The FBI Was Hacked. We’ve Seen the Data

0:00Push your limits, train with precision, see the results. At Equinox, that's high performance loving. Everything you need to lock in and unlock your potential at Equinox. Start today at equinox.com. I think anybody who has touched this information is potentially a target. They really want to find out who is in the FBI specifically.

0:27Hello, and welcome to the 404 Media podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. gain access to that content at 404media.co. Also, do remember to subscribe to our YouTube channel where you can watch all of our episodes. Subscribe at youtube.com slash at 404media.co. I'm your host, Joseph, and with me are two of the other 404 Media co-founders.

1:10First being Sam Cole. Hey. And Jason Kebler. Hello, hello. Hello, Sam. Do you want to ask me about the FBI? Yeah, I'll ask you about the FBI. Our friend's the FBI. So this has been a story that's been like, I've seen it everywhere. People are sending me clips of people talking about it everywhere. It's been like the story for the past week. So let's break it down. The headline is, we hacked the FBI. Hackers say they have data on all FBI employees. And just to be clear, there are quotes around, we hacked the FBI. We did not hack the FBI. Hackers hacked the FBI. So how did you actually find out that hackers had hacked the FBI?

1:47Yeah, so I get a notification on my device. I pick it up. I see it's from Shiny Hunters, and they often ping me about new breaches, and they often ping a bunch of journalists as well. And the text message reads, quote, We hacked the FBI. We hold data on all FBI employees and applicants. It then goes on and describes the services they've hacked and that sort of thing. it says we've defaced an FBI website as well and it has a screenshot of that which is useful for verification purposes because it shows they actually did hack something as well. And then they say we have a bunch of data. Most importantly, they eventually give a sample of the data which I guess we can talk about in a minute as well.

2:37But the significance of the breach became pretty apparent very, very, very quickly. Like this hacking group has broken into an FBI service and they've stolen a bunch of data on what they say is all FBI employees. And this isn't just like some rando hacking group or a random person. This is someone that we know. So if listeners of the pod or readers of 4.4 and even readers of Motherboard probably will recognize the name Shiny Hunters. So who are Shiny Hunters? Who is the group? What else have they done that we might have heard of? Yeah, so Shiny Hunters, although they may disagree with this, so I think this is probably fair to say.

3:15They do come from the overarching, strange ecosystem of the comm that we've covered a bunch, which are these predominantly English-speaking hackers in North America, so Canada, America, some in the UK, and it looks like some spreading across Europe, and actually some in the Middle East now that we've seen a little bit as well. but they come somewhat from that ecosystem. And Shiny Hunters has been linked to a ton of different data breaches, not over the months now, over the years, right? They've kind of surfaced under different names. There's all of these different groups. Like back in the day, there was Lapsus, which got, I think, GTA data.

4:03And then there's Scattered Spider, which is a name given to a bunch of people who started the SimSwappers. Then you had Scatus Lapsus Hunters, which they called themselves. And then Shiny Hunters, or Shiny sometimes, has been around for a long, long time, operating around this sort of very nebulous community that's sort of very, very hard to pin down. But most recently, I believe, if I'm remembering correctly, again, with all these different names, but they were linked to the mass doxing of a bunch of ICE officials as well. And we covered that at the time because that was very interesting. It was sort of at the height of ICE's mass operations, sort of the mass raids.

4:48Usually what Shiny Hunters does is they will go into a company, they will hack it, they will extract data, they will then threaten to leak it to the public on their Tor hidden service we can go download it unless the victim pays, obviously. You know, pay hundreds of thousands or millions of dollars in Bitcoin or whatever. And if the company doesn't do that, they then release the data. And we'll talk about how this one's a little bit different later. But that's who Shiny Hunters is. They are, frankly, a prolific hacking group, collective, amalgamation. They have a lot of stuff going on, for sure.

5:25I crack up every time we talk about the names of these hacking groups. And I'm sure we've talked about it before on the podcast. but like you and Lorenzo Marteschi-BRI had done a blog that was like Shiny Hunters is like a Pokemon training gem or something. Well, they lean into that now. They have like a Pokemon like on their defense webpage. Oh, really? I didn't realize that. That's funny. So yeah, let's talk about what was actually in the data. So what are we talking about here when we talk about what was hacked? Yeah, so Shiny Hunters says they've hacked the FBI. I say that's very interesting.

5:59please could you provide a sizable sample of that because I need to verify this obviously first of all they send data on a particular FBI agent and their spouse and it includes their name address phone number the name of the spouse obviously immediately that's already pretty sensitive stuff like oh wow this is where this FBI agent apparently lives and that sort of thing. They also said that this agent was somebody that was part of the broader investigation against shiny hunters. So it shows that these criminals are thinking about, well, maybe we can find people in here who are investigating us.

6:38And in the past, we've seen people in this sort of community harass the FBI agents who target them. I've received and obtained a bunch of phone calls where hackers or criminals will phone up the specific FBI agent tracking them and harass them down the phone and like call them all sorts of slurs and names and all of that so there's that i needed more data though and then shiny hunters sent this spreadsheet this file of 5 000 fbi officials and their spouses and sometimes their parents as well i don't think we've actually mentioned that in the articles but yes it includes names multiple phone numbers addresses the spouse the parent, that sort of thing.

7:24And then that's sort of the personal side. Then there's the national security counterintelligence side where it includes like their job specifically. So I went through and then I found there were several people in there who were clearly linked to the remote operations unit, which is the really secretive part of the FBI that's basically his hacking team. These are the ones that are remotely breaking into phones, into computers. Back at Motherboard, I did some coverage on them where they've used classified hacking tools and normal criminal investigations. Like, the FBI does not talk about this hacking unit, but they were in the data as well.

8:04You then had Reuters go and dig through the data and found there were a bunch of FBI officials who investigate Russia and China in there. So this is obviously very interesting to foreign state actors where they can find out these are the specific agents who are tasked with investigating our country and maybe the criminal elements in us or maybe our governments as well. And then finally, there's also medical stuff in there. This wasn't in the sample I was given. Shiny hunters mentioned this early on in our conversation because they said medical data has also been taken. And I should say that the breach here sort of centers around an FBI job portal.

8:45And it includes applicants as well, but apparently a bunch, well, definitely a bunch of current employees as well. The BBC reported that the data also included like urine and blood tests from an FBI agent. And then Reuters added that the data also included like a psychiatric evaluation. So this is, I don't think you can get much more sensitive than this. both in the fact that it's the fucking FBI and also just how incredibly sensitive this data is, like on a personal level. Did they say at this point why they did it? It wasn't just for like shits and giggles. It was for a reason, right? Yeah. So...

9:27Sort of. Sort of. It's all very unclear and you do... Kind of all you have to go on are shiny hunters' statements and their actions, which I think we'll get to in a second, which is sort of what happened next. So the state of reason why they did it was that Shiny Hunter said the FBI previously published some sort of cybersecurity report, right? They do these publicly and they say, oh, you need to watch out for these hacking threats or whatever. In this case, the FBI said that shiny hunters, in their perception, often exaggerates the claims or inflates the claims of sensitive data that they have access to.

10:12The FBI said that shiny hunters will often send threatening text messages or phone calls to victims or their families to try to get them to pay. And they may sometimes engage in swatting. I'll say based on my coverage of the com that all tracks I don't know if Shiny Hunters specifically has ever done any of those things but that's what the FBI says Shiny Hunters they say they take issue with that they think this is inaccurate so they say the reason that they hacked the FBI and then they gave the FBI a one week countdown was for the agency to delete that report or to correct it It's basically like the most aggressive correction request sort of you've ever seen.

10:57And we get those occasionally, but people don't, you know, go this sort of far. We'll get to the exciting conclusion of the one-week countdown in a minute. But at this point, what was the FBI saying about the hack? At that point, the FBI was just saying, we're aware of these claims of a data breach on the FBI jobs portal. we're investigating it all of that sort of thing you know very standard within the first 24 hours or something statement saying okay okay we're looking into it we're looking into it yeah I'm sure they can't say too much at that point because obviously it's really it's a really up in the air dicey situation so yeah the next day you publish a story about the like you said the hacking unit was part of what was exposed which is a big deal because the hackers are hacking the hackers I would assume the hackers at the FBI are the best hackers in the country, I would think.

11:49I don't know about that, but they could probably do with some help. But it's still very sensitive. Yeah, for sure. And yeah, it's like hackers, hacking hackers is what we have at this point. So things are getting serious. And that was a story that you published the next day. And then a few days later, I guess this is where we get to the week is up or close to up. The shiny hunters people say that they actually won't publish anything. So the headline for that story was, FBI hackers say they won't publish massive trove of FBI employee data. So was it kind of like, we'll see if they do, or we were assuming that they might at that point, or we didn't know?

12:29What was the feeling until they go ahead and say, we're actually not going to? Was it like, oh my God, they might actually make this data public? What was going on in that interim? Yeah, so it's very hard to say. and in my opinion, I didn't think they were going to post it. I didn't think they were going to dump the data of all FBI employees. And now, of course, it looks very convenient when they've said they're not going to and I get to go, oh, I never thought they were going to in the first place. But I've been speaking to a few people about this and I'm pretty sure I genuinely believe this in that if I thought they were going to dump it, I would have pre-written an article.

13:09You know what I mean? Like sometimes we do that with like, something's coming, let's pre-write 500 words, and as soon as it happens, we can do it. I didn't do that because I didn't think they were going to dump it. And the reason is, is because there was this previous massive data breach at AT &T, right? Where hackers there stole the metadata records of all AT &T customers. One of the most insane data breaches of all time also came from this sort of overarching community. and I think there's connections between shiny hunters and the people who did that as well. In that case, there was a lot of boasting, a lot of threatening to release the AT &T data.

13:51But kind of what ultimately happened was that it didn't all come out. People got samples. Criminals still mined that data for information on specific FBI employees, just like they've been doing here with shiny hunters and the FBI data. But one person in particular released, I think, the records of Trump's contacts and family. And I think Rubio's wife was in there as well. So it was a very small, select sample they published. And sort of that was it. So based on that happening before, I thought the same was going to happen here. Well, yeah, they give samples to a few journalists. Maybe they post a little bit online.

14:29I didn't think they were ever going to post the full thing. Maybe that's just me being hopeful, because that would be absolutely insane if they published names and addresses of, was it how many people in the FBI? Like 38 ,000, something like that. Like that would be absolutely insane. Yeah, that would be pandemonium. And then they're also saying at this point, we never intended to do it anyway. It's like, oh, we were never going to do it. They said it was all a marketing campaign to protect our business and actively combat disinformation. So you've been dealing with these guys for a while. What do you make of that sort of statement from them?

15:06I do believe them when they said that we were never going to release it for the reasons I just said, right? But then you also have to take, basically, all we have is their word at this point where they're saying this is all a marketing campaign where we just wanted to correct the record that we are a threat or whatever. And that's sort of implied by their early demands for the FBI to correct this report, which to be clear, the FBI is not deleted or correct that report, and the FBI was never going to do that either. Shiny Hunter says the media ran with this and the public misunderstood it. Shiny Hunter says they never used the word deadline.

15:42I think they did use the word deadline in communications with maybe other reporters. I'm not sure if it was with me. But yes, it was. Well, on one side, it was a lot of, you know, flexing and boasting and that sort of thing. And I feel like some people may almost be like, deflated or kind of disappointed like oh so like nothing really happened in the end no no no no the fbi got hacked they stole this two to three terabytes of data absolutely insane breach they gave a bunch of that information the 5 000 officials to journalists that then somehow got out to you know john hammond who's a cyber security researcher and a youtuber i don't know how he got that information either from a journalist or cybersecurity researchers have their own way of getting this data sometimes and then made a video about that it's not like this breach happened and then no one got the data the data is floating out around there and i think anybody who has touched this information is like potentially a target by you know foreign intelligence agencies like russian or chinese who like they really want to find out who is in the fbi specifically if they don't already know.

16:59And the more this data proliferates and sort of spreads around, increases the risk that not only it might become public, but that it might just fall into, you know, some really bad guys' hands. So like, yes, they didn't dump it publicly. This is still like a massive national security and counterintelligence issue, in my opinion. Yeah, I mean, it's pretty bad just that the FBI can be hacked and that the hacking unit of the FBI can be hacked. That's not good aside from everything else it doesn't give me a lot of confidence in the security of i don't know the intelligence but i guess yeah the i hadn't even thought about the the aspect of like everybody who had who has this data now could be a target also it's easier to hack a relatively random person who got hold of the data or a journalist or whoever presumably then breaking into FBI servers.

17:54So now you have like a bunch of squishier targets potentially who have this information that other people may want. All right, should we leave that there? And I'll take us to the next story. After the break, we're going to talk about, well, a really significant scoop from Jason about facial recognition and Flock. We'll be right back after this.

18:20there's a point in the afternoon where my brain sometimes decides the workday is over even though the workday is very much not over and i don't always want another coffee especially if it's late because i know i regret it honestly if i've cold brew after like 11 a.m i'm up all night that's where ultra pouches have been really interesting for me here's my ultra pouches We have the tropical flavor. These are nootropic pouches designed for focus and energy. And the big difference is they have zero nicotine and zero caffeine. Ultra partnered with neuroscientists who formulate them with ingredients like Infinity PX, L-theanine, Alpha GPC, and vitamins B6 and B12.

19:01They're designed to give you smooth energy and focus that lasts around one to two hours. I've been using Ultra off and on for the last few months. And I really like them, honestly, when I wake up. And then again, before that afternoon crash, I feel like when I was just using coffee to get through the day, I was always really anxious and jittery. And what I like about Ultra is that I can keep it near my computer. And if I need a little pick-me-up, I can take it. But again, it's super smooth so that you don't feel jittery. It doesn't keep me up at night. It's a very calm, focused energy. There's five flavors, Cool Mint, Wintergreen, Tropical, Watermelon, Blue Raz.

19:38My favorite, again, is Tropical. So anyways, check out Ultra. It's the ultimate guilt-free pouch, delivering instant focus and mental clarity without nicotine or caffeine. New customers can use code 404media to get 15 % off at takeultra.com. That's takeultra.com for 15 % off with code 404media. After you purchase, they'll ask you where you heard about them. Please support our show and tell them that 404media sent you. This podcast is brought to you by NordLayer Browser. NordLayer Browser is an enterprise browser that secures online work without getting in the way of productivity. It gives IT teams full visibility and control over every web-based AI tool, SaaS application, and download across the organization while making sure employees can still enjoy a seamless browsing experience.

20:27Designed for today's distributed workforce, NordLayer Browser helps companies protect access to their internal resources and prevent accidental data exposure. Go to nordlayer.com slash browser slash 404podcast and use the coupon code 404podcast10 at checkout to get NordLayer browser at 10 % off today. That's nordlayer.com slash browser slash 404podcast and use the coupon code 404podcast10. All right, we are back. We have to take a quick break because Jason's mouse had died because of the amazing design of the Apple mouse. Get a battery. No comment. Let's talk about our stories. Yes. Okay. Serious business.

21:10The headline of this one is Surveillance Company Tells Cops It Wants to Add Facial Recognition to Flock Cameras. I mean, this is huge, Jason, because Flock very explicitly says it does not do facial recognition. It says it does not want to do facial recognition. at least at the moment, when we got sent data extracted from a Flock camera, I dug through that for evidence of any sort of facial recognition capabilities and basically found nothing. But the fact that Flock says it won't and it isn't doing that still leaves a gap in the market, right? That maybe another company could come in and essentially slap facial recognition onto Flock cameras or their data.

21:57That is what you have found here. Enter Vidizmo. Briefly, what is this company offering to do? We'll get into more on the specifics in a bit. Yeah, so I guess first, Flox CEO Garrett Langley has been like, we will not do facial recognition. Like here's a short clip of him saying this. We will continue to make commitments to the communities we serve. Commitments that may differ from other companies in this industry. We will not sell ALPR data to third parties. We will not add facial recognition to our devices. And we will not weaponize our drones. And so essentially, Vadismo saw this. And they're like, well, we'll do facial recognition.

22:37We do facial recognition already. We can connect our facial recognition systems to Flock OS, which is basically the back end that Flock uses. It's its real-time crime center. And they essentially propose to, I mean, they describe it as, quote, close the gap between what Flock can do and what police want Flock to be able to do, which is in some cases, facial recognition. You know, Flock already does object recognition, and they do some predictive type things. And they definitely like, lean heavily into AI. And I actually talked to the CEO of this Spadismo company, which we can talk about more in a second.

23:14But he was like, Flock is not handling this privacy conversation very well, which is a very funny thing for this company to say. But they're basically just like, this is the way that the world is going. They should lean into it. Of course, we want to offer facial recognition on this type of technology. And this follows a trend that we've seen over and over again, which is where companies will say, companies that do surveillance will say, we'll do X, Y, and Z, but we won't do C. We won't do facial recognition. We won't marry one type of data with another type of data. They will draw their own lines in the sand or their own red lines for where they think their product becomes too privacy invasive.

24:04And then what inevitably happens is other companies see that gap in the market and they say, oh, well, we'll do it. And they can then differentiate themselves in that way. Yeah, I think a really good example of that is Clearview AI, for example, where you had Facebook and Google who could do a bunch of facial recognition stuff, but they didn't want to release that product. You did have facial recognition for cops, but we built on sort of their own databases or a proprietary database from the company. clearview crossed the line in like well there's all of this you know social media and venmo profiles and all of this stuff out on the web we're going to scrape our masks and we're going to make that available to cops this feels like a similar thing um as in filling a gap but for flock and facial recognition so how did you first hear about this company it comes from an email Right.

25:00Yeah. So basically a deflock group in Johnson City, Tennessee, which sorry, it's from the wagon wheel song. It's like perhaps it's a very small, small city in Tennessee, but they have a deflock organization there sent me this trove of documents that they foiled and I was going through it. They actually told me to look into something else. And while I was going through it, I found this Vidismo email where they, a salesperson for Vidismo reached out to Johnson City and said, hey, you guys have really championed Flock. You seem to be really into Flock. We want to help you make Flock more powerful.

25:39So I think the actual email is pretty important. So they said, quote, Flock safety generates plate reads and clips continuously. Your investigators use that data on active cases, but that Flock data does not connect automatically to your axon evidence system. When a Flock hit becomes relevant to a case, a plate read, a clip, someone is pulling it manually from Flock and handling it separately to the Axon ecosystem. Vidismo Intelligence Hub closes that gap. It brings Flock safety data, Axon body-worn camera footage, and any other evidence source into one searchable platform. Investigators search across all of it simultaneously by face, vehicle, or object in seconds.

26:19So they're explicitly saying you can take this Flock footage or license plate photos, whatever, and you can search by face. And then if you go to the Vidismo website, they have technical documentation about how this all works. And crucially, they had a page talking about how they would integrate with Flock. They said, here's how we would do it. We would connect to the Flock OS backend, that sort of thing. And then they also have pages and pages about facial recognition and the things that they can do with facial recognition and how their facial recognition system works. And this is already a company that's offering facial recognition to cops for cameras that they already have.

27:01And so this is like an evolution of something that they are already doing. Yeah. Crucially, you said in the technical documentation, it describes how the company would ingest flock data. Just to clarify, what is the status of this? Is it like a pie in the sky plan? Or is it like, hey, they have some concrete steps to do this and they're pitching it, but they haven't quite implemented it. Like what's sort of the status? Yeah, so they don't have any contracts with police departments specifically to connect flock data at the moment. They are pitching it now. And I think that's notable that they're actually going to police departments and saying like, we can offer this.

27:43They told me that they don't have any contracts for this specific connection at the moment. So it's not happening. But there's basically two ways that it could work. And the first way could be done now where these Flock cameras are recording, cops can export that data and then they could just manually put it into Vidismo system or any other facial recognition system and run facial recognition on it. This is something that I've seen cops do, by the way, not with Flock, but with ring camera footage. There has been court records and documents I've seen over the years where it's like someone recorded something on a ring camera, that footage was sent to cops, and then they ran it through Clearview, for example.