171: Melody Fraud

What if the music charts you see aren’t real? What if the numbers that define success can be manufactured? We talked to Andrew, a man who has spent his career on both sides of this battle. He once profited from the loopholes in streaming platforms, but now, his job is to close them. This episode will change the way you understand music streaming platforms from now on. SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. Support for this show comes from Adaptive Security https://www.adaptivesecurity.com/. Deepfake voices on a Zoom call. AI-written phishing emails that sound exactly like your CFO. Synthetic job applicants walking through the front door. Adaptive is built to stop these attacks. They run real-time simulations, exposing your teams to what these attacks look like to test and improve your defences. Learn more at adaptivesecurity.com https://www.adaptivesecurity.com/. This episode is sponsored by Meter https://www.meter.com/, the company building networks from the ground up. Meter delivers a complete networking stack - wired, wireless, and cellular - in one solution that’s built for performance and scale. Alongside their partners, Meter designs the hardware, writes the firmware, builds the software, manages deployments, and runs support. Learn more at meter.com https://www.meter.com/.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  I've always liked the idea of fake it till you make it. Where you act like someone you want to be until you become them. This sometimes comes with imposter syndrome. But I think the antidote to that is just more experience. But how do you go from being a total beginner to confidently doing something? I often turn to the bookstore to help me there. But you know a book that's always bothered me? It's those for dummies books, like the C programming for dummies. Or the complete idiot's guide. Even if I don't have a clue where to start, I would never buy one of those books because I don't consider myself a dummy or an idiot. Because I want to fake it till I make it, and I don't want to fake being a dummy. I want to be a great programmer. So a dummy's guide to programming is not the direction I want to be going.

• 0:42Jack Rhysider?

  I think what those books failed to do is they seem to target who you are now, not what you want to become. And that was their failure, at least for me. I've bought tons of how-to books, but I will never buy one of those books. To me, the key to success is in the aspiration. I would instantly buy books that were titled, "How to be an amazing C programmer," because that is what I want to become. And the book could contain the exact same words as the other book that's C programming for dummies, but it would have an entirely different impact on me. Every time I saw the title, I'd feel like I'm becoming more and more like the person I want to be, an amazing programmer. And that would give me that false sense of greatness, which is exactly what it's like

• 1:27Jack Rhysider?

  to fake it till you make it. Because it's not about who you are today, it's about who you aspire to be tomorrow. It's about embracing the journey of transformation and allowing your actions to shape your destiny. So go ahead and fake it. You can lie to yourself if you want, because sometimes the greatest lies are the ones that propel us towards our truest selves.

• 1:54Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:00Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 2:21Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic, one that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place, so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40 times while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 3:06Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 3:26Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought, "I should really be doing something to protect myself from stalkers, scammers, and hackers," but you're not sure what? Here's what you do: Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off DeleteMe. A few years ago, I signed up, and ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your private life private by signing up for DeleteMe now at a special discount just for my listeners. Get 20% off your DeleteMe plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 4:10Jack Rhysider?

  The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www.joindelete.me/darknetdiaries code DD20.

• 4:28Jack Rhysider?

  Today, I'm talking with Andrew. Yeah, I'm Andrew Baby. Andrew has a really unique job that I can't wait to ask him about. But first, we should learn about how he got there.

• 4:37Speaker 01

  So I started on Facebook when it was still EDU-based. And then I was one of the first 50 beta advertisers on Twitter and learning to kind of misuse their system.

• 4:48Jack Rhysider?

  Misuse their system. These systems are huge and complex. Algorithms, likes, follows, and a whole ad network. He wondered if he could manipulate any of that to his benefit.

• 5:00Speaker 01

  Same thing with YouTube. I used to be able to break anything into the front page of YouTube. And I guess I quickly became the guy that you would go to if you wanted to sort of like gray hat, black hat, some stuff.

• 5:11Jack Rhysider?

  Gray hat and black hat and white hat. Let's talk about that. That's going to come up a lot in this episode. And we'll start with white hat. White hat is doing something that's 100% legal and safe, such as hacking your own computer. Nobody is going to come arrest you for that. Black hat is doing something that's illegal, such as hacking your ex's lawyer to see what they're plotting against you. Gray hat is somewhere in between. Like, maybe it's technically not legal, but you're hacking into something only for research, but not to cause harm. But these terms also apply to marketers. Someone who follows the rules, such as paying for ads the normal way. That's a white hat marketer. But someone who uses bots, for instance,

• 5:54Jack Rhysider?

  to artificially create a bunch of five-star reviews for something, that would be a black hat marketer, in my opinion, because they are lying and cheating with their so-called marketing and run the risk of being thrown off the very platform that they're trying to grow on. At least, this is what I think these terms mean going into this episode, but my definitions might change as we go further. So, in my opinion, Andrew was a black hat marketer. He was trying to promote certain products or people by tricking people or systems to artificially inflate something's popularity.

• 6:25Speaker 01

  My favorite thing at the time was likejacking. It was a weird time period because it was before fanpages. So initially, when Facebook first launched, you could only friend request somebody, and there was a 5,000-person limit. And what you used to do is you would hide the request, friend request button, or when Fanpages launched, the fan, you know, follow button. But you would hide it in the pixels. I don't know if you've come across that.

• 6:48Jack Rhysider?

  Yeah, I have. People who want to become popular on social media might do it, like an up-and-coming band who wants as many likes and follows as possible. If others think you're good, then you're probably good. And so you might show up in more people's feeds because of that, too. And Facebook made it so you could add a like button anywhere you wanted, like on your own webpage or blog. But if you were sneaky, you could trick people to clicking on that like button when they didn't know they were clicking it. And that's what clickjacking is, or likejacking.

• 7:14Speaker 01

  In our case, we ended up using it a lot on video or photo-sharing websites. So when people were clicking like next or going through video or photo carousels, every time they were clicking, we sort of trained our users to double-click. And we started buying these websites that were high-volume websites. And then eventually, we started doing web development for other sites and then putting these in there. And what would happen was our hypothesis was that people did not log out of their Facebook. It's cached in their browser. So what we would do is just hide that pixel inside of other websites. And so we could drive millions of fans to things.

• 7:55Jack Rhysider?

  Man, how clever. They bought a popular video and photo-sharing site, and as the users clicked next or play, it wasn't the next button, it was the Facebook like button. And the users had to click twice because the first one was just liking the photo, and then the second one was going to the next photo. And so what Andrew would do is he'd advertise that he can get your Facebook page 5,000 followers and thousands of likes. And people would buy his service to promote their bands. And he'd artificially grow someone's Facebook account.

• 8:23Speaker 01

  And so that's kind of where we started a lot. Another thing we did in the early days was a kind of an ad arbitrage. At the time, for example, when you when you charge an advertiser, they cared about time on site and sort of CPMs. But they didn't care that much about the actual click through or engagement with the ads. They just weren't aware. I know that seems obvious now, but back in the in the 2000s, like, no one really knew that those are metrics to look at. Um, like traditional advertisers. So what we would do is we had these high-traffic-volume websites and we would, for example, have a $5 CPM, let's say. Uh, but we could buy traffic for like a dollar.

• 9:01Speaker 01

  And so we would blend enough garbage traffic in that we didn't really ruin our overall sort of time on site or or user stats. But we would be able to sort of, um, print money.

• 9:12Jack Rhysider?

  Oh, so he'd sell ads on his website, but then pay fake visitors to click it? Making it look like a lot of people clicked that ad and then he would just collect the money for it? But really, it was just paid traffic? Huh.

• 9:26Speaker 01

  And another one that we did that was really interesting at the time was was around YouTube. So we we figured out that you could basically, there were these pop-under ads back then and you could, um. Uh, most people recognize them from the sort of like penis enlargement ads and things like that. You click out of a website and there'd be like the annoying little open browser underneath it. We would load it with YouTube videos on mute. And we were able to rack up, you know, hundreds of thousands of plays, uh, to a YouTube video quickly. And if we could get 300,000 to 400,000 views, um, quietly, uh, in the background, we could basically break into the algorithm on the front page. And back then, people would go to the front page of YouTube to see what was trending.

• 10:08Speaker 01

  So we would be able to break a bunch of different content pieces onto the front page of YouTube. And at that point, they had to sink or swim. You basically had to have good content that people liked or not, but like pretty quickly it was evident. You either went viral or you were trash and you were removed quite quickly. So we could get you there, but the question was whether or not you'd stick.

• 10:28Jack Rhysider?

  Now, see, to me, this is all black hat marketing. You aren't bringing real customers to your site or video page. Instead, it's all fake. It's not quite bots. It's real people clicking things, but they're tricked into clicking things and they don't know they're clicking it. The stuff they're viewing is invisible to them, but it's playing in the background. And so I call this black hat marketing because if YouTube found out that you manipulated your way to the front page, they probably ban you. But I also think if you have a bunch of fake followers, then that's not real marketing either. That's cheating and lying and manipulating.

• 11:03Speaker 01

  Now, you say "we," what was this, where's "we"? I had a couple, uh, partners that we did this with. Was this like a black hat marketing firm? You know, that term wasn't really a thing then. I would say we all considered it marketing, but we didn't, um... I mean, yes, it's black hat, but I wouldn't say that that's what we visualized it as at the time. At the time, we really felt like we were just a marketing firm using all the possible channels we could to give a brand an opportunity to take off. Like, what I got known for at the time was, you know, we launched an artist on, um, Facebook and he had no label, no, um, no major label, like, nothing.

• 11:47Speaker 01

  Like, you know, he was found at a bonfire in Nantucket. So it was kind of like an interesting thing. Like, when we went to the labels back then and tried to convince them that you could use Facebook um, to launch an artist, everyone laughed at us and said, you know, "Facebook's for kids. We have a website. We do email lists. We do paid marketing. This isn't part of our mix." No one believed it was possible until we did it. And then after we did it, everyone wanted to pay us to do it. And the hardest thing was trying to like, continue to perform. Uh, because then, you know, everyone that finds a vein that works, everyone starts copying you and then you have to find a new way. It's like you're constantly on a treadmill for finding new innovative ways that you can break an artist or that you can just get attention.

• 12:32Speaker 01

  And I think, from our view, that's the, that's the art of marketing. It's less, it doesn't, I think for a lot of us, it doesn't... Feel like black hat because we're just using a technique or a tool that might only last for two months or three months until we have to find something else. And we all safeguard it. When we learn something, we don't tell people. So like when we learned about like jacking, which was the hypothesis we had. We definitely didn't tell anybody because we didn't want anyone copying us. We didn't want people to know how we could drive a million fans to something. And they were all real fans. Um, so it was just kind of a, I think, I think in that view, it's just a different era. You know, and I would also say that no one even called it social media marketing. Like at the time there was digital marketing.

• 13:14Speaker 01

  Like new media was a term. Like there wasn't even a term for growth hacking wasn't even a term. Like no one even used the word growth hacking. Um, but this was not a thing at that moment. So it is interesting to see how the whole thing's evolved. I do think that if you asked us point blank. Is what you're doing violating terms and services? For sure. We would have lied and told you, we would have told you, no, but, but we all knew, like, we weren't drinking the Kool-Aid. Like everyone in the company knew we were violating terms and services. I think the thing we thought was, who cares? Like if a real user likes what we have to do, like what we're presenting them.

• 13:54Speaker 01

  We're not like faking the genuine uh product market fit. We're just trying to get in front of those. Those eyeballs and see if we are a product market fit.

• 14:03Jack Rhysider?

  Like that was, that was a stretch as well, but I, I agree with you that I think a good marketing uh campaign is one that actually. Cause I think most people are like, I hate marketers. I hate ads. I hate all this stuff. But do you, when, when, when a product lands in front of you and it's the perfect thing, it's the, it's your new favorite song. And you're like, holy cow, I can't believe I just found this. Then you don't hate it, right? And so if you can, if you can match that person who needs this product with this thing. And that is a, a marketing move that you've done, then that is a, that is fantastic marketing. And I think that I wish that's how all marketing was, is to actually find the person who, who needs it and then, and focus on them. Unfortunately, marketing has a lot of wasted eyeballs looking at it and.

• 14:48Speaker 01

  For sure. I mean, even back then, I remember seeing this thing in uh probably like 2011, I feel like. Where there was this report that came out in advert, in like an advertising uh sort of research report that only eight percent of people who saw an ad. Online were real. Like it was just technically a machine connecting with another machine presenting the ad, but like there wasn't a real person on the other end. And that was 15 years ago. Like, I can only imagine how much worse it's gotten.

• 15:18Jack Rhysider?

  Yeah, um, when you were, when you were doing this black hat stuff, uh, did you, did you have any like success stories of people that you made? Or, you know, products that you launched well and, and just like huge success with, with these techniques?

• 15:32Speaker 01

  Yeah, but, uh, I don't want to throw them under the bus, but we definitely did win a lot. We, we took a brand in action sports that was like 17th in their spot, moved into like third in the market. We, um, and what was crazy is at the time you start doing these big activations. So when you start winning, all the big brands pile in. All of a sudden they all want to do a collaboration or some deal with you. So you end up doing really big brand partnerships or brand collaborations with really established companies. Um, once they all perceive you as the winner, and so the snowball sort of takes off. And then it becomes less black hat and more traditional sort of project management and, uh, release schedules and, and just creative, le- less like hacky.

• 16:17Jack Rhysider?

  Yeah. So one sports brand went from 17 to third. What else?

• 16:21Speaker 01

  Yeah. We had a musician that we launched that went number one iTunes, number seven Billboard with no label.

• 16:26Jack Rhysider?

  Okay. Number one iTunes, number seven. Is that, is that fake numbers? Is that fake numbers?

• 16:31Speaker 01

  Those are real numbers. That's the crazy part. That, that's what I'm saying. I, I don't feel like it was black hat because we got in front of all the, to your point. We got in front of people who decided they really loved this artist. And because they really love that artist, and we, and we sort of had an 18 month plan. So as we were building this artist with all these techniques, we were providing them with content to get them more and more hooked and engaged with the artist. And when we released that artist's EP, that artist went number one over, over everybody. Like I remember we beat DJ Khaled as an example, like we beat everybody. And no one could believe it. I mean, we were called out. People thought we, you faked numbers. We didn't fake anything. Like it was all real. We just sort of met the consumer.

• 17:18Speaker 01

  At the point, we were in front of the consumer at the right moment when they went and go discovered this artist and then thought they really liked it. And so, again, the techniques allowed us to engage and have a real product market fit. But the techniques we used were definitely not approved.

• 17:35Jack Rhysider?

  Yeah, I mean, I'm, I, when I first started this podcast, I was like, all right, let's market it. And you, you start noticing some of these black hat marketing techniques. And, and I had to really sit and look at myself in the mirror and be like, am I a guy who is going to cheat my way to success? Like fake it till you make it. And I had a long debate about it. Um, and I'm like, no, I'm a hacker. Of course I'm going to use every chick in the book, right? This is great, let's try it all. And then I was like, no, this is not honest. This is unethical and all that sort of stuff. So I landed, this is, this is funny. I landed on no black hat marketing, but I'm totally for guerrilla marketing. Which is unsanctioned marketing, right? So if I go to a conference and there's an empty booth where a vendor didn't show up,

• 18:17Jack Rhysider?

  I might sit down at that booth, put like a little banner up that says, hey, this is Dark Matt Diaries. And I didn't pay $10,000 for that booth until the people come and say, hey, is this, did you pay for this booth? No, okay, we'll get out. All right, cool. And, and so I'll put stickers on places that aren't supposed to be stickers and all kinds of stuff like that. So that to me is guerrilla marketing.

• 18:39Speaker 01

  No, I agree. I think that's definitely, and I have some examples that like, we launched an app in 2013 called Hater App. It was Instagram for everything you hate. And our, our, our logo was a giant thumbs down. And we went, I never, we went to South by Southwest and we just started putting stickers on people's backs as they were walking. And there were thousands of people walking around with these stickers. And it went by, we got like, so many downloads. The down, the downside was we built this thing totally crappy just to see if it would work as an MVP. And it went, like, we had hundreds of thousands of downloads, uh, like overnight. And the app was not functional, it was a complete mess. But it was like such an interesting moment where I remember doing interviews with like, we did interviews with like Wall Street Journal and everyone.

• 19:22Speaker 01

  And they, it was like the, uh, huge story at the time. Cause we basically did this guerrilla approach and it kind of worked. And I guess to your point, I always viewed the stuff I did online. I mean, maybe I'm just justifying it now, you know, like hindsight, you know, I've revisionist history, but I remember you really feeling like the things we were doing online was the guerrilla version of what we did in in person, you know, for like these types of techniques.

• 19:48Jack Rhysider?

  Something I noticed on the podcast world is that people can fake their way to the top on Apple Podcast charts, but most of them fall off a cliff as soon as they stop paying their black hat marketer.

• 19:59Speaker 01

  Totally. And so like I have an, there's an artist I know who I won't throw into the the bus, who is a major artist now. They were up for a Grammy, bunch of, bunch of things. Their entire first album was fake.

• 20:12Jack Rhysider?

  Okay, I know, I know who you're talking about. Check this out. I saw this article last week. Spotify accuses Drake of forging billions of fraudulent streams.

• 20:22Speaker 01

  That's not who I was talking about, but that's, that's also interesting.

• 20:30Jack Rhysider?

  Okay, so that's what Andrew was busy doing for a while. He was living in Los Angeles, and he wasn't just doing black hat marketing, launching people's careers, but also building websites and tech companies and buying and selling them. He was solidly tuned in to the internet and saw it in a way that not many did. And one of his friends is Morgan, and they like to go into football games together.

• 20:49Speaker 01

  Back in the day, we had tickets to the LA Rams. So we would go to the games every week, every, you know, eight times a year, whatever. We'd go to the games all together. We had, we had 10 seats together. So it was Morgan, me, and a bunch of music exec guys that we'd known and just randomly together. So anyway, we're there all the time. And around, I was everyone's weird crypto friend. I started mining in 2011. And sort of I've been really interested in, in sort of technology and how it could be used. But I, it, anyone who goes back to that day will understand, anyone who was in this, but maybe you were in that fin, but like, it was weird because pure tech people really didn't like blockchain people. Like, there was this weird, if you were like a crypto guy, you kind of die.

• 21:34Speaker 01

  Like the scarlet letter put on you when it came to tech and you and it was like it was it really did feel like at the moment if people found out you were the crypto guy that you would just get pigeonholed and lose opportunities. So I was very careful to like keep building tech and keep the blockchain crypto stuff entirely separate. And in around 2017, that sort of whole world merged together. All of a sudden, like people in suits started showing up to crypto events. And like, next thing you know, bankers are around and everyone's talking about how it can be used for enterprise. And it really felt like the industry collided. And the music people came to us and said, "Hey, could you use blockchain to track the number of times songs are played?"

• 22:16Speaker 01

  And the reason is, until today even, the streaming services give the labels a CSV that says Snoop Dogg, 100 million plays. No one actually, there's no receipts behind that. It's literally just a cell, like the artist's name and the next sell over number of plays for the month. Like, there's no receipts for usage. Usage is the number one driver to how much money you should be making every month. So it's really weird there's no receipts there. So the way that it typically worked when streaming took off, the music industry just adopted what they'd always done for physical, and that was always an audit period after three years. So every three years, they go and audit the partner. They, to do a usage audit, though, a forensic audit,

• 22:59Speaker 01

  not where I'm tracking the contract, not where I'm tracking revenue coming in, but how many kinds of songs was actually played? That could take them up to two years to complete. So you're talking about five years later, figuring out that five years ago, you should have been paid a million more dollars for this artist and two million for that artist. And that adds up to a lot, but all that money's been paid out. So you don't have this ability to sort of recapture that money from the streaming services because it's gone. So they came to us and said, "We believe blockchain could be a solution. You're our weird crypto friend that also understands music, and we trust your whole team here." Morgan, my co-founder, had been a lobbyist on behalf of a lot of the majors for copyright

• 23:39Speaker 01

  protection, extending copyright law. And Poria was a really gifted machine learning AI engineer. But at the time, we were doing a lot of crypto stuff together. And so they said, "We believe your team could solve this. Will you build a real-time tracking tool?" The question we were trying to answer at the time was, "How many times is every song actually played?" Because you can't rely on the CSVs that they hand over. They're always wrong. What we learned from the offline audits, where they pulled the usage logs in like 50 different audits, was on an average, anywhere between 20 and 31% discrepancy, always undercounted. So imagine you're perpetually being paid 20 to 30% less than you thought you should have. That is where we started. And we built one of the fastest blockchains in the world at the time.

• 24:22Speaker 01

  We did 10 million transactions per second per region in a private permission chain. We have over 40 patents in seven countries filed, probably 30-something issued. And we built this technology. And when we went live is when we accidentally discovered fraud.

• 24:40Jack Rhysider?

  This discovery would ultimately make him abandon this very blockchain company that he just built and take his life in a whole new direction. We're going to take a quick ad break here, but stay with us because you'll never believe the fraud he discovered.

• 25:00Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch-up when audit season is coming around the corner again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year-round, cutting your audit prep by 82%.

• 25:40Jack Rhysider?

  Plus, you can access the Vanta agent everywhere you work. Whether your team is in Vanta every day or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. Vanta.com/darknet.

• 26:08Jack Rhysider?

  So Andrew and his co-founders Morgan and Poria built a tool to track how many times a song is played. Since the music labels wanted him to do it, they were also helping him get in touch with these music streaming services to try to work out a way for Andrew to see the real-time streaming data they have. So they made deals with these streaming platforms that they were able to see the play counts for the few music labels that they were dealing with. And their goal was simply to count the plays and make sure the artist got paid for what was played. But little did they know, counting plays was not accurate at all.

• 26:42Speaker 01

  We started seeing these weird clusters of users, like 8,000 users playing the exact same sequence of songs 63 times on a Sunday. Or users suddenly getting play counts in 17 different countries in the same week. Like, how is that even possible? So we started noticing these discrepancies, and we went back to the labels and the streaming servers and said, "We think you have a fraud problem. And if we're supposed to be the leader or the trusted source of truth of how many times a song is played, and we're just telling you a song was played, we're not actually telling you the intent behind the play and if it should still be counted. Like, you can't actually pay this out because there's a bunch of fraud happening here that should be removed. And so until we can solve the fraud problem, we don't think we can solve audit."

• 27:26Speaker 01

  Like, that was the summary we came to after two and a half years, and it was a real... Challenging moment for the company because it's like you've been building this entire tool believing this is the one problem. And then you get there and realize someone said, hold my beer and you have a totally different problem you have to solve with a completely different skill set.

• 27:45Jack Rhysider?

  I'm still shocked at the point that the streaming services didn't have this capability to detect this sort of thing. In podcast world, we have the I A B, which is a, it's actually a certifiable way of measuring metrics for podcast listens. And they have a whole list. They're like, okay, you know, if a user starts on their phone and then switches to their computer, is that considered two listens or one? If they have to download for over a minute before they can actually be considered a listen, you know, if it's, if it's streaming on the watch, the watch does things to grab MP3s very differently than how a computer might. And so it, it looks like 500 listens when you come in from a watch. So you have to adjust for that sort of thing.

• 28:30Jack Rhysider?

  And there's, and there's, you can look it up on how to measure podcasts, which is very complex and complicated downloads. And I just can't imagine these bigger streaming services not wanting to have accurate download numbers, especially with paying. Before that, they had, they must've had a whole team of people trying to figure this out. And you're, and you're saying, no, they didn't. It was you that figured it out.

• 28:53Speaker 01

  They didn't. Like at the time, major streaming services, enter your streaming service, had less than half of a person dealing with this. Like it was probably some data scientists and they were mostly using rules based anomaly detection. So like, did a song get played more times than literally possible? Like, did someone play a song 10,000 times this week?

• 29:12Jack Rhysider?

  Well, that, that's really eye opening or fascinating. It's hard to believe because it, when you're, when you're dealing with money, you have to pay accurately and, and it's crazy. And like I said, I A B is a certifiable thing. You can actually pay them to come audit yours, your monitoring, your statistics and they'll, they'll confirm it. And then sponsors will be more likely to pay those numbers because you can say, no, it's been, you know, confirmed that we're I A B certified.

• 29:38Speaker 01

  A hundred percent. Cause when I, when I've done podcast advertising, I always ask for the certs because I don't trust any of the numbers to be real.

• 29:47Speaker 01

  So I understand 100 because especially in the early days of podcasting, I feel like it was just like reading tea leaves, like nothing seemed to make sense.

• 29:55Jack Rhysider?

  So this became Andrew's pivot. He was able to go to the music streaming services and convince them, look, you have some major fraud happening. Here's proof. And they didn't believe him at first, so he had to really show them how much fraud there was. And they eventually said, okay, instead of monitoring just those music labels that you're supposed to, do you mind looking at all our streamed music and see what else you can discover? And that just snowballed. One streaming provider turned into two, and he kept getting full unfettered download data from many online streaming platforms.

• 30:26Speaker 01

  Yeah, where Jeff Rollins is a leader, we're the market.

• 30:28Jack Rhysider?

  You are such a unique position. I don't imagine there being even two companies that have this access compared to.

• 30:37Speaker 01

  We have more data access than anyone in the music industry.

• 30:40Jack Rhysider?

  No, I mean, I mean, there's no other person like you who's measuring like that. They don't, they don't say, oh yeah, let's, let's open this up to 500 companies to come want to watch our stats and make sure that we're accurate. You're probably the only one for these companies.

• 30:54Speaker 01

  We are the only one.

• 30:56Jack Rhysider?

  Yeah. The competition here is zero for you.

• 30:59Speaker 01

  Yeah, totally. 100%.

• 31:02Speaker 01

  And in a lot of ways, you felt like we made the market, you know? Because at the time, I remember going back to the labels and streaming services and saying, I think you have a fraud problem. And literally, they laughed at us.

• 31:13Speaker 01

  They thought, especially the, the major labels, thought it was less than 1% because keep in mind, their artists aren't cheating. So what they see is only their data and they're like, there's no anomalies here. But to them, it just looked like the independent market was growing. I would actually argue that most of the independent music growth has been from fraud, not from true independent market share increasing.

• 31:35Jack Rhysider?

  Okay.

• 31:38Jack Rhysider?

  Yeah, you gave, you gave me a taste of a few of these things that you were noticing, right? People playing things that are humanly impossible to play that much.

• 31:46Jack Rhysider?

  And, and, and a group of, group of people playing in, in different regions all at the same time. And this, this suddenly sounds to me, because I come from cybersecurity world, this suddenly sounds, sounds to me like. Um, not exactly threat intelligence, but yeah. It's, it's, it sounds like you're looking at a security incident um tool and trying to build uh signatures to detect when there's a security incident. And, and just the one that comes to mind for me is if I had um fifty connections from some office, all go to the same IP address somewhere from different computers internally. Why did that happen?

• 32:26Jack Rhysider?

  There might be a botnet in our company that suddenly said, oh, I'll, I'll phone home at the same time. I'll, you know, get new instructions. And so I would immediately flag those fifty computers to be like, can someone do an antivirus on those to see what's going on there? And I, and I was right, there was, there was a botnet on that computer. And so I was like, okay, we've, we've got a, you know, a way to detect when a botnet happens just by how in the world did this all happen in the same millisecond, right? And so I imagine that's kind of the tools or the, the signatures. I, how, how do you look at this?

• 33:01Speaker 01

  A hundred percent. We're building uh, you know, we have probably close to seven hundred models looking for different things and it's constantly changing. So to give you examples, we found one where somebody had hacked a major artist's delivery feed. Uh, so imagine, like, it's very common to have multiple registration numbers for the same song because it may have been part of a, an album, a single, a deluxe version. It could have been done multiple times to different people in the supply chain. So what ends up happening a lot of times is a streaming service will concatenate that and pick one parent and a bunch of child uh sort of numbers. But that way they're all grouped together. So in this case, someone had hacked the feed, put their version in, but the metadata for that, the payee was different than the actual label.

• 33:44Speaker 01

  So in this case, it looks like the same song. It sounds like the same song, has the same artwork as the same song, but who the finance team pays is different. And they were able to promote their version as the parent and then manipulate those, you know, the payout. So in that case, they stole millions of dollars from that artist over an eight-month period. And when we found it. We found it by some of the ways that they manipulated the streams. Like, how do you become the parent to your question? Like, why did this happen right at the beginning? We found the manipulation early and then it stopped. And we were able to identify that there was something wrong in their data because of their manipulation. And then when we found that, we then built a model to find other artists that happened to.

• 34:27Speaker 01

  We found 1,700 other artists that had been hijacked the same way over a course of a couple of years. And so, again, like, they're constantly being creative. Another one we found, like, a little over a year and a half ago was a device we'd never seen. So why all of a sudden is this very specific device running up a bunch of streams? Like, we would normally see what, you know, for example, the Android system you're on, like, what the operating system, what the device is, et cetera. This is a device we'd never seen. And it turned out it was owned by the Department of Corrections, and someone had hacked the prison system and turned all the prison tablets into a streaming farm.

• 35:05Jack Rhysider?

  Wow.

• 35:07Jack Rhysider?

  Tell me more about that. How did that happen?

• 35:10Speaker 01

  I don't know how they hacked it, but the net effect was that they had turned, I think it was like 400,000 devices, into a streaming farm where they were manipulating streams from streaming players. And so, I guess, I didn't even know, to be honest, that prisoners had devices. But in a lot of states, they have, you sort of pay, I think by the minute or whatever, you pay for these devices. And there's a handful of applications that are approved. It turns out that most of them are runs or slash owned by a private equity company, or a couple of private equity companies. And someone had just simply hacked the devices and were able to use them all in sort of a bot network that we hadn't expected at the time.

• 35:55Jack Rhysider?

  And how'd you spot that?

• 35:57Speaker 01

  Because the device type was suddenly new and different. Like we'd never, because we get all these different. So why all of a sudden? It, in context, it seems small, but we, we have all these types of community clustering techniques that are looking for different parameters and features. So let's say that we get, I don't know, 500 fields. Like we'll get gyros. At this point now from streaming services, we get all kinds of stuff. Gyroscope, battery life, orientation of phone, everything you've done in app. Like we're, we're catching a lot of different data. Anonymized, but individual, like, but hash.

• 36:28Jack Rhysider?

  The streaming service app is collecting that and then you're seeing that as well?

• 36:32Speaker 01

  We're seeing an anonymized version, generally hash data so that we don't have any PII ever. But the, but that's, yes, we're seeing all of the stuff and then triangulating it and saying, why are all these exactly the same? And we've never seen this unique device. So what's happening here? And then it just turned out that that one device is specifically made for the Department of Corrections. Then no one else buys it. So it leaves you to sort of one vendor, which then allows you to sort of like unravel the rest. So that was like a very interesting case.

• 37:05Jack Rhysider?

  And then, and then what do you do with that? Do you say, okay, streaming service, here's a device type that we should just not?

• 37:12Speaker 01

  We demonetize it all.

• 37:13Jack Rhysider?

  Yeah.

• 37:14Speaker 01

  So we don't pay any of the streams out.

• 37:15Jack Rhysider?

  But you block that, I mean, not block, but you, you demonetize that device type. You can, you can do it that granular or?

• 37:23Speaker 01

  Yeah, for sure. We can say these don't get paid. I mean, at the end of every month, what happened is we have three sort of primary checks. We check daily to see what fraud we're catching so that it gets removed out of product level stuff. So recommendation engines, algorithms, et cetera. We, we, we sort of downweight anything we see that are, that's fraudulent. So we don't make the problem worse. The second thing we do is we do weekly updates for charts. So if we see anything on the charting side, we will, you're allowed to update the charts weekly. So what? We'll update the charting information. That's way less common because again, most big artists aren't cheating. At least on the streaming side, but again, we we sort of just safeguard that. And then the last one, which is the real one, is the money payout.

• 38:06Speaker 01

  So at the end of the, at the end of every month, we do the check for the entire month. And because there's stuff we'll catch right, like the really obvious fraud will catch day one. But there's some fraud that takes us along, like you need more of a longitudinal view to see how they're interacting over the course of a week, two weeks, three weeks. There's all kinds of cases, for example, that when we first started, we would catch that no longer happens anymore. So in the early days, I'm guessing as engineers were lazy or it's just easy. Like, how do you deal with, how do you deal with checking for anomaly detections for months where they have different days of the month? So what we often, you know, the 29 days, 28 days, 30 days, 31 days. So a lot of times what they would do at the end of the month is pull the first 28 days.

• 38:50Speaker 01

  And I don't know how fraudsters figured this out, but starting in day 29, they would jam all their fraud through. So you see massive numbers, 29, 30, 31. And so they would end up getting a large percentage of the pro-rata pool, but they only ran their fraud at the end. To sort of like get away from whatever was being checked because a lot of the sort of anomaly detection checks initially in the early days were the first 28 days. Just to, just to simplify it. So again, we, we would find all these weird sort of techniques that they would use and we would shut them down or demonetize them. In some cases, the streaming services, when we return the data back, they take action.

• 39:29Speaker 01

  So sometimes the streaming service will decide to completely remove all the content and just say, this is all fraudulent. So in this case, for example, really obvious stuff, so less than 100 real users have streamed this. 99.99% of all of their streams historically are from fake accounts. Like. You know, maybe they have less than a total of 2,000 streams total. Like, whatever it is, like, they're gonna have these sort of rule sets we have in place to make sure it's only the worst of the worst fraud. And then we'll do that, the streaming service will just straight remove that content. They'll take it off the platform entirely. That seems to be incredibly effective, because the fraudsters realize they're caught and they just stop on that, or go to different services.

• 40:13Speaker 01

  So I think our approach has been less, like, we, I'm not naive enough to believe we'll always stop fraud. I think, historically, you can look at all fraud and say that's never the case. There's always gonna be smart people, and they're gonna try different techniques. But I think we can make it so difficult that they just go to other industries.

• 40:32Jack Rhysider?

  It's so interesting for me to listen to him talk, because this isn't a cybersecurity story, yet everything he's saying is exactly what happens in cybersecurity land. You set up monitoring tools, you build rules to detect problems, and then you make it harder for people to exploit those things again. And they did it all from scratch. We all know in cybersecurity, you can never stop hackers, but what you wanna do is make it so hard for them that they move on to an easier target. That's something I've heard again and again, yet that's what he's doing in this world. And some people always reach out to me and complain that when I do an episode that's not cybersecurity-related, that they get upset. But listen, this show is about the dark side of the internet. And to me, that encapsulates way more than just cybersecurity.

• 41:16Jack Rhysider?

  It's about all the hidden stuff that you never see or experience. I wanna shine a light on that shady, dark, gritty, underground aspect of our digital life. The fraud and the manipulation of algorithms, the websites and technology, the people who abuse it, and of course, hacking and cybersecurity too.

• 41:37Speaker 01

  I was trying to find a link I had a long time ago. There was a, I've actually seen many Reddit posts where...

• 41:44Jack Rhysider?

  People are saying, hey, what's up with my Spotify account? It suddenly shows that I've played a whole bunch of these artists that I've never ever even heard of, much less played. I don't understand why my Spotify is showing that I've played these and it's recommending all this other stuff.

• 41:58Speaker 01

  Totally, account takeovers. That's a huge percentage of what we see now. If you think about, I mean, you're in cyber, so imagine it's a giant arrow back to you. If all of your bots look the same, it's easy to cluster them. If they're behaving the same way, it's easy to cluster them. If they are all streaming one artist specifically, it's like a giant arrow back to that artist. If they're all streaming from one distributor, it's a giant arrow back to the distributor. So you need to hide the needle in the haystack. And the easiest way today to do that, or like what we've sort of, I'd say for the last three years, put a lot of R and D into catch, is account takeover. So they'll log in as you, play a song five or six times and then leave. Then all of this stuff you do naturally just hides whatever they did. So they don't have to create that.

• 42:43Speaker 01

  They don't need to make differences. Like you don't need to sort of program in artificial changes in your bots. Like that, you just basically log in as somebody, play five streams and hope they don't notice. And I would say that that's like really common these days. That's the number one growth area for fraud that we catch is account takeovers in general, or adding devices to family plans. So we'll see a device that's an iOS that's legit, a Tesla that's legit, and then an Android, that's all fraud.

• 43:10Jack Rhysider?

  Wow. Okay, so what I don't understand is how they're taking over the accounts. You say it's one of the biggest things you're seeing. How is, how are they getting so many Spotify accounts or whatever streaming service?

• 43:20Speaker 01

  So there's a couple of ways. The simplistic ways are, you know, like 90% of internet logins are just people trying different data breach passwords and usernames. And I would say that most streaming services are not high on people's priority list for protecting. So, you know, and there's a sort of product question about how much friction do you add into a service to make it difficult for users? Because it hinders growth, right? So I think there's an interesting. Friction point there between like how secure do you make a streaming service on the user end and how much do they actually care and do they really care if their account was used to play a song 10 or 20 times? I don't think they're realizing how much damage it does in

• 44:02Speaker 01

  aggregate. So there's that issue, I would say. I mean, you've been on the whole, you know, series, it's called Darknet Diaries. Like, you can come to Darknet and download these accounts quite easily. I think at one point, to prove a point, you know, we went on and downloaded and showed people, uh, some executives that I could get 100,000 accounts on every single streaming service immediately. It gives you the, you know, the infection date and the last login date. You can even get, uh, if they have malware on the actual device, you can even get sort of all of the, um, the browsing history too. So if you, if you want to like warm up the IP before you use it, you can kind of mimic their behavior before you log in. Um, there's lots of this stuff existing. There's also an API that

• 44:46Speaker 01

  we found in the dark, in the Darknet that, where they own all, like, tens of millions of these accounts and they will spin them up for you. So you basically tell them the parameters of the types of plays you need and they make sure that no single account is overused or indexed too hard and they, um, and they, and they actually create the fraud for you. So they like, it is a fully professionalized, industrialized supply chain for fraud at this point.

• 45:17Jack Rhysider?

  Wow. Seriously, wow. He's shown streaming service execs that he can get 100,000 accounts on their platform instantly because after a data breach, there's communities of people who were parsed through those usernames in the data breach and pluck out all the streaming service accounts or even try to use those usernames and passwords on a streaming service to see if they reuse passwords. And from that, they build these giant lists of users for each streaming service and that list is valuable because if you can manipulate the streams, then you can get paid by these streaming services. I'm just astonished because when I hear how bad the problem is like this and how easy it is for people to get

• 46:01Jack Rhysider?

  access to our stuff, it's like a cold, wet slap in my face. I kind of go through this process again and again when making the show. At the beginning of this episode, I'm like, ooh, these are some interesting techniques. Maybe I'll try one of these on my show. But by this point of the story, I'm so mad that these companies aren't protecting our data and it's just exposed on the dark web only for fraudsters to use to make money for themselves off my account because it's our data. It's not some nameless victim out there. It's yours and mine that these people are gaining from. And I've done this show long enough to know that there is no way from keeping our data from getting leaked, which makes me blackpilled, right? And like, okay, I'm giving up. Oh, well, my data's out there.

• 46:45Jack Rhysider?

  I might as well just assume I have no privacy anymore because it's out there like all over the place and I just totally give up protecting myself. But I don't like feeling hopeless. I'm not someone who gives up forever. I'm an optimist. I'm a fighter and I don't mind hard work. So then I get this surge of ideas and it makes me white-pilled because then I realize, wait a minute, who's the ding dong who told them my address and gave them my password and username and telephone number and all that sort of? I am. Hell, no. No more am I telling these companies my real name or phone number. I am not going to reuse passwords or even reuse email addresses anymore.

• 47:26Jack Rhysider?

  It's a war out there and I've got to take care of my own data since no one else will. Okay, anyway, the name of the company that Andrew co-founded was called BeatDap in order to analyze music streams to detect fraud. And he abandoned the original idea of using the blockchain to help these labels get paid properly and he focuses on this now, pretty much entirely working for streaming services now. Yeah, well, I guess what I'm wondering is you almost need a black hat person who knows that the cheating industry, who has been there, to actually sit down and look for these, to look for things you haven't found yet, right? To find new signatures.

• 48:04Speaker 01

  Totally agree. I think I'm that guy, probably. Yeah, like, you know, the music industry will often said, I'm their hacker now. You know, like I've switched sides and I think the side switching is mostly industries. I would say the, for me, the difference is that users no longer have to actually engage with the content for that artist to get paid. What I did back in the day, I really believe was... In service of the artist. If the artist is good, the people will listen, consume and adopt it. If the artist is not, they will let you know right away that it's trash. And I think that has changed in a sense that you can be a trash artist that manipulates lots of streams

• 48:47Speaker 01

  and gets paid without actually being good or having real users or being able to sell 10 tickets to an event. So I just think

• 48:58Jack Rhysider?

  I push back because

• 48:59Speaker 01

  stealing from other artists.

• 49:00Jack Rhysider?

  Yeah, you're so you're saying it's now more of a financially driven thing and not so much a let's try to market this person and get them to break out. But I push back at you because you did that ad arbitrage where you're like, hey, we could print money by, you know, charging this much CPM and then actually just paying for somebody to come here. So you were money, you were financially driven in some aspects as well. It wasn't always, oh, let's just market someone.

• 49:28Speaker 01

  I regret that and thank God that the statute of limitations has passed. Cause it was definitely not my proudest moment for sure.

• 49:37Jack Rhysider?

  What I didn't realize is that musicians don't get paid per stream on these platforms. Instead, they get paid a percentage of what advertising revenue came in for that month, which means fraudsters are stealing money from real artists.

• 49:50Speaker 01

  Okay. So the way the music industry works is that there's one, I'm going to simplify this because it's a little more nuanced. But generally speaking, there's one pool of capital. Every month, a streaming service makes money from advertising revenue and subscription fees. Now this money goes into one pot and it's paid out every month based on play count. So if you're a artist and you make, you did this, a hundred thousand streams and that streaming service did a million total streams that month, you get 10% of that pot. You get your percentage of streams for the whole entire, the whole entire streaming ecosystem you're in of the revenue. So it's a, it's a performance prorata.

• 50:34Speaker 01

  What happens is you could release a song in November and do a million streams and get paid $3,000, and that's correct. You could release the same song and do a million streams in February and get paid, I don't know, $500, and that could also be correct. The reason the numbers could be different is that month, the advertising might be smaller because they'd spent, like especially this February or January, they'd spent a bunch of money for Black Friday and holidays and advertisers weren't spending as much in January, February. You could have less subscribers. You could also had a major release, so like say a Taylor Swift released a track or an album and all of a sudden, the majority of streams are going to Taylor Swift, then your pro-rata goes down.

• 51:18Speaker 01

  So you could actually have wildly different amounts of money you make for the same general performance because it's a performance base relative to the entire industry. So if you do one in 10 streams, you get 10%. If you do one in 20 streams, you get 5% and so on. So why that matters and how you steal is that fraudsters will load millions of songs on the streaming services as if they're independent artists. They'll create different independent artists' names, different independent artists' labels, they'll put them in different parts of the world. So it just looks like they're from different people, different regions, different companies. They will load those direct, do it yourself, like DIY, to streaming services through distributors. So the distributor is an aggregator who, you know, if you're an independent artist,

• 52:02Speaker 01

  you upload to like a DistroKid or TuneCore or a Symphonic or whatever. And, and they basically do put all the data together and all the pieces together and upload it to the streaming services for you. So they do it in one shop for you. So like instead of you going and uploading to a hundred different streaming services, you go to this one provider and they aggregate it and put it on to all the stores for you. So these fraudsters will create fake artists, fake labels, they'll use 15 or 20 different distributors so there's not one point of failure. They'll upload, so they'll get millions of songs on a streaming services. And then here's the key.

• 52:36Jack Rhysider?

  They will play a bunch of these songs, small amounts of times. They do not want to get noticed. You don't want an artist that charts. That's not real. You want to generate, you know, thousand, three thousand, four thousand streams. But you don't actually like, no one notices the song with three thousand plays. So if you create small number of streams across a large number of artists, then your aggregate prorata, like the amount that you actually have of all of the pools for that month, can dramatically increase because you're stealing pennies. It's basically like, you know, office space. You're stealing pennies from all of these different artists. They just don't realize it, but in aggregate, it's a large amount of money. And so the way that it works today is about three billion dollars worth is stolen from real artists

• 53:20Jack Rhysider?

  because it's going to people that are not real artists. Wow, three billion dollars is going to fraudsters who are manipulating these streaming platforms. That's incredible. It's apparently very profitable to go through all these processes of making tons of songs and getting someone else to play those songs across hundreds of thousands of accounts. It seems like a lot of work, but man, it's really paying off for them. And if it's paying off, then that means it's only going to grow. So a few times you've, you've made my, the hair on my, on my neck stand up when, because I'm a big privacy advocate, right? And I'm like crazy into it, like I'm freak about it. And so you've talked about like some of this, some of the metrics you're getting from some of these apps,

• 54:05Jack Rhysider?

  such as gyroscope and battery life. And I, as a privacy person, I don't understand why I need, you need to get my gyroscope information in order to just let me play a song. But on the other side, when I went to actually, you know, take ads out on some of these platforms to say, hey, market, you know, a legitimate ad on the platform, they'll ask you, hey, you know, when, when do you want someone to listen to this ad? Do you want it to them to listen while they're working out? While they're having sex, when they're making dinner? I'm like, how the heck do you know when someone is making dinner? What is going on here? And so the amount of information that these streaming platforms have on us is crazy. I don't, I don't know what, what question I have, but it, it, it just, like I said, it makes my hair stand up.

• 54:51Speaker 01

  I agree, but I would say for us, just know that in most cases, they treat that data like it is the most important data. Like, I mean, they treat it, having come from healthcare in the previous company, they treat it at a level way higher than healthcare. Like, like crazy, like HIPAA compliant, time 10. Like, they are insane with this data. They hash everything, they're very particular about how it gets to us, how it gets back. We get security audited, we have an entire internal security team. Like, it is very, like, it's partitioned in lots of ways, so even if you get to one piece, you can't get to the rest. Like, we are insane because they make us be insane with it. And, and again, at the end of the cord, you're like, it's just streaming data. But people are stealing $3 billion a year.

• 55:36Speaker 01

  So that's a massive amount of money that is going sometimes to people like terrorist organizations and organized crime, not some kid in a basement. So I, I, the argument also is I think that there's some large level implications for where this money goes and what happens. But I will say that the streaming service side treats that data, whether or not you want them to have it, they treat it like it's very, very important. I've never come across a streaming service that casually allows data. And even then, when we decide exactly what fields we need from different streaming services, we then reject the rest of the fields. Like, we take the least amount that we need to do our job, once we've built the models.

• 56:17Speaker 01

  And then if we build a new model or find a new thing that we need to do, we re-ingest that data and build again. But we don't typically just, like, sit on all this stuff, even if it's anonymized, because we just don't want it. And so I, again, my point is, I feel they've been very responsible with it, if that makes you feel any better, even though they have it.

• 56:37Jack Rhysider?

  You said terrorist organizations?

• 56:40Speaker 01

  Yeah, like, it's like, imagine that you could move money through a streaming platform without anyone noticing. So what you do is you take dollars, you turn it into crypto, at crypto ATMs, you pay the streaming farm operators in cryptocurrency to stream a certain amount of songs. Those songs are owned by different entities globally. So quite literally, you could move money from Columbia to Doha through the streaming service. It'll all be washed and clean through the, the streaming services themselves, directly funding terrorist activity.

• 57:11Jack Rhysider?

  So, so the, the, the artist that they're playing is an artist that they're controlling because they're getting paid.

• 57:18Speaker 01

  They're making fake artists. They're putting fake artist names up. They're taking music that's not theirs. So they might hack, for example, uh, Dropbox accounts. Cause you figure one out of every hundred songs typically in artist releases. So there's a huge like back catalog of artist songs that have never actually been distributed. And when they're distributed is when they're fingerprinted. So a lot of these don't have fingerprints. So if you upload them and there's no fingerprint, the streaming service and the distributor feels that you are the rightful owner of that song because they've never seen it before. So now you can take old songs that have never been digitized, make them your own, and then manipulate the stream. So the first step is just getting the music. The second step is manipulating the stream so you get paid.

• 58:02Speaker 01

  If you're the terrorist organization and you build all this infrastructure, you might have literally, let's say 30 different music label entities around the world, all using different distributors with, I don't know, a hundred quote unquote independent artists in each. And then you're going to just run small numbers of streams to those on a hundred different streaming services and slowly get paid. Um, but that money will be clean and end up from, from one location to another without you ever having to actually transport the cash.

• 58:30Jack Rhysider?

  And you think that's, I mean, looking at those numbers, how much cash do you think that they're transporting? Eighty?

• 58:37Speaker 01

  Hundreds of millions of dollars.

• 58:40Jack Rhysider?

  Well, I was, I was gonna guess a percentage here, right? So like if, if I have a hundred million dollars and I say I need to transfer this, 80% of it makes it?

• 58:50Speaker 01

  Oh, percentage wise of the dollar, like 40 to 50%.

• 58:54Jack Rhysider?

  Yeah, cause it's not very, like, see, this is, they're losing a ton of money on, in the transfer then.

• 58:59Speaker 01

  But it's better than leaving it in cash. And like honestly, that's what typically, how do you move this much cash? There's, they're gonna pay someone to wash their money regardless, sometimes 20, 25%. They're gonna pay a large amount of money anyway. Then they still need to move that money and, and sort of pay taxes and that money would end the other way. You end up losing a lot anyway. So your other approach is just to hide it somewhere or keep it as cash and find other fronts to move it through. It actually ends up that over the last 10 years, the music industry, as it was growing so fast, was a really like opportunistic place to hide or wash money.

• 59:36Speaker 01

  Because no one was watching it.

• 59:39Jack Rhysider?

  Now, I think I've come full circle on you saying you were great hat because I was saying to myself, if you're breaking the terms of service, it's black hat. And now I'm like, wait a minute, if you're breaking the law, that's black hat. This is different than terms of service.

• 59:52Speaker 01

  Yeah, that's how I feel. Like, you know, like, I didn't break laws. I just definitely didn't agree that I wasn't allowed to do something.

• 59:59Jack Rhysider?

  Yeah, and now it's getting crazy where hundreds of millions of dollars are being sent from, uh, from who? Who is, who's involved in this?

• 1:00:08Speaker 01

  Well, imagine any kind of illicit activity, you can move the money to your partners. You can send, you know, how we, how we potentially caught one, for example, is like, you'd see the exact same percentage. Like, let's say that you have a million users all playing music. I'm just gonna use Columbia as an example. But they're, the beneficial, if you think about who the artists are that's benefiting from those plays, it would be abnormal in one case, for example, where we saw, like, I'll give you, I don't remember the exact numbers. I'm gonna give you examples here, like 12% always in a Hong Kong entity, and 30% in a Canadian entity, and 40% in a Middle Eastern entity, and like, you know, maybe another 10% somewhere else. And so if all the numbers of streams are changing every month, but the beneficial owner percentage is exactly the same,

• 1:00:52Speaker 01

  it looks as if someone's moving money from one location to another location

• 1:00:58Speaker 01

  through these other entities.

• 1:01:00Jack Rhysider?

  I, I, so the moving part is that they're paying bots or listeners?

• 1:01:06Speaker 01

  Yeah, they're paying a streaming farm to create the streams, whether they're doing it through account takeovers or bots or whatever. But the end result is they've uploaded as owners under these different entities, all of these fake artists that have songs on the streaming services. There's roughly 100 streaming services globally. So they're uploading it on all these streaming services, and they're telling these streaming farms to go play those songs across all the services.

• 1:01:30Jack Rhysider?

  And then the person who owns that account is getting paid for their streams. And then the money is arriving to where they need to send it.

• 1:01:39Speaker 01

  Yeah, exactly. Because now the streaming service thinks, oh, XYZ label in Hong Kong had X percentage of the total streams. We have to pay them out. So it gets paid through the distributor and paid to them. And they just get paid.

• 1:01:52Jack Rhysider?

  This is one of those stories that I feel like the floor has dropped out in my head of like, oh, yeah, we, we, we have. I have a good understanding of how money laundering happens and how things get sent here and there and how you clean money. But then when you see, when you hear about stories like this where, oh, yeah, they're using a streaming service to launder money and send it across the globe. Suddenly my head's like, well, you could do that with buying and selling things on the Steam marketplace or, or Roblox accounts or any, any other marketplace that has money shifted here and there. And this isn't even like a straightforward, like here, I'm buying something from another user. This is, oh, they'll pay us for streams. If we can get the streams, then we can get paid.

• 1:02:32Jack Rhysider?

  It's, it's such a roundabout way of, of, you know, a convoluted way to launder money that it's blowing my mind. And it just makes me think that every single place that has money going in and out is probably getting hit with something like this.

• 1:02:46Speaker 01

  A hundred percent agree. And I think the more convoluted, the better for them because it's so much harder for the average person to understand how the money moves.

• 1:02:53Jack Rhysider?

  Because I mean, even, even something like Twitter is you get, you get paid for how much engagement you have, right? And so you could totally.

• 1:03:00Speaker 01

  Oh, yeah. Any of these engagement based activities, like especially in web three, anything at the time, like a couple of years ago, there was like this big push with treasury tokens. So you'd get paid every time people interacted with you on, on, you know, social fi platforms or any of these game fi stuff. Like you could manipulate all of this stuff and then get tokens and take it to market and sell it.

• 1:03:19Jack Rhysider?

  It's crazy to me that there's a dark web API that has access to millions of online streaming accounts. And if you feed it money, you can get all your songs played a bunch. And I bet whoever runs that hates Andrew.

• 1:03:33Speaker 01

  I mean, I've had a couple of them do crazy stuff, like reaching out or say things. But I would say that generally, you know, we were talking once, our lawyer for the company is this guy named Jim Trusty. He was the former chief of organized crime for the DOJ. And he told me once that the good news is they don't typically shoot the border guards. It's kind of a gentleman's sport. So I would say that. Most of them just changed their tactics and changed the way they behave. I also think the industry's progressed. In the early days, there was some real trepidation or fear around like what happens? Cause there's a handful of people that know what's going on here. And I would say now every single streaming service has a trust and safety department.

• 1:04:16Speaker 01

  Every single stream, you know, label has a fraud, trust and safety person. So the industry has changed over the last three years in a way that I would say I feel less scared about. Like if you did something to me or my co-founders, like this is not going away at this point. The cat's out of the bag. But I would say there was a real moment in the early, you know, 2021, 2022, where we were actually very concerned about like what happens.

• 1:04:40Jack Rhysider?

  Yeah, I mean, especially, especially if you've got cartels that are moving money in, in big ways. And you're like, okay, let's put a stop to these guys. I can see them being upset with you.

• 1:04:50Speaker 01

  I mean, that was my concern, but again, I think we, we sort of like, whether or not it was naive at the time, it was more like, oh, well, they don't normally shoot the border guards. They just find a different way to move the money, you know?

• 1:05:02Jack Rhysider?

  And do you ever, do you ever point the feds to someone and be like, hey, these guys are breaking a lot of laws? Like, I don't know, dark web API or, you know, cartels moving money. And be like, we've got to report this to someone more than just the streaming service.

• 1:05:16Speaker 01

  Yeah, in some cases, when we find things that are outside the data that, that are, is given to us in privacy, then, um, then sure, we might, we might tell people. But generally speaking, we report the results back to the streaming services. And then they determine, and, and the distributors, for example, and the, and the collection societies, right? They determine then who to, who they want to work with on the government side to prosecute. Cause that's typically a, you know, long road, three to five years. Sometimes, especially in multiple countries, you have to deal with Interpol and all kinds of different activities. And so I think, um, I would say that's an area that's emerging, but we provide all the evidence that they need and then they and help them package it to whoever agency they're going to.

• 1:06:00Speaker 01

  But typically, they are the ones that are the ones actually determining whether or not they're going to pursue it.

• 1:06:05Jack Rhysider?

  Okay, I'm now changing my mind. What Andrew did when he was younger, I used to say was black hat marketing, but now I'm going to say he was doing gray hat marketing. Aside from the ad arbitrage stuff, all he did was violate the terms of use on websites like Facebook and YouTube by artificially inflating the numbers. Coming into this, I would have said that's black hat, but not now. Now I think these cartels or terrorist organizations that are moving hundreds of millions of dollars through these streaming platforms, that's black hat marketing. That's some real dark stuff. Anytime these streaming services have to call the authorities on someone, that's what I think is black hat marketing at this point. And I suppose because now that I've seen such an extreme side of this marketing,

• 1:06:50Jack Rhysider?

  I'm no longer so judgmental about somebody having a bunch of fake followers on their account to help them break out. Because really, the fake followers and algorithm manipulation can only go so far. If they're a bad musician or whatever it is they're creating, they'll never take off, no matter how many fake streams they get. But if they are great and people really love them, then that was just a growth hacking technique to kickstart their journey. And after they break out, there's no longer a need for all the fake followers. You do run the risk of getting banned off those platforms, so I don't recommend doing it.

• 1:07:25Jack Rhysider?

  But now that I think about it, banning users is really tricky. Because suppose Twitter has a way to detect when there are fake followers, right? And they automatically ban someone if they have like 60% of their followers are fake. Well, then imagine someone gets millions of fake followers to follow Elon, and he gets kicked off for having a majority of fake followers following him. You see, you can use these bans as a weapon to get someone else banned that you don't like. So banning users for having a bunch of bots following them is really, really tricky. And maybe you can't even do it. With all this information you have, you've got to have probably some sort of restriction on what you're allowed to say. Because if there is, I mean, you can see who the top artist of the day is.

• 1:08:10Jack Rhysider?

  You have so much data. You can see how many streams are getting, you know, and all this sort of stuff. And, and, you know, magazines like Pitchfork, I don't know Pitchfork, but, you know, whoever is the music industry magazines would love to know who's the top, you know, streamer of the day, or a week, or month, or something like that. And a lot of this stuff is, is kept quiet. I mean, we get to see some statistics of what's, how many, how many downloads a song has. But we don't see very much of, of, you know, that. And, and you could have such an outstanding blog of like, here's how, here's what's going on today. And people would just flock to it. It would be huge, but you're probably not allowed to share that kind of information.

• 1:08:49Speaker 01

  It's our core promise to all of our vendors. Like you give us your data, we do not monetize it in that way. So we, we provide you results back as a true financial tool and trust and safety tool. We do not monetize it in any kind of marketing, any type of market reports. Like, we will not monetize the data they provide us. They pay us an annual service fee so that we aren't incentivized to find more fraud than there is. If there's not a lot of fraud, we tell them. If there's a lot of fraud, we tell them. Like, we are just a trusted source of truth. But we do not, we don't monetize that data anyway. Yes, we could probably build a massive company, but I'm not sure they would trust us in the same way. And I think that's the why a lot of these marketing level companies that do aggregate data, they get very limited data sets because they, you know,

• 1:09:34Speaker 01

  the biggest fear for these services is this data being public or going other places. So we are, we're allowed, we are, we are privileged enough to handle it because we've built a large and strong level of trust with all of our partners. And they know that we would never violate that trust.

• 1:09:53Jack Rhysider?

  Yeah, at first I was thinking as well of like, oh, you're saving all these streaming companies money by, you know, saying, hey, don't pay these people because they're not doing it. But now, but at the beginning, you told me, no, there's, there's a big pool and a percentage goes out to whoever gets the streams. And so I don't think you're saving these streaming companies any money at all because they have to pay out a hundred percent every month or whatever. And whether it goes to the right person or the wrong person. Yeah, okay.

• 1:10:20Speaker 01

  We're at cost of doing business for them. I would say in some cases, they save money. So there's, this is where it gets nuanced. Like what I've been talking a lot about is what's called interactive streams where people get to choose what song they listen to. But in cases where it's non-interactive, like think of it like online radio, they have to pay a set rate out. There's a rate card that's sent. So when you remove the fraud from those, they actually do save money. So in some cases, in some areas, they'll save money. But I would say generally across the board, they're probably not, not making money off of us if they're interactive. So if, if, if they offer a service where you get to choose what you listen to, they're probably not making money off of us. But they also, if I'm being honest, don't want to be the executive who's perp locked for, you know, funding terrorism.

• 1:11:06Speaker 01

  So there is like, there is an existential risk. And also you figure the major labels are huge victims here. Keep in mind, if you're a major label, you own and distribute probably over eighty percent of all revenue generating content. Not just all content, but revenue generating content, like royalties are coming primarily from the major labels or the independent labels they distribute as a major. So when you look at it as a whole, if you're a streaming service and eighty percent of the things people are listening to are controlled by these three parties and they're saying, we're tired of being victims. If you do not have a service like this, you cannot have our content, it moves a lot of needles.

• 1:11:44Jack Rhysider?

  Wow. Well, this was, so much of this was so illuminating to me. I did not know about this world much at all. I mean, I told you what I do know and there was a few things here and there, but man, there is so much I've learned here. Thanks so much for coming and telling me all this.

• 1:11:58Speaker 01

  Yeah, thanks for having me on. It's been really fun. Again, I appreciate you making the time for me.

• 1:12:11Jack Rhysider?

  This show is created by me, the hashed brown, Jack Rees Cider. Our editor is our friendly cis-admin, Tristan Ledger. Mixing done by Proximity Sound. And our intro music is by the mysterious Breakmaster Cylinder. Well, I don't know about you, but the next time someone makes fun of me for the music I listen to, I have the perfect excuse. "No, no, my account's been hijacked. It plays random stuff, I swear. I can't stand this band, you kidding me?" This is Darknet Diaries.