How a Social Engineer Catches Predators | 600 Cases Handed to Law Enforcement

Speaker A: Case for, uh, us isn't one person. It could be a sexting ring, it could be a trafficking ring, it could be a child pornography studio. We're up to 597 cases handed into law enforcement.

Speaker B: In this episode, Chris Hadnagy, the founder of both Social Engineer LLC and the Innocent Lives foundation, shares how hacking psychology and a 16 year journey in social engineering led to countless predators being identified and reported.

Speaker A: I think I was always a social engineer but didn't know it. I wrote this little program that basically would call the number and play this tone. Instead of getting free calls, it told the phone number to kill itself. So I daisy chained two 2800 baud modems and I made thousands of calls in a few minutes and the whole county just went down. So the next day the police come and I'm like, oh, that was me. Really sorry about that. It was a mistake. I spent three months and 72 hours in one time just working on that machine. I broke it. It's a 24, four hours straight. Hacking certification took me 23 hours and like 40 minutes to pass. I bought every book I can find on, uh, neuroscience, brain chemistry, non verbals, body language, influence, persuasion, manipulation, anything that I can find. The work that's being done by the ILF is effectively helping stop one of the worst, most disgusting things that could exist on the planet right now.

Speaker B: Thanks for teaming me up on, on the question. I'd love to know if you could just kind of tell me where the Chris Hadnaggy origin story starts.

Speaker A: You know, it's kind of funny because I think I was always a social engineer but didn't know it. So from really early on I was like, always wanted to have my own business. I remember being in high school and I was running a window cleaning business and I had adult men working for me, right? So they were like, I'd have this tells you how old I am. Had a pager, if you can believe that. So I get pages from these guys, I run to the pay phone of my school, call them like, okay, this your next job's over here. You got to go do this one. I was running a small business, you know, lost my shirt doing that because I really didn't know what I was doing. Uh, then I talked my way into becoming a vice landlord for a 25 unit apartment complex. At 17, the guy was just severely depressed and going through a divorce. And I walked in and he was like chain smoking and looked horrible. And I'm like, hey man, you okay? Poured his life out to me and I Said, why don't you move back to Wisconsin, Go get your family back. He's like, what am I going to do with this? I'll run it for you. He's like, okay. 17 years old, I became a vice landlord for an apartment complex, which then six months later, he's like, hey, I don't want. I don't want to come back. I want to sell it. And I'm like, I'll sell it for you. Like, I became like a real estate salesman all of a sudden. So then I graduated my last year of high school. I started going to college, uh, during that time, and I wrote a war dialer. Uh, and I wasn't. I wasn't. I wasn't on purpose. I was a phone freaker, right? So if anyone knows about that history, you know, that's when, like, Captain Crunch came out with the. The whistle in the box. And then the dude everyone called Captain Crunch, he figured out that that was 2,600 MHz. And that's the sound that a quarter makes when you put it in a payphone. So if you took that whistle to a payphone and you blew it, you got free phone calls, right? So all of a sudden, computers, yeah, computers come out and modems are there. And I'm like, I wonder if I can create the same tone using computers. So I wrote this program, and I basically got every phone number in Sarasota county and put it in an Excel spreadsheet. Back then it was Lotus 1, 2 3, a Lotus 1 2, 3 spreadsheet. And I wrote this little program that basically would call the number and play this tone. Now, my problem was the tone. I was off a few megahertz, and instead of getting free calls, it told the phone number to kill itself. So the shut off for a period of time. So I daisy chained two 2,800 baud modems. That's terrible. I'm really old together. And I made thousands of calls in a few minutes, and the whole county just went down. So the next day the police come. You know, back then there was no laws. So the police come and go, hey, who did this? And I'm like, oh, that was me. Really sorry about that. It was a mistake. And they're like, yeah, don't do that again. That was kind of crappy. And I'm like, yeah, no problem. Sorry. And the dean was like, okay, you're out. And he booted me from college because he's like, yeah, you embarrassed us. Yada, yada. So I'm like, okay, I want to do this for the rest of my life. But then, you know, I'm 18, so girls got in the way. I was surfing. I started making surfboards for a living. And then. It's just a weird part of the origin story. I. I ended up coming up to Pennsylvania, where I'd lived for a few years, to see a friend get married. And at that wedding, 19 years old, and at that wedding, I met the woman who was now my wife. And I said, you know, let me just stay up north for, like, three months, and, uh, you know, I'll see if I can win her over in three months. And, uh. Cause she had no interest in me. She had no interest in me at all. So I quit my job, moved up north for three months, got a job where she worked. Uh, I convinced them that I was a Lotus programmer, and I got that job. And I went to buy Lotus Programming for Dummies and read it overnight so I can be a Lotus programmer. Started the next day. And I just spent all my time trying to win this woman over. And after three months, we, uh, started dating. And, uh, so I just moved up from Florida to Pennsylvania. Took me two years to get her to marry me. Uh, she did not. She even broke up with me a couple times. So it was. That was pretty crappy. But now we've been married 32 years, if you can believe that. So then up north, I became an insurance salesman. Um, I was a chef for a couple years. I became an IT director. I was. I was an international negotiator for stainless steel in India and China. Yeah, I mean, this is crazy, right? And then I'm, um. I'm, um. I'm like, you know, I want to go back to that. That hacking stuff. Like that was a lot of fun. So I'm looking for a course online. And we were broke. We were newly married and broke. So I'm like. We found this company called Offensive Security, and they had this thing, pen testing with Backtrack, and it was $350. And I'm like, I'm gonna.

Speaker B: That's a lot of cash when you're broke, though, man. I mean, that's a big bet on yourself, right there. It is when you're scraping together, you know, it was.

Speaker A: But my. Yeah, my wife always supported me in these things, So I bought this course, and I got addicted and offsec, if anyone's interested. The way they do things is different than everybody else. They. They have a lab online that is just made up of every computer, printer, everything you can imagine, all virtual machines. And you don't just read, you actually learn how to hack those machines. So you take the course and they teach you how to write an exploit, how to fuzz things, how to break into Windows, how to break into Linux. So I, I was like immersed in this, like working at the day and then spending almost all night hacking away three months. Um, there's one machine inside that lab that the, the owner of the company had created this machine to be virtually unbreakable. And I took that as a challenge. So I spent 72. I spent 70. I spent three months and 72 hours in one time just working on that machine. I broke it. And after I got in, the owner pinged me. I guess he's watching the network and he's like, hey, you want a job? I'm like yes, I would love to work for you. And he's like take the cert and if you pass, you got a job. So I signed up for the cert. It's a 24 hour straight hacking certification and you have to hack these three things that you've never seen before and you have to write a fuzzer, write all this stuff. It took me 23 hours and like 40 minutes to pass. Like it was terrible. I was sweating bullets. So then he says, okay, come to dc, I'm going to be there for a conference. I met him, he hired me. We're writing exploits, we're doing training, we're doing pen testing. And I'm fascinated by stories like Kevin Mitnick and Victor Lustwig and Frank Abingale. And I'm reading these things like Victor last week, you know, 1800s, Frank Abingale 1950s, Kevin Mitnick 1990s. But I'm saying their, their attacks are all the same. They're all psychology of human, but they haven't changed over hundreds of years. So why aren't we testing this? So I said to, to my boss, why aren't we testing this? He's like, I don't know, why would it work? And back now we're talking like 2003, 4 or 5. There are no words like phishing, vishing. There's none of that. So we go to this guy and uh, a company we were pen testing and I said hey, can we try emails and some phone calls? He's like, why would that work? And I'm like, just want to test it. He's like okay. Literally my very first phishing email was this. Hey, this is Paul from it. You have a problem with your IP address. I need to have your password sent me the password I was like, what? What the heck?

Speaker B: This is an actual phone call you made.

Speaker A: That's a phishing email.

Speaker B: Okay? You sent the phishing email to someone?

Speaker A: Yeah. So then I try a phone call, and I go, hey, this is Paul from IT um, your DNS is exploited. I need to have your password to fix it. I mean, these words make no sense, right? And the guy goes, okay, here's my password, man. Please fix it. I don't want to have my DNS problems, right? And I'm like, bam. Okay, so I write this report, and this is what changed my whole life. Now, this is 2007. Um, I write this report. The boss calls me in, and he says, okay, Chris, uh, so you did it. How do I fix it? And I said, beats me. I got no clue. I just hacked stuff. And he said, this is the thing that changed my whole life. He said, if I went to my auto mechanic. And I said, what's this noise? And he said, it's your brakes. And I said, fix it. And he said, I don't know how. I'd never use that auto mechanic again. And I'm like, ooh, that's a really good analogy, sir. So I, um. Look, you noticed. I mean, you can't see. There's like 15 shelves. I have hundreds of books. I bought every book I can find on neuroscience, brain chemistry, non verbals, body language, influence, persuasion, manipulation, anything that I can find to read. And I was reading them and making notes, right? And, like, maybe one of the most influential books for me was, uh, Robert Cialdini's Influence. And I'm reading this book and I'm going, oh, my God, I understand why this works now. So I. I call the guy back. It's like a year now. I call the guy back, hey, I want to try a phishing email, but I want to tell you why it's going to work. So I write an email with influence of authority, and then it works. And I go back to him. I go, it worked because this person was too afraid of an authority figure to say no. So he complied. So here's what you can do to empower that person. Bam. Light bulbs went off. So my boss says, dude, you got to put this framework online. And I'm like, no, no, no. No one cares about this stuff. And he's like, no, this is really good. So I bought social-engineer.org. you can believe that it was available. And then I put my framework online 2008, and, uh, overnight, it went viral. Like, I wish I can say I was a Genius. But this was, like, a happy mistake. I get a call from Kevin Mitnick's publisher, and she says, I want you to write a book. And I went, I am not an author. No way. And she's like, no, you have to do it. No one has put science behind social engineering. You have to. And I'm like, okay, I'll write the book. So my first book, Social Engineering the Art of Human Hacking. Don't read it. It's bad. Uh, it's really bad. But came out in 2010, and I am getting calls from all over the globe. Literally all over. Can you come. Can you come speak? Can you do training? Can you help my company with social engineering? So I come home and I say to my wife, I want to quit my job, and I want to start a company that does only social engineering. So she says, well, how many people do it and how much do they make? And I'm like, nobody does it right now. We'd be the first. So I can't answer the second question. And she's like, uh, I need to think about that. So at the time, she had just had our daughter. I was the breadwinner. So it was a big ask. But, you know, she thought about it. She says, okay, let's give it a try. That was 2010 when I started this company, Social Engineer. And we've been doing this now for 16 years. And I've written five books. So I, uh, know it's a long. It's a really long answer to your question, but that is my origin story.

Speaker B: Thank you. Thank you. That's. That's exceptional. That's. That's a crate. That's a, uh, that. That's a hell of a story. There's no way around it. That's a really great story. Goodness. So where do we start from there? Let me think. So, you know something I was looking at as I was researching. Did I see that you wrote a version two of that book recently?

Speaker A: So my first book was this Art of Human Hacking. Then I wrote a book with my. One of my mentors, Dr. Paul Ekman. He recently passed, but he is like the grandfather of all nonverbal research in the world. And somehow I was lucky enough to convince him to co author a book with me about how scammers and con men have used facial expressions and non verbals to con people over the years. Uh, my third book, I wrote about phishing. I had a patent, a very early patent on phishing, and somebody, uh, tried to steal it. So I was like, hey, screw this. And I put the, I put the patent in the book, wrote whole thing and put it out for the world to have it for free. And then my fourth book was the rewrite of the first one, so it was called Social Engineering the Science of Human Hacking. And then my fifth book, I kind of ventured out of infosec and I went to leadership and communication. So I wrote this book, Human Hacking. When friends influence people and leave them feeling better for having met you. And it's all about the skills that I Learned in the 16 years of doing this that you can use in everyday communications, leadership, parenting, whatever you want. How these things actually can make you just a better person.

Speaker B: I like that. Are they both for a similar audience? Like kind of the everyday Joe, or is one of those more technical than the others?

Speaker A: So the, the fourth one, Social Engineering, the Science of Human hacking, that's pro. That is for the infosec industry. People who want to do this for a living, who want to go and pen test people or be a social engineer. The fifth book is for everybody. It's anybody who wants to learn these skills for any purpose, hopefully not nefarious. That book is for. Is for them.

Speaker B: Okay, I like that. I'll put the links to all those in.

Speaker A: Uh, thanks.

Speaker B: Yeah, of course. I mean it sounds really interesting. I, I was actually anyway, I asked that question frankly a little selfishly, I'm super zero. I'm zero technical. But I was looking at your books as I started and I was like, I'd like to read one of these. Uh, but you know, I'm probably not going to read five, but I would like to read one. And so, you know, now I have my answer of which one would be the right one for me.

Speaker A: Yeah, the fifth one would definitely be the right one because the first one again is just too old. It's like 16 years old now. The second one is really only about non verbals and some of that science has changed. The third one really only applies if you're going to be running a corporate fishing program. The fourth one is the most technical for people in this industry, but the fifth one is abroad for everybody. So that's. I would just go with that one.

Speaker B: Um, I love it. What is it about? I feel like there's some irony in that you wrote a book on fishing and had a patent on it and then someone tried to steal it. Is there a. Was it. Were they still trying to steal the material or the patent or.

Speaker A: Yeah, so I developed. I. One of my first jobs was uh, uh, for this company was I Got hired by a really large organization to run their phishing program. And when they came to me, they said, look, we're very advanced. We do phishing every month. But we need to level it up. We need to figure out how to get people to report more. So my job was like, literally to think about how can we do this, to make it so people want to participate. So I had to create processes. Uh, so we. I created a levelized phishing system that had three different levels of difficulty that people can graduate to and a reward system for doing the right thing as opposed to a punishment system for doing the wrong thing. And in three years, they noticed a 76% reduction in malware on their network, actual malware, because people were now reporting the phish as opposed to clicking on it. So when that happened, I went, oh, I'm going to patent this. This is unbelievable. So I patented. And at that time, phishing sasses were coming out, and one of the popular ones tried to build my patent into their SaaS. So I'm like, you know what? Okay, here you are. The world. Now everyone can have it. So there it is. And I just put it out there because I was like, you know, uh, if this helps fix. If this helps even a little bit with the problem, I'm okay with that. And I put it out there for free.

Speaker B: I, uh, might be making a jump here. Please correct me when I am. Uh, but I. It seems like we're seeing, like, just a little foreshadowing maybe of, uh, of this idea that, hey, there's a. There's a greater problem out here and there's a problem out here that's bigger than what I want, than just me. And, you know, we're going to, we're going to share some information and do some things to. For the greater good, so to speak. I don't know if that's the right

Speaker A: word, but I mean, I mean, you know, this. Like, let's make believe every company that needs social engineering came to me. I couldn't handle all that work, right? I couldn't handle it. Like, it's impossible. I don't have enough people time in the day. Um, there's not enough people for me to hire quick enough to do that. So when I started this, I was literally the only one doing it. I created processes and, and, uh, and services around it and then trained people. Uh, so that way there is competition. Now, not everyone does it the same. You know, I would say, uh, my company has a very high level of ethics. Like, we don't Use fear. Uh, we don't use, uh, anger. We don't use people's livelihood to force them into things. We don't use flirtation or sex. Um, we don't use extortion. I know some of my competitors do. To me, my goal is to get your people so they want to learn. And it's like if you came to me and you said, hey, Chris, I want to learn how to box. And I heard, you know how to box. Can you teach me? And I went, sure, and bam. And I punch you right in the face, you're going to be like, I don't want to learn from you. You look like you're a moron. Like, you. You just hit me, man. So when a company comes and says, hey, I want you to, want you to teach my people how to recognize phishing, and you come out of the gate and just throat punch them, no one wants to learn from you. And that's about your ego. That's about you needing to win, not educating the person. So when you do this in the right way, it is about the greater good. I want to teach people because if I do it right for you, Jeff, you're going to go home and you're going to teach your kids, your wife, your partner, your grandma, your mom, dad, you're going to teach them all the things you just learned because you're like, oh, this saved me. But if I humiliate you, you're not going to do a dang thing about that. You're not going to want to learn. So I find that we get more compliance when you treat people with dignity and respect and when you, uh, when you really work hard to educate them.

Speaker B: Wow, that's cool. I like that. Thank you. I fully agree with that approach, by the way. I think, I mean, if you can do something with kindness, uh, and have the, you know, 100%, why not, right? So something I was thinking about is about the, uh, you know, back to your books for a minute. These books, they, they ultimately became, I think, you know, somewhat of a fairly widespread framework for social engineering. I mean, it seems like. Can you wanna, can you tell me a little bit about how that transition happened from, hey, I wrote a book or five books even, to, hey, we're gonna use this and we're gonna start developing true, real standardized curriculum around it.

Speaker A: Yeah. Like, this is almost crazy for me to say out loud, but my first book has sold over like110,000 copies. That's, that's amazing. That's ridiculous to me. Like, that's like, tech books just don't do that. Right. And it's because it built a framework for how to understand why these things work. And that was different when everyone else was doing. And, um, look, Kevin, before he passed, Kevin Mitnick was a great friend of mine. All his books were about what he did to end up in prison using this skill. And stories, which are great because that's what motivated me to learn. But Kevin was so good at social engineering that I don't think he, like, when I would sit with him and talk and be like, well, why did that work? He didn't understand the science behind it. It was just like nature for him. He didn't have to learn it, he just somehow knew it. Right. He's just one of those natural people that could just do it without thinking. I had to learn these skills. So I wanted to be able to say, well, if I had to learn it, then other people are going to want to learn it. So it did. It became that first book, kind of created the framework. Then my focus on non verbals really helped the industry to see why this was so important. And then the fourth book kind of solidified it within science. So, yeah, it was. It was an interesting. It was an interesting thing for me because I wish I could tell you, I sat back like I was some kind of, you know, business genius, and I knew this was going to happen, and I planned this all out. I was like, just a lucky moron, you know, that that had a couple great slips and falls that turns into something great. So I. I don't know how it happened, but it did. And here we are today, Right.

Speaker B: Do you think there's something to that, though? I mean, let me paraphrase what I. Yeah, I'm paraphrase it a little bit. Like, you saw one step in front of you and you thought, yeah, this feels like this thing seems like the thing that I should do. And then you did it, and you start getting a little momentum and then just, you know, continuing to take one step, another step and just kind of, you know, kind of go where. Go where you're getting some momentum. I mean, that's.

Speaker A: Yeah, yeah. So I'm. I'm one of those guys that's like, I. I actually shouldn't be a CEO because I hate running a company, but I love to innovate, right? So, um, like, one of my goals. One of my goals for the next couple of years is actually to replace myself as the CEO of my company. I love to create. I love to innovate. I Love to. Like, when I, when we see a bad guy do something, I go, okay, how can we duplicate that with, with ethics so we can train people? I mean, there's nobody. And this sounds terribly arrogant, but there's no company on the planet right now that is doing the amount of vishing that we do. 2,500 calls, human to human calls a month like that is massive.

Speaker B: Wow.

Speaker A: Nobody's doing that. Right. I've sent. Spent over 21 million phishing emails in my career. Right. We're talking. The level of, of data that I have done for this industry is, is unsurpassed. And I love that part. I don't like running a company, so I think what you said is accurate. You know, I, I saw something, I saw a little window and I went, um, let me take that. That risk. And then that paid off and I went, oh, another window. Let me take that. And now, you know, here's this giant door of AI, and we got to run through that one too at this point, because that's the next biggest thing. So we're. There is. You know, like I said, I didn't have a plan, but it did work out well.

Speaker B: Yeah, I'm, uh, glad you brought up AI. I want to, I want to talk about that, but before we do, I'm curious, frankly. I know what phishing is with the P H P H I s, H I N G, but I don't know what vishing is. Can you tell me about what vishing is?

Speaker A: Yeah. So we have the four main vectors. So we have phishing, which is emails, vishing, which stands for voice phishing. So that's phone calls. And believe it or not, that word entered the Oxford Dictionary in 2015 as a real word, if you can believe that.

Speaker B: That's wild.

Speaker A: Yeah. Then there's smishing, which is SMS phishing. So that's like where you get a text message. Um, then there's, um, um, impersonation, which is either breaking in a building in person or impersonating someone on LinkedIn or impersonating someone on a social media. Um, and then there's a new one, which again, this is not me, but they came out called quishing, which is QR fishing, so.

Speaker B: Oh, interesting.

Speaker A: Yeah. So there's, there's the main vectors that are used in social engineering. I think everyone likes the ishing thing. So besides impersonation, it becomes ishing after it.

Speaker B: That, that's super. I mean, interesting.

Speaker A: So,

Speaker B: but the QR phishing, what? I mean, so. Okay, so let me think through this. My mind's spinning for a second. So I'm thinking for, like, if I was looking at a phishing email, I kind of know the things to look for, right? You know, you look for misspelling logos that are slightly off hover over the URL. But with a QR code, that's hard. Because by the. I mean, for me, though, if I'm thinking about this now, if I see a QR code that I want to test, the only way I know how to test it is I'm just going to put my phone up to it, and by then it's basically too late. Like, if I, If I have a split second, I look at the URL that hovers over on my iPhone. Like, maybe, Maybe I get lucky. But.

Speaker A: So, uh, yes and no.

Speaker B: So, okay, yeah, tell me through it. That's.

Speaker A: Yeah. A lot of QR phishing attacks require you to install an app. Like, I'll give you one. That happened right after Covid, right? So Covid came out, and we got used to using QR codes for everything. There was no more. You weren't touching menus. You were. You were doing it on your phone. So, uh, this attack happened in New York in the subway. Restaurants were starting to open, and they were like, hey, check out our menu. We're open now. And someone put a qr, A hacked QR code over it, and it asked you to download the menu, and it was a program that you had to install, and that was the hack. But just scanning it didn't get them to enter your phone, Right? You had to install something. Now, I'm not going to say there's never zero, zero touch. There is. There's a bunch of zero touch exploits out there right now. Not many for iOS, some for Android, mostly Windows. Uh, but they do exist. So I'm not going to say it's impossible. Just going to say most of the time, QR attacks want you to install something, and that gives you. That gives them access to your phone. Okay, So I didn't mean to interrupt you. So the rule of thumb for me is don't scan a QR code in an untrusted place. Right? If I'm in a subway that's not a trusted place, if I'm at a restaurant and on the table is a QR code that says, here's our menu. Okay? I can trust that, you know, but I'm not going to do it on the street in the subway. Hey, you want to, you want to. You want to see my website? Scan that? I'm not. Nope, not Unless I know you, I'm not doing that.

Speaker B: Okay, that's, that's a good. I think that's good. I mean, and they feel like that applies so much to other things too. Right? Just trust everything. Yeah.

Speaker A: Yes, to everything. Especially today. Especially today with AI.

Speaker B: Yeah. So you mentioned that you're an innovator. And then we also. You just enjoy innovating. That's what you said. You said you enjoy innovating. So I'd say that's an innovator. What. And then we talked about AI. What are you, what are you excited about? Innovations that are coming or that you think that are either you know, kind of on the horizon or you think we, we need to be working on.

Speaker A: So right now the, uh, the fight with AI is far surpassing the um, the defense. Right. So the offense with AI is just, it's, it's 150% deep fakes, cloning, all of that is just so easy and so simple, uh, that you really don't need skill to do it anymore. So the attack surface is massive. What we don't have is the ability to detect and defend. So what I'm excited about is my company is working on some of these things because again, like I said, we have such a m. Massive data set from all the attacks that we have done over the last 16 years. And I've saved all this data that we can use that to now train models to be able to detect deception, to be able to know what a vishing call sounds like, know what a smish looks like, know to scan a QR code and sandbox it and see if it's bad. When we're working on tools to help with the defense of social engineering attacks because the, you know, I remember when I first started on all of this, you had to really have skill to exploit something. Like you had to know how to write shellcode, you had to know how to plant things in a, and fuzz a program and figure out where the jump spot was to put the code in there. Now you don't. On the dark web, you can, you can buy fraud GPT for €1800 a year and it will write you exploits, it will do phishing emails, it will scan websites for, for malware and plant malware. It will give you vishing scripts, it will literally do the hacking for you. You just point it in a direction. So you no longer need skill. All you need is a little bit of money. And if you look at threat actor groups, I think a researcher, uh, I don't want to misquote But I think it was black Basta. I think that a researcher did the count on what they were paid, and I think it was 104 million last year. Last year. So this is a group of, I don't know, young guys and gals around the world that now have hundreds of millions of dollars to do whatever they want, buy whatever tools they want. It's, it's literally unstoppable, you know.

Speaker B: Wow.

Speaker A: Yeah.

Speaker B: So with all these tools and it's, you know, the ability for hackers, for, you know, non, non ethical hackers to try to exploit people. I mean, almost without, you know, without limitations of scale, just only defined by money for what it sounds like. I mean.

Speaker A: Yeah.

Speaker B: How do people keep themselves safe online?

Speaker A: Yeah. So this is kind of like what we were saying before, that the new rule has to be verify everything. Everything, right? So like I'll give you an example. Right now there's a scam going around called the kidnapping scam. So, uh, what they would do is look for, you know, videos of your young daughter where her voice is there. They clone her voice, they clone her phone number. They call you from that number in the background. You hear, daddy, help me, daddy help me. This guy says, I'm going to do something bad to your daughter unless you, unless you sell me money or cash at me money while we're on the phone and you're like, all I have is like 10 grand. Okay, well that's what I want. So fear, you do it. And then, and you see her number, you hear her voice, it shuts down all critical thinking, right? And you send the money. And then, you know, moments later, of course, you call her and she's safe. It wasn't really, she's no danger. There's number of cases in this country that this has worked on parents. So I'm sitting there saying, okay, how do we, how do we do this? So I made a code word with my daughter. It's a word that I'll never say to anyone else. She'll never say to anyone else. It's a word that we don't normally use ever. And I know that if that scam were to happen, I say ask her the code word. And if they don't have the code word, I know it's fake. And I told her, if you're ever in trouble, you text me that code word and you send your location. I will move heaven and earth to be there. So we have a word, we have verification system, a human like MFA basically, that will keep us safe from that scam. When my grandma was around, I did the same thing with her grandma. Here's a sticky note. This is our word, right? You know, let's just say it's flamingo. If I call you and I you, someone calls you and says, I'm so drunk and I'm in jail and I need money for Bailey, what's the code word? And if the person doesn't know it, if it really is me and I'm too drunk to remember, let me sober up in jail. I'll call you back when I'm sober. But if I don't give you that word, you don't send a dime, right? So we did. We create processes like this nowadays to where if I can't verify that it's true, I automatically default to don't believe. Right? Because you could see a video on a social media that's completely deep faked. You can hear an audio that's completely fake and it sounds like it's real. I mean, during the last election, um, hacker group made tens of thousands of dollars calling a Democratic, ah, state with Biden's voice, asking for donations to his campaign and giving a URL. And people were donating money because they did, they couldn't, uh, they could verify. I'm like, look, if you're, whatever, Republican, Democrat, whatever it is, if you really want to donate to that party, go to the official website and donate. Don't do it based on a phone call, right? Like do it on the official website. I tell people that even with charities like, you want to support my charity? Great. Go to the website and do it. Not because someone pinged you on LinkedIn or someone called you on the phone with a URL. Go to the official site and do it. That way you know your money's going to where you want it to go.

Speaker B: I think that's good advice. Wow, that's slightly terrifying.

Speaker A: Yes, I think it is very terrifying because now they don't. You know, one of the things that's happening with our teams in this, actually globally, not just this country, but, um, is something called sextortion. So one of few things will happen either they, they will use nude pictures that they got from, let's say a young girl and they'll chat up a boy as if they're that girl. They'll get the boy to exchange photos or videos and then they'll tell him, I'm uh, not this girl, I'm a 38 year old man in Africa and you're going to go steal money from your parents or I'm going to release this video. And they actually tell them there's only two ways out of this. One, you do it, or two, you kill yourself. And there have been a rash of suicides in this country because young men don't normally go for help, so they commit suicide. The second thing they do is sometimes they use deep fake technology to take a photo of a clothed person and put them in a sex video and then they extort them. I'm, um, going to release this and no one's going to know it's not you unless you steal money from your parents or unless you do this or that. And the year and a half ago, DHS opened up a special division just for sextortion, uh, focusing on the Ivory Coast. That's where a lot of it comes from. In one day, they had 4,000 new cases in one day. So this is, it's not just a little bit scary. This is a lot scary because the very skills that I use every day to help educate companies is the same exact skills that these people are using to harm our kids, to harm our, our, uh, daughters, our girlfriends, our wives, our, our sons and everybody.

Speaker B: Wow.

Speaker A: Yeah. Sorry. Dark.

Speaker B: No, thanks for, thanks for going there. I'm just thinking about this. I mean, look, this are,

Speaker A: this is

Speaker B: important stuff to, to, to be aware of, you know, so, you know, something I was wondering of is when would you say that kids are old enough to, you know, I love this idea of a two factor authentication, effectively. Hey, what's the code word? Like a legit code word, um, that only you know, only you and you and the person know. How old would you say that people could or should start doing something like that with their kids? Because I feel like there's a balance. Like you want to keep your kids safe, you also, you want to let kids be kids. I don't, I don't know. Is there an age? What do you think?

Speaker A: Uh, there is. I think if you, when you decide that your child is going to have a cell phone, that's the time.

Speaker B: That's a.

Speaker A: When a child is going to not be at your side 24 7, like maybe their first sleepover. Right. They need to, they need to have the ability, if they feel unsafe in that house, to have you come and order them to come home without them having to ask. Right? So we would have this, the same thing with my daughter. If you're at this house and this, the dad there makes you feel unsafe, you text me the word, I will call that house and go, hey, my daughter's in trouble. I need her to come home right now. I'm coming to pick her up. Tell her to pack her crap now. She's not, she's not the one to blame, right? So the dad doesn't know that she reported anything. And I'm at that house and I'm, I'm um, I'm picking her up, right? It's, you have to these kind of conversations. You don't need to sit your five year old down and tell her the thing I just said, right? You don't have to. But kids at appropriate ages need to know right now the average age, if you can believe this, for a child first seeing pornography is 8.

Speaker B: 8.

Speaker A: And also the first time they try marijuana is 8. So if you think that your 7 or 8 year olds are too young to have this conversation and it's not because most 8 year olds have a cell phone and some parents aren't talking to their kids about pornography and you can find pornography anywhere, you don't even need to search anymore, right. It's out there for free. So kids are being exposed to this content, which again, this is really dark. But if you look at the science, sexual violence against women is linked to early age pornography viewing. Because pornography teaches men that women are just here for our pleasure and that they enjoy all these horrible things that they see in these videos, that it's actually fun for them. And boys that grow up on that think, well, this is what women want, so they treat women like objects. And uh, so having that conversation is vitally important to tell our sons, this is not an innocent little thing to go look at porn. It's not innocent because it will train your brain to view people differently and to not have respect and not have empathy. So, uh, I think from early on we got to teach our kids, like if someone tries to show you this, you got to be, no, I don't want to see that. That's, that's going to ruin my brain. Because that curiosity is going to be there. Come on, we're guys, we know where we all grew up. You know, I mean, I grew up in a time when there wasn't the Internet. We had to go steal Playboys or something. But we all had that curiosity. So, um, we gotta find that balance with our kids, you know?

Speaker B: Yeah. And girls are curious too.

Speaker A: Yes.

Speaker B: I mean, yeah. So you're absolutely right. Yeah. Wow. So something that stood out to me just now is you, you mentioned a couple times, like, that's like a, there's some, it can feel like a little bit dark when you uh, when you, when you talk about topics like these, also interestingly enough, not interesting enough. These are also things that I think everyone wants to protect their kids from. Yeah, but, but I think not everyone is willing to shed some light in dark corners.

Speaker A: I think a lot of people don't know how to have these conversations. Right. Like, I mean I grew up in a generation where your parents didn't talk to you about sex ever. Right. I mean it was like a no go. So yeah, like the first time I heard about this kind of stuff was, you know, I'm already uh, a young adult. Right. So some parents are afraid to broach those topics with their kids and some parents don't know how. So you know, like uh, at ah, the ilf, at my nonprofit, I'm sure we'll talk about that. We have whole pages dedicated to how parents can speak to their kids on these topics at age appropriate levels. Because how you're going to talk to your 13 year old, not the same how you're going to talk to your six year old. Right. But kids need to feel empowered that if someone tries something, here's the actions you can take and there'll never be repercussions if you do something like we would tell our kids, look, somebody talks you into sending a nude picture, okay, tell me, I'm going to be a little disappointed. Yes. But I can help you fix it as opposed to if now that guy is forcing you to do something because he has this picture of you or he's humiliating you by sharing it with friends, tell me. Right? And I'm your advocate, I'm not your adversary. Most kids don't want to because they feel like their parents are going to kill them if they come and say I did this thing. Right. And that's really the parents job is to assure their kids that the first thing you're not going to do is say how stupid are you? M. If that's the first thing out of our mouth, that child's never coming to us again. They need to know that we're the safe space and that we're there to save them from whatever stupid thing they did. Because I'm not sure about you. I did a lot of stupid stuff when I was a kid. A lot of stupid stuff. And I wish I had a parent that was willing to be like, come and talk to me, we can fix it. You know, so I want to be that parent for my kids.

Speaker B: Yeah, you're spot on. Do you think those two things that, that fear and lack of education go together because my thought is people are scared of it because they, they don't know how to talk about it. I. I just feel like that's like a vicious cycle, but the more you don't talk about it, the scarier it gets. So I feel like just getting a little education. That right? I mean, yeah.

Speaker A: Yeah. I have a good. A good friend. He's a house representative in, in, uh, South Carolina. And, uh, his son committed suicide. Literally walked past him, said goodnight, went in the bathroom and put a gun to his head because he was being sextorted. And he'll be the first one to tell you that he never spoke to his kids about this topic. And, uh, yeah, it gives me goosebumps to think about it. And, um, now he's an advocate. Now he travels the US Talking to parents about how to talk to your kids, because all his kid needed was someone to say, I'm, um, being threatened. I'm, um, being hurt. And he didn't have that. So now he says, we, you need to tell your kids about this. It has to happen. You don't want to be the parent sitting there saying, I wish I did. If I did, they would still be alive. You don't want to be that parent. So you want to, you want to have that conversation early on?

Speaker B: Yeah, I like the idea of having, uh. So do you think the conversation, the timeline for those conversations, does it go along with what you're saying around, you know, the, the code word? Maybe by the time you get a phone or, you know, external communication when they're not gonna be around you, or does it start earlier?

Speaker A: So for my, you know, I don't know if this is a steadfast rule, but for our family, um, as soon as my daughter got her first piece of tech that wasn't owned by me, like, you know, not that I didn't own it, but it was going to be hers. Like her iPad. She had her first iPad. That's when we sat her down and said I didn't have to scare her to death. I'm like, hey, if somebody ever pings you on this pad that you don't know, or that ask you to go into a chat, you don't know who they are, just tell me. I just want to know. I just want to know who you're chatting with. That's it. And I didn't have to tell her all the gory details. And then it happened. One day, a guy called her on Skype, and he was unclothed, and she came running to me, and she's like, dad, dad, this guy. And I, you know, and I, you know, well, I went, I went off on this guy, found out who he was, where he lived, his address, everything. And, you know, he wasn't a very happy man after that. But at that point now I had to sit her down and say, okay, now let's talk about why that happened. And now the conversation had to go a little deeper because now she was exposed to it. So you have to figure out, like, where are your kids in the entertainment world? What do they do? How, how advanced are they? Some kids, some kids are not. You know, I have a, I have a friend that his, his young, uh, son is on the spectrum. And he has no interest in girls that way. No interest in sex at all. Right. At this point. So why sit him down and talk to him about, yeah, all of that. You're just going to gross them out and scare them. You might make them curious. Right. You don't need to. So you look at your child. Where are they in the advancement? And that's when you decide, how far do I want to take it? Because that's not a one size fits all for every parent and every child.

Speaker B: Yeah, I like it. I think this, what I'm hearing you say is the key goes, uh, back to what you're saying about having the relationship. So where they're not going to. Where they know that you're not going to be upset with them if they, if they come to you, which means that you got to just know your kids. Which comes down to spending time with them and hearing them and just really getting to know them.

Speaker A: And that's before something happens. Right. I mean, I'm having that conversation with my daughter where I would say, look, let's say you're at a party and you drink something, you take something that you know I wouldn't like.

Speaker B: Yeah.

Speaker A: But now you're inhibited and people at that party are getting a little rambunctious. You're feeling unsafe, call me. I will come pick you up. We won't even talk about it. We won't talk about it. We'll get you home, get you safe, getting you sobered up, whatever. We'll have a conversation when you're ready. But your safety is more important than my disappointment. Right. So call like it was all about my messaging to her was your safety is more important than anything else. So just don't, don't take a dumb action because you think I'm going to be mad. Let me be your advocate and let me be your safeguard. That's my job in this world. Right. And that will. I mean, now she's grown up and married. That's not. I said that will never stop. Never stop. If the, uh. Her husband's amazing. I love the guy, but let's say he turned bad one day. I want you to use that code word. I'll come over and kick the crap out of him. Right.

Speaker B: You know, but.

Speaker A: But like that. That should never stop. I want her, you know, when I'm 90, and I want her to still feel like I'm. I'm your safeguard. I'm here for you.

Speaker B: Yeah. That line. Your safety is more important than my disappointment. I think that sums it. I mean, that's so good that that's. And that's just, uh. That nails. That nails it. That nails it how? I think, again, I don't think of a single parent who's having these conversations or who's not, who wouldn't say that your safety is more important than my disappointment. Wow, that's. I love that approach.

Speaker A: And it's really important because I've seen too many times with, um, with kids and with your parents, where the first thing you know, they get hacked. Like, romance scam. I was working a case and. Romance scam. And the first thing her son said to her was, mom, how can you be this dumb? You just ripped her dignity away.

Speaker B: Right?

Speaker A: Not only has she just got scammed, and not only is her heart rebroken, but now her son just called her an idiot. So you might think it, right? You might think it. I remember one time I got into an argument with my daughter. She did something that really wasn't smart, and I'm like, I'm going to walk away because I'm getting angry, and I don't want to say or do something. So when I calm down, we're going to talk again, right? And that was more important to me because I'm. I can blow off and say something really mean. And now our relationship is ruined, and she's not going to come to me next time. She's not going to trust me. So that. That when you say it, when you say your safety is more important than, uh, my disappointment. You have to believe it. It can't just be words.

Speaker B: Yeah.

Speaker A: You have to believe it. And you have to live it when they come to you, because they're going to test you out. One time, and I remember I was on the meeting, sitting here on my computer, meeting with a law enforcement agency, and I get a text from my daughter, and it's the code Word. And I'm like, oh my God. And I said, guys, I gotta go. My daughter's in trouble. And I left the meeting with this law enforcement and she got my car, got her location. She was like a half a mile away. She had fell skateboarding and she was bleeding and she couldn't talk. And I showed up and I'm there within, within a minute and a half. And she's like, that worked. And I'm like, yeah, I told you. Uh, and she's like, well, I thought you were in a meeting. I was, but I told you that word pops up. There's nothing, um, there is no, no work that will exist that is more important than that. I picked her up, scooped her up, put her in her car, we got her home, got her, got her all patched up. And now she knew that I was, uh, that was real. That word hits my phone. That is real. Right. So they're going to test you and you have to, you have to prove to them that what I have to prove to her that your safety is more important than my disappointment is real. It's not just words.

Speaker B: Yeah, right.

Speaker A: They have to, have to know it's true.

Speaker B: Because in that moment, the words will go away, how they felt and those actions will stay how they.

Speaker A: Yeah.

Speaker B: So. Yeah, yeah. How. You know, this, this idea, um, of something you mentioned just now was about how you cut when you were in a moment and you felt yourself, like, you felt yourself getting frustrated. You're like, I'm just gonna walk away. I need to walk away, give myself some space. Like that, that takes, that's a skill, I think, to be able to do that.

Speaker A: I've not always been good at that. I will tell you. I am not, I'm not always good at that. Sometimes my emotions get the best of me, but when I can, you're right. It is a skill because it, it, it could, it could save a situation. It really can. Whether it's your marriage, whether it's your kids, whether it's an employee, whether it's your boss. Right. Having the ability to say my emotions are going to get the best of me at this moment. I would like to take a five minute break and calm down. Yeah, right. If anyone reasonable can't do that, then that, that's not on you at that point. Right.

Speaker B: How did you develop that skill?

Speaker A: Years and years of failing and having a really good therapist. I was a very angry child growing up. I used to fight for fun. I used to go out, like, fight, uh, like we, I was part of like an actual fight club, like that movie. Like we would go at night and fight just, just for the heck of it. I enjoyed it for some reason, like getting hit and hitting other people seemed like fun. So I grew up in a very violent atmosphere. So when I first got married, uh, I was never violent with my wife or anything, but I had a lot of anger, so yelling. I'm also Italian American, so very loud and boisterous. So I had to learn this over time that, you know, this anger doesn't get us anywhere. And I think it was also becoming a social engineer that helped me realize because the first part I always teach anyone in my classes is you have to know you if you're going to influence anyone. You have to know you because you have to know what your strengths and what your weaknesses are. So I know for me, I could be very direct, very aggressive, very blunt, and that's a strength. But it also can be a very big weakness. When I'm talking to, let's say my daughter, who I shouldn't be aggressive and blunt because she's going to take that as, ooh, I'm afraid of you now. I don't want to trust you. So when you know that if you're self aware enough, then you can put stop gaps in to try to control, right? You can, you can try that again. I'm not always perfect at it, but I can talk about it and I know and I'm self aware so I, I can feel when it's happening. And if I can get that control under, under me, then I'm, I'm easily, more easily able to, to, to control that Again, not perfect by any means.

Speaker B: My wife will, you know, I don't, I don't know anybody. Uh, there are a few people that are pretty darn good. But you know, I think just acknowledging it, I like the way that you said that you just first became becoming self aware, acknowledging, hey, this is something I need to work on. And then, yeah, that's big first step.

Speaker A: I remember I fixed this big problem with my wife once. We used to argue all the time because she would come to me with a problem and I'd come up with 10 solutions. And sometimes I'd even start implementing those solutions for her and she would just get mad at me all the time. So I don't know when this was seven, eight years ago, maybe longer. She comes into my office, I need to talk to you about something. And I stopped and I said, hey, before you go, can I ask you, is this a. Just listen to me. Conversation or is this a, uh, I want answers conversation? And she goes, just listen. And all of a sudden it was like, oh, I know my job now all I have to do is just listen. And I did. And I had. And at the end she's like, thank you. And I'm like, that was that easy. Literally asking one question before we have this conversation. And then sometimes she'd even come back later on and go, okay, so now that you listen to it, do you have any ideas? Yeah, here are a few. Right. So it ended like this decade long argument by just literally asking one simple question. You know, how do you want me to handle this conversation? You know, done. I'm like, why did I not figure this one out 30 years ago?

Speaker B: That's it. That's elite level. I, uh, think that's your elite level training. You had to level up a few times to get, to get to that skill. Yeah, that's, that's funny. But what a good story. And also, I mean, because that's, that's something that's simple, but I mean that's not the way I think a lot of, a lot of guys are not wired that way. And so I think that's a good skill to learn and. Good point.

Speaker A: Well, if, if you want to sit here and say, I've been married 30 plus years, you better learn it because, you know, I, I have, I have no, uh, no desire to be married to anyone else. She's my best friend. And if, uh, you want to keep it that way, it's gotta be a two way street, you know.

Speaker B: Yeah, no, that's true. I love that. That's an accomplishment, man, 30 years.

Speaker A: Yeah, it is. A lot of our friends are not. So it's, it's uh, I feel really proud about that because we have a lot of friends that are maybe on their second or other marriage and you know, we pushed through some really hard times, really difficult stuff. And still there. So. Yeah, she's amazing.

Speaker B: I love that. You know something, you were. Well, I don't have a good. I, I. All right, I want to do a bit of a, a pivot here and. Yeah, let's just do a pivot. So something. I'm interested that, frankly, while you were talking about your uh, you know, your conversations with uh, with your daughter and others popped into my mind was the work that you're doing. And, and I don't know if it's OSINT or OSINT or uh, what you call it, what the term is.

Speaker A: I call it osint.

Speaker B: Osint. Okay. So I'M fascinated by this idea of osint, and I wasn't familiar with it, frankly, before. When I was prepping for this interview, I was reading about osint, and I, I did an Internet search for what is osint? So that's my level of knowledge on it, outside of that. But I'm really fascinated by this work. So I was wondering if you could tell me a little bit about that. And then the work that you do in osint, frankly, here's what I was thinking. I'm wondering if there's some open source intelligence gathering that was happening while you were, uh, while you're having these conversations with, with, with, with your family members. Um, but that's here nor there. So anyway, of course.

Speaker A: So osint, like you said, it stands for open source intelligence. So what that means is anything that you don't have to pay for or, you know, break into or something like that. So that could be something as simple as. And I'm sure you've done this, you're going to a new restaurant, you do a Google search. I want to see the reviews. Is it good or bad? That's, that's osint, right? Or it could be deeper, where your son comes home and says, hey, uh, I want to go to sleep over at Johnny's house. And you start looking up his dad, his mom, what do they do? Do they have a record? Are they good people? I've never met Johnny's dad. Now I want to know more about him. That's Osint, right? In my, in my, my corporate work, OSINT is the lifeblood of everything we do. Right? I cannot perform a phishing or a vishing or smishing attack if I don't know about the person or the company that I'm attacking. Right. I have to know what are your hobbies? What are your likes? What are your dislikes? These are the things that will get me to, uh, to, to get success when it comes to, to, to this. Right. But on the nonprofit side, with Innocent Lives Foundation, OSINT is vital because for us to get a law enforcement involved, we can't do anything illegal or vigilante. We're not allowed. Right. So we have to be able to give them a report that shows them how they can duplicate every step that we took legally to prove that Fluffy Bunny is John Smith. Right? They have, they have to be able to do that. They have to be able to make those connections to get a warrant and, and that. So, uh, OSINT is vital for everything I do in my life, really. And then, like you said, with family, Osen can even be when you're observing, watching someone's non verbals. Right. I said something. And did it irritate? Did it irritate you? Did it make you happy? Did it make you, uh, angry? You know, those kinds of things? Those. That's osint. I'm taking open source intelligence and saying, oh, I said something that wasn't really good. So I need to back that up or I need to step back from that. Right. All of that observational skills is. Is osint.

Speaker B: Okay, that. Thank you for that breakdown. So something else I was reading about was that this is. I read that your firm does something that a lot of other security firms can't. That, uh. I'm just gonna read what I read, that you're hiring actors, psychologists, and OC researchers to physically break into buildings and run live campaigns against real employees. Is this. Is this true? Like, can you. Is this some work that you guys do?

Speaker A: Yeah, I mean, I break into. I broke into three banks in Jamaica. Uh, I broke into lots of armed places here in America. Uh, we break into government, um, facilities, banks, healthcare. Yeah, we get paid because, um, a lot of times companies or government organizations want to know two things. One is their security, doing their job for daytime. At nighttime, is their perimeter secure enough to keep bad people out? And what are the protocols? If someone gets caught, they want to know these three things. So you can't let someone internal do it because everyone knows them. So you have to hire external people. So we get paid to go and in the daytime come up with a pretext, what we call, like, an act. What am I? Um, I'm the pest control guy, so you got to let me in because I'm the pest control guy. And then at nighttime, you know, can I crawl over a fence? Um, is there a gate that's left open? Uh, can I bypass that camera? Is this a security alarm on? You know, can I infiltrate the server room without anyone stopping me? Uh, so these questions get answered by actually testing it. If you think about it, it's kind of like you go to a doctor and you say, I don't know if something's wrong, but I need you to do some tests. And he does an X ray, mri, takes a blood test, and he comes back and he's like, okay, here's what's good, here's what's bad. So this is like a physical test for the company instead of the body, where we do all these little probes and pokes. And then we come back and we say, okay, here's where you're strong. Here's where you're weak. Here's what you need to do to fix it.

Speaker B: That's fascinating.

Speaker A: Yeah. If you ever told me I was doing, uh. If you told young me that this is something I'd be doing now, I'd be like, you're nuts. No way. That's how people get shot and dead. Yeah.

Speaker B: Is there. Has there ever been a time when, you know, I mean, depending. I don't know. I don't know, like, the level of security of these places, but, like, if you're in a more secure facility. Has ever been a time when, you know, when you. Let me. Let me ask a question this way. Have you ever. Has ever been an exercise that you've gone all the way through, broken in, done all your stuff, and then left, and then no one's ever, like, there? Like, no security, or. Do you usually get okay? Really?

Speaker A: Yeah. No. Yeah. So I would say the majority of the jobs, uh, we get in and don't get caught. But I did have this one job that. This location, everybody that is security there is ex SOCOM military, and they're all armed with AR15s. So we were like, okay, we gotta be really careful here, right? And, uh, we had called ahead, acted like we were reporters from a local newspaper, and we were coming out to take some pictures of a groundbreaking ceremony. So they put our names on the list, and we had a name of a local newspaper. So now we're in the office getting badges. We're like, this is good. We're in. We're good. Couldn't make this crap up. One of the guards behind the counter is the cousin of the, uh, chief editor at the newspaper we claim to be from. So he texted us like, hey, this is cool. Your reporters are here. And she's like, what reporters? And he snaps a picture of us. We didn't know. She goes, I have no clue who those people are. Next thing you know, we're slammed on the ground, we're being cuffed, there's AR15s. And I'm like, whoa, whoa, whoa. Everybody calm down. You know, I have a letter in my pocket. So we always get a get out of jail free letter, right? And tells them that we're doing as an exercise. But, uh. But yeah, that. That. That. That moment was like, you know, you're nervous because you're just hoping that they're the kind of people that will cuff you and shoot later, as opposed to shoot first. But, yeah, that was. That was a, uh. That was fun.

Speaker B: I mean, and shout out to that, like, like that's ultimately what you want from your front desk guys, right? You want your front desk folks to be like, oh, that guy looks just a little bit familiar, and use all the tools that you have. I mean, that's, that's, that's exceptional.

Speaker A: Yeah.

Speaker B: But terrifying.

Speaker A: Yes.

Speaker B: In the moment for sure. You're thinking, you're thinking, oh, I really hope that letter is either laminated, I didn't stick with something wet on the way in here, or. Yeah, yeah, it's going to be bad real quick.

Speaker A: Yeah, yeah, uh, that's. So we've been fortunate that most of the places that all the places we have broken into, that the guards have been well trained enough that it's not a shoot first, ask questions later kind of atmosphere. So we've been fortunate enough for that to be the case.

Speaker B: Do you usually go on these, uh, this, on this work, or do you, I mean, do you usually send other people?

Speaker A: So there's only been twice now in my career that I sent a team without me, and both times I was really ill. One I had Covid, and then another I just was, I was really ill. But normally I go because I've been doing this so long that the team finds confidence. But, you know, sometimes I go like, I want a job with two brand new team members. And I'm like, hey, you, you go in and do this, I want you to be the first one in. Right. And give them the chance to experience the high of doing this, um, without. Without having me right there, you know, as a safety blanket. And I gotta say, she, she did amazing. This one woman that worked for me, she, she did, she did amazing. Her first time ever. Really great

Speaker B: when, when people go, well, actually, you know, I feel like there was more to that story and I feel like I might have jumped on the, on the tail end. You have more that you want to tell on that story?

Speaker A: Uh, yeah, I could. So, you know, it was, it was, um, a fascinating job because it was a very large energy company, we'll say. And, uh, we were tasked with getting to these specialized computers that control the market. Now we weren't to touch anything, but if we can sit at a computer and move the mouse, we prove that we could have like, crashed a whole country now. We could have sold a bajillion dollars of fuel or whatever and, you know, ruined an economy. And that was. The test was for, uh, this woman has a hearing impairment. So she used that. She got into the office, walked in because there was no, no front desk Security. And she walks up to one of these computers that a guy had just walked away from. And she sits down, she starts moving the mouse. You know, the guy comes back and he's like, hey, what are you doing at my computer? And she's like, oh, I'm trying to look for Lisa. And the guy goes, Lisa, uh, Smith? And he, she's like, yeah, yeah. And she's, she's signing sign language at first, right? So he goes, I don't know sign language. So she pulls out a paddle and she starts writing, I'm looking for Lisa. And he goes, lisa Smith? Yes, Lisa Smith. And he goes, oh, she's upstairs. Go, go that way. And just lets her go, right? Because the hearing impairment, which was real, you don't fake, you don't. You can fake having a broken arm, you can fake having a broken leg, you can fake stitches, but you can't fake a disability because that's, that's rude to the disabled, uh, community, right? Like you wouldn't act like you were mentally impaired, deaf or blind if you weren't, right? But she, she is, she's, she's, she has a cochlear implant. So she used that perfectly and it just showed like this guy didn't question her. She's a woman and she's impaired. So he, she was sitting at the dangerous computer, using it, and he just said, oh, no, you got to go upstairs and go that way.

Speaker B: That's wild.

Speaker A: And let her go.

Speaker B: Do. Wow. Do you. So, uh, when you look at this, these, these types of. Well, actually, so was what, what did she, can you say what her kind of a story was to, to get in the building?

Speaker A: So the way this building worked, it was, um, it was a multi story building and one or three floors was, was this company. So she just took the elevator to a floor underneath them and then took the staircase up and waited for someone to come out because the staircases were all locked. Waited for someone to come out, like during a break time and just entered, entered the door wild as they came out. So nobody questioned. That is.

Speaker B: So do you think, I mean, so that was actually my follow up question was like when you read, when you hear about, you know, adversaries doing stuff like this, do you think is it mostly more organized things like the reporter example that you used, or is it more like people just, you know, sitting behind or, you know, walking closely behind someone else getting in a door they shouldn't be getting in and then the person in front of them not asking questions.

Speaker A: So that's a Good question. Because it depends on the goal of the attack, right? So China is very well known for elicitation. They're awesome at it, right? They do multi stage elicitation. So let's say you're a nuclear physicist and you have something that they really want. Uh, they'll invite you to a conference to be a speaker, and they won't just come up and ask you questions. Right. You know what they'll do is they'll have students ask you this set of questions. Oh, and then researchers ask you this set. And then, oh, another group asks you this set. You're. They're getting the whole picture, but in your mind you're only giving people pieces, right? They're great elicitation. But if, if the goal is, if the goal is like to steal, and this has happened to like, you know, Booz Allen or others like to go steal plants, to go steal something for a new plane or something like that, uh, then they might tailgate in like that, just come in the door and use a USB key to go steal something. So it really depends on what the goal of the attack is, on how they'll enter the building. And that's why we try all of it. Because we got to tell you. Like what, like when we say to our client, what keeps you up at night? Like, what is the worst thing that can happen to your organization? And they go, this, we go, okay, this is what we do to test that. And then, then we do that.

Speaker B: Wow, that's fascinating. What. When you look at organizations that are, uh, you know, pretty buttoned up, what are the things, Are there any common traits that they have, uh, that that makes, that. You see, when you talk to an organization or you go through their tests that, hey, these guys really are well secured.

Speaker A: Yeah, they have a well trained security staff. They have physical security everywhere, like cameras, rfid. And they have a staff that is empowered. This is the biggest one. A staff that is empowered to ask questions. Right. Sometimes people don't feel like they have the right to ask questions because, oh, uh, there's always new people here, so why would I ask? But when we find companies where staff are like, I don't recognize you, what are you doing here? What department do you work for? You know, or who's your manager that has single handedly stopped us and places right, we were breaking into this bank in Jamaica and we got into the, uh, tel center and I say to this young lady, um, hey, I need you to log into this computer. We gotta do a test. And she does, she's logged in. So now we're sitting there, and my buddy Ryan, he's hacking the whole bank. And a manager comes out, and she says, uh, what are you doing here? I said, oh, we're finishing the PCI test. She goes, uh, who's your point of contact? And I totally forgot the guy's name. And I'm like, oh, let me look it up. She goes, no, no, you would know it. Come with me to security. So she brings us down to security. Now, she did her job right, but this is where everything went wrong. She drops us off of security. She goes, these guys aren't supposed to be in the building, you know, take care of them. And I said, oh, man. She got mad because I forgot my point of contact. And, uh, while we were going downstairs, I'm looking it up, I forgot Mr. Smith was our point of contact. So she got mad at me. I said, how about this? I'll call him and you can talk to him. So we have a guy outside of the van who's going to play Mr. Smith. So I call, and this guy comes out. Oh, this is Mr. Smith. Security guards. Oh, yes, sir. Their names aren't on the list. I'm sorry. I'm traveling today. I forgot to put their names on the list. So the security guard goes, okay, well, what. What should we do with them? Well, let them finish their test, because I hired them to do this test. So, bam. Hands up the phone. Guard says to me, he says, finish a test. Where do you got to go? I said, we got to go to the server room. He goes, okay, I'll take you. He takes us to the server room. So, you know, so if they had listened to the manager who did the right thing, we would have got booted out. So when people, uh, are empowered to, you know, take that step, like to say, no, you would have known this right away. Come with me. She could have got. She could have won the day, right? If we got booted because of that, that's amazing. Wow.

Speaker B: What. Was Mr. Smith a real person that you're in this case? I mean, obviously not his name, but yeah, he was. Okay.

Speaker A: He was. He was a real person at the bank, but we had someone impersonating him personally.

Speaker B: Okay. What do you do? How, uh, do you. What would you happen to do if. Let's say, I mean, maybe this is a fail safe, but, like, do you have someone who's, like, trying to. Trying to actually sound like him, to actually impersonate him, or is it just like. It happens to be like a. Yeah,

Speaker A: so what we had figured this was a quite a large bank network, right. So, and he was the ciso. So what I had figured is that the security guard probably never spoke to Mr. Smith. So all he needed was a Jamaican accent and to sound like he could be Mr. Smith. That was it. So we just had a local that, that was working with us that like, if we call, you're Mr. Smith. Right. And then he just played the part. So it was easy enough.

Speaker B: Uh, and it worked.

Speaker A: Yeah.

Speaker B: That's incredible. Wow, what a story, man. That's, that's neat. And I like, this is what I'm thinking. I, you were talking about, you know, this idea of social engineering leaving people feeling better than, uh, than when they're done. And uh, I mean I'm hearing this story and I'm feeling better at the end of it. Like it's, you know, you accomplished your job, but it's, it's really, it's. You're ultimately empowering these companies to know, hey, this is a weak spot and this is what we gotta do differently. And so let's just be a little better.

Speaker A: Yeah. So usually when we approach afterwards and we do the education most, I would say 99% of the time people are smiling and like, man, you really got me. Because we didn't use a pretext that made them fear their job. We didn't say like, if you don't do this, you're getting fired. Uh, we didn't have one of my female employees flirt with them so now they feel like they got used. We didn't use any type of fear based, like Mr. Smith saying, if you don't let them in, you're out in the street. You know, we didn't do any of that because that when they find out it was a test, they're going to now be non educatable. So yeah, our goal is always to think of what we think will work and then not to use something that will leave them feeling used or bad.

Speaker B: I like that. Um, just to keep with the theme of what the origin story is with the ilf and then also what the overlap is with that and your work with social engineering.

Speaker A: So probably about 10 or 11 years ago, maybe a little longer, I was doing a test for my corporate company with a client. And uh, without going into all the details, we found a guy using his work computer to go on the dark web and trade videos that he had made of himself molesting little kids in the Philippines. And uh, we set up a sting operation with federal, uh, law enforcement. And he Got arrested, and he'll be in prison for 150 years. And that felt really good. It felt like. I remember the first time that happened. I said, I didn't know that my skills can actually do anything. Like, uh, the guy that hacks stuff. I didn't know I can use this, right? So I go to my lawyer and I say, I want to do more of this. And he goes, go, go, go volunteer somewhere. So I did. I went and volunteered at a couple places, and it wasn't as satisfying. They weren't doing the same work. So I came back and I said, tim, listen, I really want to make a nonprofit that hunts the predators. And he goes, okay, you got three problems. Problem number one, even though you're a good guy, you cannot look at child abuse material because it's a federal crime. So you can't have it, you can't possess it, you can't download it, you can't see it. Okay? Problem number two is you can't be a vigilante. Uh, I did not know this, but Chris Hansen, like, 82% of his cases got kicked out of court. Because if you do vigilante crap and you do one thing wrong, scumbag lawyer can get your case kicked, right? And number three, if you do all this and no law enforcement will work with you, you're wasting your time and money. So I said, okay. So problem one, I went with a buddy named Ryan and I said, okay, we need to figure this problem out. So we, we got onto a VDI virtual desktop environment. And we, uh, we. We took a Windows VM and we altered it. You know, uh, we didn't do anything illegal, but we altered it. So no cache. Uh, it doesn't save anything, any cache at all. We built a tool that blurs all images and videos. Uh, we have it completely burnable. So if anything bad happens, this. This VM can just be burned, burnt, and smoke. It's not on anybody's computer. Ah, non attributable. So they're not linked to a person. They're linked to an agent number. So problem one solved. Problem two, uh, we. I. I hired a board. I had a board made of all these different people that we came up with. Our pillars. Our pillars, our rules. That those pillars meant that we couldn't be vigilantes, that we were going to never educate predators, that we were going to always stay ethical and above board. So we had these rules. And then number three was the hardest. Every law enforcement I went to, they were like, no, we're not interested. Not Interested. And then something happened that I don't want to say I was lucky because this is really terrible. I had a friend whose 11 year old daughter got groomed into sending some pictures over Instagram and he called me because local law enforcement said they couldn't help and we had located the guy. So I went to federal law enforcement that I was speaking with and said, hey, look, I know you said I'm interested, but I have a case and I actually have the person, will you take it? And they took it and they were so impressed with the report and they went and got the guy. They're like, if this is the kind of work you do, okay, we'll work with you. So 2017, I launched the Innocent Lives Foundation. We became a 501C3. I honestly thought we'll have five or six people, maybe once a year we'll get together in a hotel room, hack away at some stuff, hand in a couple cases. Uh, that first year we did, I think 12 cases. And I was like, this is amazing. We have 50 volunteers right now. I got two employees, a therapist and a COO. I just stepped down as CEO and we have a brand new CEO and we're up to 597 cases handed into law enforcement. And we've stuck to those rules the whole time. We don't do vigilante work. We work with every major law enforcement in the U.S. local law enforcement in the U.S. and global law enforcement, and they accept our reports and some of them even come back to us and ask for help. So eight years had gone by and uh, we're doing things I never thought we'd be able to accomplish. So it's something I'm really proud of. Uh, I'm a volunteer, so I'm not an employee, so I don't get paid for working at the ilf, even though I founded it. It's my passion project. So if and when I ever retire, that's probably what I'll go do full time. Is that right now, um, I'm in the pit with, we have Predator identification team, we call it the Pit. And those, I'm with those guys and gals in there who are just amazing people, a lot of them ex law enforcement, uh, current law enforcement dedicate their time, their spare time, to helping, uh, do the worst work on the planet. Having to go on the dark web and find, find these people and um, and then locate them in the real world. And they're good at it. They're really good at it. So I can't say enough good Things about the ilf. It's an, it's an amazing origin story and to still be here because a lot of nonprofits don't make it after, I think what I heard was a year and a half. A lot of nonprofits don't make it past that. The fact that we're here eight years.

Speaker B: Yeah.

Speaker A: Shows the dedication of the team. Uh, the work that we do speaks for itself. And, uh, we've been, we've been blessed to have a lot of really great people at, at the organization.

Speaker B: That's amazing. So something two, ah, things stand out to me. One is the number 597 cases you've worked on. But I mean that means that. I think in my conversation with Lee, he told me that I can't remember what the number does, is either one predator can attack either several hundred or several thousand kids.

Speaker A: So I mean, if they're a serial predator, it can be up to 400 kids. If they're a non serial predator, it's somewhere between 8 and 12. And if you think about a case for us isn't one person. It can be, it could be a sexting ring, it could be a trafficking ring, it could be a child pornography studio. Right. It could be dozens of people in one case. So when I say case, it's not 597 bad guys that got nabbed. It could be thousands, uh, of people. Right. So when we talk about that, I'll let people know like, yeah, the work that's being done by the ilf. And you know, I'm saying the ilf, not me, the work that's being done by the ILF is effectively helping stop one of the worst, most disgusting things that could exist on the planet right now. I'm not naive enough to think that someday we're going to wake up and it's going to be gone. Um, I know that that problem's not going to happen. Not, not because of us. But if I can make a 1% dent in that, if I can help a couple thousand kids have a better life, man, I can go on my deathbed knowing that I don't care. All the stuff I did in social engineering world, that doesn't mean anything. I can go to my deathbed knowing, Chris, you actually did something really good here, you know, and, uh, absolutely did.

Speaker B: I mean, because sure, it will happen in the world and that's tragic and it's, I can't. It is the most despicable thing.

Speaker A: It is.

Speaker B: But to that family of whoever those kids that were impacted, that's the whole world, man. Yeah. And that, uh, that's really, that's, that's really impactful.

Speaker A: Yeah.

Speaker B: Has it been hard?

Speaker A: We get cases sometimes from parents who report and the, the letters that we'll get from them thanking after we help them is, uh, maybe some of the best things that we can get. Right. Because it's like to read these letters of thanks or for how their kids are safe. We had this one case. This young girl was groomed by this adult man and she was in love. So she was going to run away with him and he was coming to pick her up and we ended up getting him nabbed. And, uh, her dad called me six months ago. She graduated high school, she went to nursing school, she was working in a nursing home, you know, and he's just. It gives me goosebumps. Right. Another young girl was groomed and was also going to run away with her guy. And, uh, she was self harming also. And, um, she went to college and now she's an art major. You know, it's like you hear these stories of these kids that we've impacted, that their lives have become different and better and saved. And you like, you know, you just sit back and you're like, you know, I really don't ever tell those stories. Actually, I think that's the first time I ever mentioned those, those two stories. Um, but you sit back and you think, wow, that, that happened. Like we did that, our group did that, you know, and, and it feels good. I may never meet those kids. Right. I may never meet them. But I know that, uh, that one dad, his daughter had some ceremony that she was a part of and he said, we're going to zoom it. Would you like to be part of it? And I watched her in the ceremony and it was just like I sat there like, I don't even know these people and I'm not related to them. But, you know, here we are, I'm, um, a part of their family now because of what we did for that case. That's, that's impactful. That's something you can't ever take away.

Speaker B: No, totally. I mean, and it's something that you did for them that no one else could do.

Speaker A: Yeah.

Speaker B: That's neat. Is it hard to step away, to step out of your leadership role?

Speaker A: No. You know what? No, I thought it was going to be. When I, when we first came up with the idea of doing this, uh, I sat back and I was like, man, but I started this, like, this is my thing. And that was the wrong thinking. And then I started to look at like, what is the role of a CEO? And it's really to be the person who is spearheading the organization and keeping everyone accountable and moving forward. I'm so focused on in the pit that I wasn't doing that job properly. I wasn't. And uh, the organization was great, but we were fractured. Everyone was going different directions. So we brought on Christy Nordman. You should have her on. She's amazing, amazing woman. And basically what she does for her career is she goes into companies that are failing and she makes them work. So we brought her in as CEO and she's doing that for us. And in two months, the amount of organization she brought to us is unbelievable. We're ah, a well oiled machine running at 100 miles an hour. And I'm like, I could have it made me say what I said to you before. I want to step down as CEO for Social Engineer. I don't want to be CEO anymore. I see the effect on ilf and I'm like, this is amazing. And I get to do what I love. I don't have to focus on that crap. I get to do catching the bad guts. And that's what I love. And if I could do that as Social Engineer and be like, I want to be an innovator, you go run the thing, I'd be so happy. You know, the difference is ILF's a volunteer organization, so you have to pay someone to do that for a social engineer. But, um, that's my goal. That's my goal because I thought it was going to be hard, but I see the effect and it's just, it's truly remarkable, the difference in the organization.

Speaker B: That's amazing. I will, I'll reach out to her. Something you mentioned on your volunteer staff is that I think you said you have a psychologist or a social worker that works with you, Is that right?

Speaker A: Yeah.

Speaker B: Is that.

Speaker A: We hired a therapist because.

Speaker B: Therapist thinking that's the word.

Speaker A: Yeah. That was one of my first hires because when I was starting this, uh, I had a conversation with ncmec, which is the national center for Missing and Exploited Children, and I called in and asked for a meeting with their psychologists. And I said, look, here's my idea, here's what I'm gonna start doing. Can you give me some pointers? And they said, mandate therapy. And I said, okay. And she said, the stuff that you're gonna get involved in, even though you're not gonna see it, is so horrific that the human mind, unless it's Perverted wasn't meant to read these things. So you want mentally healthy people. So I said, okay, well, mandate therapy. But then it came to me, well, what if someone is poor and they don't have money for therapy? Am I going to pay for their therapy? I'm like, uh, what if that's 20 people? I can't afford that. Right. So I said, well, let's hire a therapist, and she can be the wellness director for everyone that's here. So we hired a therapist. At first, we had a group of therapists that she was also on the board, and then her therapist came at a very reduced rate. When Covid happened, she said, I can't volunteer anymore. There's so many people that need help.

Speaker B: I.

Speaker A: We have to go do this full time. And then we hired Erin Maloney, and she has been literally a blessing. She's unbelievable. She is like a ray of sunshine in the darkest part of the world. She's the most positive, happy, wonderful, beautiful person on the planet. She can smile through the ugliest things on earth. And, uh, she takes care of our people, makes sure that they're well and that they have someone to talk to about the burden in their life of doing this. And, uh, so, yeah, she's. She's, uh. She's been there with us now for years. Is truly remarkable person, and is. Has a, uh, history in child trauma therapy. So, uh, so for her, the subject matter is not new, so she's able to handle it herself. So she, uh. She's great.

Speaker B: That's amazing. Yeah. My question was going to be around if they were helping you with, like, you know, going after bad guys or if they were helping the. The helping your staff. You answered that. But did they. Do they also help with, uh, kind of understanding psychology of this, or do you guys already kind of have that dialed in?

Speaker A: So, yes. Uh, so she doesn't ever help us with the dark web stuff, but we get a report from a parent or a caregiver, and I'm going to go to that meeting. She's always with me and that meeting for multiple reasons, because I would say 95% of the time, it's women who are reporting. So I don't want to be in that meeting alone with a woman who's either been abused or kids are abused, because I'm not saying that anyone would do anything. But nowadays and the culture we're in, all someone needs to say is, well, Chris asked me for a nude picture or something, and, you know, my life, so I always have her there. Plus, she can, she's very good. Aaron's very good at reading the person. Is this real trauma? Are you just an angry divorcee? You know, like, what, what is it? She helps me get to the point, are we really going to be able to help this person or not? So it's, she's, she's a, she's a great help on those calls. And then she always, if someone's really having a burden, she's always there to offer. Here's a couple numbers you can call. Here's some therapy numbers you can call. I can help you find a therapist in your area. She's very good at giving that advice to the, to the parent, uh, to get them help in the local area. They are. So having her on those calls is, is necessary.

Speaker B: That, that makes sense. Do, do you find that most people who report are, are, are like, legitimate, or do you. Or like, what is the. I don't know. Is there a percentage that are kind of just like you said, like, like they're angry about something else and they're just using this as an outlet?

Speaker A: Yeah. Uh, so I can't tell you a statistic, but I can say that a large majority of people who report they're going through a divorce and they have no proof. So it's like we can't find you proof. Right. Like, we can help you get the proof. If you think he has pictures, we can tell you how to get them off the computer. If you can find proof, we can help you get it to law enforcement safely and forensically. Sound. But I can't hack his device illegally and get proof. I can't produce proof, and I can't take someone's name. Like, you can't go on the Dark Web and search Chris Hadnagi and link it to a moniker. It doesn't work that way. So if you have emails and monikers that you think he might be using, I can go look on the Dark Web for that. But a lot of times people come and it's. They, you know, I know something happened and, and you don't have proof. Uh, you know, we tell you, okay, here's the steps. First, report it to local law enforcement. They'll start an investigation. Have your child, uh, forensically interviewed. Right. That's important because if a child discloses to a forensic interviewer, then they have to disclose that to law enforcement. But if the child sounds groomed, like you said, say the daddy did this and there's no sign of that trauma, then no, you know, and, and we'll tell them like, not, we don't. No blame. Like, we don't try to say, you should have done this. But, like, if this happens again, you need to get your child to a doctor seconds after, because they can document, and they're mandatory reporters, right? So when a parent comes to me and they say they did all those things, then I'm like, okay, let's help. Because they wouldn't have done went through all that if they were just looking to wreck this guy's life. Um, but sometimes we'll even go as far as, like, let's just do a little digging in the guy. Does he have a record? You know, has he done something like this before? Because that might help us see, like, okay, is this feasible? So we always take those seriously. But, um, you know, we've had some real crazy ones. I mean, I had somebody call me, and she was convinced that her husband was trafficking her teenage son. Her son won't speak to her. So what she did to get his attention was she went into the husband's yard and lit off M80s and, uh, and then bashed his mailbox. And now, and she, she's like, and I want you to help me find proof. And I'm like, first of all, that, no, you know, that's, we're not gonna be able to help you with that one. Sorry. You know, we had another woman call, and she literally had her whole room wrapped in tinfoil. I'm not even kidding. She got on camera, everything was in tinfoil. And she's like, I know they're listening, you know, and, huh. So it's like sometimes we get ones where it's really obvious, like, this is not what we do. I'm sorry. You know, we help children get out of really bad circumstances. And, you know, the government spying on you is not our, not our, not our, not our thing. So, yeah, we've had, we've had a few, uh, a few funny ones, but, you know, most of them are not.

Speaker B: Yeah, I bet. I mean, wow. Okay. You mentioned the Dark Web. What, what is it? What is the Dark Web like for? I mean, I, I, I don't even know that I have the right definition understanding of what it is.

Speaker A: Yeah, so the, the Dark Web actually started as a science project from MIT in the US Navy. It was, it was, uh, a way that they put together these private VPNs that then they could trade science, uh, papers even in countries that were, you know, banned from doing things like that. Quickly, though, uh, the Dark Web was used by some MIT students to do drug deals. And then quickly after that, it got used for pornography, which seems to be everything that man makes gets turned to some kind of sex thing quickly. Nowadays, the Dark Web is. It's. It's a massive, massive network of what they call Tor nodes. And those are just computers around the globe that are set up to connect to each other to this massive network of servers that hosts anything you can imagine. Guns, drugs, humans, uh, pornography, counterfeit money, hacking services. There's. I would. I would argue, uh, uh, besides whistleblowing websites, there's really not much good on there that I can think of. It's really not what. The. What. What it was created for is not its intended purpose at this. At this point in time. So it's where. Because. And they, you know, they have some. Some validity to this, that there's a higher range of anonymity on the Dark Web that, that people that, you know, you're not tied to an IP address. You know, like, if you're sitting at home and you commit a crime, and let's say you hack into a bank and the bank says, here's the IP address, they can trace that back to you. But if you're on the Dark Web, they can't trace that back, because when you. When you touch a Tor node, your connection breaks into like, maybe 15, 20, 80 different Tor nodes, and it's broken up. So you kind of go out like this and then come back together. You are not, um, attributable to one node. Right. So now there's ways around that. But, um. But that's. That's the reason why all this illegality exists on the Dark Web is because there's a higher level of anonymity and much harder to catch somebody than there is on the Open Web.

Speaker B: Thank you for explaining to me like that. Have you read the book the Anxious Generation by Jonathan Haidt?

Speaker A: No, I haven't. No.

Speaker B: Ah, it's fascinating. It.

Speaker A: Oh, uh, that's aligned.

Speaker B: It's aligned to what? Your, Your work. The, the general idea is this. He's like, we. We. Apologies, Jonathan Haight, if you hear this, and I'm butchering this synopsis, but, uh, his, His. The general idea is we worry so much about kids physical safety and not enough about their safety online. He's like, we worry about them getting kidnapped at the park, which is, you know, hey, let's be aware of that. But also. But then we give them a device and expose them to all the potential. You know, we open. Open a window to a lot of. Really potentially we raise their exposure infinitely. And it's. Anyway, books. Book is phenomenal.

Speaker A: Yeah.

Speaker B: Definitely recommend it.

Speaker A: And, uh, I agree with that, though. I mean, we do spend a lot of time and I think because, I mean, kind of like what we've been talking about here on the podcast, I think it's easier. Um, a lot of parents nowadays have become like the iPad parents. Like, hey, you want your, you want your kids that they occupied. Look at this. Right. And then they, they've lost that communication touch to talk to them about these things. Right. And I do think, though, that this younger generation, they're a lot more open to therapy than our generation was. And that, you know, I'm, I'm under the belief that everyone should have a therapist, because therapists, you know, you, you could say things to them that you can't say to anybody else, and their job is to help you. Right. I'm a big believer in that.

Speaker B: I agree, you know, with this idea of devices, like, it's, it's hard to keep your kids all the way off of devices forever. You just can't. We know when that's not going to happen. Do you have any thoughts or recommendations on devices that are out there that are a little safer or more easy to use or things to stay away from?

Speaker A: Yeah. Uh, so again, I'm not saying I'm the. On the rule set, but this is what we did in our family.

Speaker B: Sure.

Speaker A: My daughter was given devices and things were locked depending on her age. Right. So we had a monitoring tool on her phone that blocked certain websites, blocked words, blocked, uh, that if, if, if it turned it off at certain times. So like at 10pm for bedtime, it no longer. Nothing worked but the clock and the, uh, the, the audio so she can listen to music.

Speaker B: Oh, nice.

Speaker A: You know, we had all those things as she got older. We lessened those things. Right. We lessened it. And then as she hit teenage years, of course, teenagers need their, their privacy, so we had to lessen that even more. But we always had these conversations. So that way we felt that we weren't just giving her. Like, let's look at this analogy. No parent in their right mind when their child turns 16, would say, here's the keys. Go figure out how to drive. We just wouldn't do it. They'd be dead and they'd kill other people. But yet we're okay with giving them a phone at 9 with no guardrails. That phone is way more dangerous than a car. Way more dangerous. Right. So when we want our kids to drive, we take them out, we put we get them in a parking lot, we make them drive slow. We might hire someone to train them how to drive. They got to do hundreds of hours behind the wheel before they have to have a permit for a year before they even are allowed to drive without you. And, yeah, here's a phone. Be safe. We. The training process should be similar. And, you know, parents hear that. Like, how the heck do I do that? And I'll tell you, I did this with my daughter, where I wanted to know what she knew, so I would say, am I. I heard Instagram has this new thing called dms. What does that mean? Oh, direct message. I'm like, how do you do it? She'd come over and she'd, dad, you're so old. She would show me, great, now I know she knows, right? And then I would say, so what. What would you use a DM for? Oh, if you want to, like, talk to one of your friends and don't want it to be public. I'm, um, like, uh, okay, right. I would always ask her things. Hey, have you heard of this app called, uh, Snapchat? She's like, oh, yeah, everyone uses it. I'm like, is it good? Like, what's. Like, I don't know. What's up with this? Right? And then she'd be like, well, you know, and I'll look into it. And I'd look into it and ask her questions. So what is this for your eyes only thing? Like, do you have that? And she's like, no, no, I don't. I don't use that. Okay, well, can I. Can I see? I'm curious. Because it's, like, weird. Show it to me. I don't have Snapchat. You know, show me and have, uh, her show me. I had her educate me on the apps, and that kept her also telling me what she knew and what she was using and let me have more knowledge than the average parent on these things. So I like.

Speaker B: I love that approach of just go. It goes back to what you know. This is a theme now from hearing what you're saying, folks. Focus on the relationship. Really make sure that's strong, and then use the relationship to, uh, to help keep your kids safe. Keeping it strong as well. Yeah, I love that.

Speaker A: Look, every parent's gonna mess it up. I mean, I can tell you a million things I did both for my son when he was young and my daughter that, you know, are embarrassingly stupid. Um, so I don't want to make it sound like I'm this, like, grandiose awesome parent that never made mistakes. That is definitely not true. And either my kids listen to that. I hope they appreciate me saying that. I know that. But, you know, in the, in the recent years, you know, we've been able to self reflect and really work on ourselves, my wife and I, and, you know, just really be able to hone these things in, um. Because the relationship building never stops with your kids. It never stops. And yeah, you know, my son is in his 30s and my daughter's in her 20s, and they're, they're going to go through problems still. And I want them both to feel that they can come to us with that problem and we're going to listen. And we might disagree completely, we might not agree with the path you're deciding to take, but I'm going to listen. And if you want, I'm going to give you my two cents. And if you don't, then I'll still listen and just hear you out. But that's, that's all I want from them. You know,

Speaker B: you have a unique, sure, nobody's perfect, but you have a unique perspective here in that, you know, you're, you're a parent and also you're focused on helping kids. Uh, what are, what are some things that you wish parents knew about helping, keeping their kids safe that we haven't talked about already?

Speaker A: Yeah, so the first big one that we already did talk about is having those conversations with them. Like you have to do that. Second is being aware of what's happening to our kids out there. Like, you were shocked when you hear, like, the average age of seeing pornography is eight years old. Most parents don't know that. So they're like, no, no, that's not true. Yes, it's true. Because one of their friends at school has a phone and looked up the word boobs and showed everyone in class because it was funny. Now, they might not be looking at it in a lustful way, but they're looking at it and they're seeing it. And when it starts that young. And the way, um, the reason pornography becomes addictive is it's like you could be with the same man or woman 30 years and never get bored. Why? Because there's this thing called oxytocin. So you have this building trust relationship that only is released with the physical touch or the person that you love with you don't get that from a picture. So when you watch porn, you have dopamine. And the next time, that's kind of like the first time you rode a roller coaster. That roller Coaster probably doesn't get you the same thrill anymore because it's. It's old, it's boring. That's my first one. So when you watch porn, your brain. Dopamine. And now I need something different for that same dopamine and different. And what they found in studies is that most of the time people who are into child pornography are porn addicts. Because what has happened is they. They, um. I'm not saying every porn addict becomes a child. Child abuser.

Speaker B: Right?

Speaker A: I'm not saying that. That correlation is not there. But they started off looking at what you could call normal porn of such a thing, and then they had to get into more hardcore porn and then gangs and then orgies and then, um, bestiality. Animals and animal and child porn seem to be very linked together. A lot of times when these guys get arrested, they also have animal porn in addition to child porn on their machine. And you imagine now if somebody in our age group who couldn't even have access to porn until they were in their 20s, when the Internet was around. Um, if now my kid at 8, he's got a. He got a very short Runway. By the time he's a teenager or she, they're already addicted. And. And then. And nowadays, I mean, I'm not saying it was better. Pornography has always been bad, but, uh, you know, sound like. Like, I'm like a grandpa. Like in my day, it was literally like Playboy. It was just nude women, you know, nude, nude men. That was it. There was no choking, there was no punching. There was no bondage. There was no, you know, violence. There was no spitting. There was like, none of this stuff that happens today that just tells boys and girls that this is. This is the. This is the way it goes. And anybody who's married or as with a partner knows that actual intimacy never looks like it does in the movies or pornography ever. It's designed to look that way, to drop that dopamine. But when a young person grows up viewing that, and I think this is what. Answer your question, this is what parents need to know, is that it's not a little harmless thing that people just do. It can actually alter the way your child thinks about other people. If they become addicted to that, it is really not great. I worked the case, literally. Sadly, the father had to report his own son. He became a porn addict and he got into child porn and he was downloading it, and they caught him and they called me and I'm like, it's a mandatory report state, man. If you don't do it. And he gets caught, you're going to jail, too. Like, you know, you got to make your choice. But I tell parents a story to be like, talk to your kids, monitor your kids, have these conversations with them, because you don't want it to be that decision that you have to make that that father had to make. That should never be a decision a parent has to make, Right? So I know that's a long answer, but I think those are the things parents need to know, like, having those conversations, what's going on with them out there, monitoring their devices, and know who are their friends. Like, when I was young, if you want to go sleepover, it was like, well, I need to know who their parents are. But now you can look on their phone. I have a thousand friends. Do you know all those people? Do you know who they are? Like, you just accept anyone who says, friend me. Like, do you really know a thousand people? Do you really know 10,000 people? Are all those people safe? Right. I would tell. I would tell my kids, like, look, it's okay to have Instagram, but don't want it to be public. Like, our private lives shouldn't be public. So just let your friends and family join the people that you know in real life could see your Instagram. And then my daughter became a photographer and a makeup artist. So now she's like, I want a public one, but for my art. Great, that makes sense. My business has a public one. I don't put my family and my vacations on that one. That, uh, stays private. So you don't need. The world doesn't need to know what you're doing every second of every day. They don't need to know what you're eating this moment. They don't need to know when you're going to the bathroom. They don't need to know things, right? But this world, when I was young, if I went and read my sister's diary, my dad beat me up. Nowadays, their diaries are out there for everyone to see. And if you don't press, like, they think you're a bad person, you know, that you have to like it. It's just a different world. And parents need to understand what the pressure our kids are under. When, When I was their age, bad news. I, uh, may be heard on the news. You heard of something bad happening overseas? You might have, uh, the TVs. The TV shut off at 11:00pm There was no more news. Now in the palm of their hand, they can see beheadings. In the Middle east, they can see fires Raging and people dying. They can see people being shot in other countries. They can watch wars happening in real time. You want to talk about the generation of anxiety? Holy crap. Why? I mean, they're seeing the most horrific things 24 7. And now you add the AI generation into that. I know why my kids are anxious. I mean, they turn it on and all they see is a steady 247 stream of bad news. Parents need to understand that our kids are under pressure that we were never under. We were never under that kind of pressure.

Speaker B: Wow. Uh, it's true.

Speaker A: Yeah.

Speaker B: And they're, they are under pressure and we, you know, there's going to have to be, I think, some upskilling by the parents here to, to try to figure that out because we weren't raised with those skills. And so we're gonna have to figure this out.

Speaker A: We do desperately. We do desperately. Because it's a scary world and it's getting scarier. You know, my daughter comes to me and she's like, can you believe what's happening with all these people getting arrested and deported? And you know, for her it's like, what if one of my friends, what are we going to do if one of my friends gets deported? I'm uh, like, there's nothing we can do. Like, there's nothing, we're powerless. There's nothing that we can do. So they're seeing this and they're feeling for the first time, at least in this country, I know other countries have experienced this. They're feeling this whole sense of injustice and powerlessness that is adding to their anxiety. So people are looking for outlets which is, you know, I think I saw the, the lawsuit that Meta just lost, uh, the lawsuit about creating addictive algorithms. And I'm so happy to see that because their, their escape becomes social media. And I think I read that, uh, doom scrolling. A lot of these people, these younger people, they, they admit some seven, eight hours a day on social media. Can you imagine? I cannot, I can't imagine doing anything but work or sleep that much in one day. But it's so, you know, again I'm trying. It's not. We really have to end on something positive. Okay, so we're going to positive in a second because I don't want people listening to this being like, you know, everything bad. But so let's, let's, let's talk about something positive for a second. The, the uh, the Innocent Lives foundation has put out a ton of education for parents to, to help learn about these things and learn how to talk to their kids. There's videos on there, there's hope frameworks on how to have these conversations with your children. So I think for any parent that is sitting here going, I don't know what I'm going to do. Just go to the website and reach out. Every week we have something called a Fireside Chat, where one of our volunteers interviews somebody that comes on and talks about some of these things and how to talk to your kids. Be a part of that. Come on. Uh, it's on. Oh, no. Twitch. It's on Twitch. So you can come into that channel. You can ask questions, right? So if you're a parent and you're just come on that, then ask us questions. You know, every year we hold ILF Fest online. You could be a part of that. Come and ask questions. And if you're really lost, email us, say, hey, um, I heard this episode, and I don't know what to do. We will reach out to you and we will help. Right? That is our whole mission. If parents are doing their job, we can see a great reduction in children being exploited.

Speaker B: So thank you.

Speaker A: There's your positive point, and it is

Speaker B: positive because, look, the thing is, hard, things are going to happen. People are going to deal with these problems. But the good news is they're not alone. There are resources out there. There are people and teams that want to help and can help. And. And even if you, you know, you don't want to, even if you're not ready, you don't want to. You just, like you said, don't know where to start. Like, I feel like that's so empowering to people just to be like, hey, I can get educated, make a plan. Start with one thing and then go from there. I think that's a. I think to your point, that's a. That's a great. That's a great takeaway and a great way to end this podcast. This is. Yeah, Chris has been awesome. I really enjoyed this. Uh, I feel like I learned a ton, and I know that people are going to really, really get some value out of this, so I super appreciate it.

Speaker A: Thank you. Thank you. It's been great, great conversation. I really appreciate it.

Speaker B: My pleasure, man. Thanks so much.