177: National Public Data

24:28We're going to take a quick ad break here, but come back because this story is about to take a whole new turn.

24:43in all kinds of ways. Crashes, slowdowns, regressions, the stuff you only see once real users hit it. Sentry, that's S-E-N-T-R-Y, catches all of it. You get traces, replays, errors, profiles, and the details around them like stack traces, commits, releases, and the developers who broke it, all in one connected view. So you're not jumping between tools trying to figure out what happened. Sentry shows you how the request moved, what ran, what slowed down, and what the user saw seer centuries ai debugging agent takes it from there it uses all of that century context to tell you the root cause suggest a fix and can open a pr it also reviews the prs for you and flags breaking changes with a fix ready try century and seer free at century.io they have a free dev plan and listeners of the show can use the code darknet for 100 in century credits when you go to Sentry.io that's spelled S-E-N-T-R-Y go to Sentry.io and tell them I sent you by using code Darknet for$100 in Sentry credits.

25:50There's a new character who comes into our story now. His name is Salvatore Verrini Jr. but I'm just going to call him Sal. He wanted to get into the entertainment business and decided to produce and star in his own TV shows. and he was swimming in it. He owned a mini mansion near Miami with palm trees and a three-car garage, had a hot red 57 Chevy Bel Air and a hot wife. He was a successful guy. But I went and watched his biggest show, which is called Country Days with a Z. It streams on Amazon Prime. It's a staged reality show starring him and his friends. Here's a clip from two minutes into the first episode.

26:29See what you think. Hey, everyone. I'm Sal, the CEO of Everything Country. You know the best part about owning your own business? You get to hire all your friends. Yeah, baby. That'll look good. Hey, what's up, Sal? What's going on, Big Mike? Ah, nothing, Mouss, man. What are you up to? Ah, nothing. What are you doing? Ah, nothing. Hey, man, I gotta tell you something. I got a video. I got 100 % proof the Earth is flat. You gotta take a look at this. Okay, so a little backstory on Mike. Mike is what they call a flat earther. And, well, they think that the Earth is actually flat. I mean, like really?

27:05Dude, again with this. I'm telling you. It's round. It ain't round. Mike. Just take a look. No. I'm going to lose five minutes of my life watching this again. You'll probably gain five minutes. Oh, dude, come on. I'm telling you. I promise you, you will. Copernicus, it's round. Copernicus is the guy that, that guy. You can't even say it. Whatever. That guy's all over in his grave. He's the guy who thinks it's round. I'm the guy who knows it's flat. Okay, I have to stop there because they just keep going on and on like this for a long time, like way longer than they need to. But I played this clip for you to give you a sense of what Sal is like.

27:41And I think Sal is not only the star of the show, but also the writer, the director, the producer, the editor. He did it all. I was curious, so I checked. Turns out nobody watches this show. If you go on IMDb, reality shows usually have like five, maybe 10 ,000 reviews. Country Days has 11 reviews. Nobody's watching it. Sal's personal IMDb page lists his other shows and movies. Some of them don't even exist. There's a few pictures of him in an action movie, except if you go on his Instagram, he admits that those pictures were just taken in a photo shoot that he paid for. Which, when I think about it, I admit I did that once too.

28:20In high school, I somehow faked my way into the picture with the football team. So if you open up the yearbook that year, it looked like I made the football team, but I was never on the team. So who even is this Sal guy, though? Where is all this money coming from? If his shows don't have any audiences, how has he got that big house and all the money to run a film studio? Well, here's the truth. He always wanted to be an actor. He was in school plays and got on a Burt Reynolds show as an extra. He studied theater in college, but it didn't work out for him at all. But his dad, Sal Sr., is a prominent lawyer in Florida.

28:52And when Sal crashed out as an actor, Sal Sr. probably hooked him up with his next gig in a sheriff's office as a deputy. Yeah, Sal became a cop. And it was a huge setback for his dream. But Sal didn't give up. He believed in himself, and he hatched a new plan to rekindle his Hollywood dreams. And I think it was here, while working in the sheriff's office, that he noticed something which gave him an idea to make money to pursue his dreams again. Years ago, if you wanted to get someone's photo or know their daily routine or who they're in a relationship with or get their phone number, stuff like that, you'd have to hire a private investigator who would tail the person and gather what they can.

29:34But today, everyone is posting their own private data voluntarily online, especially social media. We see photos of people's kids, their accomplishments, their vacation photos. We see them with their new lover or their new home renovation. Sometimes you just see people post their whole day on social media. We don't need a private investigator or to get information about where people are and what they're doing and what they look like or any of that stuff anymore. It's just all there on social media. And so there are companies that go on social media and scrape all that data to provide it to cops.

30:12Like I remember a few years ago, there was a whole controversy about a company called Clearview AI and they were raiding major social media websites. They'd take Facebook, for example, grab every picture and bit of information they could off of everyone's account and then add it to a file that was created about them. Then they'd repeat for Twitter and LinkedIn and wherever, automatically. Of course, the social media companies got mad. They're like, hey, that's our data. You're profiting off our data. Then they sent Clearview AI a cease and desist letter. But even those megacorporations couldn't stop it.

30:42If anything, Clearview is bigger today than they've ever been before. I just saw that they signed a$10 million contract with ICE. So keep that in mind. Your social media posts are likely scraped and processed through AI and are easily accessible by ICE agents, even if you deleted your post. And for the record, I don't think this is right. The Fourth Amendment says we should have a reasonable expectation of privacy. It says the government has to have a warrant to conduct a search. Yet ICE is able to get tons of data about us without a warrant. And the loophole they found is that they're allowed to just buy data from data brokers.

31:19It's the data broker loophole. And the thing I hate most about this is we never gave them permission to exploit this loophole. We never voted on this. We never collectively agreed that data brokers are cool and it's totally fine for the government to buy data from them and get around having to have a warrant to conduct a search. This was all decided without our input or support. And the government hides all this from us. They hide how much they pay data brokers to get information on us. I'm disgusted by how much the government spies on us without a warrant. when it's clearly a violation of the Fourth Amendment.

31:53The thing is, this business model is very profitable for data brokers. They are incentivized to gather as much private data about us as they can since the more they have, the more the government will spend on it. They are in the business of brokering your personal data. And I think Sal saw how important these data brokers are to law enforcement. and maybe he even caught a glimpse of how much the contract was with one of these. And he might have been like, whoa, I'm in the wrong business. So Sal quit his job as deputy and decided to start his own data broker service. He created three almost identical websites, Records Check, Criminal Screen, and the flagship site, National Public Data.

32:39He hired some cheap programmers in Bangladesh to code the initial website for him. Then he started collecting everyone's data. You can think of the data he collected in two buckets. There's what the government publicly posts about us, such as bankruptcy filings, court records, motor vehicle records, death records. You'd be surprised how big this bucket is. You ever buy property? Yeah, you're in a public database. You got married? Yep, that's public data too. Registered to vote? In some states, you're in a public database. Then there's bucket two, the dirty work. Scraping it, sneaking it, stealing it, buying it.

33:12I'm not sure what the rules are here, but it seems like data brokers treat rules more like guidelines than actual rules because they'll go to great lengths to get private data from people. Sal either bought or scraped data from other data brokers, subscription and marketing lists, loyalty and rewards programs, social media, and other apps. Some brokers even collected the data leaked by hackers like USDOD. Eventually, Sal had collected not thousands, not hundreds of thousands, not millions, but hundreds of millions of Americans' personal data records. Then he packaged it into individual profiles and sold access to law enforcement or whoever wanted to do people search.

33:52And it worked unbelievably well. In 2022, Sal made$750 ,000 from selling our data. And in 2023, he made$1.15 million. And he almost instantly turned around and used the money to make his own TV shows. Here's what he spent his money on. I'm telling you. It's round. It ain't round. Mike. Just take a look. No. You ever watch those NASA videos? CGI, bro. No, please. CGI. They're sitting there flying over to Earth. You see the Earth below. You see the Aurora Borealis. You see it cruising around. Green screen. Green screen. It's all fake. They green screen the Aurora Borealis. They proved it on here.

34:29Would you just take a look at it? Trust me on this. I'm getting dumber by the minute. I'm looking at Sal's financial records now. And there's something telling about the way he spent his money. The data broker company's total cash in the bank is$563. Insurance expense,$1 ,327. Cybersecurity budget, zero. Salaries? Yeah, there were no salaries. He ran it all by himself with two desktops, a laptop, and file servers in his home office. To me, the way I see it, Sal's data broker business was only set up for him to make as much money as possible and didn't spend a lot of effort protecting this data or securing it.

35:13So now that you know what Sal was cooking up, let's go back and focus on Luan, a.k.a. USDOD. By this point in 2023, Luan was trying to get his military intelligence business set up and needed a lot of military identities to impersonate to get more data and decided to hunt around for vulnerable data brokers. He found Sal's data broker site called Records Check. Records Check advertised instant background checks, social security number traces, and more. Perfect. Luan was now laser-focused on this site, locked in, trying to look behind the curtain to see everything the site had on people. He used a tool to try to scour the site and see every file and image that was publicly viewable on this site.

35:59And one file stood out, members.zip. What is this file, and why is it just in the open for anyone to grab and look at? He grabbed it and looked at it. Members.zip had Sal's site's source code, and buried inside the code were admin credentials. Luan just got the email and password to access any corner of this site and all the data in it. So Luan logged in to Records Check as Sal, but then discovered the site was connected to two other sites. And guess what? Sal reused passwords, which allowed Luan to log in to National Public Data, which gave Luan access to the biggest set of data that Sal had.

36:48And Luan took everything. 2.9 billion lines of data. 277 gigabytes worth. Personal information about hundreds of millions of people. If you're listening to this and you're American, chances are you were likely in this database. Then Luan does what Luan does. and he posted it for sale online as USDOD with the cute little kitty picture, and he put the data up for sale for$3.5 million. TikTok was outraged. This is a public service announcement to remind you to check your credit files. I just received an alert from my credit card and also from my credit reporting agency about my data being leaked online.

37:352.9 billion records. One of the largest data breaches in recent time. Why is this one important? Because you're not a subscriber to this service. This is for running background checks and fraud prevention. And so they just randomly collect data about billions of people without your consent. We have to protect ourselves now. Although we're going to have a lawsuit against NPDs, they did not protect our data sufficiently. The problem is the data still got out into the public domain. The problem with the NPT data breach is that it is a scraping company that was designed to find out everything it can about you.

38:20Now, if they're a data brokerage company that has other information about you, a hacker can start to put together an identity profile on you. And then with that identity profile, breach your security. We all know that data breaches happen all the time. But the most recent one has been with national public data. It was over 3 million people's data was breached. That's from the UK, US, and Canada. At the beginning of this episode, I told you about how that guy Matthew Kieran stole William Woods' wallet and later his identity. And all it took was for him to get William's name, birth date, and social security number.

38:56And from there, it was enough to impersonate William for decades. National public data leaked full names, birthdays, social security numbers, home addresses, past addresses, email addresses, and phone numbers, all in plain text. A lot of it had errors, but most of it was accurate. The ramifications of a data broker having a data breach is huge. Catastrophic to some people listed in the breach. Researching this episode, I came across all kinds of horror stories of people who had their identity stolen after a data breach. Like a bunch of people in Oakland, California. After the city was attacked with ransomware, they interviewed one guy who was on the news and he said that criminals had impersonated his identity and they were taking tens of thousands of dollars in loans out and making purchases in his name and he was on the hook to pay it all back.

39:46And so you can imagine the huge nightmare that he had to try to convince the bank that he didn't spend any of this money. That hardly compares to this other girl I read about. She was in Florida, and she tried to sign up for her first credit card when she went to college. But she got denied because they told her that she already owes one and a half million dollars, and she's in huge debt. Apparently, someone had been using her identity since she was nine years old. Another crazy story happened to an LA Times reporter. After her wallet was stolen at a bar, she knew it was gone minutes after it happened, so she thought there was enough time to act before something bad happened.

40:21So she called the bank, she called the police, she called everyone. but it didn't matter. The thieves used her info from her wallet to get her social security number online and for a whole year, they opened dozens of credit cards in her name, they rented cars in her name, got new iPhones and wrote tons of checks, sometimes more than$10 ,000. And that's just a couple of things criminals can do if they get your information. We've already talked on the show about SIM swaps. If a scammer knows enough about you, they can convince the phone company to transfer them your phone number. Then they can log into your bank account or crypto accounts and steal all your money.

40:57I read about multiple people who have lost millions of dollars this way. So I'm sure the victims exposed in the national public data breach have faced a lot of similar nightmare scenarios. And despite victims being hit with this, they might not even have a clue that national public data is what leaked their data. It's really hard to know how a thief got your info, you know? And the worst part is Sal isn't going to be on the hook for any of the damage done to the victims because how can you prove that the criminals got their data from this data breach when these criminals hide in the shadows of the internet and are seldom caught?

41:33This is one reason why I despise data brokers. They mistreat our private data and don't care how negatively it impacts us. They're incredibly greedy for our data, and then it gets abused in the worst way possible. This is why I've become a privacy freak over the course of making this show. I know these data brokers exist and are trying so hard to get my information. And I know there's nothing I could do once they get it. I can't opt out or ask them to delete me. God, I would love to send a cease and desist letter to Equifax and tell them, please delete all my data and stop spying on me. But no.

42:04And I know it's just a matter of time before criminals get their hands on my data, either from a data breach or buying the data somehow. There's just no way to protect it. And since I know if someone gets my data, it could be catastrophic to my life. So that's why I take extreme steps to hide from these data brokers, even so much as wearing a disguise when I go in public sometimes. In fact, many of you even have met me in disguise and only know what I look like in my disguise. It's the only way that I feel like I can empower myself to stay safe in today's internet age. I use fake personas, burner phones, burner emails, even burner credit cards, and I'm super secretive about my personal life when I go online.

42:44Anyway, God, these episodes always get me ranting about privacy. Sorry, I know some of you don't care about your privacy, so I'm going to move on. But someday I hope to get through to you. I mean, I just want you to understand this one thing. Most companies won't protect your privacy, even if they say they do. They share it with data brokers, and they'll profit off of it, or they'll just lose it in a data breach. The only one who can protect you is you. A couple months after this leak, he taunted CrowdStrike, a cybersecurity company. claiming he hacked into them and he got all their threat actor lists and their indicators are compromised and he has it up for sale.

43:19Well, the thing is, CrowdStrike has some pretty impressive cybersecurity researchers and investigators. So they started looking to see who USDOD was. And they discovered he uses the same email address for GitHub, all the blogs and social media accounts he has everywhere. It turned out that for years, Luan only used one email for everything he did, hacking or non-hacking. So CrowdStrike was able to figure out his name, address, phone number, tax registration ID, and more. Basically, Luan got doxed, but privately. CrowdStrike, law enforcement, some news outlets had his details. And Luan admitted to what he had done, and the dox were true.

44:00But he wasn't done. I saw him tweet, this is not my end. And then he offered his services to the Brazilian government, but that didn't go well. Now that law enforcement knew his name and location, the Brazilian police swarmed in on him and arrested him and took him to jail. Sal was doxxed too by reporters, but he just lawyered up and went silent. It didn't go well for him. Congress wrote him a letter calling National Public Data's lack of transparency staggering. Now he's being sued for everything he's got, and then some. Multiple class action lawsuits are against him by people who are in the data set.

44:37unless country days takes off this year, he will not be able to pay off even a fraction of that. And you would think after having a catastrophic incident like this, Sal would just shut down national public data and maybe go back to acting or something. But if you visit nationalpublicdata.com, it's still there. The site's still up, collecting our data and selling it. Sal tried to declare bankruptcy, to wipe out his debt to society, but the judge just saw right through that and did not accept his bankruptcy plea. So then Sal supposedly sold his data broker company to another company, which is ironically called Perfect Privacy LLC.

45:16But you won't find much about Perfect Privacy LLC online, but you'll find plenty about yourself if you search your name on their website. The revamped National Public Data advertises that. You can find pretty much anything you need from someone's contact information, location, age, and birthday, to workplace, relatives, and criminal records. Which has to be the craziest thing about this whole story. Like a data broker can have a total breach and then continue operating, scraping my data, storing it without my consent, like nothing happened. So what's the solution here? I don't think politicians are an ally here.

45:52They aren't going to enforce any kind of data privacy law since they're the customer for many of these data brokers themselves. I mean, the government is who mandates that Equifax must be allowed to collect data off of all U.S. citizens without their consent. And even if the government wasn't using data brokers, they'd claim that they need our data for national security reasons. So I think they are no help here. But then I was caught off guard when I read that 85 % of the members of Congress were also included in the national public data breach. And a lot of them seemed pretty upset about this breach and wanted to do something about it.

46:30So in April 2024, they did. Weeks after Luan put the 2.9 billion records up for sale, Congress and the Senate proposed a nationwide privacy law called the American Privacy Rights Act. It listed protections Americans should have, but also had a rule where anybody could file a form with the government to prevent data brokers from collecting their information. That is, submit a single form and all the American data brokers would have to delete your information if you want to opt out. Democrats and Republicans liked this bill. It went up for a vote. But then the day before they voted on it, it was sabotaged.

47:08Lobbiers came in and put pressure on politicians who then started watering down the bill until most of the useful privacy protections were gone. And after that, the whole thing died. So the American Privacy Rights Act never got off the ground. And this is what I mean. No one is going to save you. No one is going to protect your privacy. You have to do it. And lucky for you, there are easy steps that you can take to protect it. I mean, just thinking right off the bat, stop using text messages. Those things historically have been insecure, and they typically are end-to-end encrypted, and they can be monitored by phone companies.

47:41So a chat app like Signal takes extreme steps to never be able to see chats. Even if someone pointed a gun to their head, they would not be able to read your messages. And the same goes for end-to-end encrypted email providers like Proton or Tuda. They cannot see what's in your emails. Compare that to something like Google, who looks through all your emails to provide ads for you. I also highly recommend a web browser that cares about your privacy. Google Chrome is the worst on the list. Every character you type into the address bar gets keylogged and sent to Google. They want to know everything about you.

48:14So I use the Brave browser, which makes enormous effort to not collect anything from me. So those are three quick and easy wins. Use Signal, use an encrypted email provider, and use a privacy-focused browser. because it's not just about stopping Sal or Luan from grabbing at your data and exposing you. You want to future-proof yourself from tyrannical regimes that are also trying to hoard your data. You might be okay with who's in charge now in the world, but that's going to change one day, and whoever inherits your data next might decide that you're a criminal. Then it's too late for you to do something about your privacy.

48:53In the end, Luan, a.k.a. U.S. DOD, is still in a jail in Brazil. Since Brazil doesn't extradite their citizens to the U.S., he'll probably just serve his jail time in Brazil and is likely never going to go to the U.S. And one newspaper speculated that he's facing about four years in prison, but we don't quite know what his prison sentence was.

49:24Are you a premium subscriber of Dark Knight Diaries? If not, why not? Listen, I'm certain that you've bought a book or paid to go see a movie before you knew if that book or movie was any good. I don't want to do that to you. I want to give you this show for free in order to prove its value to you and show you that I'm worth pitching a few bucks at. Have I done that? Does this show bring you value? you? Do you learn from it? Do you get entertained? Does it help you get through a long car ride without being too bored? If so, I want to ask you to become a premium subscriber to show your thanks. And hey, if you do, you'll get ad-free episodes and bonus episodes.

50:07There's actually 12 episodes in the premium feed that don't exist anywhere else. So please consider signing up. Go to plus.darknetdiaries.com. I really appreciate it. This show is made by me, the pasta pwner, Jack Rees Sider. This episode was written by the DDoS attack dog, Nate Nelson's sound design by the VHS vandal, Garrett Tiedemann. And this episode was assembled by the cruise controller, Tristan Ledger. Mixing by Proximity Sound, our theme music is by the mysterious Breakmaster Cylinder. My data has been in many data breaches. And once a hacker messaged me saying, I have everything, bro.

50:44I have your name, your password. I'm like, no way. Oh, my God. Thank you, I've been looking for that password for years. This is Darknet Diaries.