Massive T-Mobile breach and other messy security issues… #6

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to The Security Guy and the CIA Spy Podcast. I am Robert Siciliano, and this is Peter Warmka coming from Orlando. Hey Peter, how you doing today?

How's it? Good. How's everything up in Boston?

Well, uh, it's good. Uh, weather's been a little nuts. Uh, we've got a hurricane barreling down on us, but you know, it's what you do, it's what you deal with. I am prepared. I was talking with my family today about, you know, what we would do if we got battered, because you're looking at 70 to 80 mile an hour winds. It could be a category 1 should that happen. I've got probably 10 days of fuel to power up a generator should we— should the power go down for any extended period of time. I've got a couple of freezers full of food that would also be powered up by that same generator, so we wouldn't lose that food. Then I've got probably, I would say, probably about 6 months of dry goods, uh, in case, you know, uh, the apocalypse occurs in some way, shape, or form.

You're a prepper!

Well, look, you know, I would— I guess I consider myself a prepper. I don't actually have, uh, an underground, you know, something or another in case I needed to go to. Um, I do have a safe room, but I don't necessarily have a supply of oxygen. Uh, so I prep, but I wouldn't consider myself a prepper. I think that the basic preparation that everybody should have is what I just spoke to. You know, so should the power go out for any period of time, I think that you should have— anybody should have just enough food and water and fuel, uh, to keep you going for at least a couple of weeks, because that's generally what it would take for the power to get back online. Look at— in my adult life, I've seen the power go down in my immediate area for some people for as much as 6 weeks. Uh, Hurricane Sandy back in 2012 Some of those people lost power for 2, 3 months. So, you know, I don't consider myself a prepper, but I do prep. How about yourself?

No, I think I'm just joking. I'm just giving you a hard time because I really, I really believe that more people should have this mindset of preparing, not living day by day, right? It's not this just-in-time sort of mentality that everything is going to arrive to my doorstep just in time when I need it. But, you know, when my wife is usually the one on my case when there's a storm potentially coming. It's in Orlando. We don't— we're not usually right in the path of the storms so much because we're inland a little bit, but there's a lot of these that come really close to Florida. So keeping a good supply of water and of course toilet paper. Everybody needs to have lots of rolls of toilet paper, right? No, and dry foods. So we're in pretty good shape. I'm not not too concerned about that, but you need to have a little bit of a stock up for a little bit of these things. And it's not just natural disasters, as you talked about many times. There's also these different times when the power grids can go down if there is some sort of emergency or cyber attacks. So it's always good to have a supply for a couple of weeks of everything.

At least, right? When the pandemic initially hit and everyone ran out of toilet paper right away, I was like, why is everybody out of toilet paper? You know, I had probably 2 years worth of toilet paper. I probably have 5 years worth of toilet paper right now. And I have lots of females in my life and I've taken it upon myself to buy probably a couple of years worth of sanitary napkins as well. You know, because wouldn't that be horrible if they ran out and/or, you know, if the supply chain broke down and they didn't have that? Like as a civilized society, I think that that's necessary.

Yeah, and you have dog food, or they know you have that big dog?

I have probably about 6 months of dog food as well. You know, one of the— I've read in the past that like when people run out of food for any period of time, one of the first things to be killed and eaten is the actual dog. You know, that's—

yeah, I guess if it gets that bad, and that would probably be one of the last things here. My, my I shouldn't joke about this. My dog, I love him, but he would not make even a snack. He's a Yorkie.

All right, so Peter, we've got all kinds of interesting things to talk about today. All right, so let me, um, bring up, uh, my shares. All right, so check this out, right? Uh, hacker claims to have data on more than 100 million T-Mobile customers, asks for over a quarter million dollars This is via Gizmodo. So Peter, it goes on to say that a hacker claiming to have data related on more than 100 million T-Mobile customers in the US is selling access to part of the information roughly for $277,000, which means that essentially he's on the dark web in chat rooms and he's got all this data that has what? It has a motherboard on Sunday reported that the hacker revealed that they had data on an underground forum, um, specifically was related to T-Mobile in the post. Uh, it said that they claim to have Social Security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver's license information. Uh, so that information, specifically the Social Security numbers, is what's worth a good amount of money, right? The socials, because that could be used to open up new accounts under people's names. Oh yeah, um, physical addresses would help in that regard, right, when you're opening up new accounts. Um, the IMEI numbers in the phone numbers themselves could be used for additional scams, and the driver's license numbers could be used for additional scams. This is what they would call in the hacking world, black hat hacking world, FULLZ, FULLZ spelled F-U-L-L-Z. So when bad guys are selling FULLZ, they've got at least 4 to 6 points of data on that individual beyond physical addresses and beyond email addresses. They've got enough information to essentially open new lines of credit under that person's name. So, Peter, like, what went wrong here?

Now, this is incredible because we're looking at almost a third of the US population. If we— if you're looking at 100, it's just phenomenal. And I don't think they've— well, this is an ongoing problem with— not to point the fingers at T-Mobile, because there's been a lot of organizations that have been hit with, with, uh, multiple ones. In the case of T-Mobile, I think this might have been the 6th successful breach in the last few years. I don't think they disclose exactly how this happened, but it's phenomenal about what can be done, as you mentioned, with this particular data. It calls into question, I don't know, for the service providers like T-Mobile and other ones, do they really need to have all that information to open up an account and provide that service? Would having one identifier, like, like the, uh, Social Security number, and having one maybe for verification, maybe a date of birth, would that be enough for a service provider like T-Mobile to, uh, be able to provide you with the service? But here they got everything, right? In many cases, even the number, you know, Social Security number, driver's license number, date of birth, and all these things where when they do get hacked, it's a full— the fulls, right? All this information that makes it so easy for someone to use. Is there a way for these vendor service providers, if they need this information, to be able to segregate it, to separate it on their system so that if someone hacks, they don't get this treasure trove of information?

I think the answer to that is a definite yes. They're able to separate it in a number of different ways they could do that. But the, the, but a number of questions do come up. Why are they storing it for as long as they are? Like, after the initial credit check, why do you still need the Social Security number? Wouldn't you want to make efforts to remove it from your systems entirely, to completely wipe it out? So once the credit check is done, get rid of that data. But the fact that— yeah, but the fact that they even, you know, were hacked to begin with means that either A, somebody on the inside did something wrong, and that wrong could be that they didn't patch a server, that something was outdated and there was a vulnerability discovered in either, you know, Microsoft Windows or, you know, Linux or whatever the case is. They didn't patch a vulnerability, which allowed the bad guys backdoor access, and/or somebody on the inside was socially engineered to give up credentials. That's usually how these things happen. So usernames and passwords by an employee were compromised, and/or Or those same credentials, usernames and passwords of an employee, were on the dark web because that employee uses those same credentials for another particular website they may access. Username might be an email address and a passcode could be the same passcode for his or her Facebook page. And so with all that information, they were able to log in to whatever that server might be to give the bad guy, in this case, access. To that server, you know. And that, that, so all of that is essentially poor cyber hygiene.

It is. There's one thing you didn't mention. You mentioned a lot of different examples how somebody could, uh, through negligence facilitate the breach, but you didn't mention that there's— and there are breaches that take place where you do have an insider who is malicious or who understands, who's willingly knows that they're providing this to a threat actor. Maybe they're getting paid Maybe they have a grudge against their employer and they say, okay, I'm gonna, I'm gonna provide this information to somebody to really hurt this company. You don't know. We can't always assume that it's negligence because sometimes there's people on the inside that will do, do malicious things to breach the security.

As a matter of fact, I just saw this week that researchers had found on a forum hackers were soliciting insiders, company inside employees. They were, they were soliciting insiders to give up access to internal networks of their companies or government agencies, and that the criminals in this case were, would then get backdoor access, uh, load ransomware onto the network and extort that company and pay that insider 40% of the Bitcoin in which they got as a result of that extortion?

I completely believe that that's so easy. I mean, that that happens, that could happen, and that it will be some cases, especially— we talked about this before, where we get employees that begin to work remotely. They're working from their house. They're not going in on a day-to-day basis. To the company where they're kind of like inside of the company culture. They're working from home. It becomes more of a transactional relationship with their employer more than ever. You know, I'm putting in so many hours, or I say I'm putting in so many hours. You might be able to check how many hours I'm actually working. They might be able to check my productivity, but I'm doing that and I'm getting a paycheck in return. I'm getting whatever paycheck benefits, but it's very— it leads to a disintegration a bit and the potentially in the loyalty that employees will have with their employer. So if someone is so easy for a criminal group to approach somebody, so easy, and you put that on the table, listen, uh, we can conduct this hack, probably won't, probably won't lead back to you. If it does, in any case, you know, you're gonna have, hey, you're gonna have, uh, $4 million in your bank account. So what? So what if you lose your job? If somehow, I mean, if that kind of money putting into on the table for you, there's going to be certain people, you know, that where the ethics or morals are not going to play into the game. It's going to be how much can I get today. So that is a tremendous leverage that some of these groups can use by using an insider and then willingly knowing that, yeah, I'll facilitate this this hack for you.

Yeah, and I'll bet you we're gonna start to see more and more of that. So one thing I wanted to point out to everyone, uh, that, um, essentially would assist them in protecting themselves is, uh, and I'm sure Peter at this point maybe, or hopefully, you can see my screen. So one thing that I think that everybody should do is do a quick search for credit freeze, right, and then TransUnion. Okay, and when you do that You will come to TransUnion's website on how to go about getting yourself a credit freeze. So if you have been part of this particular breach, which you may or may not have— 100 million, I, I, I doubt that I am because I've never had a, um, T-Mobile account. But if you are a Sprint customer, I think they had merged at one point, one of the best things that you, you could do right now is either if you already have identity theft protection, that's good. In addition to that, you probably want to have a credit freeze. So if you search credit freeze TransUnion, What immediately propagates in search is also Experian credit freeze and Equifax credit freeze and so forth. And when you click on freeze my credit at transunion.com, it brings you to the page on TransUnion's website on how you go about freezing your credit. So right here, a credit freeze, also known as a security freeze, is the best way to help prevent new accounts from being opened in your name. It's absolutely free to freeze and unfreeze your credit, and it won't affect your credit score. So that should answer a few questions for people. And then right here you click Add a Freeze, and when you do so, it's going to bring you to the page on TransUnion's website that basically is you filling out a form, uh, providing all of your sensitive information here, which is fine, just do it, uh, in regards to freezing your credit. So they're asking for first name, middle name, last name, address, uh, city, state, and zip. They want your email, mobile number, date of birth, and the last 4 of your Social Security number. To begin with. Look at— they already have that data anyways, right? But the only way that you can protect yourself from what is called new account fraud is by freezing your credit. Now, identity theft protection services will work on your behalf to prevent new account fraud too, and I think you should have them, but a credit freeze, I think, supersedes that and is without a doubt an additional layer, if not the layer of protection to freeze your credit. If you're not freezing your credit these days, I think frankly that that's a bit irresponsible.

I agree with you 100%, Robert, and I've done this for about 7 years now. I've frozen the credit across all 3, uh, bureaus. It was so simple, and I think they give you just like a reactivation, uh, code. And so you can freeze it in a matter of, uh, 5-10 minutes, and to reactivate it. It's almost instantaneous. It'll take you maybe 5, 10 minutes. And, and, and it's very easy to do. If you all of a sudden say, well, what happens if I want to buy a car or something where they're going to, they're going to check my credit? All you need to do is ask them, okay, what credit bureau do you consult? And then when they tell you which one, you go to that credit bureau and you just reactivate it for a period of time, maybe for one day, for a week, whatever. Uh, and then re-freeze it. It's so simple. It's a great peace of mind. I would highly recommend it as well.

Yep, love it. Great, cool. So, uh, next on the list, um, MasterCard will start removing magnetic strips from its cards in 2024. So, uh, I'll read through. This is via, um, CNET, and they talk about how MasterCard will start phasing out magnetic strips on its debit and credit cards in 2024, and it expects the process to be completed by 2033, according to a release. Uh, MasterCard says it will shift to biometric cards combining fingerprint and chip technology to verify a cardholder's identity. U.S. banks will no longer be required to issue cards with a magnetic strip by 2027, and by 2029, no newly issued cards will have a magnetic strip. So, uh, magnetic strip has been around, I think, um, well, since the beginning. Uh, it's time to embrace the best in class. Magnetic strips were introduced in the 1960s and allowed banks to encode a user's bank information and so forth, right? Now, Robert, you know what's—

you know what I find is just, uh, I don't know, it's, it's— I wouldn't say fascinating. To me, it's just kind of curious or sad because, you know, the, uh, the chip was sort of like introduced here a few, 2 or 3 years ago, and that's being the hottest and most important thing to help protect you with this chip. I lived in Belgium from 1999 to 2004. And the chip was utilized across Europe in the credit cards way back then as being something much more secure than the magnetic strip. You know, I think a lot of it just came down to economics for the financial institutions to say, hey, we're going to go ahead and we're going to shift and use this. The technology has been around for a long time.

Long time.

We see right now these other things, technology, a lot of In a lot of cases, the technology exists. It's just a matter of, you know, the economics if organizations start to use this and roll it out.

You know, in some parts of the world, they don't use credit cards at all. I believe it's, uh, it might be South Korea, and I could be wrong, but I think that the majority of their financial transactions are done, um, wirelessly. They, they use their mobile phone. It's all RFID. It's all NF near-field communications, uh, that they're, they're just waving their phone and they're hardly using cards at all. Uh, and, uh, I thought at some point here in the U.S. we'd be leapfrogging credit cards in, in its, in their entirety. Um, it's amazing to me that Apple Pay is not as ubiquitous as it should be. Uh, I guess what it boils down to is old habits are hard to break. And the magnetic— the reason why we, we introduced, um, the chip in this country was to eliminate card cloning. So the magnetic stripe by itself is, is real easy to read via a skimming device. Beyond that, a magnetic stripe card is easy to clone, which basically means that you can, uh, use that card by physically duplicating the information on the magnetic strip and go ahead and use that in a retail location. Now we still have the magnetic strip, but my understanding is that even with the magnetic strip being on there, that because it is a chipped card, that it still can't be cloned due to the fact that there is additional data that, uh, would not be copied via a magnetic striped copied card, that with a clone card it still wouldn't work because that additional data is unavailable in that cloned card, if that all makes sense.

Yeah, all I know is that, okay, I've been getting these new credit cards with the chip and It seems like so many of the readers are having a heck of a time with these that they— the transaction fails and you got to do it maybe 3 times before they go through. So there's a problem. I'm probably not the only person. I'm sure there's other people out there that experiencing kind of the same frustration. They're supposed to be more efficient, work quickly, and, um, some of the readers are having difficulties.

And the other issue is that, um, you can still use a card number from a chipped card over the phone and online as long as you have the CVV code. So, and then another issue is that overseas, like you mentioned in Belgium, they don't even use the chip and signature card. They use a chip and PIN card similar to our debit cards here in the US, which means that you, you swipe your card or insert your card, being a chip card, and then you have to punch in a PIN code. Whereas here in the US we just sign our name, which is total BS.

Yeah, whoever looks at those signatures—

and this is the zero security in a handwritten signature to begin with, right? All that being said, I think since it might have been April of 2018 or '19, Visa, MasterCard, American Express no longer even require a signature when, um, uh, when transacting at a point of sale. But many retailers simply haven't got the message, and/or they want that signature for whatever reason, often in the, in the restaurant industry, which would also indicate that you would provide a tip. So, you know, it's just the whole thing is just so backwards. We're so backwards. I think we should just leapfrog cards altogether and just go pure NFC, because I can't stand the fact that I have credit cards in my wallet at this point.

Oh, I agree with you. And they were mentioning, uh, they were going to incorporate biometrics, uh, which I, I mean, across the board. So when you, whether you're using your laptop or your phone, I mean, I, I just can't imagine your face. Yeah, I just can't imagine this is going to roll out and be very, you know, in a timely manner.

You know, I, I don't know Um, uh, whether or not we'll ever actually leapfrog cards themselves and just go all digital, uh, or NFC, RFID— I hope we do. Uh, I think that, um, it's all a facade to begin with. And, uh, you know, I think that there's more. Look, you'd be hard-pressed to hack Apple Pay, okay? Uh, but cloning a card, using that card number over the phone or online Uh, you know, like you said, all the technology is already there in order to, um, conduct these various transactions or to make us that much more secure. And I think it's so user-friendly. And I, I think, I think, you know, all of this announcement, while it's interesting, um, I think it's, you know, ridiculous that they're even considering, you know, going— you still using cards in the next, uh, 5 to 8 years. Like, just go all digital. Like, who doesn't have a smartphone at this point, right? So, oh, and the other thing, Peter, is, you know, when we start talking about cards, um, one of the first questions that people always ask me in my presentations is, how do I protect my credit cards? And the answer is, you can't. That there's no way you could protect your credit cards. It just doesn't exist. What you can and should do is set up what's called push alerts or push notifications. So push notifications are when you log into your credit card company's website, your, you know, your, your account, and you tool around the dashboard of the menu and you look for alerts, notifications via the security settings. So with every single charge, I get an email and/or a text message with my American Express and with my MasterCard and so forth. That way, in real time, as the card's being inserted in or swiped in or used online, I get a notification almost instantly. That way, if there's a charge that I am unaware of, I'm alerted to it in real time, and I can stop— I can basically call the credit card company right there and then and say, hey, I think my card's been compromised, can we do something about it? And an example I tell people is that just a little while ago, my wife was taking the kids to school and I'm at home, and I got a couple of text messages from American Express alerting me to a couple of charges that were being made in real time. And so they were at Whole Foods. And so it's like 7, 8 o'clock in the morning, and I, I called my wife, and I'm like— because we share cards— and I said, hey, are you at Whole Foods? She's like, no, why? I go, because I just got a couple of alerts from American Express that there were a couple of charges on the Amex at Whole Foods. She's like, well, that wasn't me. I haven't been to Whole Foods in months. So I called American Express, and they were like, yeah, this, this is fraud. So they took the charges off, and they sent me a new card because my card number had been compromised. So it's likely that my card number was in a data breach somewhere, and so they, you know, canceled the card and sent me a new card, and, you know, all was well. But the fact is, is that those charges were like $18, $19, and I don't think that I would have refuted it if I was just relying on my paper statements every month to look at those charges. Because it's short money to begin with, and we go to Whole Foods. So it's that real-time notification that really sets it apart to let you know— well, let me know when those charges are occurring in real time. That gives me an opportunity to just to dispute it. Peter, what are your thoughts on that?

No, that's, you know, that's, uh, fantastic. I, I have, uh, my son-in-law uses push notifications, and, uh, I actually have— I've been procrastinating, you know, like a lot of us do for procrastination. I really truly believe, as you've mentioned, it's a great resource, and I'm definitely going to do it across my credit cards. Because yeah, I mean, you can say, well, we're still protected, right? If, if, if we have a fraudulent transaction and if we report it to the credit card company, the credit card companies have really good, uh, systems in place with algorithms that will usually pick up on, you know, fraud over a period of time. But it's possible that something can get through them, and if you don't catch it and report it to the credit card company within— I don't know if it's 30 days or maybe 60 days— you're out of pocket, you know.

Yeah, it's not 60 days. It's 60 days based on what's called Regulation E, right? But here's the thing, like, studies show that as many as 9 out of 10 people don't actually check their credit card statements at all. They just— they pay the minimum or the maximum balance And they end up paying for the lifestyle of an identity thief if they don't catch those specific charges. I know in my life, we sometimes spend as much as $10,000 a month on our credit cards because we funnel every single charge that we possibly can through our credit cards, insurances, gas, food, month-to-month payments for various utilities and so forth. And we have what I call lifestyle credit cards. Lifestyle credit cards are, uh, cards that facilitate points for travel, in my case, because I travel on business. And so whether it's airline points or hotel points, my lifestyle cards benefit us as a family when we travel and give us significant discounts and/or upgrades and/or free nights and so on. So I suggest people do that. Uh, and if you have push notifications, it can keep your um, you know, cards that much more secure, essentially reactively, should there be fraudulent charges. So Peter, I expect that your cards are going to be, uh, set up with push notifications in the next day, right? Before we—

before our next podcast, they will be. But I want to add something to it, okay? You know, the, the lifestyle credit cards with the points in there, that's a, that's a good, uh, incentive, a good value added for why we would use the credit card. But there's another really important reasons why I think credit cards give us leverage in disputed transactions. Because if you were to buy something and pay by check, or just by PayPal, or whatever, another means of the credit card, and there's a dispute, you really don't have leverage. But with a credit card company, you got the backing of a real big organization that if you dispute it, they're going to be the face, they're going to approach that merchant. And most of the time, unless you don't have a valid dispute, they're gonna, you know, they're gonna take care of that for you. So it's a great peace of mind also.

I agree with that 100%. Okay, so, um, check this out. So Apple will report images of child sexual abuse detected on iCloud to law enforcement. This is via CNBC. So Apple will report child exploitation images uploaded to iCloud in the US to law enforcement, the company said on Thursday. The new system will detect images called child sexual abuse material CSAM, using a process called hashing, where images are transformed into unique numbers that correspond to that image. Apple says that its system is more private for users than previous approaches to eliminating illegal images of child pornography because it uses sophisticated cryptography on both Apple servers and user devices. So, couple things. Number one, Apple has access to your photos on iCloud. And of course we know that, but did anyone know or think that Apple had the capacity or were even interested or were scanning or were looking at your actual photos to determine what was going on there? Um, what most people don't know is that both Microsoft and Google already have been doing this for quite some time. That this isn't necessarily new information. It might be new to some of you, but it's not new, and the big, uh, data companies have already been doing this.

Okay, Robert, what concerns me— I mean, I think it's— I mean, anything to be able to, um, reduce child pornography, I think is a great thing. But my I guess my concern is why come out and publicly expose this or talk about it when at the end of the day, all you're doing is with the individuals who would be maybe utilizing Apple iCloud to store photos, they're going to look for alternative means. They're, they're not, they're not going to stop. They're not necessarily going to be catching so many people. The people that are really into it are going to— I mean, what, are they going to go to Android? Are they going to go through some other means? Uh, they're still going to be— they're still going to be dealing in child pornography. It's just that now that they know, oh, how to do— how to navigate through this and not get caught— I mean, I'm not sure if the reason why Apple is making this a big announcement is more for PR, because they're kind of like— they're kind of exposing it to what a child pornographer would now try to avoid.

Yeah, the bad guy in this case, the pornographer, is just going to go further underground.

Right, exactly.

Yeah, and, and, and so there is, you know, um, there's a term that I'm sure you're familiar with, it's, you know, security through obscurity, right? Uh, in this case, you know, the security through obscurity, uh, would be, you know, uh, not talking about it, um, would be better in this case, uh, so that the bad guys in this case were unaware of it, right? Um, and they're unaware of that technology. And so, uh, you know, Apple bringing it to light, I don't know why or where that comes from or what data might have leaked that might have, uh, facilitated that level of PR. Um, but, uh, that being said, you know, um, hopefully the bad guys in this case aren't, you know, reading the news. Uh, but if more than likely, uh, you know, those in the child pornography business or world will be telling each other, hey, if you're using iCloud, man, you might want to, you know, stop because they're paying attention and they've got backdoor access to your information or to your photos. Um, you know, look at— like you said, I am perfectly okay with giving up privacy in this case, um, so that in this case Apple or Google or Microsoft, uh, can, you know, do their job to let law enforcement know that this particular individual is, um, you know, harboring child pornography, right? You know, and the sad aspect of this is that, um, I remember probably at this point, uh, 11 or so years ago, I had sent my dad some pictures of my daughter in the tub, right? You know, naked pictures of my daughter in the tub. And, um, he was like, you gotta delete that. Like, you gotta get that off your phone. Like, that's— you can't do that. You know, like, that's just wrong. Like, it's too much. Like, you can't have those photos. And, and, and I, and I, and I thought about it, and I was like, he's right. You know, like, I can't do that. And I remember as a kid, you know, as a child, I mean, I probably still have pictures of myself as a baby that my father gave to us when we, you know, got older because he, you know, no longer needed them, I guess, or wanted us to have them of us in the tub, really in the kitchen sink, in the kitchen sink naked, you know, because that was like a traditional thing that you did with your kids is you would take pictures of them with the, with the instant camera, whatever it might have been, uh, and you know, it was a normal thing. Now it's just not. Yeah, and it's kind of like a lost art.

It is. So it's interesting to see what happens, but there's a lot of, I guess, opposition to this, uh, for people also who are concerned about privacy, right? So it's going to be ongoing discussion.

It is. And but you know, it is one of those necessary tools because there's a lot of just weird people out there that this is what they do. Okay. All right, so Peter, um, couple more things to talk about. Uh, check this out, right? So this is via Axios: in-flight tension— in-flight tensions at historic high. So, uh, flight attendants are having to handle hostile passengers at unprecedented rates. Why it matters: travel is rebounding in pre-pandemic levels. But the pandemic is not over. Like many other service sector workers, flight attendants are on the front lines of public interactions as they now need to enforce mask mandates on top of regular safety procedures on board. They're also feeling less safe doing their jobs. By the numbers, more than 85% of 5,000 flight attendants surveyed between June and July said they've had to deal with unruly passengers. Close to 60% said they've had to deal with at least 5 incidents, while 17%, they have experienced a physical incident. What is that?

Almost 1 out of 5 of the surveyors announced that they've extended their ban on selling alcohol. They're not going to sell alcohol on their flights for— I don't know how many months they've extended the ban.

Who said that?

American Airlines announced that.

You know what, I can't blame them. You know, of the surveyed, 84% said they've experienced unruly behavior during a flight. So what they're saying, incidents of unruly passengers on aircraft are so high that they continue at this rate, we may see more incidents in this— in, in one year alone that we've seen in the past. And they said we have seen more incidents in one year than they've seen in the entire history of aviation.

It's, it's crazy. I mean, It just seems there's a— the problem is bigger. The problem has to be with individuals not being able to really— I wouldn't say about self-control. I mean, we all get angry. Over the last few weeks, there was two different flights that my wife and I took. We actually missed the first one because it took over— I won't say which airline, but it took over 2 hours just to check in the suitcase. We missed the flight. In the other case, it took over an hour and a half to get through TSA, and my wife almost missed the flight. So in those circumstances, you're stressed out, you're angry, you are angry. I mean, I can see people getting really upset, but getting angry and/or getting inebriated, am I still going to go to the point of where I'm going to get physically violent with somebody? I mean, to me, I just don't— I don't get how how so many people seem to have this problem. And then, so what's the solution? Do airlines ban them for life? I mean, if they had that policy, I would think people would think twice before doing that, but I don't know. Is it just so simple as this?

I saw, I think very recently that the FAA has levied as much as $500,000 in fines. Against people that have acted out on, uh, flights.

And total, not, not, not incident. Like, an incident might be 10,000 or 15,000, right?

In total, right? Which is significant, you know. Um, so, uh, because what, that, that, that's 2,500 potential— I think they— the number I saw was like 2,500 incidents where passengers were acting unruly and in many cases had to be restrained, removed, in some cases duct taped to their seat. Um, safety, security, and self-defense of flight attendants becomes a necessary tool for risk mitigation, says Security Magazine. Look at this. Boils down to a couple of things. It boils down to adults acting like 2-year-olds, you know. I mean, look at the past 4 or 5 years has given a significant part of the population just reasons to just do and act as they feel without taking into consideration that you are an adult and we have basic norms of behavior that simply, you know, need to be recognized. And people are just acting out as if what they've seen and heard others do, sometimes in a position of leadership, is okay. And it's just not. You know, basic decorum 101 is that you just follow the golden rule. You treat others as you wish to be treated, you know, and you just show basic common sense and decency regardless of what your politics are regarding the rules. Okay? All of the ridiculousness revolving around vaccines and masks and freedom, right? People are looking at freedom as, "I can do whatever I want when I want, and I could just be able to speak my mind and do what I wanna do." And it's like, well, Not necessarily. I mean, there are rules for a reason, there are laws for a reason, and freedom does not mean that you can do what you want when you want. That's why we have the rule of law. And when people don't follow it because they're confusing freedom with how they feel in what they think is right. We have rules in place for a reason, and people just think that rules don't apply to them, and they've just forgot basic decorum to begin with.

Yeah, I thought that, um, our main concern with aircraft— I mean, with the aviation safety, other than the aircraft being safe, we were concerned about terrorism. Now, you know, that's what TSA was there for, right? To make sure that Nobody was going through with something that could be utilized in a terrorist attack. But now it seems like they almost got to get into the minds of some people and see about whether or not they're a little bit unbalanced when it comes to these particular cases because it's just ridiculous. It's not just the airline that's impacted. If they have to divert a flight, it means a lot of money. But all of those passengers that all of a sudden now their travel plans have been disrupted. You know, it's just amazing amount of people that are impacted just because one person had a bad day and wanted to express themselves.

Yeah, look at, you know, I— the reason why that I— that we're bringing this up, that, you know, is because number one, you know, many of us fly and none of us want to be subjected to someone acting out, whether under the influence of alcohol or not, they're just having a bad day. Um, you know, regardless of those reasons, Look at Flight 93 went down because someone introduced violence into a flight that ultimately led to dozens and dozens of people being murdered as a result of, in this case, someone's political views, right? Terrorist activities, right?

Right.

And it's— and it is entirely possible that something like that could happen on a domestic flight because an angry American didn't want to wear a mask, or they were just upset because they were uncomfortable or weren't getting enough alcohol. Like, that's entirely possible. And so you and I, as, you know, uh, business travelers, right, need to get on a flight today and look around the perimeter of our body and determine if there's somebody that is could potentially act out and what you and I might do to stop them from charging the pilot should the pilot decide to go to the bathroom, you know, because they're upset because they don't want to wear a mask or they, you know, for whatever reason, you know, like with 2,500 people being cited, you know, more so in the past year than in the history of aviation. That doesn't look good for any of us who board a flight, and that, that is something I think to be worried about.

Well, I agree. I don't think— I think another issue here is that the, uh, who has arresting authorities? I don't think the Federation— that the, uh, FAA doesn't have arresting authorities, right? The only way to really arrest somebody, they got to call in the police, maybe when they, when they just land somewhere, to actually arrest somebody. That's why maybe a lot of these things are just fines that are levied versus actual, you know, arresting individuals with— and having them go through a legal procedure, court.

I'm sure it's actually a little bit of both. I think once they get on the ground and they, they are in fact escorted off the plane, often they are arrested and often they do face some form of criminal charges in addition to the fines that are levied against them. But as far as I'm concerned, that is the least of my concern. What happens to that person is the least of my concern. What occurs in flight that could put that flight and everybody on it in some type of jeopardy is what concerns me the most. And so, again, we brought this up because it's important that our viewing, listening audience recognize risk in the air, that whether it's a terrorist or a domestic, say, citizen, that acts out, you know, we have a responsibility to protect ourselves and everybody else on that flight and sitting back and doing nothing these days, it really isn't an option. And so, understanding personal defense, self-defense, knowing how to physically restrain another individual, knowing how to protect yourself and loved ones and other passengers, taking action, being proactive, I think is something that people need to think about.

I agree with you. We can't just put it all on, well, that's the responsibility of the flight attendants. I mean, uh, yeah, it is a responsibility because they will say we're here for yourself, your safety and security. But, uh, but we— and everything that we can do as well can really help mitigate this problem before it spirals out of something that's really dangerous.

Yeah, and that very well could happen. I see that that might be the direction that we— there might actually be a downed flight as a result of, as you know, some stupid person who has too much alcohol or acts out. So, all right, so Peter, um, what do you have to promote these days?

What I have to promote— I'm gonna say I'm gonna promote actually going doing the push notifications, as I promised I'm gonna do that before the next, uh, next time we run this podcast. And good, keeping— I'm gonna be out and conducting. Fortunately, even though we have this COVID and a lot of things are shut down I'm here in Florida, and a lot of the events we have here locally in Florida, for now at least, knock on wood, are, you know, in-person events are taking place. There's a lot of precautions, you know, there's a lot of measures for hygiene and to clean everything and try to have some social distancing and having people wear masks or having people and/or having people actually be vaccinated before participating as a speaker. But A lot of these events, at least here in Florida, are taking place. So I'm happy, at least from that standpoint, and I'm out to be able to get to speak. I just came back minutes before this podcast. I was speaking for— before a group of wealth managers. So that's all going good. I'm— my message, I continue to promote it. Those of you who have not gotten my book yet, think about it. Very interesting. I think Robert can—

the title of your book?

Yes, the, the, uh, book, The Confessions of a CIA Spy: The Art of Human Hacking.

Excellent. And, uh, y'all check us— check out my company's website at protectnowllc.com. We're doing some, um, continuing education training for real estate agents all over the country, and we'll actually do— be doing a program in mid-September for the Texas Realtors. So check that out on our home page. Meanwhile, y'all be safe and secure out there. I am Robert Siciliano and this is Peter Warmka.

Until next time.

Excellent. Be safe and secure out there. And hey, look it, wear your mask. You still have to wear your mask. We'll talk to you soon.