Activist Sharon Salaam speaks out for WBAI.
We should be moving forward, collecting the funds that we need to make sure that our station is whole
and that it can do its job as it has done for me in the past.
When all of this stuff happened to me many, many years ago in 1989,
I didn't get very many opportunities to speak out in regards to the wrong that was done to my son
and the other boys in the Central Park jogger case as it was called at that time.
Very few people stepped up. Yes, Like It Is was there, WBAI was there, and a few others.
Majority of those stations that let people like myself speak and tell them what was going on on
the other side, those stations are gone. If we lose WBAI, where do we go to get our words out?
Where do we go if you've been arrested unjustly? Where do you go if someone's taken your children
unfairly? Where do you go to seek justice? We must keep this station alive, alive. WBAI.
This is listener-sponsored, locally controlled WBAI New York.
And the previous program was Economic Update with Professor Richard Wolff, heard
Wednesdays at 6 30 p.m. here on WBAI. Stay tuned for Off The Hook coming up.
And again, if you consider supporting this radio station and haven't done it yet,
well, this is a great opportunity than any to do it now.
212-209-2950 or go to give to WBAI.org online and you'll be glad you did.
As I've mentioned before, WBAI is now 63 years being part of the Pacifica Radio Network,
part of the Pacifica Foundation, and it's because of people like yourself
made it happen. Now stay tuned for Off The Hook coming up.
Due to telephone company facility trouble in the area you are calling,
your call cannot be completed at this time. Please try your call later. 078-T.
We're sorry. The number you have reached, 99.5 WBAI, is now Off The Hook.
078-T.
And a very good evening to provide the program is Off The Hook.
Manuel Goldstein here with you on this Wednesday evening, joined tonight by Kyle.
Yeah, I'm right here.
And out there in Skype land, I see Rob P. Firefly.
Good evening.
And Arsene, you're joining us again.
Yes. Hello.
Arsene, you may remember from many years ago,
used to be one of the co-hosts of this particular program.
And in fact, you've just flown in from London, I believe.
Yes, yes.
You didn't have to do that. You could have been on the show from London.
You didn't have to fly all the way back here just to be on the show.
I'm here in person.
Okay. And we also have a special guest.
Lorex is joining us from Distributed Denial of Secrets,
one of our favorite organizations.
Greetings, Lorex.
Hi. Thanks for having me on.
We're going to get to a very big story involving you folks in just a moment.
But first, we're going to just go through some of the things that have happened
over the past week.
It's kind of our usual hodgepodge of smart things and stupid things.
So we'll try and race through this as quickly as possible.
Okay. By the way, Rob, Gila's not here.
So is she coming later?
She is not. She is on her way.
She is caught in the wonderful weather out there.
And so she'll be here at some point.
Okay. And I should also point out, Alex is currently on a plane from London to here.
But his plane, unlike Arseny's plane, is getting here after the show.
And if you remember the last time we tried to talk to Alex on a plane,
it did not go well.
We're not even going to try to do that again.
I don't know what's going on in London or why everybody's in such a rush to get back here.
But whatever.
Well, in any case, I'll be very happy to provide very bad legal advice.
Okay, that's fine.
That's great.
Yeah. So now speaking of degrees and accomplishments and things like that,
MBA, Masters of Business Administration, that's quite an achievement, don't you think?
It's something that a lot of people strive for and they work hard, they study.
And a damn Chad GPT passed an MBA exam given by a Wharton professor.
Yeah.
Professor Christian Tiewitsch, who authored the research paper,
Would Chad GPT-3 Get a Wharton MBA?
A prediction based on its performance in the operations management course,
said that the bot scored between a B- and a B on the exam.
The bot's score shows its remarkable ability to automate some of the skills
of highly compensated knowledge workers in general,
and specifically the knowledge workers in the jobs held by MBA graduates,
including analysts, managers, and consultants.
The bot did an amazing job at basic operations management and process analysis questions,
including those that are based on case studies.
Now, as you recall, we were playing with this last week on the air.
We were writing poems and songs and even film screenplays.
And it wasn't doing badly, I have to say.
It's a little frightening how on the mark this can be sometimes.
But there's all kinds of concern over how this could be taking over our lives in one way or another.
Certainly, Google is concerned because it might do a better job of searching online
than Google does.
And they haven't had competition in a very long time.
Experts who work in both artificial intelligence and education have acknowledged that bots,
like ChatGPT, could be...
I keep saying it wrong.
GPT.
Yes, I said it right.
Okay.
They need a better name.
It could be a detriment to education in the future.
In recent interviews, some educators and experts say they are not yet concerned,
but they expect to be concerned really, really soon.
There's a student in Princeton who has written an app.
And we believe he's human.
We're not sure yet.
Hasn't really been verified.
But supposedly, this human student has built an app that helps detect whether a text was
written by a human being or using artificial intelligence tool ChatGPT.
Of course, that's exactly the kind of thing that ChatGPT would do to fool us.
So I'm a bit wary here.
And what's stopping ChatGPT from using that app on itself, on its own stuff to improve it?
Yeah.
Yeah, you're right.
It could use the work that Edward Tian, which is the human name that's being used here,
devoted all this time to.
He said in a recent tweet that the algorithm behind his app called GPT0 can quickly and
efficiently detect whether an essay is ChatGPT or human written.
As you know, it's exploded in popularity recently for its ability to spit out coherent essays on
virtually any topic in just seconds.
You know, fun projects.
I think this is what we need to be doing.
Just, you know, create as much mischief as possible.
I had it write an essay on George Santos.
Now, keep in mind, this thing only goes up to 2019, is it?
Is that where its knowledge base cuts off?
I thought it was 2021.
It might be 2021.
OK, but that's still before we all found out the truth about George Santos.
So this thing read back this essay that the current George Santos could have written.
It was full of praise.
And this guy will make a great congressman, etc., etc., all his accomplishments.
So that was a bit of fun.
And there's no limit to the other kinds of things that you can do with this to create
mischief and mayhem.
I was thinking of taking a controversial subject, let's say something like nuclear power,
and writing a letter to a local newspaper in favor of it and then writing another letter
opposed to it, both written by the bot and both getting published, I'll bet.
That would be brilliant.
Yeah.
Just side by side alone.
We don't need humans anymore, do we?
Contrasting the arguments.
Yes, go ahead, Rob.
This business about ChatGPT earning an MBA, it's very entertaining.
I'm wondering how long it is until we have to call it Dr. ChatGPT.
But this also talks to a lot of teachers are talking about completely revamping how they
teach subjects in high school, in college, to specifically avoid the pitfalls of being
prone to ChatGPT being used to cheat.
And so this is a funny story about the bot, but it's also kind of a funny story about
the requirements to earn an MBA from Wharton.
So they're going to have to reconsider how they hand these things out.
I have a business degree, by the way, and it's not rocket science.
Well, yeah, I guess not.
And you're going to have some competition in the very future, I would say.
Gila is actually listening to the show right now and texting me from Parts Unknown.
She says she would love to watch ChatGPT have to defend its dissertation.
Yeah, you know, you could write songs in the style of particular bands and artists and
things like that.
You can make arguments based on the logic of certain people.
You could recreate debates, presidential debates between different candidates, all
sorts of interesting things like that.
I'm thinking of all the fun applications.
We'll get to all the dire applications and how this can really be used to hurt us.
But I think staying away from it, as many people have suggested, is not the right thing
to do because you have to plunge into the danger and see just what exactly it's capable
of before you can figure out a way to get past it.
And that's what we're all about here in this show.
OK, another technology that's been in the news lately is facial recognition.
As you know, if you have upset the people at Madison Square Garden in any way, they
will keep you out of various venues that they own.
Local elected officials are now crying foul on Madison Square Garden's ban on certain
lawyers and the use of facial recognition technology to impose it.
Manhattan State Senator Brad Hoylman Seagal and a bunch of other politicians gathered
outside Madison Square Garden on Sunday to demand its controversial CEO, James Dolan,
end the practices.
Over the last six months, we've seen extraordinary, courageous and alarming use of biometric
technology, said Hoylman Seagal.
Obviously, there's a pattern here.
There's a pattern of James Dolan punishing who he views as his corporate adversaries.
And the thing about this story is these are not people who are criminals.
These are not people who are a danger or a threat to the operations of Madison Square
Garden or any other venue.
These are people that work for the same company that is involved in a lawsuit against
Madison Square Garden Enterprises or one of his companies.
And it just shows you how easy it is to misuse this technology in a way that can really hurt
people, hurt innocent people who are just there to see a game or a concert or something
like that.
So it's interesting to see politicians getting involved.
New York Daily News, look at this.
They printed a big picture of James Dolan.
So if you want to take his face and ban him from your events, I guess you can do that.
We don't use facial technology at Hope, do we?
Maybe it's worth it just so we can ban him.
What do you think?
Certainly possible.
Creative ways people can retaliate with the same kind of attitude.
Yeah.
I've never had the chance to play with facial technology, facial recognition technology.
It's something that I'd like to mess around with a little bit.
Yeah.
Wasn't it at the second Hope conference that everyone was wearing masks of Kevin Mitnick?
That was the first Hope conference.
That was 1994 we were doing that.
Yeah, that confused a lot of people.
But we didn't have facial recognition technology.
Go ahead, Arseniy.
Yeah, I mean, are there consents when you go to a sporting event or a concert or whatever
that they can use your face as a way to verify you or something?
Well, there might be a sign at the door that says by going through this door, you're
agreeing that facial recognition technology will be looking at your face.
And I don't know many people who would turn around and say, yeah, I'm just going to give
up my ticket now because of that.
But the point is, if you do go through that door and they, for whatever reason, decide
they don't like you, they can kick you out.
And it just seems like a real abuse.
I had a big fright when I came into the country, not today, but last time where I was a Global
Entry member, but I was then expired, but I went to the machine to check, was it working
or not?
And you go up to the machine.
So Global Entry allows you to get through customs very quickly just by putting your
passport in.
And I'd given them my fingerprints before, but I'd never given my face.
They have my picture, but it was just a picture.
In any case, you come up to the machine, it scanned my face, immediately just knew everything
about me and said, hey, your membership expired.
So why did I still remember my face if it expired?
Why wasn't your fingerprint enough?
I mean, but usually you'd have to put your fingerprint in the machine.
But now it just takes a picture.
You know, it just the webcam is always on and it's reading you.
And it's frightening because I've never given a biometric kind of face scan.
It's just it's taken my picture enough times that it can recognize me.
It could probably do that without you going right up to the machine, too.
I'll bet it can get you in a crowd.
That is frightening.
OK, over to the inevitable department.
T-Mobile got hacked.
37 million customers had their data stolen back in November.
T-Mobile said a bad actor.
You think a bad actor?
This wasn't somebody who was just out to do good and spread the knowledge about 37 million
people doing a favor?
Yeah, OK.
Well, 37 million current customers were victims of a November data breach.
Regulatory filing last Thursday.
That's when the company said the hacker stole customer data that included names,
billing addresses, emails, phone numbers, dates of birth.
Why does T-Mobile need all this information in the first place?
You know, I've been asking this question ever since they started,
since they were OmniPoint.
Why do you need all this information?
And many times you can give them fake information and still have an account.
It's not impossible, but it's more and more difficult.
Social security number, you know, dates of birth.
No, they don't need all that.
They really don't.
But yet they insist on getting it all from you.
Anyway, the information can easily be compiled with other stolen or publicly available
information used by scammers to steal people's identities or steal money.
And of course, T-Mobile says working with law enforcement.
I don't know what they're going to do at this point.
They've begun to notify customers whose information may have been breached.
And I'll bet I'll just bet when they notify these customers,
they're going to offer them a free period of enrollment in a program
that monitors their credit report.
And they can sign up and pay for it after that period of time has ended.
It almost seems like a promotion, you know, when they when people get hacked
or have their identity stolen, that that entitles you to a free year or 18 months of this service.
Anyway, the wireless carrier did not indicate what it might do to remedy the situation.
Of course not.
It noted it could be on the hook for significant expenses because of the hack.
Although the company said it doesn't expect the
charges will have a material effect on T-Mobile's bottom line.
They hired an external cybersecurity team to investigate after they found out about this.
They were able to discover the source of the breach and stop it a day after it was discovered.
The company says it continues to investigate the breach, but believes it is fully contained.
Protecting our customers' data remains a top priority.
And we see that's how priority gets us.
Okay, over to some of the smarter news.
Appliance makers, Whirlpool, LG, they're a bit baffled by this.
They added Wi-Fi to all their dishwashers and ovens and refrigerators.
They made apps.
But only 50% or less of their owners have connected to Wi-Fi.
And they don't understand why aren't people connecting the dishwashers
and their ovens and refrigerators to the internet?
And apparently most people don't think that's a good idea.
Most people must be listening to us.
So that's great.
Don't connect your damn refrigerator to the internet.
What do you need to do that for?
You know, yeah, sure.
There might be an instance where you're, you know,
delayed on a train and you want to turn something down a little bit.
Or you can just be a little bit inconvenienced and not have the refrigerator be the gateway
to people hacking your entire home network.
Because oftentimes these devices have default passwords that people don't change.
And it's just all kinds of security holes as a result.
Anyone here ever put their refrigerator on the internet?
Or their oven?
Or their dishwasher?
I mean, I'm always thinking about this.
I got into those automatic vacuum robots that vacuum.
And right now I can go on my phone and turn on my vacuum cleaner in Russia.
Why would you want to do that?
I've always turned it on when I'm in the house.
You know, which actually kind of defeats the purpose of having it do it by, you know,
having all that.
But, you know, thinking a lot about why the circuits for these kind of small Wi-Fi connections,
they're really small.
They don't take up a lot of energy.
And it is easier to connect to the device if you need to, for some reason.
You know, for whatever reason, you'd need to connect to your dishwasher.
And a great reason would be for diagnostics.
If it's broken, it would be easy to connect to it.
But I don't think that's what they're doing.
I'm just happy that so many people aren't doing this.
You know, we talk about things like this week after week.
And it just seems sometimes like people are just following blindly into the world of high
tech without asking questions and, you know, buying the same thing over and over again
because it's built in obsolescence.
But in this particular case, I think people are doing the right thing by not adding these
things to their network.
There's no reason to do that.
And hopefully that's a trend that continues.
Okay, so we're going to dive right back down into the stupid again.
Uh, every so often you see a headline where you just are so disgusted by it.
You don't want to continue reading, but we have to.
It's our job.
The lights have been on at a Massachusetts school for over a year because no one can
turn them off.
How do you continue reading a story like this?
Well, let's see what happens.
Yeah, for nearly a year and a half, a Massachusetts high school has been lit up around the clock
because the district can't turn off the roughly 7000 lights in the sprawling building.
The lighting system was installed at Minichug Regional High School when it was built over
a decade ago and was intended to save money and energy.
But ever since the software that runs it failed on August 24th, 2021, the lights in the Springfield
suburbs school have been on continuously, costing taxpayers a small fortune.
We are very much aware this is costing taxpayers a significant amount of money, said the assistant
superintendent of finance.
How does that person still have a job at the Hampton-Wilbraham Regional School District?
And we've been doing everything we can to get the problem solved.
Have you?
Really?
Because I feel like the guy in war games who just says, can't you just unplug the damn
thing?
It's insane.
How can you design a system that you can't bypass, that literally keeps lights on, and
there is no way for you to figure out how to just turn the power off?
Hey, talk to the electric company.
Maybe they can just turn all the power off and then reset the thing somehow.
There's got to be a way, but this is insane.
Well, I think it has something to do along the lines of what Arseny was saying with that
integration to the systems that are in inconvenient, sort of hard to get to places that
by having this, it allows you to do things remotely without having to send someone into
a machine room somewhere.
They have lights, a light switch, the easiest thing in the world.
It may have been like relying on something that was just unaccessible and broken, and
they would have had nothing were it bypassed.
I'm all in favor of convenience.
I'm all in favor of gizmos and the modern things of the day, but you always need a way
to get around it if and when it fails.
It always fails.
It always will fail one way or another, but these people, they installed a system that
there's no way around.
It failed, and they're screwed, and they're making the taxpayers of the area pay for their
stupidity.
I really don't think they should be held accountable for this.
This is something that was a really, really bad decision, and those kinds of bad decisions
should be held accountable.
Rob, and welcome, Gila.
I see you made it.
Thank you.
Yeah, I am heartened by the hacker spirit evident in the staff of this high school because
this new story on NBC talking about this mentions that when the teachers have to do things like
show a film or project something onto their whiteboard, they figured out that they can
reach up into the sockets and unscrew the light bulbs manually in order to darken the
room.
That's being credited to hackers?
Like literally knowing how to unscrew a light bulb?
Okay, you know what?
How many teachers does it take?
You know, with all the bad press we get, I guess we can take that.
Yeah, we do know how to unscrew a light bulb.
We can manage that.
We have to stay on task if we accomplish what you're there for completed, so by any means.
Wow.
Arseny, we didn't point out that you normally live in Russia.
Well, not anymore.
Not anymore.
Disclaimer, disclaimer.
Fortunately, yes, but when you were there, this kind of thing wouldn't happen, right?
I mean, it's interesting.
I think these problems are just, you know, universal stupidity is universal.
True, but keeping the lights on, period, is a challenge in many parts of the world.
I don't think they'd be so quick to jump into this, you know, super,
quote unquote, modern, efficient way of doing it.
The smart home thing is getting out of hand everywhere.
But this is not a smart home.
This is a stupid school.
This is a stupid design.
Yeah, it's just wrong.
Okay, and now for the ultimate, we're going to go into something that we always knew
was going to happen at some point.
We always knew at one point in history or another, the no-fly list would be compromised.
And that is exactly what has happened.
And that is why Lorex from Distributed Denial of Secrets is joining us tonight.
And Lorex, maybe you're the best person to simply tell us what happened.
There's a story in the Daily Dot that really does a good job of describing it.
But you guys are on top of all of these security breaches and leaks and embarrassments.
But this one, I mean, we're talking, I think, over a million names of people.
And we're talking, you know, some of them are legitimate terrorist types.
And some of them are eight-year-olds.
There's all kinds of variety here.
But can you tell us how this happened?
Can you hear me?
Yes, we hear you fine.
Great.
Yeah, so the Daily Dot was the first outlet that reported it.
And it was a small regional airline from Ohio that I think is part of
United Commuter Service called CommuAir.
And the security researcher was browsing Jenkins servers on Chinese Shodan,
which I guess is called Zumai, and came across some keywords that made
her think that this was an aviation-related entity.
And eventually, they found the no-fly list.
Maya Arsene Krymu was the hacker who reported this breach.
And the Daily Dot also was checking the data set pretty early.
I think that they were collaborating before that story came out.
So, yeah, there are more than a million and a half lines on the Excel spreadsheet
for the no-fly list.
There are two parts of this data set.
There's the nofly.csv, and then there's the selectees.csv, which is a smaller list of names
of people who aren't necessarily banned from flying, but they are selected for the no-fly list.
And then there's the selectees.csv, which is a smaller list of names of people who aren't
banned from flying, but they are selected for increased screening.
And it's sort of up to the discretion of the TSA agent on duty, whether they can fly or not that
day.
So the file is actually called nofly.csv.
It's not like they were trying to make it at all hard to find.
This server was something that they were using for testing purposes.
The original people who found the leak, they didn't know when the list was dated from.
But before the first Daily Dot piece came out, the airline issued a statement saying
that it was from 2019, so it wasn't the most up-to-date list of names on the no-fly list,
but it was a genuine snapshot from 2019, which is pretty recent.
That is incredible.
What has been the response so far from the airline industry, from governments around
the world, at having this information just made public, I guess?
Well, it hasn't been made public in that the researcher has restricted access to the
data set.
I think that Maya replied to maybe a few hundred requests for the data, and DDoS Secrets has
a bigger archive of data sets, and we have this category called limited distribution,
where we routinely put data sets in this category that are for requests from researchers.
So it's not that the list is public, anybody can search for it or find it yet.
It's restricted to people who have published research in the past and who can be generally
considered that they won't leak the full data set, because we think that it would
cause more discrimination of the people who are perhaps on this list than they've already
been through just by being put on the list.
There's no due process.
There's often no way to get yourself off the list.
There are names on the list of people who've been dead for years.
As you mentioned, there's children on the list.
So both Maya and DDoS Secrets think that for harm reduction, it's best if we don't
publish the full list.
Absolutely, yeah, and that's extremely responsible.
I just worry if somebody had gotten to this first, before that researcher was able to
find this, then that list would indeed be public, or even worse, just given to certain
people who really shouldn't have it and used for nefarious purposes.
But has there been any kind of pushback from other organizations or governments, the fact
that you have access to it at all?
Nothing official.
I mean, I heard that there was a Republican Congress person who wants to launch an
investigation.
It might be an investigation of the airline for leaving this sort of data on the open
web.
It might be shooting the messenger, which often happens with hacking cases where they
go after the security researcher who found the vulnerability.
We don't know, but it could also just be looking into the fact that there is this
ballooning no-fly list.
The names, I think the number of names, the amount of names on it should be surprising
because previous reports of the no-fly list have listed things like 81,000 was reported
in 2018.
In 2011, I think it was 16,000 people who were on the list.
But if there's a million and a half rows, some of them are duplicates, but one can assume
that there's more than 100,000 names on this list now.
Yeah, it mentions that the recently freed Russian arms dealer, Viktor Bout, he had over
16 potential aliases as well.
But that's probably an exception.
Even if you divide this in half, that's still 500,000 names.
That's a lot of names of people who can't fly.
What does it mean if you show up on this list?
You're just barred from getting on a plane, period?
No questions asked?
Well, I think it is the U.S. no-fly list, so I don't know how far outside the U.S.
that sort of ban would travel.
The FAA controls a lot of air brules around the world, but it is specifically a U.S.
no-fly list.
Yeah, I don't know the answer to that question.
I think that it would depend.
Like you said, the Viktor Bout was on the list more than a dozen times.
That was unusual.
A lot of the names only have like four or five variations.
Some of the names are only on there once, so they're not all duplicated to that extent.
But I do think that they have problems with Cyrillic alphabets in the U.S. no-fly list.
I was going to ask, how do other alphabets and languages get translated?
One thing that the researcher said, it's just crazy to me how big that terrorism screening
database is, and yet there are still very clear trends towards almost exclusively Arabic
and Russian-sounding names throughout the million entries.
That's something that is definitely cause for concern.
I just wonder how many innocent people are caught up in that.
Yeah, I mean like some of the names on the list were children who are four, eight years
old or seven years old, who one would assume have not committed any terrorism at that age,
and they're just related to someone who was on the no-fly list.
So there's names like that that are totally just attempts at predictive policing or
something like that.
And then there's a lot of dead people on the list as well.
Osama bin Laden is on there a few times.
He is, wow.
Okay, so what kind of information do they give for Osama bin Laden?
The home address?
Oh, they didn't have the home address, right?
That's the whole point.
Well, the list is redacted and only includes name and date of birth.
So there are other columns that have been redacted either by the airline or by
someone else before.
So the list just includes the name and then the date of birth.
So why would it be redacted if it was being used to basically keep these people off planes?
I don't know.
I don't know how the list was used in the testing environment that Commutair had
left it open on the internet.
Yeah, you know, that's something I can't wrap my head around.
They're using it for testing purposes.
Why not use a testing file?
Why use the real file with real information in it?
It just seems like a really bad idea.
I mean, that's the thing.
It's like this was on Jenkins server.
The list was old, right?
It's from 2019.
And then the format CSV, I think, would have a lot of trouble with those alphabets we mentioned.
But then the question is, shouldn't there be – I mean, this information is pretty sensitive.
Shouldn't there be enforced rules on how it's used by the airlines?
One would think.
But again, we see this time and time again where these rules, if they even exist,
just are ignored or bypassed.
Yeah, when it comes to use of PII like this, a lot of organizations who have a testing
environment set up, like from a technical standpoint, it's the easy way out to just
take a snapshot of the real data, move it into the testing environment, and do what
playing with it you have to.
To come up with new data would take work, and it would be too much like work.
And even when it's like ultra-sensitive PII and new data, it's still too much like work.
And newsmaking stuff like the no-fly list, I think the temptation had to be there to
just use what they had rather than do things basically the safe way.
Yeah.
For the benefit of listeners, we've mentioned Jenkins and Shodan.
Does anyone want to give an explanation as to what those are just so people have a better
sense as to how this data exists and how it was compromised?
Well, I don't know.
Shodan is a search engine of sorts for things that are open and online.
I don't know much more about it.
Can someone else elaborate on how these tools were used?
No.
So I can talk about Jenkins.
That means it's a way to process builds.
So if you are working on software that's not, you know, released, it's a way to process
it, it's still internal, you would use a software like Jenkins to deploy it or move
it down the pipeline.
Okay.
And Shodan, as Kyle said, is used to find things like video cameras.
That's what I thought it was.
I don't know what form it is if it's a program.
Is it compatible with washing machines?
You would find washing machines.
It probably can be because it basically exists to find the kind of servers
that internet connected devices of various types would have on the internet.
So just various things that are connected up and making their presence known, Shodan
finds them and you can search them.
So that's what this researcher was doing.
And I imagine researchers are doing this constantly.
Is that right, Lorex?
Yeah, I think that step one, boredom.
Like so many of my other hacks, this story starts with me being bored and browsing Shodan.
Well, technically it was Zumai, which is the Chinese Shodan, looking for exposed Jenkins
servers, which I think Maya has done before and successfully found source code, which
was the theme and one of the main leaks that they used to put out on their Telegram channel
was source code that was exposed in these sorts of testing environments.
So this was very much within the theme of how Maya usually works.
So when something is found, what is generally the next step after that?
I think it depends on the person.
We at DDoS Secrets hear from a lot of sources who have a higher than average curiosity for
what is out there and what can be discovered.
I know that Maya has been criticized for basically not reporting this directly to the company
and leaving everyone else out.
I think Maya did report it to the company and the company fixed it before the news report
came out.
But Maya also involves journalists and communicates to the public when these sorts of things happen,
which a lot of security researchers criticize it for.
But yeah, so it really depends on the person.
We at DDoS Secrets frequently hear from sources who find data that they think needs to make it
out to the public.
Now, when someone contacts you, you generally are very responsible with the data that is shared.
As you mentioned before, only researchers or certain journalists are even allowed to
view something of this nature rather than just posting it online somewhere where anybody
could just download it and use it for all sorts of nefarious purposes.
Do you get any pushback to that policy?
Yeah, all the time people who wish that they had access to our limited distribution data
sets are challenging our decision to keep something on the redacted stream.
But yeah, we basically don't have the staff to redact the PII from everything that we archive.
And we do publish a lot publicly.
There are a lot of data sets that don't consist of mainly PII for people who are unrelated to
the public interest.
If it's data of politicians and corporations, then that's different than if it's a database
of all of the citizens from a given jurisdiction and their ID numbers and their addresses.
So we get pushback on both sides, I think, from people who wish that we published more
torrents and public access data sets and also from people who don't think that we should archive
hacked data at all.
Well, if you're annoying people on both sides, you're probably doing something right.
So that's a good thing.
But how do you compare yourself to other organizations such as Wikileaks in the past
when they would simply publish all this information?
I guess that's probably the difference right there is they would publish a lot of this
and not restrict access in many occasions.
At times they did, but they've been criticized for not doing that.
And that's what DDoS Secret seems to do differently.
Yeah, I don't think that Wikileaks had a category for reserved data sets.
Different reasons.
They've also published less stuff and added less stuff to their archive over the years,
like volume.
Then we have, I mean, there are a lot of differences.
I think that DDoS Secret tries to be less centralized around one person.
We try to have multiple people doing multiple things so that if one person
gets locked up or disappears, then the work wouldn't necessarily stop.
We have a non-profit in the United States, which I don't think that Wikileaks has
officially a non-profit.
I think that they're registered as a for-profit corporation in Iceland.
And then they have some non-profits in Germany that process donations for them.
But they're not necessarily reporting their own finances in the way that we are to the IRS.
I don't know.
There's a lot of differences between us.
Yeah, I do think that because Wikileaks doesn't publish or doesn't archive stuff in a reserved
way, they've had to make different decisions about stuff that they put out there.
So it's working for us so far.
Although this week, with the amount of requests for the no-fly list, it has
the system sort of like slows down when you're just humans processing these requests.
I can imagine.
Now, have you been targeted by any kind of agency or threatened with all sorts of legal action?
In the past, we have lost a server to a law enforcement seizure in Germany.
This was in 2020, I believe.
2020, Blue Leaks.
You covered it at the time.
But we published more than 250 gigabytes of data from U.S. law enforcement, fusion centers,
and training facilities.
And they got one of our public distribution servers taken offline that was in Germany.
We did lose some data, some indexed data, and like a search engine at the time.
So that was pretty annoying.
But recently, we haven't had any new letters or indications that the no-fly list in particular has
pissed anybody off.
Wow.
Now, how can people reach you if they find themselves in that particular situation?
If they find themselves in that particular situation where they've discovered something
and they want someone responsible to be able to guide how or if it's released,
how would they make that initial contact?
We have an email address, submissions at datasecrets.com.
We also have chat accounts that they can contact if they don't want to put it in an email
and talk to us about the data set.
We ask that sources contact us after they have a full copy of the data set and not when they're
like in the middle of anything because we don't want to be involved in anything that happens
until the data has been reviewed by them.
So yeah, contact us.
Contact us.
Details for like what's the most up-to-date way to reach us is on datasecrets.com.
And I imagine people can make contributions as well.
Contributions.
Yeah, there are a few ways that people can contribute to the project.
The most helpful way is like seeding the torrents.
When we put new data out, download it and leave your connection open so that other people can
grab it quickly and efficiently.
We are also like a registered non-profit so people can donate to us and get a tax write-off.
Yeah, datasecrets.charity is where we have sort of like a donation page.
Was that what you meant by contribute?
Other things that I missed.
Because this kind of thing, it takes such courage and it takes such fortitude in just
continuing day by day to try and share this information in a responsible way.
On that note, what kinds of requests have you been getting for the no-fly list?
Some of them might be funny.
Oh, yeah, I mean, because this sort of made a big splash on TikTok, we've been getting a lot of like
high school students who are really interested in this like relic from the 2001 era of like a no-fly
list.
So there's like a lot of that, which I mean, I hate to say no to, but I also,
yeah, I remember myself in high school and I wasn't necessarily the most responsible researcher.
So there's been some of that.
There's definitely been like
intelligence community, like international intelligence community.
I think that the Brazil Secret Service approached Maya and asked for it.
And Maya was like, no.
Wait, they don't have it already?
Secret Service of Brazil doesn't have access to this?
Yeah, I guess that the US has locked down access to this data to certain countries.
And that sort of does show up in the list.
It's like, which countries have intelligence sharing mechanisms with the US?
Because those countries would have more names on the list.
I know that like Ireland has quite a few like Irish names on the list.
Like members of the IRA or something.
Yeah, but there's like a lot of countries on names on there.
There was a report from Italy.
They found like mobsters and communists from, what's it called, the Red Brigade.
Oh, the Red Brigade.
I remember them from the 70s.
Wow.
Okay, that's probably a badge of honor for many people to be on the list.
That is simply incredible.
Hey, we're down to our last minute or so.
Anybody out in Skype land have any questions for Lorax before we go for the on-air part of the show?
No?
Nothing?
Robert, your lips are moving, but I'm not hearing anything.
Just thanks for keeping it going.
And yeah, the URL for DDoS Secrets, again, is D-D-O-S-S-E-C-R-E-T-S?
No, just one S.
Just one S.
I would get the other domain too, just in case somebody types that wrong.
Because I imagine a lot of people do.
And Ken, your domain still can't be typed on Twitter, right?
Correct.
You can't put DDoSSecrets.com on Twitter.
But you can put DDoSSecrets.charity on Twitter.
Oh, okay.
Yeah, folks, try it.
If you type DDoSSecrets.com on Twitter, your message will not go through.
It'll fail.
Even private messages.
It's the most insane thing.
And I don't know of anyone else that that happens to.
It's really silly.
But indicative of the kinds of challenges that you face when you're involved in something like this.
Lorax, any final words from you?
Things you want people listening to the radio to know about?
No, I mean, thanks for having me.
It's great to chat.
I'll stick around for the after show.
Great, great.
And that after show, by the way, is called Overtime.
It takes place on YouTube on channel 2600.
Or you can click on the link that appears at the top of the 2600.com web page.
And we can take phone calls over there.
Which we can't do over the radio right now.
Because we're not at the radio station.
But hopefully someday we will be again.
All right, that's it for this week.
We're off next week.
And as I said, we'll be on YouTube in just a couple of minutes.
8 o'clock p.m. on channel 2600.
Good night.
8 o'clock.
8 o'clock.
8 o'clock.
Once again, a reminder, Off The Hook is not on next week.
However, there will be 2600 meetings a week from this coming Friday.
So please visit 2600.com slash meetings to see where your local hacker meeting will be taking place.
Again, stay tuned for Overtime over on YouTube.
And keep listening to WBAI.
8 o'clock.
8 o'clock.
8 o'clock.
This is Ralph Poynter.
Join me and others every Wednesday, 8 to 9 p.m.
Eastern time on WBAI 99.5 on your radio.
Now, it would appear the human movement is such that at any moment in history,
there are too few that understand possibilities of existence that would benefit all who inhabit
this planet and are willing to act on this understanding.
This program will feature that few.
What are your views on these issues that impact your life today?
What are your views on America today?
What are your views on America's future?
Can we talk?
Call in 212-209-2877 Wednesday, 8 to 9 p.m.
on WBAI 99.5 on your radio.