean side of all this, but then she's an American who they, they find to— I mean, this is the part of the story that was— there's a photo in one of your stories, it's crazy. I mean, they're just mailing her all these laptops to manage. She has this apartment or house that has like 80, 90 laptops these shelves. And so, so part of this is like sometimes you can do it remotely, and then sometimes you need, you need a laptop like in country or something.

I mean, if you think about it, you have— you've hired your North Korean, right? And, um, most corporations when they onboard somebody, they're like, okay, we got to send your company laptop somewhere, and they kind of want it to not be, um, Pyongyang, right? Like, that would be a problem. So they— so the North Koreans, like, one of their core skills is basically Fiverr-ing the hell out of any problem they have, right? So if there's some kind of problem, they're just like, oh, we'll just get some temporary employee who can like circumvent whatever the problem is. Like they're really good at that. And so this has given birth to this job title, which is called laptop farmers, right? And so there are probably dozens of these laptop farmers all around the US and they typically are people who are just like getting, they're in the gig economy, they get this job, they're like, we need representative for our, they might say it's a Chinese company or something like that. We have people who are working in the US and we need somebody to help process, you know, their employment stuff. We're like, you're like an employment agency aid. So the laptop farmers, they just do everything that requires a US address. So it can be receiving the laptop, could be receiving a paycheck. It could be, it's often the banking. You need a US bank to get paid in the United States. It's filling out these, these, these remote work forms, these, these, um, you know, the I-9s. Is that what it is? And I was trying to— yeah, I signed one at one point when I started the journal. But yeah, I think it's an I-9. Um, and so, you know, they need people to make all this, all this happen. Uh, and so that's what the laptop farmers do. They're like the U.S. representative for this criminal scam that— where the, the actual workers, they might be in Laos, they might be in Vladivostok, they might be in India, they might— a lot of them are actually in North Korea. And so, so every day the laptop— Chapman's, um, my sense of her life was, uh, because of course I did not interview her for, for my story, but she, uh, was a mad TikToker. And so I watched 2 years of her TikToks, and every now and then she'd sort of talk about her job obliquely, um, and it felt like, you know, she kind of complained. She's— one, in one TikTok she talked about getting up in the morning and like, you know, her clients being very demanding, and so she'd I mean, she literally, like, boot up these computers, connect them to their, their home offices, and then there'd be a software on the computer that allowed the North Koreans to remote in and then do their work all day.

Yeah. A link to this photo. I printed this out in black and white.

Oh, it's going to—

it's going to suck.

But oh yeah, yeah.

A link to this photo in the Substack and on YouTube. But basically to describe it to people, I mean, she's got IKEA shelves or Home Depot shelves set up with just dozens of laptops all open on the shelves. And then she's got Post-it notes all over the place.

Post-it notes are my friends.

Yeah.

That's, you know, they say like Nike, you know, like Kevin, she's trying to keep track of all the jobs. It's a lot of laptops.

It's a lot. Right. So, and then, okay. And I wanna, I wanna get into this whole TikTok thing cuz I also found that fascinating, but, but who is this woman? Where does she live? How old is she? Yeah, so she's, she's 50 years old.

Yeah, Christina Chapman. I mean, it's— after watching her, her, her TikToks and kind of putting together her story, I mean, I— you, you, you can't help but have some sympathy for her because she was a woman who was basically, um, like, not quite homeless, but she was showering at the gym. She didn't have running water. She lived in a trailer. She's struggling financially, you know. She was really— she's kind of, um, her life just hadn't worked out like she had hoped. And, um, she got approached with this, you know, she was trying to pivot into kind of like a, an internetty type job. She was doing, she's, you know, she was doing these gig economy type things. And, um, and she just got approached on LinkedIn by somebody who was like, hey, we need you to help us out. And so she did that, and it really did transform her life. She, she, she made— she actually didn't make that much money from the whole scam, but it was enough to, to give her a much better lifestyle than she had.

When she ends up managing, I think it was like around 90 people's laptops, something like that.

I mean, when they, uh, the FBI raided her house in October of 2023 and they found 90 devices in, in the house, but she was, uh, her, her farm was associated with more than 300 workers.

300 workers over a couple years, and they are So she's, she's logging in for them every morning so they can do their work on this laptop. She's, she's taking the payments from the, the actual companies, then she's taking a cut of like her services.

Yeah.

And sending the rest of the money to them. And then the whole point of this is to raise money for the Great Leader. Yeah. Right.

And, uh, yeah, the, the nuclear weapons program. U.S. authorities would like to It's stress.

And then she has to pay like the taxes?

No, no, no. Somebody else has to deal with that. And there are actually like in, in her court case, there are— there's one victim statement from somebody who is basically like the people whose identities they steal have to pay the taxes. So Christina Chapman is not on the record as the worker for all of these companies. Kevin is, and all these other people who's— who are actually Americans.

So, so they are real people.

They are real people. Yeah. And they're whose identities have been stolen.

I see. So, so, so Bob Smith is an American worker and this North Korean has subsumed his identity. Yeah. And like, does that include his Social Security number? It does. Oh, so they've hacked all this stuff.

Yeah. Oh, that stuff. I mean, that's like, come on, we could probably get some. You want a social? Give me a name. Like, you could get that. It's like water, right?

And so there's, and there's this person like, don't they start to, um—

they're gonna get a big tax bill at the end of the year. Yeah, yeah. Because I, I would imagine the, the North Koreans take the minimum amount of deductions. They're not like, oh, let's— you know, I don't want to be hammered with that. So yeah, there are people who just get— you know, actually, I did find, um, one, one of the people in her, um, laptop farm was dead.

Okay.

But, but yeah, definitely they're, they're assuming the identities of Americans, and those Americans are eventually going to get hit with like these massive tax bills. I mean, some of these, these are coders, right? They're making like more than $100,000 a year.

Yeah. So like, so this has like a year shelf life for each person, roughly.

I mean, I don't think they worry about that too much. Yeah, right. Like, it's like, you know, what's going to stop it? Yeah. At what point? I don't even know how. I think what typically would, would happen is that the, the companies would terminate before the whatever, the IRS would notify a company that they had an employee that wasn't paying taxes, or the, you know, like, it would just— I, I have actually never heard of, uh, of a North Korean being discovered through the tax burden of the victim whose identity was stolen. It's always, it's always something else. It seems that ends the job for them, so they don't worry about it.

And she, Miss Chapman, um, like on the TikToks Tragically, some of the ones you linked to in your story have been erased from the internet. Yes, I wanted to let you know. I discovered that last night, so I couldn't get like a, a full feel for what you're describing. But the way you write about it, she's, she's like, uh, she's just kind of like documenting her life. She's like, hey, good morning, I'm booting up my laptops. And, uh, I mean, I guess she doesn't like fully know what she's doing, but she's kind of, uh, she's kind of— what were these TikToks like? She's, she's just documenting her life.

She like she had— she dreamed of being an influencer, and she— by the, by the, by the end of her career, she had 100,000 followers on TikTok, which is pretty good. And I don't think I really got into this too much in the story, but like most— like 99% of what she was TikToking about was not relevant to her. Like, she was— she wasn't like how to become a laptop farmer TikToker. She was like a, um, She was super interested. She was very political. She was really interested in— what did she call it? It was like food, food accountability. So she would like— there were tons of TikToks of her just like, this is what I'm eating this morning and this is a smoothie. And, and then she later on, she got really into this Japanese boy band and I think she built a lot of followers through that. Okay. And she started— she was a bit of a shut-in, right? And then she went to Long Island and saw this band Uh, she went to Vancouver and then she went to Japan and she was like getting like sort of backstage access to this band and whose name I can't remember. But, um, but, uh, then their fans started following her TikTok. So she was, and she was, she was loving it. She was loving the attention. Um, and so she called them, hello my lovelies, every morning. And she just, I don't, I'm not a big, you know, I'm Gen X, right? Like The TikTok, I don't know why people watched it, honestly. Like, it was so boring to me. But I think you develop a relation— she sort of developed relationships with people. And then at the end, it got real— after the raid, it got really dark.

Oh, she's still TikToking?

She's still TikToking, right? She didn't— she was like, in October of 2023, when the raid happened, she said, I just lost my job, you know, and my employer didn't give me my last month's payment.

So, okay, and when you hear that, I mean, she knows she's doing something nefarious because I see in some of these emails she's— they're like, she's forging their—

this is a federal crime, right? What I am doing here, what are you asking me to do, is against the law.

She's like, I'll forge your signature again, and the North Korean guy's like, thank you, hahaha. So, so she knows she's like obviously up to something, but does she know she's like working for the North Korean government?

There's no evidence that she did, although there was something in the indictment about mailing laptops to North Korea. So I'm not sure, you know, if it was— yeah, I don't— you can't do that from U.S. Post, I'm pretty sure. But anyway, I, I didn't see any real evidence that she knew that it was North Korean she was working for.

Okay.

And she wasn't like— I mean, hey, did you know about the North Korean fake IT worker thing in, in 2023?

No, I mean, I didn't know about any of this until you started writing about it. Yeah, this is why I wanted to do this. Yeah. No, I don't think, I don't think most people—

it's so crazy.

Yeah. So, okay, so she's, she's doing this for how long? It was like a—

it was a couple of years.

Couple years.

Yeah.

And I think, I mean, there were a couple different figures because it looked like in this trial that she just went through, new information came out. But originally I saw, like you said, I mean, so she does this for a couple years, she had made like $170,000. Yeah.

And then the—

I think in the trial it was closer to like $300,000.

Maybe. I, it was a, it was, it was confusing, but the, the, the, the best number I could get from the Justice Department was $170,000. $170,000.

So she does all this work, she's kind of in dire straits before that. So $170,000 is pretty good, but it's not like you're— it seems like a lot of work.

She, she made $17.1 million for the North Koreans.

She made $17.1 million for them. Okay, so she's getting like this tiny cut. Yeah, okay, and 10%. And okay, and so she knows—

oh no, wait, that's 1%.

1%. Yeah, yeah. Yeah, well, I mean, what does she do? She, she like turns the laptops on. I mean, they don't like fill out some forms. I mean, somebody else is actually— and I guess the North Koreans were on some level like doing work because they had to keep their job long enough to—

I mean, I've heard from people who, who have interacted with, like, I heard, uh, I just talked to an investigator, uh, who was like, you know, this part of their job is like to inform these companies that they have employed North Koreans. I've definitely heard about people who are Really? Um, are you sure? Because they're, they're kicking ass. We don't want to get rid of them. Kevin. Kevin is like, are you sure it has to be Kevin? Could it not be someone else over there?

Kevin, I mean, he steals a little every now and then, but he's like knocking a lot of stuff out of the park, man.

Oh yeah. Well, and then, and then the whole—

what's the goal? Oh, it seemed like there were kind of 3 goals. Like one is to earn the salary because it's pretty good and you're sending that money back. Two is maybe you find, like, especially in the crypto world, some sort of like backdoor in your, your ciphering. And then there is this like intellectual property element where we talked about Nike and then a bunch of the other companies are unnamed. The, the FBI does what it always does, which is like, it was describing like a, you know, brand name. Yeah. Major US NBC, like media company, the, the, the fourth largest publisher in the United States. And then like, uh, what sounded like— well, I'm not, I'm not saying it's Levi's, but it sounded like a major, uh, clothing maker in San Francisco. Um, and so, so prominent companies. And, um, and so, yeah, so part of this, every now and then if you ran across some decent intellectual property, maybe you—

yeah, yeah, yeah. Like a defense contractor, for example, would be, uh, would be good, uh, a good one. But, um, I think, uh, the money— the, sorry, the intellectual property was also taken, uh, to be weaponized. In some cases, the North Koreans, once they were found out, they'd be like, okay, we need another $100,000 or whatever, or we're going to dump all your IP online, right? There'd be this extortion, okay, uh, you know, finale. And then in some cases—

so how much was the just earning the salary versus trying to find a backdoor to siphon off bigger chunks of money?

It's hard to tell because that's all— it's very, um, there's not— they're not good numbers. Yeah, about that, right? So we know that the crypto stealing that the North Koreans have done is— I think it— the total is like $7 billion right now over their whole—

billion with a B?

Yeah, B. Okay, okay. So, um, and, and how much of that came from insiders and these fake workers not clear, but some of it did. A good chunk of it probably did.

Are they stealing from like shady, like, do we have sympathy here for these crypto company? Like, are they stealing from already shady crypto things or this is like Coinbase or something like that?

Or, uh, that's a good question. I mean, there's a, there's a range, right? Yeah. And I think the, the, the, the, the, you know, a company like Coinbase is all over this. They are very— they're doing a lot of due diligence to make sure they're not hiring North Koreans.

They have like the, the filter for Kevin on the—

I mean, I, you know, I would love to know what they do to filter these people because, because years, like at least 2 years ago, uh, I had the sense that they were on the cutting edge of identifying fake workers. And I was like, how are you doing? You know, what, how do you, how do you do it? And never got that story, but Then there's the other, the other, the other end. So they're on one extreme. On the other end, you've got these, you've got companies who are like run by anarchists, anonymous anarchists, right? Like some come, like some of the crypto world are actually true believers and they don't believe in sanctions. They don't believe in borders. They, they, they want to change the world. And from that, from, from their perspective, as a North Korean, like, why would we What's wrong with the North Koreans? Yeah, we should, you know, trust them. Like, they're, they're just people like us.

That's what I was imagining. Yeah.

So you've got this spectrum of, of people, some people who seem to care less about it and others who are like, if you— the closer you are to interacting with the, the, the real world financial system, the more you're going to be very careful. Yeah. About it.

Okay. So there's the $7 billion figure. And then in this most recent lawsuit, So I get, I get a little worried about the FBI sometimes. And, you know, and is it the FBI who was doing this case or was it, did it get up to the Justice Department?

Well, Christina Chapman was investigated by the FBI and then prosecuted by the Department of Justice.

Okay. But you had a— so I— not to cast too many aspersions, I like you, I've covered this stuff for a long time. I always feel like they heighten the figures sometimes in in ways that you can't for sure say, but they say there's a quote, um, oh, hundreds of millions of dollars from these remote workers. And Gregory Austin, the section chief at the FBI, says it's a material percentage of the North Korean economy.

Um, not asking you to say, well, I mean, 100% Christina Chapman, yeah, we believe generated $17.1 million in revenue. Okay. Also believe there are easily dozens, probably at least 100 of these people.

So it's plausible.

So yeah, it's totally plausible.

Okay, okay. And, and you, you said it at the beginning, but it's what we, we think there's like thousands of, of laptop farmers in the US?

No, worker— thousands of workers. Okay, for sure, around the world.

And dozens of laptops.

And dozens, yeah, maybe, maybe 100. You know, they had a big— they had, uh, the FBI took down like 28 of them, I think, recently. Okay, so fewer than there were, but they pop back up. And yeah, there are definitely dozens of them.

So if you're listening to this podcast and you don't want to hire a laptop farmer, or you don't want to hire one of these fake identities, um, like, what are you looking out for?

Well, it's funny, like, okay, so I asked the CSO of Amazon if he was aware of this problem and what they did to prevent it. And he very— I just like walked into this and he was like, well, you return to office is the obvious answer, you know, like make your employees show up. And it doesn't work in that case, right? Yeah. But there was a— there was a guy I interviewed named Marlon Williams who hired— he didn't realize it at the time. He had a North Korean working for him for a couple of years and then like like, it didn't work out, and he fired the guy. But then the FBI came knocking on the door, like, later, and they're like, that was a North Korean. And he said— and he's a crypto— he, he, he's, he, you know, he believes in virtual identity and that privacy and all this stuff. But he was like, if I'm gonna hire you, I'm gonna have lunch with you. I'm gonna have lunch. We'll meet face to face, you know. And now the North Koreans could TaskRabbit around that, probably, and have somebody show up to, to be the face. But, you know, it does— there's something to be said for face-to-face connections. Yeah.

Okay. So, so now that like the FBI's zeroed in on this, I mean, is this, this still a thing? Is it?

Oh yeah. Yeah. Yeah. It's still, it's still going on because the incentives— I mean, it's a big world. There's a lot of coding that is, is, is that there are a lot of companies where coding is just something that they, they have to have done and there's a lot of pressure to reduce costs there, right? Like, and remote work is, is like a very attractive option for a lot of companies who, you know, they have— everyone's got software, they need, they need some somebody to be a coder. And if they— if you really just feel like if the code gets written and it works, then I'm, I'm good. Yeah, right. So and then you have this— there's this other problem with, with staffing agencies who are like these intermediaries who are hiring the coders or presenting you with the coders. Their incentive is for you to hire that person, right? But they're also the people who are doing the due diligence to make sure they're not North Koreans, right? So they have this kind of like, how much diligence do you really want to do if it's gonna prevent Kevin from getting a job, getting placed, right? Like, so they, so, uh, they could be doing a better job.

Okay, I want to, I want to read this one part for one of your stories. It says, uh, Many of these fake workers use minions and other Despicable Me characters and social media profiles and email addresses. Some investigators initially thought their use of GRU was a reference to Russia's famed GRU, which is kind of like their NSA, sort of Russia's military intelligence.

Yeah.

Yeah. So instead, it was a tribute to the Minions overlord, Felonius Gru Sr., the Steve Carell-voiced animated character who tries to steal the moon. So, I mean, there's all like— you wrote a whole story on this Minions aspect, which like, yeah, seems farcical at first, but, uh, is, is real. They like to be named Kevin. They're having these chats. They're— what's going on, man? They're just like, really? They're just super in. Okay, so we have— they're talking about Gru all the time. They like to be named Kevin. And then there's what? There's just random chit-chat about Despicable Me.

Hey, Minion, what's going on?

That's what they do. They call each other—

well, I mean, the thing— okay, so this story started because I was having a dinner with a couple of security researchers researchers who, um, were like, what's up with Kevin? Why are they all called Kevin? You know, they love the name Kevin. I was like, that's funny, that's— I should look into that. Like, that could be a funny story. So I looked into it, and then the, the point I knew I actually had a, a Wall Street Journal story, which by the way is an A-head, right? So that's, that's for us, these are these like lighthearted kind of comical stories that we put on the front page. But the, the moment I knew I had a story was I interviewed a researcher who said, um, she was talking about this hack she had done, and, um, she was like investigating this person, and their GitHub popped up, and then she saw the minion, and she's like, oh yeah, North Korea. I was like, if that's your— if that's like, um, uh, an indication of compromise, basically, like you see a minion icon, that is funny. Yeah. Um, and so they're not all obsessed with North— with minions. And I did get this angry letter from a reader saying like, Thanks a lot, man. You've ruined it for everybody. Like, now they're going to switch from Minions, you know, as if we won't be able to identify the North Koreans when they stop using the Minion icons. Yeah, but, but they, they do, uh, love animation. And, um, they're, they're— I think there was probably one or two cells of them that were just like really into the Minions. I don't— we didn't put it in the story. Yeah, I don't think we did. We actually had a, a photo of one of the alleged North Korean IT workers standing in front of like a big Minion, like a telecom Minion display, which I I linked to it in the article and you can click on the link and see this hilarious picture of this.

And then you and I were texting yesterday and South Korean news has picked up on the story and they had this huge like minion. They were obviously going to town on that.

They, yeah, they love anything about North Korea. And, um, my, one of my colleagues sent me this picture of like, um, a television network in South Korea that was, you know, very, it appeared just from the still that it looks like they're, they're these earnest, you know, anchors reporting the story. And there's a photo of this like very spooky key looking keyboard on one side, and then on the other side are all the Minions. And, uh, I thought that was very funny.

It is very funny. And so less funny for Christina Chapman. I mean, she gets 8 and a half years, and she was just sentenced. And then this is a federal judge in Washington, DC, for operating a laptop farm in her house. And is she the— is she the first person?

Yeah, I, I, um, there's a— there's another guy who's been charged, uh, as a laptop— there's two other— two other cases, but I don't I don't believe they've— either of those has had sentencing at this point. So there's a guy in Nashville, and there's like a Ukrainian who had a couple of farms, uh, around the country.

Is like— and you talk about like some of these people, they're in— they're not in North Korea. You mentioned that they're in— they're in China or Russia. Um, like, do any of these people just like go— there's like, screw it, this is kind of a good job, I'm just gonna make some money, and like Yeah, yeah.

Uh, well, I mean, with a, with a regime like, uh, North Korea, there, there are other ways of exerting pressure on people. And this is like, this is a big, um, you know, the, the insider threat is, is a, is a problem that especially in the technology industry everybody is super concerned with. And it's probably, you know, we, we really just see the tip of the iceberg of this kind of stuff. But I, you know, you, you hear about some of these cases and they have family, right? They have— so if you were to be— if you were a North Korean, you know, worker who was given the luxury of going, leaving the country and doing this kind of work, which by the way, um, they work like 14-hour days, they work hard, it's not by our standards a great job, um, but, uh, you know, I think, I think you'd be really worried about your family and what would happen to them if you—

you know, it's like anyone who, who leaves the regime Yeah, okay, I'm gonna read just a couple other parts from your story. I mean, this is how this works. Um, Chapman was a jack of all trades for her clients. She'd help send their falsified W-2 tax forms or other verification documents when they got hired. The workers had their company laptops sent to her address. She'd unpack them, install remote access software, and power them on for the North Koreans to log on. She made sure connections ran smoothly and helped troubleshoot any issues. She's like Geek Squad for these people. Sticky notes on the computers identified the company and the worker they were supposed to belong to. And then later, just to give people an idea of like who the FBI has sort of vaguely outed as being affected by this, for companies employing the North Koreans, their data is at risk. And the workers Chapman helped were able to get their jobs at a top 5 national television network.

I think Bloomberg reported that that was NBC.

NBC, a premier Silicon Valley tech technology company, an aerospace and defense manufacturer, an iconic American car manufacturer, a high-end retail chain, and one of the most recognizable media and entertainment companies in the world. And then later, when she— when Chapman was recently sentenced, that's when— that was the first time I saw Nike kind of.

Yeah, there's a victim impact statement from Nike there.

Okay. Um, okay, well, this is insane. Are you It seemed like you were doing the bulk of the reporting on this. I mean, is this like— this is all super widely known now in the security reporter land, or—

uh, yeah, I mean, I think it was, it was widely known. I think, um, there was sort of a bit of a reluctance to talk about it because there were a bunch of cases that were— everybody was like, oh, we're gonna, you know, all these laptop farms they shut down, for example. So I think there was a little bit— there was probably a little bit of a freakout going on, like, as everyone realized that this was basically a ubiquitous problem. Right. And then a bit of a like, oh, let's get our hands on the situation and then let's, you know, like they don't like corporations, don't like it when you get ahead of their response. Right. Because they're mitigating. And so, like, nobody wanted to talk about it very much. But with Chapman, they've sort of had to.— with these other cases. It's kind of becoming more, more well-known, but it's been going on for, for years. Yeah, for sure.

Do you know, was this like the Silicon Valley branch of the FBI that figured this out, or—

Oh, the Chapman case? Yeah. Uh, I don't know. I doubt it.

Okay. Have you ever, have you ever been to the, the FBI office in Palo Alto?

No, not in Palo— I've been to the San Francisco one. Why?

Well, I, I haven't been there in probably like, I would say, I would just guess like 8 years. So maybe things have changed. I'm sure they haven't. Um, you know, I don't know if people know this, and I'm going to simplify things a little bit, but, um, there's an FBI office in Palo Alto and one of its main jobs, pretty much its main job, is to like safeguard Silicon Valley intellectual property. And, um, it's all of about— well, I'm doing this from memory, but, you know, it couldn't be that much more than like 8 to 10 people.

Um, the front line.

The front line. So what I'm about to say is going to sound really disparaging and everything. The 8 to 10 people that I met were— they were young, they were bright, they were like energetic. They seemed to be trying to do their job to the best of their ability. I found it comical that the United States had, had about 10 people, you know, protecting the world's most valuable intellectual property. And, and it's crazy. So, you know, we've read for 20 years now of, uh, you're, uh, you're, uh, China, you're have some kind of familial relation with China. You're working at a— right, Google and Apple. You're there for a few years. Maybe your career doesn't sort of take off the way you thought it would. China comes knocking and they're like, hey, if you can, you know, get us some intellectual property, we'll make things pretty good for you. And, and we see this all the time. I mean, we've had semiconductor secrets taken. Bloomberg did a great story on, on stealing the pigment for this, this very bright color of white from, from DuPont, I think. And, and, you know, and then I did a series of stories years ago on like pretty professional break-ins at startups all around Silicon Valley where they would bust in, go like right to a very specific workstation, lift that, go out. And the cops in Palo Alto, when I first started calling about it, they're like, oh, this is just like a smash and grab kind of thing. I was like, well, why do you think they only took like one laptop, one workstation, man? And why do you think there's like head of engineering, 20 of these? You know, that was the— somebody sent me the the footage from the security camera, and it was like they went in the door, they knew where they went, like right to this one, one desk.

Wow.

And, and they were like, not, um, it was definitely like not an amateur operation. They were in and out. They were all dressed in black. And, and, and so as I was digging into that story, that's when I started to learn about this FBI office. And I got really sad, man, because the people there seemed super well-intentioned, but even when they have a case, it takes like 8 years to prosecute, and the evidence has to be so perfect.

And your DOJ has to want it. Yeah, they might not want it, so they got to pick cases that are winners.

But this is, this is not so like— there's— and then I was talking to like the chief security officers at places like Facebook and Google, and you know, they— there's this insane calculus that they run, which is, is like, okay, well You know, it turns out like some of our best and brightest employees are from China and other places. And yeah, we're going to— there's going to be some percentage of them where this happens. But like, this is the cost of doing business. And yeah, anyway, I just find it's a really interesting problem.

I think there are a couple of thoughts. Like, one, it used to be that if China wanted our IP, they could just hack us. It was so easy. And they stole a lot of IP that way. And I think we've gotten better at protecting that. So on that note, I think the pressure to have the insiders leak it is probably increasing. On the other hand, if you look at these big Silicon Valley companies like, um, Meta or Google, they have an intelligence capability that is, um, I mean, probably superior to the FBI, right? They are like surveillance monsters. And so So they're kind of, they're kind of up for, you know, that type of a task. Now, the FBI has certain capabilities they don't have, right? Um, and so they need to work with them. But I've, I've written about a number of cases where it's like clearly the— all the work was just handed to them, and then they, they, they take it over the finish line. The place that I, I find it really interesting right now is these AI companies, right? The smaller— because they're smaller They're not mature. They don't have— they just don't have these programs set up. And of course, that's the— these, these, these models are, you know, the weights that they have are there. It's not a large amount of intellectual property. They, they're pretty small, uh, just in terms of bits. Um, and, uh, yeah, they, they're prime target.

Yeah. I mean, I've thought about this a ton. I've been working on like an AI book. What I've noticed is, is, um, if you go to the big AI companies like OpenAI and Anthropic, I have never— I, you know, I've covered Silicon Valley for whatever, 25 years.

Yeah, it's pretty uptight.

Like, like more security than, you know, everybody has like a, a dude out front who's, who's kind of dressed in normal clothes and he's just watching the door of the office all day. And then they have like security inside. And that dude out front is, you know, Silicon Valley's a pretty easygoing place, man.

Yeah.

I mean, usually, yeah.

Yeah.

It's like nobody, like internally at the firewall level and stuff, people take this seriously, but the rest is like, it's Silicon Valley. You just like show up with your jeans and your t-shirt and go, this guy, these guys are like, why are you here? I remember I was, I was going to interview Altman or Brockman or something like that. And I had a backpack full of, uh, like podcasting gear. So it was, it was, it was huge. And I just like walking through the door, I could tell this guy was about to grab me and, and, uh, He's, you know, like, what are you, what are you doing here? So they, did they search your bag? Yeah, 100%. Yeah. And then if you're like on the list, you know, you're kind of okay, but it takes a second. Um, like I've had to just stand outside for 10, 15 minutes while somebody sorts out what's going on. And so that's unusual. Like I've never lived through an era of the Valley where, where that was happening. Palantir was like kind of a, sometimes, yeah. When I first started covering them, it kind of like felt like theater a little bit, but then, but then this, this all feels quite serious. And then I've been in some meetings, you know, at OpenAI where I've heard like the head of security laying out sort of what they're, what they're doing. And, um, yeah, I mean, they're taking this pretty seriously, but you're right. You know, there isn't, there are large, in some sense, like large gaps between the foundational model companies and these, these other AI upstarts. But you could get, you could get pretty far, you know, from just grabbing some startup Yeah.

Yeah. And then the insiders. I mean, yeah, I don't know how you— there's— it's, it's really hard to protect against that.

Like, kind of crazy.

Yeah. Yeah.

I'm so— I'm fascinated by all this. Yeah. And, and the, uh, and then there's, there's also this, there's this like old element of, uh, during the semiconductor heyday, like in the '60s and '70s, you know, that was Cold War time. And the Soviets used to send, um, like double agents here who would hang out at the bars and things like that. That. And it's pretty interesting. There's this great book, um, Engineering Communism, and it's funny because that was so semiconductor-based that, um, the Soviets were stealing stuff, but they could never quite like keep up because the semiconductor industry moves so fast that if you were— if you had to steal stuff, reverse engineer it, figure out how to make it, you were always like 2, 4 years behind.

Well, so did they get anything more than Tetris or?

They, no, they did. Like they got, they got like, like legit semiconductor designs. They would get like, um, networking chips, things like that. But they would struggle to implement, create a fab that could make them. And then even when they did it, because of Moore's Law, you were, you, you were 2 turns of the dial, 3 turns of the dial behind.

Yeah.

And so you're just, you're just like always kind of, you know, you can feel it, right? You're like a, you're like kind of a, like a decade behind on compute power.

Yeah.

Whereas like now if you You got the weights and you, you could just—

software is, yeah, overnight it's faster than, yeah, to implement.

And the Russians used to do it sort of James Bond style where you've got like a couple dudes hanging out doing their spying. They would go to trade shows and like talk. And then this Chinese model is more like much more patient and it's just kind of like, you know, we're just going to wait until this regular, not a spy that we've trained, just like a regular person It's kind of like, oh, my life didn't work out like I thought it would here. And, and the PR— the, the China's like, oh, well, if you can get this code, we'll give you like a whole company, you know, over, over here. And so it's a pretty good deal.

Yeah. Yeah. It's crazy. I mean, and you— and nobody really— it's so— I mean, it's shadow world, right? It's, it is like, it is industrial espionage, uh, of the 21st century version of it. Yeah. And it's just, um, it's so— you get, you just get flickers of it, you know, every now and then. But like, you've, you— it's one of those stories, it feels like there's a ton going on under, under the radar.

Yeah, it is wild. Um, all right, well, there was one other story I wanted to get to if you have time.

Sure. What time is it?

Uh, the— we could go quicker on this one. Um, but am I going to say his name right?

Ricky Hanschumacher.

Hanschumacher.

Hanschumacher.

Yeah. And so, and I mean, we'll get into his story, but he's kind of associated with this organization called the comm.

It's not— it's like, it's like, think of it like goths.

Okay.

Like, you know, it's self— you self-identify. You see one, you're like, ah, comm, you know, but it's not like an organization.

Okay.

It's closer to Anonymous, but it's like more like goths.

Okay. So these are, these are people who enjoy stealing kind of like identities online.

It's like an online culture that has evolved over the last 15 years that goes back to gaming, right? And it's fascinating. I just got really into it because, you know, I'm a gamer and I just— where gaming culture has gone is just of great interest to me because it's drifted from, you know, what I think that where, you know, what I— what my core values, shall we say. And so in the comm, like if you— Ricky's story was basically he was, you know, a baseball player. He was just like a regular kid. Kid who liked to play Halo. One day he's playing Halo and like somebody just kicks his ass in the game and he's like, what happened there? And his buddy's like, oh, you know, that was standbying. You got standby. There are these forums online where you can learn how to do it to other people. And he was like, I need that. So he starts learning how to standby and those forums just kind of lead him down this path to all kinds of like bad behavior amongst gamers.

And standby is where they like kind of take control of your computer and pause you. They, they flood it with like, like a DDoS attack.

It can be. Yeah. That I, I, I'm not there. There's probably a couple of ways of doing it, but yeah, you basically, your computer freezes and so in the game you're frozen and then you just like, they kill you. Yeah. Okay.

So he wants to learn how to do this. He learns how to do it. And then there's, at least for his part of the story, was this thing I never knew existed, which is this like underground world of trading valuable gamer tags. OG users.

Yeah. You didn't know about OG users? No. Oh man. OG users has been like like just in the, in the per— it's just percolating around for, for years. And, and there are cases like when, when I started at Wired, there's a guy named Matt Honan.

Yeah.

Who wrote like the, the most read story of that year was like how my online life was destroyed. You know, OG users who did that to him.

So they, okay.

So because he was @Matt and they wanted @Matt on like Twitter.

That's what I was gonna say. So, so people are after the, the prime like, @, like, a just a normal name, @, like, a single letter, like, like the really choice sort of gamertags. And Ricky, so when he gets played in that game and he kind of gets into this world of the comments, so he learned, he starts to learn hacking techniques and social engineering techniques to begin to, like, acquire these, these gamertags.

He wanted @Wolverine for whatever gaming Sony or whatever he was on, the network he was on. So he, he figured out a way to get that. And the interesting things that connects all of these stories is that they are both about online identities, right? And just what a shit show our management of online identities is. And what the comm kids figured out— so they start figuring out how to take over these accounts. And basically the way they do it is they, they call up tech support and they're like, ah, I am Wolverine and I've lost, you know, I've lost my password, or my account's been hacked and I need you to help me get back into my out. And so they figured out all these ways of just like talking tech support into restoring your, your credentials. And what's so fascinating to me is like, at exactly the time they were doing this, Microsoft, which had been like this gaping hole of security of the internet, was actually getting its shit together. So it was getting harder to hack into machines than it had ever been. And, and there was this tech support, like account recovery, uh, whole that like there was nobody cared about it. No, you know, if you lose your Twitter, uh, handle or your X handle, I mean, who cares, right? Like there's no financial incentive to the companies to actually, uh, police this and, and to have like real hard, you know, hard controls over it. They're basically, these are services that are very individually very low value to them. So these guys started figuring out just how to how to, how to, how to social engineer tech, um, tech support and how to get back into accounts. Well, around the same time that the North Koreans had the crypto, um, epiphany, the comm kids did too. They were like, you know, crypto had a big spike and they were like, well, we can get into gaming accounts, why not crypto accounts? And so they started applying the same tactics and techniques to the crypto world and stealing, um, cryptocurrency from people. Now they're making real money. So it goes from just like a haha pastime to like a criminal enterprise. And then over— you just fast forward over the next 8 years, crazy innovation, crazy amount. Like, just in the same way that the North Koreans like went far with the laptop farmers and all the, all the, all the ways that they found of circumnavigating the, the employee onboarding process process. These calm kids figured out all these ways of getting into companies and getting access to credentials. And basically, the, you know, the legacy that we have of that are the— is this, this, this group that's called Scattered Spider. There have been some arrests of them lately, but they, they have had massive disruptive effects on the, the Western economies, right? Like, they've hacked into Microsoft, Nvidia, uh, Uber, Rockstar Games. Recently, they, they shut down a bunch of, uh, retailers in the United Kingdom. They've broken into insurance companies. It's all the same techniques that were like Ricky and his crew were like experimenting with when they were just trying to tweak each other in video games.

And Scattered Spider, they're just more organized.

And I mean, they're— yeah, there's sort of the, the skill set has evolved. Um, the, the kids have grown up. They've had no adult supervision. I mean, there's a variety— like, this, this whole world is very interesting because a lot of the hackers like, um, uh, operate— hackers often are very successful operating outside of the West, right, where there's law enforcement can't get them. But the, the comm kids are all Western, and that's actually— they flip that to an advantage because they, they're really good at— often they work— yeah, they can call up tech support and they sound, they sound like, you know, Kevin in IT or whatever. Um, they're so, so they have that sort of cultural, that way of resonating with people, that way of kind of— I mean, ultimately what they're able to do is talk people into having sympathy for them. I mean, it's so awful because it leverages this key thing that actually makes society work, which is like when you deal with a bureaucrat who like doesn't adhere to the rules very strictly to get— just because they understand, they've hacked our humanity is what I'm saying. And so I mean, how many people have— there's— it's so often you're, you're, you're flying or you're dealing with the DMV or something like that and you've, you've made some mistake with your paperwork and you just find somebody who's human who's just like, it's okay. You're like, well, just, well, I can just get you through that. Like, don't worry. That's what they're going after. Okay. That's what they're abusing.

So what's the future of this is like infinite AI agents try to social engineer infinite AI, like customer support agents.

This is the one domain that AI hasn't conquered yet, right? Social engineering, it's terrible at it.

Right. But I mean, I'm just picturing this, you know, if you could fire up almost infinite personalities and I'm just picturing these AIs working against each other to try to see who breaks first.

Yeah. Yeah. I don't know. I mean, like, it feels like the AI is going to be mostly on the on the support side, not on the hacker side. It's been pretty useless for hackers. I mean, it's getting more useful, but in terms of like social engineering, it's got a long way to go, right? Like humans are really good at that. But yeah, how, how, like it, how do you social engineer an AI? I guess that's prompt engineering. I guess that's how you do it.

Yeah. I mean, I did, you know, it's just as like all the voice stuff gets really good and the image stuff will get really good. And you know, they'll have like this rich personality. They'll probably pass for a person. I would imagine.

Yeah. I mean, it'll help with their OPSEC probably before it helps with their social engineering.

Right.

So they can obfuscate their identities better. Yeah. Or look like, we're hearing about this too. Like there are cases where you hear about executives' voices being spoofed via AI to, to, to persuade precipitate fraud. Yeah, like that's already happening.

Yeah, yeah. I mean, I did, I did a video in like 2018 where I, you know, this was before the AI voice stuff was very good. I used this startup called Lyrebird. They were one of the first, so they'd train a model on my voice and I called my mom and she totally thought it was me. And then, you know, this is, that was years ago now. Yeah, I see this happening. And then there was that weird thing, right, where, um, wasn't it Trump or like people associated with Trump that they were They were getting phone calls from spoofed numbers.

Oh yeah, the Biden spoof.

Yeah, yeah, okay.

A year ago. Yeah, that really got a lot of attention.

Yeah, yeah. So you, the, I mean, maybe we'll leave on either a positive or—

Positive note, yeah.

No, but I mean, do you think, do you think, I've always found security reporting frustrating. Like a lot of what you just described with the comm and everything reminds me of going back to the '60s with like phone phreaking and—

Yeah.

So like, in some sense it's like, it makes sense that this is a never-ending cat and mouse game. On the other hand, it's like, good Lord. I mean, that's, it's like 60 years and we're still, we're still doing this.

Yeah.

And then as AI comes, like, yeah, do you think we're, it's just stays a cat and mouse game or we're heading to some sort of Armageddon of powerful computers and I don't know. I don't know, because it's like, is this good or bad? Where are we headed?

Yeah, yeah. I mean, complexity definitely feeds, uh, problems, you know. It's what the, this, the, the hackers feed off of, complexity, because, uh, there's just little edges open up that they can sneak in, into. So our world is becoming very automated and very complex, and that is to the advantage of the hackers. Yeah, 100%. Yeah. I mean, they're like, I think, I really think this identity problem is just the glaring biggest problem in the world right now in terms of cybersecurity. There's so many bad things that come out of just the fact that, you know, on the internet, no one knows if you're a Kevin, right? Like you can just, and part of that, as I was saying earlier, you know, Microsoft did get its act together with security to a certain extent, although they still have problems. But, um, the iPhone came out, it was a brand new platform. And I got to say, when the iPhone came out, I was like, just wait for all the hacks, right? And Apple did a really good job of locking that down. There was no iPhone worm that like, you know, disabled the phones worldwide or anything like that ever happened. Like, they, they actually showed that it's possible to roll out systems in a thoughtful and a secure way. Um, so the hardware is kind of locked down, but like, there's always going to be some place where we're critically dependent on things. And nobody's thought about it yet. So it's like water flowing downhill. It's just gonna move somewhere else. And so right now, I think a lot of the security problems, like 20 years ago, they were all around the software and zero days and bugs in the code and stuff like that. Now it's all around identity, in my opinion. And it's just a massive soft spot that we have, you know, no idea how to solve. How that's gonna be fixed. Yeah.

Yeah. And we were talking about it a little, I mean, when I, I did a big story on Worldcoin and I went with the company's founder and CEO over to Germany where they make these orbs for people who don't know, I think it's actually called World now instead of Worldcoin. But you know, it was backed by Sam Altman and, and they have this orb that does this like iris scan. And so the whole, the, the big idea is, is to, to exactly what you're saying, kind of like prove who you are, that you're a person. And so this orb does an iris scan, it sort of does a heat scan on you. It, it, it has mechanisms to make sure you're not just like holding a photo in front of it. So, you know, it's like proving that you're an actual human that's like alive and breathing, and then that you are who you say you are. And then, you know, there's critics of this from all sorts of directions, but this is the idea is that now if I've scanned myself at this orb, when I log in online to my X account or Reddit or whatever, that I am like, people, the other people know like, okay, yes, you are, you're a, you're not an AI. You're at least, even if you're anonymous, you're like a human. And that's, I know what I'm dealing with.

I mean, and the crypto people are the worst at this, but like in the tech industry, industry, there is such a delta between the, sort of the protocol and the implementation, right? So the idea may be cryptographically sound, but then you write the software that implements the cryptography and it fails, right? And so I initially thought World was like the dumbest idea ever. And then as I started thinking about all these identity problems, I was like, maybe it's the only solution. And right now I'm kind of in a middle ground because the reason we have all these identity problems is because companies have been such terrible stewards of our private information and they leaked it all out. It's all available for criminals. So if that happens with our unique identifier, that's our eyeball, what are the ways that that could be circumvented?

Right.

And has somebody really thought about that?

It's your last chance. It's your last chance. Yeah.

I mean, you have to replace your eyeballs, you know.

I thought about the same things. I think when I first went in, in the story, I was like, this is nuts. This is ridiculous. And nobody's going to trust, right? No matter how you feel about Sam Altman or Silicon Valley, like nobody's going to trust some, some kind of company with, with like your iris database. And then, but then I was, I was also like, why don't I definitely don't trust the government to protect it, you know, if they were doing it. And then, um, and then I think I just more recently went through the same thing you were kind of going through a bit, which is like, oh yeah, I mean, like, we probably have come to the time where something like this will— something like this will need to be done on some level because, um, who was it?

Was it Scott McNeely that said that we should have a driver's license for the internet? Maybe it was Eugene Kaspersky or somebody back then.

Well, Scott used to always say, you've got no privacy, get over it. And, um, and then, yes, I mean, they were always trying to do like a big identity.

Yeah.

Like they wanted to create like an internet-wide, very proven identity years and years and years ago. And then it just always gets undermined by, uh, yeah, all these different systems you gotta log into and everything. And then like you say, I mean, it's, it's, there's been so many breaches over time that, um, you just become inured to it and you're like, oh, uh, Wells Fargo lost all my stuff. Like, okay. You know?

I mean, we do have these like systems of identification that are grounded in the physical world, like the driver's license, for example. And we do have ways of connecting, um, you know, to those systems and to, you know, sort of establishing whether the driver's license we're being presented with is legitimate or not. And that's— it's pretty good. It might not be perfect, but it's pretty good. I mean, I better not tell the story. Let's just say someone I know recently had their fake ID taken at a bar because one of those systems worked. Um, so, you know, like, it's just when you, when you look at the, these crimes and these activities and you just see like how appallingly bad the, the implementation is right now, you're like, it could be better. It might reduce the fraud. It might, you know, the determined hackers are always going to get in. Determined people are probably always going to be able to pull off frauds. Like 16-year-old teenagers, you know, who are like hacking into NVIDIA, like, eh, maybe that could be stopped. Yeah.

All right. Well, Bob, thank you so much for joining us. Everyone, if you're, um, getting an application on LinkedIn and there's just, you know, there's just a lot of minion, uh, Gru, if it's from Gru or Kevin, just red flag that. Just definitely, definitely keep an eye out on those. Ask, ask to meet them for coffee. Um, and, and that would be step one. And yeah, man, thank you. I would, you know, we've been friends for a long time. Your reporting's so fantastic. Thank you so much for joining us. I urge everyone to hop on the Wall Street Journal. You can go search for Robert McMillan and find all these stories we were talking about pretty easy. And yeah, man, thank you.

Thank you, Ashlee Vance. It's a real, real pleasure to chat with you.

The Core Memory Podcast is hosted by by me, Ashlee Vance. It is produced by David Nicholson and me. Our theme song is by James Mercer and John Sortland, and the show is edited by the John Sortland. Thanks as always to A1 Ventures for making this possible. Please visit our Substack, YouTube, and podcast channels to get more of what Core Memory makes. Thanks, y'all.