Former CIA spy hacks humans! #18

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it. Whoa, and welcome to the Security Guy and the CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka.

Hi Robert, how are you?

Doing pretty good, Peter.

So Peter, you are the CIA spy. Tell me just a little bit about your background.

Well, I want to say former CIA spy because I don't actually— I retired from the agency about 10 years ago, but I had a 20-plus career with them and spent most of that time overseas, uh, collecting intelligence for policymakers back in Washington, DC. So I had to breach the security of the organizations that had this information, which I was trying to collect. And now today I carry that over in the work I do for the private sector and helping them to understand the threats that come in from the outside that are trying to breach their, their IT network. So still doing the same work, but I'm on the opposite side of the fence this time.

So now when you say overseas, right, like, you know, I think overseas, I'm thinking like I want to go to Italy, I want to go to Greece, like, I want to go to Spain. I mean, were you in like Europe or were you in like, you know, Black Hawk Down? Where were you at?

Oh, I mean, how sexy do you want this podcast to sound? I'll be honest with you, I was living in some pretty, pretty nice areas. I mean, I spent a lot of time in Latin America. That's always been my forte. But then I, I lived in for a period of time in Europe, but I traveled from there. I traveled into the Middle East, into Asia, but unfortunately I was able to live in places that were relatively nice for my family because my family accompanied me while I was working overseas.

So Middle East, Asia, and what, Central America?

Yeah, and of course all Europe. I've been through all of Europe.

Speak one more than one language?

I speak some English. Spanish, Portuguese, and French.

Oh really, you speak 4 languages? Oh, that's pretty awesome. So you really are the real deal.

Well, I mean, it's really, in my opinion, the only way to be effective. You're more effective if you can speak the language of the individuals who you are, say, you know, targeting and dealing with. And not just the language on a basic level, but really to a level that you understand the mentality, you're able to also, you know, make jokes in that language. I mean, you ingratiate yourself with the people and that really opens a lot of doors because they think of many times overseas, they think of Americans as, oh, they only speak English. They can't speak our language. But when you really try to speak their language, they're so much more receptive. And so it's always been very good for me and good for our country.

So you use a specific word when you mentioned the people that you are working— you mentioned, you said the word targeted or targeting. What does targeting, like the targets, what does that mean?

Well, okay, this same thing that works with like security today, if you're looking to penetrate an organization, for whatever reason it may be, you're going to be almost always targeting insiders, individuals who have access— yeah, new information inside that organization, whether it's access to files, access to negotiations or discussions in the boardroom, or access to the IT network. So these were the individuals that I was targeting when I was in my former career with CIA, targeting individuals who worked in particular organizations, uh, for both the government as well as, as a private sector, who had access to information of interest to us.

So now when you would target someone, how would you, I guess, approach them, build that relationship, get that access? Like, what would— what, how would—

how would—

what is the process of targeting?

Well, that's a very good question. And there's a couple of different ways. It can be a target of opportunity, where all of a sudden you come across this individual who might be from an organization that you think, whoa, this person is an ideal candidate. Let me see, how can I Can I, you know, begin a dialogue, begin a relationship with this person? Or maybe it's someone you identify and you've collected information on, especially today in a world of the online, you know, the amount of information available on the internet or social media on individuals. We can pick somebody who we don't know and kind of develop a way, a pretext for contacting them, establishing a dialogue. Usually it takes more than just like a one-time conversation. You want to look at, how can I get back and have multiple conversations with this individual, use elicitation skills that we've developed to really gain a lot of information, not only about them but the organization they work for, and then get to a point where you get them to undertake an action. Most times, in my case, it was winning. They knew that they were they were, they were involved with providing me information. They didn't know necessarily who I was working for, uh, but they knew that they were providing me with this information, helping me out with this information based on developing that relationship with them, a trust, you know, amount of trust that they had in me. And they really wanted to help me. That's why being ingratiating, you know, for me it was very important. People felt that they could trust me and they wanted to help me.

It, it, this, I know this isn't what you did, but it sounds to me like the process of a romance scam. Like, you meet somebody and you tell them what they want to hear, and you begin to, you know, uh, in a sense, pour your heart out or just be like, be honest with them. And eventually, like, they trust and they believe in you. And before you know it, like in a romance scam, they're turning over money, right? In your situation, they're turning over information or whatever that might be. Does that parallel work or am I off base?

No, no, you're not off base. Basically, it's, it's when you are assessing the individual, you're looking at them as unique individual and what might be their wants and needs, what might be their motivations, what might be their vulnerabilities. And then you begin to look at, okay, how can I develop them and the relationship with them so that I know what buttons I can push and I know what I can offer them in exchange for their assistance based on what their, their respective motivations are, right? So you try to satisfy whatever they need. Like in a romance scheme, you know, scammers are trying to satisfy that loneliness, uh, or romance that someone is looking for, right? At the end of the day, in those cases though, the person pretty much gets burned almost in all scenarios. In my experience, individuals that I work for at least, and for the most part, at the end of the day, the individual has developed a relationship where they are benefiting from it, and hopefully they will benefit for a long time, and eventually the relationship would be severed, right? But that individual should be able to walk away with nothing detrimental happening to them. To the contrary, It's all— it's been a win-win for us as an organization and a win-win for them, that because they've gotten something in return that's been beneficial to them.

So, you know, this— it doesn't— it sounds similar to what I might see in the movies, but it's also different. So are you in a position to— because I know you can't share a lot, but are you in position position to share like an example of what that might look like? Like, like, like what the, what the, what the end goal is, who the target is and why, what you did to, I guess, socially engineer them and how they provided you what you needed?

Like, I mean, let's just say for example you are, we're targeting a senior government official in the ministry, okay, that definitely has access to something, uh, to information that's considered foreign intelligence. It's private, you know, it's closely held, it's non-public, and it really would meet some requirements that we have for a better understanding of what's going on in a particular country, under a particular administration, or within that ministry. So then an individual we can validate is a validated target. It's not that we assume that they have access. We find out through the initial dialogue with them they in fact have that access. Okay, now we gotta look at how can we develop that relationship with them so that we can get that individual to provide us with that information. And it could be a number of reasons. And, you know, most cases, most cases around the world, it's gonna be financial. Okay, some people might do it from ideology. In the old days, especially with the Soviet, you know, the Cold War, there would be people that would cross over and do it for ideological reasons. They, they believed in, uh, in the United States, they believed in our system. They didn't like what was happening back home. They wanted to see if they can make a difference, right? And so there are people that, that will be motivated by ideology, but in most parts of the world, uh, it is financial, where they are receiving compensation for information that they are providing. And they might use that, that money for a number of different reasons. Maybe it can be packaged in Hey, you know, you want to, you want to be able to send your kids to college someday. This is a, you know, this is our funds that you can set aside for college or for buying a nicer home or for your retirement or for, you know, you know, luxuries.

All right, all right, all right. So, so what you're saying then is, is that you were the guy that actually handed off briefcases with cash in them for information?

Well, not briefcases per se, it might be envelopes, but, uh, yeah, kind of like the Candyman, right? I mean It's transactional, but it's not only— it's not only based on the money. I mean, most times if it's only based on money, it's probably going to go sideways. It's based on money— is the money and the motivation, but also the trust in the relationship that we're going to protect them, right? And also it's a friendship really, and trust with the individual who, who recruited them and who handles them. I mean, they really enjoy dealing with you, and because you're probably the only person that knows what they're doing, because they're not telling their family, friends.

It would be considered an asset. Yes, that's movie stuff right there. Okay, so the target would be their boss. They are the asset. They're the medium for you to get that information.

No, they are the target. I mean, the target, the ultimate target might be their— the organization that they work for, right? The information that's held in that organization, but they become the target individual, right? We refer to target, we typically refer to the individual that we are targeting. Once they are recruited and the relationship is established, then it's an asset.

So would it be safe to say that, uh, some of what you were engaged in over the years, uh, was part of like the larger picture to secure American borders, to protect the homeland, and/or to get access to other countries to start something, to stop something. Like, would you say you're a little bit of all of that?

Yes, absolutely. All of that. I mean, there's so many issues of interest to the US government, not just US government. I mean, most governments have the same concerns, right? Whether it's to prevent terrorist activities, whether it's to deal with counterproliferation,, uh, that might be taking place, whether it's, you know, negotiations, trade negotiations with other countries, uh, better understand your, you know, the adversary's capabilities from a military standpoint. I mean, uh, understand their economy and, and what it might be the main sources of income for their economy. All these things basically to understand what's going on in another country. Not all the countries are the same level of interest. Of course, there's going to be prioritized, uh, targets of interest, countries of interest.

So now, based on the 20 years that you spent in the CIA, um, your home base being what, Langley?

Oh yeah, ultimately Langley, but I mean, I spent very little time. I spent most of my time, uh, overseas in the field, you know, just like people think in the corporations, they prefer to be out, you know, overseas working in the in a branch office than working back at corporate, because corporate is very different sometimes. No one likes to be working at corporate. And the—

what do we call the missions, projects? Like, what, what, what do you call each, I guess, deployment? What do you call that? Well, I mean, it's, it's each case, you know, like law enforcement, it's a case, or it's a— for military, is it deployment? For You know, a spy programs.

I mean, you have, you have programs, and then within those, I mean, the program might be collection on, uh, XYZ, you know, collection on Iranians, collecting a collection on the Iranian nuclear program, or collection on the, you know, um, the, the Russia. I mean, these are programs, and then within those programs you're going to have budgets, and you're going to have areas of interest within those programs, and you're going to, you know, recruit sources within those programs. But yeah, typically programs.

That's what it was called in and around the coffee, uh, in or out the water cooler. This is my current program, or this is the next program, and so forth. Is that correct? Okay, very interesting. So the stuff that you did, um, would it be— would the engagement, the program, and its results or its progress be something that we as a, uh, or its results, would it be something that we as consumers would see in the news eventually? Like, they— in that you would have been a part of that, maybe not by name, of course, but like you were a part of whatever that might have been?

Uh, that is sometimes— that's very true. Uh, I mean, a lot of our— and unfortunately, a, you know, you usually when you hear something in the press that's attributable to, uh to, you know, the government or the intelligence world is like, oh, they screwed up, there was a big failure. And it gets a lot of prop, it gets a lot of press, right? But the many successes, which are so many more than the failures, typically don't get— it might be in the press, but people, they don't realize who was behind it, right? They don't realize that we were involved. And there's a lot of cases where, yeah, I've been involved in incidences where things have come out in the press and say, yeah, you know, and it turned out the way that we wanted it to., we were involved, but we were unable to, to take out, you know, we got to be— can't be attributable, because if it— if some things become attributable to us, it can go back and actually potentially put sources and methods at risk, at risk. So that's what we got to be really careful. That's what kind of like irritates, uh, some of us, uh, when people come out with books. Could be very— some people are putting out books just to, to talk and, you know, glorify what they did in a particular mission, uh, you know, whether it's, uh, Central Intelligence Agency or other, you know, Department of Defense units, you know, the elite services like the SEALs, the, etc., where an individual might come out with a book about, you know, how something went down. But people can also get concerned because that also reveals a methodology. We got to be very, very careful and not put things out in the press. And the same thing happens with the presidential administration. They might want to put something out in the press showing, hey, that was a victory for us. But at the same time, it shares with our adversaries information that can be very useful for them in the future. So we tend to— we got to resist that temptation of putting too much information out there regarding how we conduct these activities.

Yeah, of course. I am connected to someone who is considered special operations in the US military. Who engages in, in this case, deployments that you and I, or maybe you back in the day, but in general, the general public does not know what he does, where he does it, who in many cases are his target, and he can't even tell, he can't tell anybody. He has to keep everything under wraps for all the reasons that you mentioned. And this is somebody who essentially will go to places and do things that you and I will never, ever, ever do. And hopefully he honestly survives it and lives to it, you know, based on the type of work that he's doing, or I guess deployments. Yeah, so that's, that's a big deal. So tell us about your book. So you mentioned, you know, certain, you know, authors out there that have a history with government agencies and special operations situations, programs in your case, uh, writing, you know, tell-all type books with— in some cases they probably shouldn't be doing. What's your book about? Tell us about it.

It's kind of a segue to what we were talking about earlier, that some of the things I describe in the book is sort of methodologies, right, when in regard to how human hackers— because I consider myself a human hacker— we as intelligence officers would target individuals to become potential sources or assets utilizes methodology, and none of it is, is secret. I mean, this is out there. You can find bits and pieces of that, but I put it together in such a way that the layperson can really understand the methodology that is utilized by an intelligence officer and how it's utilized by other human hackers who are, who are targeting individuals to breach the security of the organizations that they work for. So I wrote, I wrote it more for the individual who's not really involved in intelligence, but for the layperson to understand how, you know, the methodology that is utilized and how they could be approached as a target of interest, as an insider, because of the organization that they work for. So it's really trying to help prepare, educate them, provide security awareness to protect both themselves and their organizations from targeting by threat actors.

Gotcha. So your book essentially kind of breaks down a bit more about your process and how those that are employees of an organization, even company officers, frontline employees, managers, supervisors and up, how they could be targeted. And you've dissected that for them so they understand what it looks like when they're being targeted, what those methodologies are, and essentially how to, I guess, anticipate it should they, uh, start to get a sense that they're being targeted. Does that all make sense?

That all makes perfect sense. And for those that are not familiar with the name, uh, it's, it's called Confessions of a CIA Spy: The Art of Human Hacking.

Confessions of a CIA Spy: The Art of Human Hacking. Hold on one second. Uh, Confessions of a CIA spy. All right, and this is you right here, top of, um, top of search. Uh, that is Peter Warmka, 71 ratings at basically, for all intents and purposes, 5 stars. Good for you, Peter.

Thank you very much. I mean, I enjoyed writing it, and I've gotten a lot of really excellent feedback from people that say that It's an easy read. It makes a lot of sense to them. Some companies even with, you know, some of the, the best compliments I get, the best compliments I get when people say that they are buying this book also for their adult children. Think about it, right? They think that this could be really useful to other family members. And then I also get individuals that tell me that they're making this required reading for their employees in the companies where they work. I mean, these To me, that's a great endorsement when people are recommending this to other people to read. So, very pleased.

Yeah, that's great. So essentially, any company that's providing any level of security awareness training, whether it's phishing simulation training or bringing in a trainer or speaker, somebody like you or I, the information in the book is designed to support all of that. To give them that much more insight to the, the, the methods, the tactics that, um, somebody like yourself, a good guy, would use, uh, and/or somebody like a fisher or a scammer or romance scammer would use. And it's kind of dissecting all of that, correct?

That is correct. I mean, it goes into, uh, a lot— there's a lot of stories in there as well to kind of like illustrate, to illustrate these, uh, these methods. Um, I, I think people find it fascinating, and I'm in the process of actually writing another book. I'm not going to say too much about it. I don't want to get the— everybody, you know, waiting for the book because, uh, it takes a little bit of time, as, as you can imagine. Uh, some of you might not know, but, uh, this book— anybody that works for the CIA, who has worked for the CIA, who's going to publish something has to get it approved by the CIA. There's a publication review board, so it was submitted to them. Some of it was struck out. I had to make some edits to make some changes because they feel that— felt that some of the information was overly sensitive. So it's been totally approved, blessed by them, and I won't get in any trouble for releasing it, nor will the readers get in any trouble for reading it.

Now, since your retirement as a— I don't even know why I did air quotes with that one. Sit with, uh, because, because you— but I guess why I do know, because you're still working actually, but maybe not for the CIA. What do you do with your expertise now? Like, what besides, you know, being a successful author, um, how else do you spend your time?

Well, I established Counterintelligence Institute about 2 years ago, and for the purpose of working with organizations, whether they be, you know, for-profit corporations or or nonprofit, or even municipalities, state government, federal government, or all organizations that, that could be targeted for breaches by human hackers. And so I provide— I do a lot of speaking at events and conferences. I also provide training events, workshops for companies. And I also provide a number of different types of services like phishing simulation program support, red teaming audits, look at the vulnerabilities that organizations might have. But the big part for me, the most— what I enjoy the most is the educational piece, the security awareness piece.

Yes, the, the boots on the ground, how people are swindled in social engineering, how that all works. So yeah, this is, um, let me— I just, uh pulled up your website here. This is pretty good stuff right here. Pop-up with the book. That's great. And click the screen here. And there you are, Security Awareness Training, learn about security breaching from a former CIA spy delivered through courses online, live events on client site. Really great stuff, Peter. So for those of you who are just tuning in, we're speaking with Peter Warmke. He's a former or retired CIA spy, like the real Dale, working in— spending a lot of time in Central America and overseas via the Middle East. And he is my co-presenter. As you probably know, I am Robert Siciliano. I provide security awareness training with ProtectNow LLC, and Peter is— and I'm the security guy, and Peter is the CIA spy. So that's a bit about his story, and Uh, Peter, so you really are a, a true master when it comes down to it. Like, you, you're absolutely the real deal.

Well, thank you. I mean, I, I still learned, though, right? Because the, uh, everything is constantly evolving. Human psychology hasn't really changed too much, but the mechanisms to, to get to them, to manipulate them, have changed. Technology changes, right? So there's always, there's always— this game is always, uh, evolving. And so that's the reason why I love to still be involved, because it's always more— still more to learn.

So that's excellent, Peter. Thank you for all of that. So we are the Security Guy and the CIA Spy pod broadcast. We are on, you know, Apple and all of the socials, live via stream once or twice a week. And so tune in, look for us, sign up for our newsletter. You can see me and my team online at protectnowllc.com. And Peter is at— hold on one second, let me get right back to your website. Peter is at— why don't you, uh, tell them anyways, Peter? It is Counterintelligence and Peter is a 2x TEDx speaker. And what we discussed today, his website, my website, will be in the show notes, which will be published via our newsletter. Head over to protectnowllc.com and sign up for our newsletter, and you will get our feed every couple of weeks, know when the next broad— pod broadcast is going to be, And Peter, you have last words?

Well, thank you very much, Robert Siciliano. Enjoyed speaking with you, and everybody just keep safe out there. There's a lot of things going on and there's a lot of angst, especially now with what's going on with the conflict between Ukraine and Russia. I mean, the history has been filled with this. This is just another chapter. You know, just do your part. Take care of yourself and take care of others.

Yeah, and be nice to each other. You know, there's a lot of angry people out there. Just be nice to each other. Be patient with people.

Thank you, Peter.

Thank you, Robert. You take care.