162: Hieu

All Hieu Minh Ngo wanted was to make money online. But when he stumbled into the dark web, he found more than just opportunity, he found a global dark market. What started as a side hustle turned into an international crime spree. Find Hieu on X: https://x.com/HHieupc. SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. Support for this show comes from Drata https://drata.com/darknetdiaries. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries https://drata.com/darknetdiaries. This show is sponsored by Red Canary https://redcanary.com/. Red Canary is a leading provider of Managed Detection and Response (MDR), helping nearly 1,000 organizations detect and stop threats before they cause harm. With a focus on accuracy across identities, endpoints, and cloud, we deliver trusted security operations and a world-class customer experience. Learn more at redcanary.com https://redcanary.com/.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  I want to make sure I pronounce your name right. So can you say your name for me?

• 0:04Speaker 01

  My name is Hugh Minh Go.

• 0:06Jack Rhysider?

  Hugh was born in Vietnam.

• 0:11Speaker 01

  I'm growing up in a small town in Vietnam. It's called Camphan. I was started to be a hacker when I was very young. Maybe around like fourteen, fifteen years old. And then it's just kind of like out of curiosity. You know, like wondering about how the internet working and and back then the internet is very expensive and super slow.

• 0:43Speaker 01

  That's one of the reason that I started to hack and steal a few internet dial-up accounts to be able to use it without paying anything.

• 0:58Speaker 01

  That's kind of my my first time I got into trouble when I was like fifteen years old.

• 1:05Jack Rhysider?

  This was around 2004, a time when 56K modems were the most popular way to get online. And the way it worked is you dialed a phone number and connected to the ISP that way, and they would connect you to the internet. But the ISP would charge you by the minute to go online. Can you imagine that, being charged for every minute you're on the internet? That's how it worked back then. Hugh couldn't afford that. So he figured out a way to use someone else's account, basically stealing someone else's ISP connection to get online. And that meant other people were paying for him to get online.

• 1:35Speaker 01

  And just like a few months, you know, few months using these stolen internet dial-up account, I got kind of a paperwork sent to my house. And my parents, they got very surprised. And then they told me what's about. And then I told them, you know, it's related to some stolen internet accounts.

• 2:01Jack Rhysider?

  The paperwork said that Hugh did $5,000 in damage. And his father had to pay the fees? That's a lot of money. His father was pretty mad and sent him away to go live with his uncle in Ho Chi Minh City. And little did everyone know, it was going to be there, in Ho Chi Minh City, where he was going to build a darknet service and was going to make a fortune doing it.

• 2:29Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:36Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 2:59Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now, retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic, one that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place, so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40 times while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 3:44Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 4:03Jack Rhysider?

  This episode is sponsored by Arctic Wolf. Everyone is slapping AI-powered on their security tools, but Arctic Wolf took a different approach. Instead of duct taping AI onto the SOC, they rebuilt the SOC around AI and called it the Aurora Superintelligence Platform. If you ever tried to build your own AI pipeline, you know the pain. Data engineering, model tuning, governance, validation, Aurora removes all of it. You deploy it and instantly inherit the intelligence, guardrails, and operational maturity of one of the world's largest agentic SOC. Under the hood, Aurora is running a fully agentic architecture. They call the Swarm of Experts. These agents are battle-tested inside the world's largest commercial SOC

• 4:45Jack Rhysider?

  and only ship when they can outperform human-only workflows. And its integration is seamless as Aurora works within Arctic Wolf's concierge experience, allowing your security team to focus on higher-value strategy and proactive risk reduction. If you want to see what a real trustworthy agent-led SOC looks like, not the marketing slide version, go to arcticwolf.com/darknet. That's arcticwolf.com/darknet.

• 5:14Jack Rhysider?

  His dad recognized that Hugh was really into computers. And Ho Chi Minh City is a big city that has better schools to learn computers. And so Hugh got enrolled in classes and started studying. His parents would check in with him to make sure he was doing his schoolwork.

• 5:26Speaker 01

  I was learning a lot. I was learning about like web programming. I built my first website, HughPC.com, I remember.

• 5:35Jack Rhysider?

  He was learning about operating systems, networking, and cybersecurity, all at high school. He really loved computers and was hooked on learning more.

• 5:43Speaker 01

  I went to the internet cafe, you know, to use the internet because internet at my house is very slow. So I went to the internet cafe and I, the moment, you know, I been there, I passed to one of the computer screen. And I saw that computer screen is kind of very dark, you know, some kind of dark background and the font size is very weird. And also like the, the color of the text is also like look cool, you know, like green color and something like that. And I asked the guy, you know, what's this forum about?

• 6:25Speaker 01

  And then he, he told me, you know, this is about the dark web in Vietnam.

• 6:34Jack Rhysider?

  Ooh, Vietnam's dark web? That sounds interesting. You ready to go there? Hugh was fascinated by it. He learned how to access it, where to go. For him, it was like finding a whole hidden place online, filled with really fascinating stuff. Hacker forums, forbidden item marketplaces. It really emphasized the power of the internet. This was all unregulated. The government, the police, they can't stop what goes on on the dark web. And that really fascinated him. There's this whole section of the internet where anything goes?

• 7:09Speaker 01

  They're talking about hacking. They're talking about, you know, like sharing sensitive information and also like bank account and also some hacking techniques too, you know, like... And it got me, you know, wondering how they did that.

• 7:25Speaker 02

  Yeah, but so I think maybe a normal person would look at that and say, "Wow, there's stolen stuff here, there's illegal things here. Maybe this isn't for me, maybe I should go back to the clear web."

• 7:38Speaker 01

  Right, that's true.

• 7:39Speaker 02

  What?

• 7:40Speaker 01

  You know why? Because back then, right?

• 7:43Speaker 01

  Underground forums is very fun though. They always sharing and they don't mind about money. Like they... Sometimes they hack something, they just post it for free for everybody. Not really like into business or trading or dealing anything. It's just like sharing techniques, you know? But, you know, like, when it got into that, I say, "Man, you know, it's something that, you know, I really wondering. I watched on the movie and TV about hackers, very cool." That's why, you know, I say, "Yeah, I want to learn that." You know, "I want to be a member in that hacking forums, underground hacking forums."

• 8:28Jack Rhysider?

  So this became his obsession, how to hack. What are the techniques? Like, he would learn about a vulnerability and then use Google search queries to find websites that were vulnerable. And it was like the whole internet opened up to him in new ways. He was finding that thousands of websites are vulnerable to a variety of different attacks. And he was just getting into one after another with simple techniques like default passwords and SQL injection. But the extent of the damage he was doing was he just hacked into the site and put something on the website that said, "Pwned by HuPC", which is the name he was using at the time, and also the name of the website that he made as a teenager. But the whole time, he was just curious, not using his access to make any money or stealing anything.

• 9:10Jack Rhysider?

  He just liked learning and liked the excitement you get from getting into places that you're not supposed to be in. It made him feel clever and smart and powerful, and he was teaching others how to do it. But after all, he was still in high school.

• 9:23Speaker 01

  I share a lot of like hacking techniques and that, also like social engineering techniques. But the thing, you know, like the more I share, the more the people they know about me on these underground hacking forums. And eventually, they voted me as an administrator in one of these forums, very popular in Vietnam. And after that, you know, I joined a few, um, a few forums in Russia and even like in the Eastern Europe as well, too.

• 10:04Speaker 01

  So I keep learning, but the thing went really market money. You know, before that, it's just trading for free, sharing the knowledge, sharing the techniques.

• 10:15Jack Rhysider?

  From posting on the forums and being an administrator to one of them, he started becoming more known. And so he met a guy, one of the forum users, and this guy's like, "Hey, listen up, Hu. Your ability to hack into websites is actually worth a lot of money. Do you want to team up? You want to hack places and give me what you find and then I'll pay you for it?" The guy explained how together they can make all this money. And Hu didn't have much money at the time and was interested.

• 10:42Speaker 01

  And you know, like when talking about money, when I was very young, I say, man, you know, like, I saw the people making a lot of money too by, you know, by using like stolen identity and ridicule. And and you know like to make some money and then and then be able to uh buy some stuff if if if very cool, right? You know, like some uh technology stuff or some new devices, something cool for myself without asking my parents. So that's why, you know, I I say, yeah, okay, let's uh so let's do it.

• 11:21Speaker 01

  And then um the guy, he moved to my apartment, um living with me. And then I, you know, during the night night night time, uh after the school, I started to hack a lot of e-commerce website.

• 11:40Jack Rhysider?

  E-commerce sites, like places you go to buy things online, like clothes or computers, kitchen items, uh travel tickets. A lot of these sites back then ran on WordPress or PHP or ASP and didn't have the best security. And it's kind of like a numbers game, right? If there are million e-commerce websites on the internet and one percent of them has poor security, that's 10,000 websites that are just sitting there vulnerable, way more than enough for someone like Hugh to go through. So the idea was to get into these sites and plant a listener that would capture when someone would enter their credit card to buy something on there. And then Hugh would give those credit card details to this guy he's teamed up with. And the guy will somehow convert the cash for both of them?

• 12:26Jack Rhysider?

  Hugh was 17 at the time, a senior in high school. And so after school and on the weekends, Hugh and this guy would get busy scouring the internet for a vulnerable site to hit.

• 12:37Speaker 01

  Back then, a lot of website, right? They use like the language called PHP or ASP. It's contain a lot of vulnerabilities. And then I search on Google with those keyword, um you know, some of the Google Doc that to be able to find out for me on the list of the website. And I put on the customized tool that I programmed. And then I just click scanning and it just got like automated scanning for the vulnerabilities. And then it will give me the list of the vulnerable website.

• 13:21Speaker 01

  And then I will explore that to be able to obtain the credit card information.

• 13:28Speaker 02

  And what was the first site that you made money from?

• 13:32Speaker 01

  The first website is, I remember is located in the UK. Right? That website is still very popular nowadays in the UK, but I don't want to mention that.

• 13:45Speaker 02

  That's fine. Yeah, what kind of site is it? Is it banking? Is it a?

• 13:48Speaker 01

  No, that website is an e-commerce website selling like electronic stuff. And in that website, it got SQL injection vulnerability.

• 14:00Speaker 02

  So you found a website through Google Dorking in your scans?

• 14:03Speaker 01

  Right.

• 14:04Speaker 02

  You tested it for SQL injection, it worked. And what is that feeling like to get into a website using SQL injection?

• 14:11Speaker 01

  It's got like a goal mine. I say, wow, you know, like this is so many credit card information. Like a day, I'm so excited though, like the feeling is kind of you control something, you have a power. You feel like you be able to plug into anything. If you have time and you have the resource. And you feel like you on top of the world, you know, you can be able to get anything.

• 14:44Speaker 01

  And I feel like so excited, like the world, it's hard to say to explain that, but. Feel like so happy, technically so happy though.

• 14:59Speaker 02

  Yeah, do you give each other a high five?

• 15:01Speaker 01

  Right. I, me and him, we give a high five and hug it. I say, yeah, we did it. We, we got it. And, and, and I think, you know, we will be able to make a lot of money from this. Um, not just selling the information, but also like using that. And he's so excited and we was laughing the whole night, I remember. And we was very young. He, back then he was like eighteen and I was like seventeen. And he say, "Yes, uh, let's do this way." "We use all the credit confirmation, right?" "Every day we was, uh, getting like slowly,

• 15:43Speaker 01

  around like fifty to a hundred credit card from that website alone." "And, uh, we was playing on the poker website."

• 15:54Jack Rhysider?

  Of course they took the stolen credit cards to a gambling website. I should have guessed. No, they weren't actually gambling with it. What they were using this poker website for was to launder the money. See, back in the late 2000s, online poker casinos didn't always have this most strict security and verification controls. They were happy to take anyone's money, whether it was stolen or not. So he created an account at the casino, loaded it up with as much stolen money as he could, and he might make three or four of those kind of accounts. And then he would have all those accounts join a poker table where his buddy was in and just try to lose as many hands as possible as he could to his buddy. Then his buddy would get all the chips and cash them out at the local bank. This technique is called "chip dumping."

• 16:39Jack Rhysider?

  Now, the casino was aware of these sort of things and would try to spot people doing this. So he had to do things to avoid the fraud detection, and his tricks were working.

• 16:47Speaker 01

  And we was able to make in like a day like thousand and thousand USD a day. And then we split the money like fifty-fifty. I, you know, I spend on like, I use that money to spend on stupid stuff, vacation and also like taking girls out and, you know, like easy money, easy go technically.

• 17:12Jack Rhysider?

  Can you imagine that setup? A hacked website is supplying them with a constant stream of eighty new credit cards a day. And they take those cards, deposit the money into a casino, move the chips to another player, cash it out, and then go spend that money on something fun. Like where do you even focus here? Do you want to get more credit cards? Or cash out more at the casino? Or just enjoy a good time with all the money you have? For them, it was all of that. They wanted more cards and then they'd be busy trying to drain them all as fast as they could to launder the money. But as Hugh found more and more sites vulnerable to his attacks, he was sometimes stumbling upon whole databases of customer credit card details. Websites shouldn't be storing their customer credit card details like that.

• 17:54Jack Rhysider?

  And this was even a surprise to him, but this meant sometimes he could find thousands of credit cards in a single day.

• 18:00Speaker 01

  Eventually, I went back on the underground hacking forums. I sell the information. Visa and Mastercard, I sell for like fifty cents for one information. And American Express and Discover, Discover card, I sell for from one dollar to three dollars, you know, different.

• 18:25Speaker 02

  That sounds so cheap. So you're telling me the full credit card information was you were selling that and the people could take that credit card and buy something for a few hundred dollars with that, right?

• 18:37Speaker 01

  Right, that's true. They can go on eBay and buy. Or they either they, you know, back then very easy though. You can just use the stolen account, stolen bank account or stolen credit card information. You deposit it into PayPal and then you withdraw. It's so easy.

• 18:54Speaker 02

  Yeah.

• 18:55Speaker 01

  It just took a few days and few weeks to be able to get the real, real money out.

• 19:04Speaker 02

  I'm surprised you were selling it so cheap, though.

• 19:06Speaker 01

  Very cheap though, like because so many, so much information.

• 19:10Jack Rhysider?

  That's crazy cheap. Usually cards are like, I don't know, ten to fifty dollars per card. Because theoretically, each card should be worth a few hundred dollars before fraud detection kicks in and make the card invalid. Rarely I'll see them for like five dollars or less, but fifty cents a card? Wow. And that's what Hugh was selling them for because he just had so many. Because he just kept finding more and more e-commerce sites that were vulnerable to SQL injection, which means the website's form field wasn't as secure as it should be, right? So he can go and type something onto a form field in a website, and that triggers the vulnerability. And suddenly, he can see like whatever's in the database, like an admin's password hash. And then he could crack that password hash and log into the site as the admin.

• 19:55Jack Rhysider?

  And sometimes that alone would give him credit card details to the site. Because some sites did not treat their customer credit card data properly.

• 20:02Speaker 01

  It show everything on the admin panel.

• 20:06Speaker 01

  Like you go, you just click on the customer option, right? It show you the list of customer. And when you click on the credit card information, it pop out of credit card information.

• 20:18Jack Rhysider?

  I mean, when I hear that, I immediately think that's a PCI violation. PCI is Payment Card Industry. And for you to be able to accept credit cards for your business, the credit card company has to verify that you're properly storing customer credit card data. If you aren't, then you will lose the ability to process transactions and can be fined quite severely. So Hugh kept focusing on finding more and more sites to hack into and take all the customer credit cards that the site would store in their database. And he spent years doing this, mostly selling the cards in bulk on the dark web. He was finding and selling tons of credit cards.

• 20:52Speaker 01

  More than 100,000 credit card information.

• 21:01Jack Rhysider?

  He gets done with high school and decides he's had enough of this. His pockets were overflowing with cash, and he knew what he was doing was wrong. So he decided to leave town.

• 21:11Speaker 01

  And then, you know, I saved up some money because I know this couldn't last long. We was making like more than a year, and it kind of getting harder. Because they know the chicks, right? And they fish the vulnerabilities. So getting harder. And I saved up some money. I paid for the school fee in New Zealand.

• 21:35Jack Rhysider?

  His sister was living in New Zealand, so he decided to go see her and go to school there. He knew that what he was doing was wrong and could potentially get him arrested, but he grappled with it. Like, he went back and forth convincing himself it's okay to take these cards. Like, these websites should secure their site better. And if it wasn't him taking it, then it would surely be someone else taking it. So why not me? But then flipping it and being like, no, this is stealing. This is illegal. I'll get in trouble for this. The move to New Zealand gave him a fresh start. He wanted to become a good student who was learning computer science.

• 22:10Speaker 01

  When I got into New Zealand, I stayed there for a few months, not doing anything illegal. Tried to be a good student at the school, learning about computer networking and be a computer scientist, you know? But things couldn't work out. I started to hacking again. After talking with a few friends, a few hackers on the internet. And they say, you know, they need to record. And, you know, and I need money because my family couldn't afford to send me much money. So I say, yes, so let me find out if in New Zealand have some website

• 22:54Speaker 01

  that I can obtain the record information. And I hacked into a few e-commerce website in New Zealand. Yeah, the same thing, you know, it's just some basis, vulnerabilities. And I got into the database and I got the stolen record.

• 23:17Jack Rhysider?

  He was able to sell the credit card data to make some money, but with all these cards, he decided to use a few himself, which was probably a dumb idea.

• 23:25Speaker 01

  And I used that stolen credit information to buy electronic stuff like laptop and cellphone on similar like eBay, they call it Jimmy platform. I used that, I used the stolen credit card on that website. And I got the stuff and then I sell that to the same platform to make money. Kind of like learn with the stuff, you know, like to get the real cash. But eventually, you know, I made a mistake that using the stolen credit card

• 24:06Speaker 01

  to buy the music concert tickets to the ticket master. And I bought a thousand and thousand music concert tickets to sell to other people with a cheaper price. And then when-

• 24:22Jack Rhysider?

  You bought a thousand concert tickets?

• 24:24Speaker 01

  Right, I bought a lot.

• 24:26Jack Rhysider?

  Wow.

• 24:27Speaker 01

  And I resell that to other people on the platform. But the thing, you know, like a few of the people, they bought my music concert ticket.

• 24:43Speaker 01

  They got robbed when they tried to enter the stadium or tried to enter the concert, right? They got denied because this ticket, you know, is got invalid because it's kind of considered as a fraudulent ticket. And they got so mad and they got so scared and then they also complained to the law enforcement, to the police in New Zealand. So the police in New Zealand, they freeze my account on the platform and also freeze my bank account. So I got so scared. They also called me and called my sister. Almost a year, stayed in New Zealand. I got into trouble. And the moment I got that phone call from the law enforcement,

• 25:28Speaker 01

  I got so scared. I bought the ticket, I ran away. I ran back to Vietnam.

• 25:34Jack Rhysider?

  Oh, boy. Hugh was on the run. The police were now looking for him. But he was able to get away and find refuge in Ho Chi Minh City in Vietnam. He escaped the police and didn't suffer any consequences from this. Lucky break. We're gonna take a quick ad break here, but stay with us because this is not gonna be the last time that the police go looking for him. His operation is about to go stratospheric.

• 26:03Jack Rhysider?

  This episode is sponsored by Black Hills Information Security. Black Hills InfoSec loves sharing their knowledge with free webcasts, blogs, zines, comics, and courses designed for beginners and those more advanced. Through anti-siphon training, they teach you the cybersecurity skills you need, from SOC analyst tools and methodologies to setting up traps and running deception operations. It's hands-on, practical training built for people who want to advance and hone their skills. The world of cybersecurity has changed a lot this year, and every day seems to bring more questions about what comes next. That's why anti-siphon training is hosting a free summit on December 9th, asking, "What in the actual cyber happened in 2026?" Join experienced practitioners as they share practical lessons,

• 26:48Jack Rhysider?

  real-world experiences, and insights into the top security news of 2026. Because you're a Darknet Diaries listener, they've got a little something extra waiting for you at blackhillsinfosec.com/darknet. That's blackhillsinfosec.com/darknet.

• 27:09Jack Rhysider?

  Hugh gets back to Vietnam. He's around 20 years old at this point. He goes to see his mother and his father, and they heard about his fraudulent concert ticket thing, and they were mad. They scolded him, they shamed him, and Hugh was just lying back to them.

• 27:22Speaker 01

  I give them all the false promises, you know. I told them, you know, I will be a good boy and be a better person, not doing anything illegal. It kind of feel like very ashamed, you know. So my mom was crying a lot. But back then, I was like 20 years old, 19 years old. Tried to be a good person. I didn't touch the computer with insisment when I got back from New Zealand. And I told with my mom, you know, I want to go to Ho Chi Minh City to learn computer science at the university in Ho Chi Minh City.

• 28:07Speaker 01

  My mom and my dad, you know, they can't believe me that I'm kind of a changed person. And hopefully this time will be the last chance for me.

• 28:19Jack Rhysider?

  So around 2009, he moved to Ho Chi Minh City and enrolled in the computer science and cybersecurity program at the university.

• 28:26Speaker 01

  But during that first year, I went to kind of to hang out with other old school hackers in Vietnam. They own black hat hackers. They heard about, you know, I got problem, I got trouble in New Zealand by using stolen credit card. I say, yes, you know, that's why I don't want to touch computer anymore. I'm I got so scared, I almost got caught. And they told me, you know, why you don't think about US identity or personal information? It should be safer, it should be easily to sell that.

• 29:05Jack Rhysider?

  So these hackers were telling him, yeah, of course you got in trouble for stealing stolen credit cards. Man, don't mess with money. The police are gonna get mad if you do that. That was your mistake. They take credit card theft very seriously. Heck, I bet the US Secret Service probably has a case opened on you. What you should have done is gone into the business of stealing the identities of US citizens and sell that. Not only can you make money doing that, but the Secret Service doesn't give a crap about stolen identities. In fact, nobody does. They'll never come after you for stealing identities. Especially if you stay here in Vietnam, they can't touch you. So you should try stealing US identities. So he starts looking into it. My goodness, he thinks, right? Stealing identities and selling that is far less of a crime than stealing credit cards

• 29:50Jack Rhysider?

  and just as valuable on the dark web. He wasn't sure why it was valuable, but if he could get all the personal details of someone, like their address, social security number, phone number, work history, the type of car they have, then people will buy that up like crazy on the dark web. So he starts looking around for places that might have all this information on US citizens.

• 30:10Speaker 01

  I didn't think kind of in the long term. I just see whatever I see in front of me. And the money is just kind of blind my eyes. And I thought as should be safer. And I'm in Vietnam. And this is US identity subify.

• 30:33Jack Rhysider?

  I mean, the logic checks out, right? Stealing identities of people in a far, far away country? No chance of them catching him in Vietnam, right?

• 30:41Speaker 01

  And eventually, I spent like almost a month. I recon and also do a, doing a lot of auction to get me a list of only data broker in the US to be able to provide this data.

• 31:00Jack Rhysider?

  Data brokers, of course. They would absolutely have a ton of people's identities. Okay, so if you don't know, a data broker is a company that spends an enormous amount of effort gathering up as much information as they can about you. Here's how they do it. Number one, they'll copy the whole phone book into their database. That's got everyone's name and phone number. Then they'll take a copy of all the county records. This includes who owns which property, court records, marital status. Then they'll look at your social media account and scoop up any photos that you have taken of yourself and posted. Email addresses you list, affiliations, like which school you went to or place you work. Like LinkedIn is being scraped by data brokers all day.

• 31:43Jack Rhysider?

  Would you personally have told what your skills are? Who your coworkers are, where you work, and what you look like? Now, to me, that's already spooky enough that someone would go through all this trouble to get all this data on me by doing all that. But some data brokers go far deeper and are way more sinister at getting data on us. They have been known to install trackers on your phone, which typically just comes along for the ride on popular apps. Like a data broker may pay an app developer to put a tracking pixel on the app so that they can track people even more. This means data broker is often collecting cellphone data, which could include your phone number, the app usage, but more interestingly, up-to-the-minute location information.

• 32:27Jack Rhysider?

  Some data brokers go even further and set up antennas around town and watch what phones interact with those antennas, and they can track your phone's location that way. Some have been known to put little sensors on roads to identify which cars have passed down that road and take pictures of license plates going by, too. Of course, purchasing history is important to them. I've heard stories of data brokers buying your purchase history data from retail stores. And if you don't know, a lot of retail stores are very closely tracking all the purchases you make with your credit card and have a complete history of everything you've ever bought with that card in their store. Sometimes they even track where you are in the store and what you stop to look at to see what interests you. And yes, absolutely, data brokers are buying up all this data that the stores are collecting

• 33:12Jack Rhysider?

  on you because this consumer behavior is worth gold to these data brokers. So why do these data brokers do this? Why do they go to such great lengths to build databases on us? Because there's a lot of people who are willing to buy this data. Your data is very valuable, and I'm not talking about selling it on the dark web. We'll get to that. Data brokers often sell their data to law enforcement. And this has been a growing problem over time. I feel like law enforcement has found a loophole to ignore the Fourth Amendment. As a refresher, the Fourth Amendment says, "You have a right to privacy from the government. The government should not be able to see into your life without a warrant or probable cause." But they are through data brokers.

• 33:57Jack Rhysider?

  There's something called a third-party doctrine now, which says if you give your data to a third party, you no longer have a reasonable expectation of privacy from that data. So that means if you have money in the bank, the bank can share your data with the government without a warrant, and law enforcement can purchase your location data from a data broker without a warrant because it's commercially available data. Data brokers are trying to ruin the Fourth Amendment. And I want you to look a little closer at where this data is coming from. Yes, a lot of it is publicly sourced. But a lot is not. A lot is data that you think is just private between you and the party you trusted your data with. But they're selling that data to others.

• 34:38Jack Rhysider?

  And so if you think it's safe and secure, but it's secretly being scraped and sold, I would say that's spying on you, which the government isn't allowed to spy on its own citizens. I mean, mass surveillance is against the law, flat out. But they can get away with it because data brokers are the ones doing the spying and the mass surveillance, not the government. And then they're selling it to the government. Now, I've tried to remove my digital footprint as much as possible, but there are still things that I'm forced to do, which hurts my privacy and I hate it. Like, for instance, anytime I see a doctor, I can't do it under a fake name. They have a strict policy where I have to prove my identity in order to get medical treatment.

• 35:22Jack Rhysider?

  And then my medical records are being passed around to millions of people. HIPAA isn't there to protect our privacy. It's there to assist others to get our data. The portability part of it means they're making it easy to package up our data and send it to whoever asks for it. And there are millions of people and entities that can access HIPAA and patient data. Second is banks. There are laws in place where the banks have to verify who you are before they do business with you. Know your customer type stuff. And the banks are forced to report certain activity to the government. So millions of customers' banking data is going to the government again without a warrant. Lastly, I hate all this public record stuff.

• 36:07Jack Rhysider?

  If I buy a house, get married, go to court, start a business, get arrested. All that is public record and it gets abused all day, every day because it is. I have no choice when it comes to these matters. My banking history, medical information, marital status. There's no way to opt out of any of it. And data brokers are just licking their lips, sucking it up as fast as they can. And they're profiting off of it. And they're using it to strip away my rights. But don't think it stops there. Data brokers are just companies trying to make money. So they have no problem selling your data to Walmart, Facebook, Google, insurance companies, credit card agencies, ad agencies. Because all these businesses would love to know more

• 36:50Jack Rhysider?

  about who you are so that they can target you with ads or to calculate the risk of doing business with you. And these data brokers absolutely do not want you to know they exist. They do a great job at hiding their presence in the world. Let me give you an example. I'm going to list eight of them for you. And I bet you've never heard of any of these companies. Yet there's a high chance that all of them know exactly what you're doing right now. Merkel, LocatePlus, LiveRamp, Microbuilt, Vental, Safegraph, XMode Social, Court Ventures.

• 37:32Jack Rhysider?

  I certainly don't know anything about these companies. But Hugh was learning a lot about them.

• 37:43Speaker 01

  And I found out, right? There are a few key players in this data business related to the US. And they provide this data to law enforcement, to lawyers, to private investigator, stuff like that. And I see, man, it kind of like very difficult to get this information. You have to prove yourself. You have to be verified. So that's why I put a lot of time, like almost a month. And I hacked into two different data brokers, very popular one.

• 38:25Speaker 01

  Uh, the first one is this, uh, Locate Plus.

• 38:29Jack Rhysider?

  Locate Plus is a data broker that markets itself to people doing background checks and investigations. They get their data from criminal records, property records, the phone book, and also gather social security numbers and date of birth.

• 38:45Speaker 01

  The first one I hacked into is the Locate Plus. And the second one is the MicroBilt.

• 38:55Jack Rhysider?

  MicroBilt collects data on US citizens, which includes criminal history, employment history, address history, and social security numbers. They also keep records of your utility payments, rent payments, loan payments, and stuff like that to see if you pay your bills on time. The big credit bureaus use this one, like Experian and Equifax, because your credit score is a reflection of how well you pay your bills. But not only that, landlords use MicroBilt. Employers do background checks on it, and lenders look to see how much of a risk you are before doing business with you.

• 39:28Speaker 01

  So the two companies, Locate Plus and MicroBilt. I hacked them a few times. First, single injection. The second one, the file upload vulnerabilities. And the third one, cross-site scripting. When I got into their database, right, I steal the customer logins of their live app. And then I use that to be able to lock it into the platform and make a queries.

• 39:59Jack Rhysider?

  Okay, interesting. He didn't get into the main data broker database. Instead, he was just able to get into the web portal side of things, which had user accounts. And that's the people who use the site to do background checks and lookups with. He was able to steal some of their logins. So now, he could log into the site and use it as if he was a lawyer or a cop or an investigator who's been vetted by the site to look up anyone's data.

• 40:28Speaker 01

  I can search your name, the state that you've been living, or the city you live in. And that's all. It will pop out the possible people identity related to that name and in that city. And you can get the social security number rivelation on the previous 10 years addresses that you've been living, even the current one. And also you will obtain your relatives, your family members, right? You can also get the information.

• 41:03Jack Rhysider?

  Now, these sites charge for their services, often it's pay per search kind of thing. So when he would search, it would go to someone else's bill. And he thought if he did a lot of searches on one user, then their bill would go way up, and then they'd investigate what's going on here. And they would find out that he's been using their account, and they would shut it down. So he would cycle through all the accounts he had to spread out his activity.

• 41:27Speaker 01

  I remember I was using more than 5,000 accounts on MyToBuild alone.

• 41:37Jack Rhysider?

  So with his access, he could look anyone up and get their full name, maiden name, phone number, email address, where they live, address history, social security number, driver's license, where they work, work history, and the VIN number for their car. He decides to build a website to charge users to be able to look up people in this database.

• 42:00Speaker 01

  Because so much information, then I built a website. And then I, through that website, I sell to all the sub-criminal around the world for like $1, for one search. Kind of like $1 for one information, one identity, basically.

• 42:18Jack Rhysider?

  The first week of him launching this website, he made $5,000 from people doing searches on it. It was an instant hit. He wasn't sure why people were using his site to search for other people, but he didn't care. He just saw the money coming in, and was like, "Yeah." And interestingly, this was the early days, and crypto wasn't really adopted so well yet, so he wasn't accepting that.

• 42:41Speaker 01

  But then I didn't use Bitcoin, we used Liberty Reserve.

• 42:45Jack Rhysider?

  Liberty Reserve was sort of like a PayPal in the way that you could send money to someone online, except they didn't do much in regards of checking people's identities. So it became known as the place for criminal transactions around 2010. It was the go-to place for stuff like that for a while. So he was getting tons of Liberty Reserve dollars, and they were piling up in his account there. Then he was using some Vietnamese money mules that he found on the dark web to send them his Liberty Reserve dollars, and they'd cash it out and give him cash. And things were looking good for a few months.

• 43:18Speaker 01

  But you know, the thing is not stable. Because the two companies, they find out about the vulnerability, so they shut down. And then they also fix the vulnerabilities. Kind of like me and them, you know, like, uh, we've been playing the cat and mouse game. Kind of they fix their vulnerability. I fired down another one. So we just keep hacking and phishing. So I got kind of tired.

• 43:47Jack Rhysider?

  He was getting tired of constantly trying to find new ways to stay in the system. They were getting good at detecting him and kicking him out. So he stops to think about it. And he thought, you know, why struggle to maintain access? When he could just become a paying user of the site. Now, MicroBilt would only allow certain people to use their site. You had to be a professional investigator or a cop or in a position that you can be trusted with this data. And there's a serious vetting process. So Hugh decided, well, why not try to act like a private investigator and get in? Step one, create a driver's license with a fake name.

• 44:25Speaker 01

  At first, I got the license to Google, but it didn't work. I tried to do Photoshop and stuff like that, but couldn't work out. It's not good quality.

• 44:37Jack Rhysider?

  Okay, that didn't work. Time for Plan B. Try to impersonate someone who is allowed to have an account there.

• 44:44Speaker 01

  So I did an, uh, kind of like an ocean to gather in on the list of emails address belong to private investigator. And you know, when I hacked into MyReview and Locat Plus, right? I got the email address already. I got on the list already. So I used that to do phishing. I was phishing them, uh, you know, through malware. So I can, uh, got into the computer.

• 45:22Jack Rhysider?

  Wow, so the 5,000 users that he got from MicroBilt, he could see which ones were private investigators and get all those emails and also their data from the data broker to know everything about them and then send them phishing emails? And if they clicked the link, he would infect their computer with malware, essentially giving him access to their computers. And when he got access, he would look around to see if he could find any identifying documents for these private investigators so he could impersonate them.

• 45:52Speaker 01

  And one of the private investigator, I remember he was living in Michigan in the US. And I got into his computer through the malware. I got all the data on his computer, including like the private investigator license, even his passport, his social security numbers. And I got, I mean, I got everything. And back then, you know, like the people, they still got a habit uh saving all the sensitive stuff on their desktop inside the uh spreadsheet, right? Kind of like an Excel file storing the username and password,

• 46:35Speaker 01

  like sensitive information in that file. And I got that file too, you know, and so I got all the information. Their birth and uh driver license, stuff like that. So I impersonated as him under his name. I obtained an account at uh MicroBuild. So I got a MicroBuild account officially. I was using that maybe a minute or two. So they find out this is a fake account. So they shut down my account.

• 47:08Jack Rhysider?

  So he's realizing MicroBuild is giving him a lot of trouble and decides to look at another data broker to maybe register an account there? And that's when he found a data broker called Court Ventures.

• 47:19Speaker 01

  Court Ventures providing API and data access for the people to make inquiries to be able to obtain the uh US identity.

• 47:31Jack Rhysider?

  Oh, this is even better, he thought. If he could get API access to make queries and do searches, that's a whole lot easier to integrate into his website. They were just like the others. They had address history, criminal history, full identity data. And yeah, investigators, cops, fraud detection agencies, and credit bureaus loved using Court Ventures to look up people's data. He found a private investigator in Singapore and was able to obtain all his details and was going to impersonate him to try to get an account at Court Ventures.

• 48:01Speaker 01

  I got his license. And I impersonate at that guy, the private investigator in Singapore. And then I used that to apply the uh Court Venture account.

• 48:17Speaker 01

  And I paid for them. You know, I was dealing with them like real businessman. You know, like I say, yeah, I was, I was doing for big company, doing background check for Microsoft, Google. So I need a lot of, uh, queries every month to do background check. And they okay with that because I paid for them. And I, I, I told them, you know, I want to have a good deal. And then, uh, the CEO of that CodeVenture company, they gave me a good deal. And like, I remember like fourteen cents, fourteen cents for one information.

• 48:59Speaker 01

  So I say, yes, okay, we make a business contract too. Like I fight the signature, I, I fight name, everything. So I send back to him and they didn't verify anything. They just keep going, like they okay everything.

• 49:14Jack Rhysider?

  Okay, he got the account. He could do searches on people now. Good, good, he thought. But he wanted that API key, so he applied for it. And a few weeks later, they gave it to him. Incredible.

• 49:25Speaker 01

  So I got that account, man. I say, oh, oh my God, I got the API asset to like almost two hundred million US identity right there. And all I need to do, you know, to integrate that into my website, that's all.

• 49:40Jack Rhysider?

  Yeah, two hundred million US citizens' details were in this data broker. That's like over sixty percent of all US citizens' data. That's incredible. And at fourteen cents per lookup, he could sell each of those searches for a dollar on his website. His grand plan was starting to come together.

• 49:59Speaker 01

  So at that time, my, my website is, is still on the clear web. You know, like anybody can gain access. But most of the clients that I have is all cybercriminal or other. And technically, I didn't care what they, whatever they been using this identity. So I just keep selling, um, to the API of the CodeVenture. And I remember every month I was making more than a hundred twenty K per month.

• 50:34Speaker 01

  USD.

• 50:35Jack Rhysider?

  Yeah, he really didn't care who would use this site or why. He didn't even ask. All he knew is that people liked using it to look up people and he could make a nice profit off it. So it seemed like a good business model to him. But even though he was making $120,000 a month, he still had a massive bill to pay to Court Ventures every month.

• 50:53Speaker 01

  And I was paying for Court Venture every month from $20,000 to $35,000 USD per month. Yeah, they're happy and I'm happy as well. So we were kind of a win-win situation. I keep running that website for over two years and I was making more than three millions USD by selling the US identity.

• 51:25Jack Rhysider?

  It makes me wonder, is any of this illegal? I mean, can you squarely point at who the victim is here in this situation? Do you know the story of irate Joes? It's an interesting one. So there's this US grocery store called Trader Joe's. It's fantastic. I love it. A majority of food there at Trader Joe's is the Trader Joe's branded stuff and people get hooked on that brand. Well, up in Vancouver, Canada, they were like begging Trader Joe's to come open a store here. But Trader Joe's refused. They're like, no, we only focus in the US. We're not going international. So some guy in Vancouver is like, well, you know what? I'm gonna open my own Trader Joe's in Canada. Why not? Because if they're not gonna do business here,

• 52:10Jack Rhysider?

  then there's probably no jurisdiction issues or harm. Should be fine. So he crosses the border into Washington State, buys a ton of Trader Joe's stuff and drives it back to Vancouver and opens up a little shop called Pirate Joe's. He charged more than Trader Joe's did because of the logistics of it. But hey, people in Vancouver were happy to get some of their favorite food items, finally. Trader Joe's was like, hey, you can't do that. And Pirate Joe's was like, yeah, yeah, we're in Canada. Your US laws don't apply here. He was right. Trader Joe's had a really hard time getting anywhere legally. But eventually, they convinced a US court to force a trademark infringement on Pirate Joe's, saying the name of the store is too similar to Trader Joe's and they're smugglers.

• 52:55Jack Rhysider?

  So what did they do? Pirate Joes dropped the P and renamed the store to Irate Joes. And they clearly put all over their store, "We are unaffiliated, unauthorized, and unafraid." Trader Joes was furious that they stayed open and started banning them from coming into the store to buy stuff. They banned the owner, who was driving twice a week, to buy $5,000 worth of groceries from Trader Joes. Then he got his coworkers to go to different Trader Joes and try to buy stuff from there. But Trader Joes started figuring out which stores in Washington they were visiting and buying food in the shop, so they would block these other people from purchasing things. So Irate Joes started asking their customers to help stock the store. They're like, "Hey, if you're going to Washington, please pick some stuff up for us at the store."

• 53:39Jack Rhysider?

  And soon dozens of people were now helping stock the shelves at Irate Joes. I'm telling you, people really loved Trader Joe's stuff. And crowdsourcing the buying was working for them. But Trader Joes was putting more and more limits on how much people could buy in the stores that were close to Vancouver. The guy who owned Irate Joes is like, "Bro, I'm your biggest customer by far. I buy more than anyone else in this store. What is your deal? We're not asking for anything special. We just want to buy what you have." But Trader Joes kept giving them legal trouble. And eventually, Irate Joes shut down from the expensive legal fees that they kept facing. And again, here's a situation where I wonder, who's the victim?

• 54:24Jack Rhysider?

  Trader Joes sure thought it was them. But what do you think? I mean, when I was a teenager, I used to buy things from the dollar store and then sell them on eBay for $5 each. If it's legal for data brokers to sell identities of US citizens, why would it be illegal for Hugh to buy those and resell them for more? This is the part I don't get. It's apparently perfectly fine for a data broker to buy and sell identifying information on US citizens, but it's not for Hugh? In Hugh's case, he didn't hack into the site. He didn't steal anything. He was a paying customer of Court Ventures. I was paying them a lot of money for all the searches people did. And they seemed to be fine with that. Happy that Hugh was their customer.

• 55:10Jack Rhysider?

  So he had his little website set up and accepted payment from Liberty Reserve. And users could search Court Venture database through the API.

• 55:17Speaker 01

  And at first, that website is called the USSearching.info. And then eventually like Supergate.info and Fivet.me, stuff like that. You know, I changing the domain like constantly to avoid like law enforcement. And I was selling more than, a little more than 3 million US identities during that two years. From 2010 to 2012.

• 55:51Jack Rhysider?

  Okay, let me do some math, okay? 3 million searches, 14 cents per search. That's $420,000 that he paid to Court Ventures and all this. Geez, that's, that's a lot of money Court Ventures made off him. And that was fine for him because he made over 2.5 million dollars in profit after that. Unbelievable.

• 56:12Speaker 01

  And during 2011, right, I dropped out the, the, the school. I don't, I didn't study and finish the university anymore. Because I was thinking that man was making a lot of money. Every month, I, I was making up to 120K per month.

• 56:32Jack Rhysider?

  What were you using the money for that you were getting?

• 56:35Speaker 01

  Back then, it's too young, too dumb, you know, like a lot of money. I spent on stupid stuff, on five-star hotel and, and, and business class. Spent a lot of money on like stupid things. And I waste a lot of money for cars and luxury stuff.

• 56:55Jack Rhysider?

  What kind of car did you have?

• 56:57Speaker 01

  I have, I was having like three different cars. Two sport cars. One of them is a BMW.

• 57:07Speaker 01

  The convertible one. And another one is a customized car, like full customized one. That I don't even know that, you know, what kind of car is it, but like kind of like one of the. I remember I I used that car to be in a contest for the like good customized car. And I won the prize as well too, you know, like because I spent so much money on that car. And customized and fine tuned that car. And the other car that I have is luxury car, Lexus, right?

• 57:45Speaker 02

  Yeah, so what did your parents think of all this money?

• 57:48Speaker 01

  I was lying to them, you know, I was working for a international bank in the US. And they hired me to protect the system and also building their website. You know, like all the lies, you know? And when I met up with all the people, kind of same age. Even like the people that I know on the street, they asked me, you know, why I am so rich? And I lied to them, you know, because my family was a well, a wealthy family. And they they they got everything for me, that's why. So I I kind of like lying with each other with different stories, you know?

• 58:32Speaker 01

  And I kind of very tired though.

• 58:35Speaker 02

  What were the people that were using your site? Would, do you know what they were, why they were searching for people? What was the point of them paying for people's searches?

• 58:46Speaker 01

  That's good question though. The question, uh, you know, like the the answer for this is at that time. I didn't care much about how how did they use this information? All I know, you know, may maybe they use that to impersonate somebody. Or even like they use that to bypass the uh, really call transaction authentication, whatever. That's all I know.

• 59:17Jack Rhysider?

  So like he said, this went on for years. He was able to automate a lot of it. So he would only do a few hours of work a week to keep it all going. Life was going great for him.

• 59:26Speaker 01

  Eventually Court Venture, right?

• 59:30Speaker 01

  They got escorted by the Experian.

• 59:35Jack Rhysider?

  Oh, interesting. In December 2011, Experian bought Court Ventures. Now, Experian is one of the three major credit bureaus in the US. They create a credit score for every US adult. And rental places and loan agencies will check your credit score before doing business with you. So Experian loved the data that Court Ventures had on people so much that they just bought it outright. I couldn't find what the purchase price was for 200 million US citizens data, but I imagine it was in the millions of dollars. Now, after Experian bought Court Ventures, the Secret Service contacted Experian and was like, "You know that company you just bought? Yeah, well, we have reason to believe that they are giving data to someone

• 1:00:20Jack Rhysider?

  who is illicitly reselling it to criminals." Experian is like, "What? Say that again?" Court Ventures never told them this in the trade deal. So Experian quickly shut down Hugh's account and cooperated with the Secret Service. In fact, Experian was so mad that they sued Court Ventures for not taking action on this earlier. I suspect the lawsuit was because they were misrepresenting their business in the trade deal. And so, the Secret Service now had their eyes fixed on Hugh.

• 1:00:56Speaker 01

  One of the court requests from the US Secret Service, you know, asking about the status of my account, the fake account. And eventually, they shut down my account at the Court Venture.

• 1:01:11Jack Rhysider?

  He shut down his account entirely. But he had a backup plan in case this did happen. He had a second account. Not one he made, but one he stole the password to, someone else's account. And he could use their account to continue to do lookups. But he no longer had that API access where he could automate it.

• 1:01:28Speaker 01

  That belonged to one of the company, one of the US data broker as well too. It's called the US search info dot com. Something like that, I don't remember. It's a long name. But anyway, this, this company, I got one of the account to phishing attack. And I used that to do manually searching identity for other people who, who still need the service.

• 1:01:56Jack Rhysider?

  He wanted to get another API connection to Court Ventures. And this hand searching stuff was just taking way too much time. So he starts emailing them, "Hey, um, how come you shut off my API connection? I need it back." But what he didn't know is that because the Secret Service were investigating him, it was them who was responding to his emails.

• 1:02:15Speaker 01

  And they was making up a story that, you know, they will offer me a good API connection, not only to the US identity data, but also the UK identities data. I say, "Whoa, you know, it's a good business, it's coming. Too good to be true." But you know, at that time, the money just blind my eyes. I say, "Okay, it look good." But the thing, you know, they, I feel something suspicious going on too. Something not right.

• 1:02:51Jack Rhysider?

  Apparently, there was another guy that was doing the same thing as Hugh, also reselling data broker data. But the Secret Service caught that guy who was in the UK, and that guy was assisting the Secret Service to catch other people doing the same. So that's what felt off to Hugh. He was talking to both the Secret Service, an agent named Matt O'Neill, and a guy from the UK named Mark, who got caught reselling identities.

• 1:03:13Speaker 01

  His name Mark, he still keep communicate with me to email and even call me to, I remember to Skype back then. And um, they say, you know, they, they, they want, they want me to go to the US and also go to Australia or go to Hawaii.

• 1:03:37Speaker 01

  I say, no, I don't want to go there. But Matt O'Neil and Mark, they collaborate together. And they lure me to Guam.

• 1:03:49Jack Rhysider?

  They told him if he can meet them in Guam, they'll give him all the things he needs for his API access. They made up a story of why they need to meet him in person. Something like, "The big boss really wants to meet you. You're one of our best customers, and we can get the contract signed right then and there."

• 1:04:03Speaker 01

  And then we can open the big party, you know? So we can have fun together. And then you can fly back to Vietnam, everything good.

• 1:04:12Jack Rhysider?

  So he decides to fly to Guam, which is kind of near Southeast Asia. He figures it's the closest option that they gave him and looks safe.

• 1:04:20Speaker 01

  You know, I didn't do any research about Guam. I thought it's just like an island, nobody care. And I heard that some Vietnamese people, they living over there as well, too. Maybe it's fine, you know? If any problem, I will, you know, go to talk to my people, asking for help. And then I bought a ticket, and then I went to Guam with my sister. Because back then, you know, back then, my English is not really, really well. And I went there with her, together.

• 1:04:55Speaker 01

  And the moment I landed at the international airport, they escorted me to US Customs Office. And that moment, that right moment, you know, I just feel like, man, something going on, something fishy. Yeah, and then they told me, "Sit down here, you know, we want to talk to you a little bit." And I was so nervous, kind of like, I was trembling, you know, like, man. And I was shocking. I say, "Man, something, something not right." They put a stack of the paper like, I remember like, maybe like, 10 inches thick,

• 1:05:39Speaker 01

  very thick documents. And they told me, you know, "We know about, about you. We know everything about you. Maybe more than your family knows about you." And that moment, I say, "Man, it's over. It's over."

• 1:05:58Speaker 01

  And that's it.

• 1:06:04Speaker 01

  I feel like I was on top of the world and right now I feel like I was living in hell. And that's it. They sent me to the jail in Guam. After that, and they sent my sister back to Vietnam. I told with the prosecutor and the US Secret Service agent. I say my sister had nothing to do with this. It's all about me. So they released my sister. And I was staying in jail in Guam for like more than, a little more than two months. And then they sent me back to the mainland, the US mainland.

• 1:06:47Speaker 01

  To many different jails. They sent me to Hawaii, to Los Angeles, Nevada. They sent me to Oklahoma, New Jersey, and then New York, and then New Hampshire.

• 1:07:03Jack Rhysider?

  New Hampshire is where his case was going to be tried. So that was his final destination. And he was stuck in prison through the entire legal battle. Apparently, the US prosecutor who first investigated him was in New Hampshire. And so that's why his trial was there. Reflecting back on how he got caught, he has a few theories. First, he blames Brian Krebs, a cybersecurity journalist who did an article that said how criminals can look up people on the dark web. And Hugh's website is listed there. And so he thinks that's how the Secret Service probably first learned about my website. Then on his website, he made a few mistakes. The first week of having it, he used a hosting provider but registered it under his real name. But then he changed the registration to an anonymous name, but those past records are still visible.

• 1:07:48Jack Rhysider?

  Second, he used to have his personal email address on the website for contact details. So these slip-ups would have easily traced someone to Hugh. And I also believe that the Secret Service probably used his site, did some searches on people, and then tried to correlate that with the logs at Court Ventures to pinpoint exactly which user Hugh was using for his site. But this whole time, he wasn't sure exactly why he was arrested. He was paying for these searches in full. Where's the fraud here? Where's the crime? But it wasn't until after his arrest, where he learned what people were using his site for.

• 1:08:22Speaker 01

  The federal court, they told me, you know, the information that I stole and also like sell that to other people. They using that for tax return. That's something new to me. I never know that, you know, tax return. And then I I find out what tax return and then it's very serious.

• 1:08:42Jack Rhysider?

  What people were doing, it was going to Hugh's site, looking someone up, getting all their details, and then try to file the taxes for that person. See, here in the US, we pay taxes to the government all year. And typically, people overpay on their taxes. So they get a big return come tax season. So a lot of Americans get a check for maybe a few thousand dollars every year from the government because they've overpaid on their taxes. Well, criminals know this. So they file tax returns on other people and they put on there that they should get a $2,000 refund. And then the IRS processes the tax filing and they look at it and it looks legit and sends this person a $2,000 check. And when the real person goes to file their taxes, the IRS is like, oh, no, no, no, you have already filled it out. We've already sent you a check.

• 1:09:27Jack Rhysider?

  And now suddenly, there's a bunch of Americans saying, oh, no, I didn't. Give me my money. And there is a big problem. So the Secret Service was investigating this because Hugh's people's search engine was complicit in helping criminals defraud a lot of American citizens. And apparently, there were a lot of people in New Hampshire that someone stole their tax return check.

• 1:09:50Speaker 01

  And you know, I got so much information. And then it turns kind of like thousand and thousand victims in New Hampshire.

• 1:09:58Jack Rhysider?

  OK, there's the V word, victim. We found a victim. The people of New Hampshire who didn't get their tax refunds. OK, sure, they're victims of identity theft. I'll give them that. But typically, the IRS will understand and pay them anyway, essentially giving out two refund checks. So this makes the IRS the victim. But then you could say, no, it's the US taxpayer that's the real victim because this is money that's just lost. And it drives me nuts how much money the IRS loses on this every year. Like, every single year, the IRS will give out billions of dollars to criminals submitting tax refund scams. And I just have to ask.

• 1:10:42Jack Rhysider?

  IRS, when are you gonna take this problem seriously? You're world-class at collecting our money, but terrible at distributing it to the right people. Billions of tax dollars are lost every year because a criminal asked you for money? How is this acceptable?

• 1:11:01Speaker 02

  So what were your charges? Because I have no idea what you're actually guilty of still.

• 1:11:08Speaker 01

  Yes, um, apparently you can read that on the US courts records.

• 1:11:14Jack Rhysider?

  Okay, fine, I will. All right, he's charged with three items here. All three are violations of the CFAA figures, right? The first specifically says he used a data broker in a way that they didn't authorize him to use. It's against their terms of service to resell the data that you're given access to or to impersonate someone to get an account there. And he did that. He absolutely violated their terms of use. And that is what the Secret Service is saying he's going to prison for. Unauthorized access, which we can guess means that he impersonated an authorized user, which is against their terms of use. You know how many of us violate the terms of use on websites? We all do, all the time.

• 1:11:57Jack Rhysider?

  Like, if you ever let someone use your Spotify or Netflix login, that's the same violation, unauthorized access. He's being charged with that sort of thing. Second item, specifically it says he's personally gained money from violating his access. And the third item is that it was in excess of $5,000. So all three of these are CFAA violations. And it drives me nuts that if you violate a website's terms of service, it's a federal crime. I don't know why it's not just a civil issue, a problem between you and the website. Like, why is it a federal crime? I think the site has grounds to terminate you, ban you, and probably even sue you for violating their terms of service. But prison time? I think that's just going too far. But that's how it is.

• 1:12:41Jack Rhysider?

  It's a federal offense to violate a website's terms of use.

• 1:12:48Jack Rhysider?

  And I'd be remiss if I didn't mention Aaron Schwartz here. Aaron was an MIT student and because he was a student, he had access to academic research papers through a place called Jstor. Well, he thought this information was so valuable to the world that he was downloading it and publishing it for free. The world should have this academic research, not keep it exclusive only for university students. But Jstor was pissed. They called the feds on Aaron for violating their terms of service. And the DOJ charged him with 13 felony counts and he was facing 35 years in prison. They told him, look, if you take a plea deal, you'll probably only do six months in prison. But he absolutely did not want a felony on his record, a felony for violating the terms of service.

• 1:13:32Jack Rhysider?

  The pressure was too much for him. And Aaron killed himself. So after that, politicians were like, whoa, whoa, whoa. Why does the CFAA have it written in there? That unauthorized access to a website is a federal crime. People are dying over this. Just because you violated a website's terms of use should not be a federal crime. And so Aaron's law got proposed, which asks to change the CFAA to stop saying that a terms of use violation is a federal crime. But sadly, the law didn't get passed. Can you tell I hate the CFAA?

• 1:14:12Speaker 02

  See here, I'm upset about this because, first of all,

• 1:14:16Jack Rhysider?

  Right.

• 1:14:17Speaker 02

  these data brokers are collecting data on us without our permission. And so they should be the ones that are doing illegal things. Second of all, they're selling this data for 14 cents per lookup. You're selling it for $1 per lookup. Yeah, so the only real thing here is that you're saying, hey, I'm just up, I'm doing an upcharge for this and giving you access to more people. It's not really stolen data. It's actually paying for the data as you're using it. And

• 1:14:50Jack Rhysider?

  Blame.

• 1:14:51Speaker 02

  You're right, the unauthorized access is a CFAA violation. And I could see them saying that. But I'm just so frustrated about this because you didn't do any money laundering in the US. So for them to say you did money laundering there, it's not true. You did that in

• 1:15:07Jack Rhysider?

  I know.

• 1:15:08Speaker 02

  Vietnam.

• 1:15:10Jack Rhysider?

  So I'm just frustrated on your behalf.

• 1:15:14Speaker 01

  I know, but the thing is, why is it though? That's how it's work. And also, the, um, the damage amount that they put in my case is very huge though, like over sixty million USD.

• 1:15:30Jack Rhysider?

  Prosecutors were saying he caused sixty million dollars in damage? And of course, they didn't explain how they came to that number. It's kind of impossible to look through three million lookups on Hugh's site and then connect that to what identity theft crimes happened for those people and then add up how much money was earned from that. And anyway, all that was secondhand. None of that stolen money was done by Hugh. So they likely just made up some number, but he's not the one who did the identity theft. He's not the one who did tax fraud scams. So it's maddening that they're saying he's the one who's responsible for all that damage. Like Hugh is a criminal. He is the bad guy here, okay? I'm not trying to say he should have gotten off. He absolutely did break the law.

• 1:16:14Jack Rhysider?

  What I'm saying is that this is the wrong law to be charging him with because I hate when the CFAA is used like that. They tried to say he was also in trouble for money laundering, but he didn't do any of his money laundering in the US. So I'm not sure if that one even flies. But like, none of his charges were for any of the credit cards he stole or drained. All those sites that he hacked into back then? There's nothing about all the concert tickets that he bought and then essentially scammed all those people? Like, those are easy charges to slap him with, yet they're completely absent here. There is a law around identity theft, but I think it would be hilarious if they charged him with that since that's the whole business model of what data brokers do already, right?

• 1:16:56Jack Rhysider?

  They work every day to grab as many identities as they can without anybody's permission and then sell them. And not only that, he didn't steal the identities, he paid for them. So the theft part would be in question too. I think the proper crime here that they probably should have charged him with is that he was knowingly helping criminals conduct crimes, right? Like aiding and abetting and conspiracy, that sort of thing. Hugh knew his site was used by criminals and they were his favorite customers because they would pay for tons of searches. So he was catering to them, making it easier and better for them to use his site. So while he didn't do any of the tax fraud himself, he did help a lot of people do it. But he wasn't being charged with aiding and abetting.

• 1:17:41Jack Rhysider?

  He was being charged with violating the terms of service of a data broker where he was impersonating someone else to get an account there. But the thing is, the feds would have a much harder time proving his site was intended for criminal use compared to simply giving him a CFAA violation, which is easy to convict someone of. Like I said, we all violate the CFAA all day, every day. So in my opinion, the feds charged him with the wrong crime because of the almost guaranteed win for them, as opposed to charging him with the right crime and then struggling to find evidence to prove that he did that. And by the way, while the feds said that he caused $60 million in damage, nobody was asking for restitution there. None of the data brokers were saying he caused them damage.

• 1:18:25Jack Rhysider?

  So if he did do all that damage, find that victim and bring them into the case. Because here's the thing, I'm looking at the indictment and there's not a single company name here or victim name listed at all. Of course not, because the data brokers want to hide from you. So the only thing listed there is Company A headquartered in New Jersey and it said he did an SQL injection on Company A. Well, by doing a little bit of research, it's kind of easy to figure out that the data broker in New Jersey that they're talking about is US InfoSearch, which Hugh did in fact steal credentials and use that site, but not much at all. I mean, it was such a small blip in his story that it's hardly worth mentioning, yet that's the company that was saying he got unauthorized access to?

• 1:19:09Jack Rhysider?

  But here's the thing, here's how it all connects. Court Ventures was partnered with US InfoSearch. If you were a paid Court Ventures user and you look someone up, they had a connection to US InfoSearch, so you'd get results from them too. Now, I'm just connecting the dots here. But that sounds like to me that Court Ventures was reselling data broker information that they got from US InfoSearch. Like surely, whatever deal they had with US InfoSearch, they were selling that data for a higher price to their own customers, right? You see my point? This story is pretty bizarre. So you could say this company listed in the indictment, US InfoSearch, was the back end and provided data to Court Ventures.

• 1:19:52Jack Rhysider?

  And it's US InfoSearch that the US government is saying Hugh got unauthorized access to and profited off that access.

• 1:20:00Speaker 02

  You say the victims were the people who got their tax fraud or whatever stolen. But I really think the victims are the people you were stealing from, right? LocatePlus, MicroBilt.

• 1:20:16Speaker 01

  LocatePlus, right.

• 1:20:17Speaker 02

  And the source. Yeah, Venture. And I think those are the people you were robbing or attacking. And I'm surprised, were they part of the case at all? Did they come and testify against you or give evidence?

• 1:20:32Speaker 01

  No, no.

• 1:20:35Speaker 01

  I didn't see anybody from this company.

• 1:20:38Speaker 02

  Yeah, but I can't, I just, did you have a good lawyer?

• 1:20:42Speaker 01

  I paid for the lawyer. Like I spent like almost more than, I think up to 700K.

• 1:20:50Speaker 02

  Wow.

• 1:20:52Speaker 01

  Yeah, for the lawyer.

• 1:20:54Speaker 02

  Because I would have thought to say, yeah, you're saying that he caused 60 million dollars in damage. However, he did not actually do any of that damage. He just gave the information to someone else and someone else did the damage. He never did a tax fraud. So you can't say he's the one who did tax fraud. It's like if I sell you a lighter and then you take that lighter and you burn a building down with the lighter, I'm not in trouble for selling you the lighter. The person who burned the building down is.

• 1:21:25Speaker 01

  That's true. But but you know back then, you know, like a lot of people told me the same thing. You know, I shouldn't keep, uh, you know, I shouldn't hide, I shouldn't hide a lawyer. I just keep that money.

• 1:21:39Speaker 02

  Yeah.

• 1:21:40Speaker 01

  But you know, like my family, you know, they so worried and they just look up on the internet, you know, oh yeah, this is good lawyer, like good, good, good rating. Like five star rating, international lawyer, whatever, in New Hampshire, you know, like professional one. And yes, that's, that's what happened. I remember like every time the lawyers and his team meet me up. Like every, uh, every time like that, it cost me like five to ten thousand USD. And an email I sent to him or the, or the lawyer team, like it cost me like

• 1:22:24Speaker 01

  two or three hundred USD for one email.

• 1:22:27Speaker 02

  Lawyers are so very, so expensive.

• 1:22:30Speaker 01

  I know. It's very expensive. But you know, it, it, it was it, you know, easy money, easy go. So I'm, I'm, for real, you know, I, I don't really complain about it. Like because end up at the end of the day, it's kind of like dirty money.

• 1:22:46Jack Rhysider?

  You know, another thing that really bugs me about this whole thing is neither Microbuilt, Locate Plus, or Court Ventures ever told their victims that there was a database breach.

• 1:22:55Speaker 01

  No, they never say, even until now, I thought about them and they never mentioned anything about it. E- even though it's, it's really happened to them.

• 1:23:06Jack Rhysider?

  What scumbags. I just, I have no sympathy for these data brokers. I absolutely hate them. They take my data without consent. I can't even opt out if I want. They don't protect it. And when it's lost in a data breach, they don't even have the decency to tell me that my data that they gathered on me got loose. Hugh was desperately trying to get his lawyer to help him. But here's the thing, there's a 99% conviction rate when the feds slap you with a CFAA violation. In all the cases of the feds accusing someone of a CFAA violation, I've only been able to find two or three cases that the defendant actually won. The rest were people pleading guilty or found guilty in trial.

• 1:23:48Jack Rhysider?

  And so the chances of Hugh getting off were slim to none. He tried to fight it, but everything they tried just kept getting denied by the courts. And after a few years of fighting, Hugh got tired and was running low on cash.

• 1:24:03Speaker 01

  You know, my lawyers explained to me, you know, I may lose the trial. I may get up to like 45 years in federal prison.

• 1:24:12Jack Rhysider?

  Forty-five years?

• 1:24:13Speaker 01

  And I got so, right, I got so scared. All the charges, like all combined together, not only from New Hampshire, right? But also from the, from New Jersey as well, too. So I got two, two, uh, two criminal charges.

• 1:24:32Speaker 01

  From New Hampshire and New Jersey. So they all combined together. And they, they say up to like 45 years if I lose. So, so my family and me was so scared. So we play, uh, kind of we play plea deals. And, um, yeah. I play guilty during the summer time of 2015.

• 1:25:00Jack Rhysider?

  Guilty. Guilty of doing $60 million in damage.

• 1:25:05Speaker 02

  When your, your sentence came up or during a plea deal, did you offer to give up your money to reduce the sentence? Like, how did that go?

• 1:25:15Speaker 01

  Oh, yeah. My family also asked them, you know, like they want to give back all the money. Uh, but they say, no, they don't need that.

• 1:25:26Speaker 01

  Yeah.

• 1:25:27Speaker 02

  Really?

• 1:25:29Speaker 01

  Right. They don't need money. They don't need any assets and they don't need anything. So it's what it was it. So but the thing you know, I spent a lot of money on lawyer.

• 1:25:43Speaker 02

  Yeah.

• 1:25:43Speaker 01

  On, you know, like during my incarceration as well, too, you know, like for foods and medication and stuff like that.

• 1:25:51Speaker 02

  So they didn't for they didn't take any of your money or property or cars or anything?

• 1:25:58Speaker 01

  No. They didn't care. They said they don't need that.

• 1:26:02Speaker 02

  They just want you.

• 1:26:04Speaker 01

  They don't want me.

• 1:26:06Jack Rhysider?

  After pleading guilty, he was sentenced to thirteen years in prison. Thirteen years for getting access to data broker data, which he wasn't authorized to access? At this point, I'm wondering, what if instead of Hugh accessing data broker data to sell that? What if he just made his own data broker business, you know, for anyone to access? Would that be illegal? Like if Hugh copied all the data out of the phone book and all the court records and the county record and scraped some LinkedIn data to build complete profiles on millions of people? That's all public information, right? And it wouldn't have been that hard for him to do because he's a clever guy. Are there laws that he would be breaking if he sold that data? I guess what I'm wondering is, are there laws that data brokers have to follow?

• 1:26:52Jack Rhysider?

  Well, I had to stop and look into that. Basically, yes, there are data broker laws and often states regulate them. And the gist of the laws is that data brokers have to prove that they aren't selling their data to criminals.

• 1:27:07Jack Rhysider?

  I mean, think about all the dangerous household things we probably all have, right? Box cutters, a hammer, matches, lighters, gasoline, bleach. These are all things that can cause a lot of harm and destruction, right? Yep, when you go to buy them, the store doesn't verify your intent. They're not like, hey, what are you gonna do with that box cutter? You have to prove to us that you're gonna put it to good use. Yet, that's how data brokers treat their customers. Their customers have to show proof that they have a legitimate reason to search their data, and they're on the approved list of okay people. Apparently, it's not good enough for data brokers just to say, "Hey, you can't use this for malicious intent." They have to verify every single user

• 1:27:50Jack Rhysider?

  to try to prevent any of them from using the data maliciously. So, the approved list is people like law enforcement, marketers, investigators, loan agencies, those sort of people. And that distinction is very fascinating to me. Data brokers are legal, but only if they sell their data to an exclusive group of people. And I don't like that, not one bit. I mean, of course, I don't like that there's a business out there buying and selling my personal information. That's gross. Go get a real job, all right? But I think I might have a hot take here. I don't like that they only sell their data to a certain group of people. I wish they sold it to anyone. Only people in some exclusive club can look up my data?

• 1:28:35Jack Rhysider?

  A club that I'm not allowed in? I mean, the reason why states regulate data brokers is because if anyone could search those databases, then we'd all be flooded with scammers and identity thieves and stalkers. But to me, that's not the problem. To me, the problem is, one, I don't even know how much data those data brokers have on me, and two, I don't even know who has my data. Like, if I could somehow feel the sting and pain every time my privacy is lost, I would take my privacy way more seriously. So like, I know there's probably apps on my phone that are sending real-time location data right now to a data broker. And if someone took that data and saw where I was and came to my house and knocked on my door, of course, I wouldn't answer, because I never answer my door.

• 1:29:19Jack Rhysider?

  But I just imagine them continually pounding on the door like, "Hey, I know you're home. Answer the door. Your phone is sending me real-time location data to me right now." I'd immediately be like, "Wait, what app is sending you my location data?" And I think having a scary moment like that would absolutely force me to uninstall apps that are tracking me.

• 1:29:42Jack Rhysider?

  So my hot take is that stalkers aren't the problem here. It's the obsessive collection of my data. That's the problem. If data brokers open themselves up to let anyone search their sites, we'd all be way more private and secure. Because we'd all be taking huge steps into protecting our privacy way more seriously. When we don't know what's out there, we don't think it's a problem. And they're trying to hide that from us. Of course, the data brokers say they take our privacy seriously, and security is their top priority. Yeah, well, until it isn't. Hugh got into four different data brokers, all by himself. And it didn't look like it was that hard for him to do.

• 1:30:23Jack Rhysider?

  Not only that, there's a news story after news story of data brokers getting hacked into. The biggest one is when Equifax got breached. If the data brokers were so worried about their data getting into the wrong hands, like scammers and stalkers, then don't collect it at all. Because if there's one thing I've learned about doing over 160 episodes on hacking, is that you will fail at securing your network and data at some point. There is no safe way to collect and store my personal data, much less sell it. The regulators think forcing data brokers to vet every user is stopping criminals from accessing the data. But clearly criminals are in fact accessing the data.

• 1:31:06Jack Rhysider?

  Since when do criminals follow regulations? So really, all the regulations are doing is stopping people like you and me, normal citizens, from being able to see what's in there. There are so few people who truly understand what is happening in this data broker world, since they like to operate in the dark, in the shadows of the internet, and they work hard to keep everyone else in the dark. I want to believe that someday, privacy will be in style again. And we just need enough cool people to tell us it's worth wanting. Because data brokers has a bad aesthetic. Surveillance is sterile. It's cold, gray, and depressing. There's nothing cool, or romantic, or aspirational about being trackable, down to when you're peeing, or having sex, or eating, or sleeping.

• 1:31:51Jack Rhysider?

  Yet these data brokers are feverishly trying to know all of that about you, and build a complete behavior profile on you. And then selling that to millions of people who are on the allowed list. I hope someday wanting privacy doesn't make you a weirdo, but it makes you cool.

• 1:32:15Jack Rhysider?

  Hugh was sentenced in 2015, which meant he'd get out in 2026 because he already spent two years in prison by that point. And it was there, in the New Hampshire prison, where he learned English and studied all kinds of things. The police asked if he could share his story with others to teach them how the dark net works and all that. So he cooperated and told his story and was trying to self rehabilitate to get out early. But when he was in prison, he heard some news which really crushed him. That Liberty Reserve website was seized by the feds and the owner was caught.

• 1:32:48Speaker 01

  I heard on the news that he got caught.

• 1:32:50Jack Rhysider?

  And the thing is, Hugh had a lot of money still in his Liberty Reserve account. But when the feds seized the site, they seized all that money too.

• 1:32:58Speaker 02

  How much did you lose there?

• 1:33:02Speaker 01

  I was saving up over there, like a little more than 300K.

• 1:33:08Speaker 02

  Wow.

• 1:33:09Speaker 01

  You know, I was thinking, man, I will go home and then we get that money. But, you know, the moment I heard on the news during my incarceration time in 2014 or 15, and I say, man, it's over. No more money.

• 1:33:29Jack Rhysider?

  So he continued serving his prison sentence, staying out of trouble. Because he had good behavior, they let him out early. After serving seven years in prison, they let him out in 2020. There was a lot of complications getting out of prison in the middle of a pandemic. So it took him eight months to get home after he was released. But he eventually made it back to Vietnam.

• 1:33:51Speaker 02

  When you got home in 2020, did you have money remaining from all this?

• 1:33:57Speaker 01

  I still got a little more than 50,000 USD.

• 1:34:03Speaker 01

  And one apartment.

• 1:34:07Jack Rhysider?

  When he got home, he got a job with the Vietnamese government to help with their national cyber defense.

• 1:34:13Speaker 01

  They so-called the NCSC, the National Cyber Security Center. And been working there for like four years. I just, I just left NCSC just five months ago. Because you know, like, the government, they, they restructured the agency. And that's why I left NCSC. And right now, I just trying to mainly focusing on cybercrime investigation. And I love hunting cybercriminals technically. And to the, the day I got home until now, I was, have been law enforcement in Vietnam

• 1:34:58Speaker 01

  and other countries as well to arrest more than 200 cybercriminals.

• 1:35:07Jack Rhysider?

  He says he also enjoys helping victims of scams and identities left by educating them on what options they have and helping them regain control of their life and use the law to help them out. In fact, it sounds to me that Hugh feels pretty bad for all the people who got scammed from his service.

• 1:35:21Speaker 01

  I feel like, you know, I owe a lot to the people, especially the people in the US. I kinda, I hurt and harmed so many people's lives. And I kinda always feel ashamed about it.

• 1:35:38Jack Rhysider?

  So he wants to be clear that he is sorry for anyone whose identity got stolen and lost money from his website. He truly feels bad about it and has apologized publicly multiple times. And wants to try to do what he can to correct the wrongs he's done, which is why he's helping victims now and works with law enforcement to catch cybercriminals in his home country.

• 1:36:09Jack Rhysider?

  Thank you so much to Hu Ming No for telling us this incredible story. This one was wild. I had to stop and think like multiple times while making it. And I love a good story that puts me in deep thought like that, and I hope it did for you too. I recently read a book about data brokers, which was extremely eye-opening, and I encourage you all to read it. It's called Means of Control by Byron Tau. Check it out. It's a total page-turner. You will not see the world the same again after that. Don't forget, you can pick up some really cool shirts at our shop. I guarantee you will find a shirt you love there. Go to shop.darknetdiaries.com. This episode is created by me, the Hack Street Boy himself, Jack Rhysider. Our editor is the hash slash Tristan Ledger.

• 1:36:51Jack Rhysider?

  Mixing by Proximity Sound and our intro music by the mysterious Breakmaster Cylinder.

• 1:36:57Jack Rhysider?

  They say if you don't pay for it, then you're the product. But what if you pay a data broker to look up your own data? What then? Hmm? This is Darknet Diaries.