AI Came for Bitcoin First | Jameson Lopp

32:34The big carriers have been caught selling that data over and over again. CAPE is America's privacy-first mobile carrier. Their identifier rotation feature changes your ID every 24 hours so you look like a different subscriber every single day. And sim swaps are off the table. Your number can't move without a 24-word phrase that only you hold. There's also no name at sign up, no social security number, and there's no profile to build on you. If you're a Bitcoiner in America, I honestly don't know why you'd use any other network. You can head over to cape.co forward slash WBD and use the code WBD for 33 % off your first six months.

33:08that's c-a-p-e dot co forward slash w-b-d if you're already self-custody bitcoin you know the deal with hardware wallets complex setups clumsy interfaces and a seed phrase that can be lost stolen or forgotten bitkey fixes that bitkey self-custody built for real life it gives you an intuitive easy to use wallet with no seed phrase to sweat over and it has a strong recovery system and built-in inheritance for long-term peace of mind and bitkey's just had a massive upgrade the new device now has a screen so before you approve something you can check it on the bit key itself the transaction the address or any account changes it's a big difference you're not just trusting what's on your phone you're seeing it for yourself on the device it's simple secure self-custody without the stress go to bitkey.world today and use the code wbd to get 10 off the new bitkey that's bitkey.world and use the code wbd when it comes to like obviously bitcoiners always say don't trust verify and with the cold card vulnerability i like i can't verify i can't i mean i could send an ai agent to go and look at it and tell me what it saw but i i can't read that code myself and so the trust for me wasn't even necessarily just in cold card it was in i guess every open source developer that's looking at an auditing code across the bitcoin ecosystem but do you think someone outside of just the actual cold card team or i guess what i'm trying to say is Did we let people down?

34:34Should someone have seen that earlier? Yeah. I mean, I think there's plenty of blame to go around. Obviously, from the original cold card developers that wrote the code, and then whoever reviewed it originally. I think a large part of the blame goes there. For sure. 99.9 % of the blame goes there. Yeah, like, I mean, I have plenty of other questions that I don't know the answers to. Like, I don't know if Coldcard hired external security reviewers to look at that code, you know, like doing the annual audits that we do at Casa. I don't know if Coldcard was doing that. But in general, though, part of the problem, it does come down to how many eyes are on it.

35:29And I think that part of the discrepancy and part of the reason why so many people were shocked when this happened is that I felt like there was a big discrepancy between cold cards posture within the industry versus their actual size and resources in reality. um you know if you talk to bitcoiners and this is going to be massive generalization but you know if you talk to like hardcore bitcoiners um you know a lot of them will poo poo on ledger uh because they support a lot of non-bitcoin things and they've had uh you know personal information leaks and stuff over the years uh and they would say you know cold card is the best because it's like the hardcore cypherpunk ethos project.

36:21And that is all true. But if you compare the companies, and I don't know the numbers off the top of my head, but let's say rough order of magnitude, Coldcard as a company is probably making millions of dollars a year in revenue. And Ledger, I think, is making hundreds of millions of dollars a year in revenue. And Coldcard had maybe two or three engineers, and I think Ledger has like 100 engineers. And so just size and scope of amount of resources that are put into looking at the code and ensuring it, when you look at it that way, it's a lot less surprising that something like this could fly under the radar.

37:11Yeah. And even to add to that, Ledger have their dedicated team in a dungeon that are constantly trying to break Bitcoin hardware wallets. And I feel like everyone just drank the MVK Kool-Aid a little bit. And he was quite arrogant. And we did a show a few years ago after Ledger added the feature that allowed you to basically do a Shamir secret of your Bitcoin keys. and mvk just lambasted the ledger ceo pascal for an hour and a half pure arrogance and then the whole time that i think even when we recorded that show that bug was still in the cold card at that point um like it was i do think everyone just fell for his shtick and and it worked for a while and it's quite embarrassing as bitcoiners i think yeah um though also um i know that ledger dong John looked at cold cards several times over the years.

38:04And I suspect they also looked at it at some point in that four or five year period where that vulnerability was there and they didn't see that vulnerability either. So like, if anything, that's also another, uh, you know, bit of credit towards how obscure and nuanced of a vulnerability it was. So like after this was discovered, obviously terrible for anyone that lost money. I think everyone has at least rethought the way they do this Bitcoin security setup. Maybe people have had a look at it and decided that what they do is absolutely fine. I'm sure there's a lot of people in the boat of Bitcoin self-custody is too scary.

38:43I'd rather hold it on an exchange or with an ETF. I think it would be a good exercise to go through and talk about what you think the best practice is for people's self-custody, maybe on a few different scales. Like from maybe we start with the person that has somewhere between a thousand and ten thousand dollars in Bitcoin. Like, what do you think that Bitcoin security setup should look like? Yeah, I mean, I think if you have at least a few thousand dollars worth of Bitcoin, then the very least that you can do is take your keys off the Internet. invests$100 or$200 into one of these air-gapped devices that protects you from hackers and protects you from 99 % of the threat vectors in the space.

39:28Now, that means, yes, you are going to end up trusting that company, whether it's Trezor, Ledger, Bitbox, KoliCard. And by the way, I'm not going to tell people not to use cold card because somewhat ironically now cold card is like the most secure that it has ever been because it has received so much attention. Like I still have and use cold cards. Many Casa clients have and use cold cards and and we had no loss of funds as a result of the incident. As far as I'm aware, there was no evidence that any multi-sig user of cold cards lost funds during this incident, even if you had a signing threshold of cold cards.

40:19And I think that was simply because the amount of permutations that the attackers would have to try just exponentially blew up and gave people enough time that they were able to move their funds before the attackers started grinding through all the multisig permutations. mutations. But yeah, I mean, at least get yourself on a dedicated hardware device because that protects you from any number of things of like malicious software. Like it's almost impossible to fully lock down like a laptop or a desktop. These like full-fledged operating systems and especially browsers these days just have massive attack surfaces.

41:04And so by taking your keys and and putting them on a dedicated hardware device that's extremely simple. That means the code that that's running on and even the hardware that it's running are simple enough that it's actually possible for security teams to audit them and have a better level of assurance that it's acting as intended. Though, as we saw, none of this is a guarantee. It is still a single point of failure. And so if you're getting above that level of value, if you're getting into life-changing sums of money, that's when you have to start thinking even more paranoid of what is every possible thing that could go wrong?

41:57And how do I ensure that if and when something goes wrong, it does not result in catastrophic loss of funds? And that's basically what we've been doing for nine years at CASA. I guess another way of thinking of it is, like you said, don't trust, verify. It's a great mantra, but very few people have the resources to verify. So at CASA, you could say, we just go by don't trust. we don't assume that anyone can verify anything but rather we say don't trust any given hardware device don't trust any given piece of software don't even trust Kasa you should assume that Kasa could blow up or could become malicious you should think about what would happen in a situation like that and how does my security model protect me in that situation i'm kind of surprised that you said you still use cold card um when you like if someone was setting up a cold card today do you think you can trust the random number generator now or do you think everyone needs to be creating their own entropy when using a cold card uh so i haven't because the reason i ask is like when you were saying before about the the liquid hack you were like this was a disclosure then they rushed in a fix and that fix ended up being worse than the original issue.

43:20And you could probably, I don't, I have no idea, but you could maybe make the same argument about cold card in terms of being like a rushed update after the fact. Yeah. I mean, they've made several updates now. I haven't set up a fresh cold card on the latest firmware yet, but from what I've heard, or at least from like a reason, reading the release notes and stuff is, uh, the, the, they have actually changed it. So you have to add your own entropy now, during the cold card setup. I haven't looked at the code myself to see what the verification checks are on the entropy that is input to make sure someone doesn't just hit one a million times.

44:03But yeah, I mean, like I said, I think that they have received more scrutiny against their code base over the past couple months than they probably have over their entire lifetime of their company. So it's about as trustworthy as you could get, I think, at this point. But still, there are no guarantees. There is no insurance. If something goes wrong, then it could be catastrophic. So that's why rather if you're putting life changing sums of money into Bitcoin, I think instead of trusting any one company, any one project, any one piece of hardware or software, you're way better off distributing your trust across many different ones.

44:51and having an architecture that assumes that any given one of them will have vulnerabilities and can fail. And that if that happens, you're okay. You're robust enough that that's not a problem. And that's really where CASA's security model is shining this past month. Because like I said, we had plenty of clients that were using cold cards. And rather than this resulting in a catastrophic loss of their funds, they just had a minor annoyance where they needed to either update their firmware and regenerate the key or go buy a different hardware device and plug it in and set it up and then use our key rotation functionality within the app to basically heal their slightly partially compromised setup.

45:47i'm interested to know what you think about the idea of creating your own entropy because obviously for people like you who have been in bitcoin security for i don't know a decade more however long forever um it makes sense and like you know how to do it you know the trade-offs you know what you're doing but for people who are new to bitcoin do you still see it as like a foot gun where they can potentially end up giving themselves way worse entropy than trusting a random number generator because from the people i've spoke to random number generators should be really good it's just the in cold card, it just wasn't being used.

46:16Um, and I know there's like, I've, I've got the, the bull Bitcoin entropy cards and there's like these things from the seed signer guys that make it easy. Those are great. Yeah. But like, do you think we should be like, that doesn't scale to millions and millions and millions of people? Like, do you think we should be leaning further into this? Or do you think we need to kind of put the trust back in, in certain signing devices that they can actually produce you good entropy? Entropy is such a tough thing. So the funny thing about entropy is that it ultimately comes down to physicality. And that when you're trying to generate entropy on a digital device, you're actually still sourcing that entropy from the physical real world.

47:05and different pieces of hardware do it in different ways but they could, for example, sample current timestamp. They could be sampling things like ambient temperature or temperature that the chip is running at. Some of them use the camera. Yeah, yeah. And so that's why it's hard for me to ever say that you should just prefer device entropy because ultimately any device entropy is using physical real-world entropy. It's just that when you are rolling dice or you're pulling playing cards or you're pulling those seed word sticks, you are verifying the physical entropy with your own eyes while you're doing that.

47:55When you're trusting a digital device to be doing that in the background, and it's completely opaque to you. So I think from the verification aspect, it's far better to do it yourself. And I don't think it's that difficult to get your hands on either some playing cards or some dice. It really is just more of a question of, can someone be bothered to do it because it takes 10 or 20 minutes to set it up? And I think that is the question, because if we're looking at devices that are gonna scale to everyone, there's most people aren't going to be won't understand the importance of it and therefore won't spend the time on it and we'll end up like i've got friends who did the dice rolls quote unquote on the cold card but really we're just hitting random numbers and like that's going to be like i i i don't know i i assume that's far worse than you just trusting the random number generator on a device uh well the human brain is very very bad at entropy so yeah Yeah, if you're doing something where you're just mashing buttons and whatever, then yes, that is arguably worse.

49:04And this is the problem is that it's more convenient. And so I think that's a good rule of thumb in general is that whenever you're doing something in this space that is the more convenient option, it's almost guaranteed to be the less secure option. So you should be aware that you are you're literally sacrificing time for security. You know, convenience and security tend to be in opposing force. Yeah. And don't get me wrong. It's not like I think these options should ever be taken away. Like, I think they should always be there. I just I just struggle to see how they scale scale to sort of mass market.

49:43OK, so if that's when let's say when you get into life changing money and you want to store your Bitcoin, um obviously at cast of your two main products is sort of the two or three multi-sig and the three or five multi-sig what is the like what's the threshold when you need to move from a two of three to a three or five uh well i mean this is also tough to have a real rule of thumb around because um you know you would say well it's when you have a lot of money but a lot of money is very different to different people. Another way of looking at it is like within our system, the three of five level is accompanied by higher level support tier where like you actually have, you know, a personal relationship with your client advisor and, you know, you get on video and phone calls with them and talk through any and everything that is on your mind.

50:41And so that's also an order of magnitude increase in cost where our two of three tier is really designed to be more self-service. It's the Netflix subscription of self-custody,$20 a month type of tier, whereas going up to our premium and private client levels, that's getting into thousands of dollars a year. So I think very few people are going to want to spend more than a fraction of a percent of their holdings per year on whatever their security architecture is. So you can kind of do the math from that. Like if you're at a premium tier and you're paying$2 ,000 a year, you probably want to have at least a few Bitcoin that you're holding on to there so that it sort of starts to make financial sense.

51:35If you're viewing this as kind of an insurance product, like security and insurance, they're kind of two sides of the same coin. Security is like upfront insurance and traditional insurance is like after the fact something went wrong. and your security failed, how do I try to recover from that? But in Bitcoin, because this is a highly liquid bearer asset, compared to a lot of other things in life, you want to have the super high level of security up front so that you don't have to deal with the loss in the first place. Whereas if you had that type of model for your car, then you would only want to be driving a tank around.

52:20But that doesn't really make a whole lot of sense, you know, for many other reasons as well. But you definitely want a Bitcoin tank. As someone who is like has some public profile in Bitcoin, how worried should I be in terms of avoiding wrench attacks? Yeah, I mean, I think that anyone who is publicly known to be a Bitcoiner, especially if you've been in it for more than a few years, you should care a lot about privacy. Like even if you have the ultimate distributed self-custody setup where you're basically wrench attack proof, you don't want to find out the hard way what would happen if you are in a duress situation.

53:05because for example even if you have what I would call a wrench attack proof setup where you don't have direct access to your funds at your home that's the biggest problem for pretty much everybody if you have the ability to access your funds without leaving your house you are vulnerable to being put under duress and made to move them But even if that's not the case, and this is something that really no security architecture can do anything about, you're still vulnerable to your friends, your family, your loved ones being taken hostage. And you are still under duress, but you are free to move and authenticate and go around and get to all of your keys.

53:57so you know i i don't think that anyone should really be advertising or uh leaking information about you know where where you are where you live to make it easier for someone to try to put you under duress in any way but the problem especially with the way you live is we've seen a ton of um leaks from hardware wallet companies where full addresses full names have been have been leaked and that cat is out of the bag for a lot of people like i was in the original ledger leak in i think it was 2018 or whatever i mean i've moved house every all my information has changed in sense so i don't mind saying it but like i was in that leak and i've i mean the number of phone calls i got was insane luckily i've moved house i think before the leak even happened so i never had anything physically happen but like that that isn't just the reality that people live with now is that people might know their address they might know their phone number their email that like everything.

54:53How are you meant to deal with that? Well, I can certainly opine upon it. You know, I'm in a rare situation because I was physically attacked before really any of those leaks happened. You know, I was swatted in 2017. And that's what really made me wake up to the severity of this problem of having your home address available to malicious people. So, you know, the short version is that I never put my real home address and my real name together in any database and any service. You know, I have mailboxes and even decoy, like condos that I use for different purposes where depending upon the nature of what merchant or service or government agency or whatever that I'm interacting with and what their requirements are, then I give different levels of false information, really.

56:06That's like one of the hardest things for the first few years that I was doing this, um, I was basically becoming comfortable with lying, um, and understanding that it's, it's not immoral to lie to people. If you're not trying to like deceive or defraud them, I am lying to people on a daily basis to protect myself. And, uh, and it's not just paranoia. Like I've actually been attacked before and I am not going to allow myself to be attacked again. But unfortunately, it requires a massive, massive change in lifestyle. And I think that's beyond what most people are going to be willing to do. I mean, for sure, even though I don't think there's anything wrong with lying in that case.

56:54I'll put a link in the show notes for anyone who wants to listen to the show we did a few years ago where you told the whole story about getting swatted. But essentially, the SWAT team turned up, guns drawn at your house while you were just... Were you cleaning guns at the time as well, which made it even more sketchy? insane story but it's um it it just it it feels like this is only going to get harder in terms of everything to do with bitcoin security over the next few years yeah um and you know with regards to like some of the personal identifiable information leaks and stuff some people are like well this is why you should never order a hardware wallet or other people like the seed signer proponents will be like this is why you should build your own hardware device with off the shelf parts because nobody is going to be like trying to get leaks of like raspberry pies or whatever but it's a nearly intractable problem because almost every merchant that you deal with asks for your personally identifiable information.

58:10And almost every exchange out there where people are acquiring their Bitcoin asks for egregious amounts of personally identifiable information. And this is a really fun one for me to deal with, like I said, because I try to use obscuring address information wherever possible, but the KYC stuff is very difficult. And the only way that I'm really able to get around that in some cases is to actually have a driver's license that is connected to a decoy residence where like it's a real place. I just don't actually hang out there. But I mean, there's a lot of other tricks too of like whenever a service tries to KYC me, I always try to use my passport first because there's no address information on there.

59:03usually that works sometimes it doesn't uh it's like when it comes down to places that will only accept a driver's license that that has an address on it it becomes really problematic that's interesting i always think of the passport as the more precious of the identifier so i would always but that makes total sense um do you think that with like this rise of ai enabled attacks that kyc is going to come under a lot of scrutiny and we might actually get a chance of pushing back against it because I'm not sure the data is clear that actually protects anyone, but it is creating these huge honeypots.

59:36And we've just seen that Revolut's been got, which is a massive, massive fintech, like tons and tons of information. And these are just honest people who are trying to use a service who now have their information all over the internet. I don't know. I mean, I don't think anything is going to change unless someone in power gets hurt. That's like, That's the short version. Until there's a politician or a really rich and powerful person who gets burned really badly from this, that they're willing to then go spend a lot of resources to try to get political change or regulatory change. no like the amount of leaks has been increasing at an insane pace and it just seems to be business as usual it's like oh there was another massive leak this week we'll give everybody free credit reporting and identity theft protection for a few years and then move on and you know it's very profitable, like the companies that are collecting this information tend to be highly profitable.

1:00:50I think, you know, the regulators don't want to give up any of their power and any of the sort of surveillance apparatus, even though there's many different levels of independent reports that show that, you know, the money laundering has the people that do money laundering professionally laugh at all of these KYC safeguards because they just go out and buy real identities on the dark net for pennies on the dollar and just burn through, you know, stolen identities that can get through all of these regulatory compliant systems. And if they do get caught, then they just throw it away and pick up another one.

1:01:35So, yeah, I mean, the whole thing is just a clown show, but it seems that the people who are behind it are so entrenched that the incentives aren't there to fix it. Well, one day they'll get hacked to and we might get a change. All right. Last thing I want to talk to you about, because obviously with Trezor's had a ton of email scams go out recently. One of their service providers was hacked, I believe. Steve. There'll be a load of people getting a ton of phone calls now with people trying to convince them to give them their seed words or go to dodgy websites. I saw on your Twitter that you had one of these phone calls recently with a scammer.

1:02:14Tell everyone what happened there, because I listened to the sort of three minute clip, whatever you put on Twitter, but it sounds very interesting. Yeah, well, we'll have several lengthy clips coming out soon. I think close to like 45 minutes worth of conversation. So basically, like you and like pretty much everyone else in this space who has been the subject of data leaks, I get these calls. and it's never been a problem for me because I never answer the phone if it's a phone number that's not someone I know personally and talk to regularly. But we started seeing more of our clients getting these calls and it just started becoming more of a security concern for us because we started having some clients that their Google accounts were getting compromised.

1:03:12And that was becoming really problematic for us because then sometimes we'd be trying to actually converse with the client and the bad guy would be inside their email and just deleting the emails from us and then sometimes responding to us as if it was the client and saying, oh, everything's fine, so on and so forth. So the short version is just don't answer the phone from any number that you don't know. But also just never trust any incoming message, whether that's email, phone, direct message on any platform, unless it's a strongly authenticated like end to end encrypted system like Signal or WhatsApp, where it'll actually tell you if your cryptographic exchange has changed.

1:04:10you cannot rely upon the person that the message is from actually being that person. Like all of these things can be spoofed. Emails can be spoofed. Phone numbers can be spoofed. And what I actually ended up doing was I actually, I took Coinbase and Google's like official business numbers and added them as contacts in my phone so that I knew that whenever I I got a call from them that it was one of these social engineers. And I started picking up the phone. And they have a very sophisticated system where they won't have humans call you. They actually have an auto dialer. And it'll call you and it'll say, hey, something happened.

1:04:57Like someone logged in here. If it wasn't you, press one and we'll get a human on the phone with you. and and so i started pressing one and eventually the humans actually started calling me and um i would i would play around with them for like you know 20 minutes or so to to get a better understanding of their script and and really like what they were trying to do uh how they're trying to get access and then eventually i'd be like hey uh like you know i'm a cyber security expert right It's like, you're not going to trick me. And in that case, they'd either hang up immediately or they'd be like, oh, shucks.

1:05:37I was really hoping to get you this time. And it's interesting because they knew that I am the chief security officer of a security company. And they'd still try to pull one over on me because you never know. Like even the smartest, like most intelligent people might have a bad day and might be preoccupied with thinking about other things. And really what they're trying to do is social engineers are hacking your brain. And they're doing this via psychological methods. They're usually using like fear, uncertainty, doubt. they're using a sense of urgency to be like, there's a security issue and you need to fix it right now.

1:06:26And I'm a trustworthy employee of this billion dollar company. And I will tell you how to fix your security issue. But meanwhile, what they're actually doing is they're tricking you into compromising your security so that they can get into your email. And from there, most people have one or two email addresses. And that's like the primary nexus of all of your other accounts. And once they get into that, they can start getting into all of your other financial accounts. And they'll be looking for what exchanges you're using. They'll be looking for seed phrase backups and photos of like your seed phrase.

1:07:03They are highly sophisticated organizations now where they have different people that specialize in doing different things. And so I was talking to the guy who specializes in tricking people into getting into their email accounts, and he gets paid for every email account he gets into, regardless of whether or not there's anything valuable in there. And then he'll also get a cut of whatever the take is if something else is found. But then they have other people that specialize and then doing the crypto related stuff. And then they also have other people that specialize in doing the wrench attacks.

1:07:37And those people then coordinate other people on the ground, sort of the henchmen, the two bit thugs to actually go and do the attacks. And like I said, they're complicated and sophisticated international crime rings at this point. And they do this all day long. And the thing about security and about all this stuff is that if you're the defender, you have to be successful 100 % of the time. But if you're the attacker, you only have to succeed one time. And that's just another one of the asymmetries in the space. It was great. like listening to it the thing that shocked me is how much money they're making as well i i can't remember was it did he say he's making about eight hundred dollars per email he gets into he was saying he can make up to about five grand a day or something like it's real good money um yeah how did you actually get him talking um well you know we just eased into it uh of of me playing dumb for a while um and and then you know the the trick is to not be an asshole which is really hard because these guys, you know, they're doing terrible stuff.

1:08:48But once you get them talking, like, they're just normal human beings like everyone else. They tend to be young guys, you know, generally in their, like, 20s. And the reason that they're doing this is because it's just insanely profitable. And they tend to have a mercenary mindset of, you know, I'm almost like a Robin Hood mindset of, like, I'm going after guys who are so rich that it's not gonna be the end of their life if I take millions of dollars from them because they're so well off. And that's like, he, he literally said something kind of like, like that to me of like, oh, you've been in Bitcoin so long, you know, you would be fine.

1:09:31And it's like, um, I guess we can just completely gloss over the fact that, you know, you're stealing from people who have, you know, spent a lot of time and effort, uh, building up their wealth and you're just going to take them, take it from them in a matter of an hour or so and, you know, not have any sort of regret regrets about that. But that's, that's how it goes when you get into the criminal world is that, you know, people will justify that whatever they're doing isn't so bad. And I don't know if you can talk about this, but before we started recording, you said there might be something coming from someone from North Korea.

1:10:08Yeah. Well, you know, We've already said a few times, security in this space, it's coming from a million different directions. And we've only talked about a few of the different things that I'm dealing with. But another is that, especially if you are running a company in this industry, there are nation state backed threat actors that want to get inside of your infrastructure. And they're going to do that in any number of ways. I think a lot of the people out there will be familiar. Lazarus Group, which is the Democratic People's Republic of Korea, they do a lot of DeFi hacking. They love hacking smart contracts and other types of projects, and I think they've taken billions and billions of dollars through that.

1:11:05But what they also love to do is to pose as technical security and software engineer to get jobs at companies. Because if you can get employed by one of the companies in this industry, you're going to start to get access to privileged systems. Maybe not production systems, but at least development environments. We posted a job posting for security engineer position, which of course is a highly privileged position that would eventually get production level access. You know, if you build up a level of reputation and trust with us. And we just got an insane number of North Korean actors that were applying for this position.

1:12:04And a lot of them, it's very easy to weed out just from like looking at the resume, LinkedIn profile, so on and so forth. But, you know, some of them get a little further along in the funnel. And what was particularly surprising this time around, I've never had them get to me before. And I'm usually the second or third person after, you know, initial call screening. And what we realized was happening is that they were using an actual American for the first initial video interview, and then they would swap out with the North Korean on the second interview. you. And, and you know, they're good at answering the technical questions related to the job description, the job that they're trying to, to actually interview for.

1:13:01And they probably even have some of the skills where they would be able to do that job. But as it, as it is with everything in this space, if you know the right techniques, if you know how to catch them off guard, if you know how to ask them the questions that they're not prepared for that a real American would be able to answer, then it's actually pretty easy to trip them up. And the difference between those guys and the social engineering guys is that you can't really get them to open up about what they're doing, probably because they're being monitored by their military or whatever state organization is actually sponsoring them.

1:13:48So they tend to hang up pretty quickly after you ask them a few questions that they're not prepared to respond to. What kind of is that? What do you think of your supreme leader? Like, what question are you asking? Yeah, that's an easy one is to try to get them to defame King John Un. but other less obvious ones tend to be cultural related questions. Like I said, they, they build up a, you know, a persona profile of who they're supposed to be that they're trying to impersonate. And so, you know, they'll know some of the background of the resume that they've given to you. But a few things that I've done is dig into like more personal questions based upon the resume that would normally not be asked in an interview, but which any normal person would be able to answer, things about their college life experience and stuff like that.

1:14:51There's also any number of other American cultural questions that you can ask that they're just not prepared for. They just don't really know anything about American culture. Super interesting. You've got to be careful of that. North Korean sleeper cells. Damn, there's so much to be conscious of right now. But James, this has been awesome. I think there's hopefully been some good actionable advice for people who are rethinking their security setup. Tell everyone when they go to follow you and find out more about Casa. Well, you can find me on X. My handle is just L-O-P-P. Check out Casa. It's C-A-S-A dot I-O.

1:15:31Perfect. Appreciate the time, man. Thank you for this. You bet.