166: Maxie

Maxie Reynolds loves an adventure, especially the kind where she’s breaking into buildings (legally). In this episode, she shares stories from her time as a professional penetration tester, including high-stakes physical intrusions, red team chaos, and the unique adrenaline of hacking the real world. Her book: The Art of Attack: Attacker Mindset for Security Professionals https://amzn.to/4ojYSVZ (https://amzn.to/4ojYSVZ) Her data center: www.subseacloud.com/ https://www.subseacloud.com/

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  The Cardiff Giants is an interesting story. In the Bible, Genesis 6:4, it says, "There were giants on the earth in those days, and they mated with people and created mighty men of renown." This guy named George Hall was like, "Wow, there were giants on earth." But the reverend argued with him and said, "No, no, no, there were never giants here." But George was like, "No, no, the Bible says so. There's gotta be a way to prove it." But George could not prove it, of course. So he decided to fake it. He went to a quarry and dug up a huge block of gypsum, then hired some stone cutters to make the block into the shape of a giant man. They created a rough statue of a man that was 10 feet, 4 inches tall. Then George stained it with acid to make it look old

• 0:42Jack Rhysider?

  and put it on a train and took it to his cousin's farm in Cardiff, New York. And late at night, he buried it on his cousin's farm. A year later, his cousin went to dig a well and hired a crew to come out and dig the hole. And they ran into this giant in their dig. And one of the workers immediately shouted, "This must be an ancient burial site." And so they dug up the giant. And the word spread that they found a buried giant. People from all over flocked to the farm to take a look. It was quite surprising to see a petrified giant of a man. A lot of people believed it was a petrified human. The Bible says so, see? But some thought it was just a statue. But pretty quickly, George's cousin realized how valuable this thing was.

• 1:27Jack Rhysider?

  So he put a tent over it and started charging people 50 cents to come in and see it. 500 people came a day to see this amazing giant. The whole town started to profit from it. Restaurants were filling up, hotels were booked. And that's when P.T. Barnum came. And he was like, "Sir, I will give you $50,000 for that giant. What do you say?" The farmer was like, "No way." So P.T. Barnum hired someone to make a wax copy of it. And Barnum displayed this unauthorized copy at his circus and claimed it was the actual giant and charged people to come see his fake replica. A year later, George Hall came out and said, "This whole thing was a hoax, that he's the one who buried it there." But while it didn't prove that giants roamed the earth,

• 2:12Jack Rhysider?

  it did make his cousin pretty wealthy. And that's how scammers would get you in the 1860s.

• 2:24Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:30Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 2:51Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought, I should really be doing something to protect myself from stalkers, scammers, and hackers? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off DeleteMe. A few years ago, I signed up, and ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your private life private by signing up for DeleteMe now at a special discount just for my listeners. Get 20% off your DeleteMe plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 3:35Jack Rhysider?

  The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www.joindelete.me/darknetdiaries code DD20.

• 3:55Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic. One that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place, so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation. To get through peak season, scaling fulfillment up to 40 times while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 4:40Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 4:58Jack Rhysider?

  I want you to meet Maxie.

• 5:00Speaker 01

  My name is Maxie Reynolds.

• 5:02Jack Rhysider?

  She grew up in Scotland and had an itch for adventure when she was young. She knew she wasn't fit for a sort of sit-down, do-a-lot-of-paperwork-office-type-job. No, her head was always up in class, looking out the window, dreaming of faraway lands that she could visit.

• 5:16Speaker 01

  I left home at a really early age, about 15, and I had no idea about what I was gonna do, what I wanted to do. And so I tried everything, and I was ending up, you know, working at bars and as a cleaner and all these sorts of things. And I just thought, no, this isn't for me. And I want a job where I can travel and see, you know, outside of Scotland. So I went to a university in England, which is somewhat treacherous, being a Scottish person. And I got a degree in underwater robotics.

• 5:48Jack Rhysider?

  She was hoping this degree was her ticket to travel. Maybe if you're gonna be operating underwater vehicles, you'll get to go to some pretty faraway places. So she started applying to every company she knew that used these remote operating vehicles.

• 6:01Speaker 01

  And I couldn't get a job. And it was because I was female.

• 6:05Jack Rhysider?

  The reason why this was a problem is because sometimes she'd have to go out to sea in small vessels or be stationed on some kind of platform at sea, which also had small living quarters. And the problem was that these companies required men and women to have separate cabins. And they simply couldn't accommodate her because a lot of these cabins had four beds in them, and they didn't have any single-bed cabins that she could be in. And there just wasn't enough women to fill up a sleeping cabin. So she just didn't get the job. I was told this same story over and over. But that didn't stop her. She kept applying at places. And eventually, a Norwegian company finally said yes to her.

• 6:39Speaker 01

  Finally got a Norwegian company to accept me. And they said, if you get your private pilot's license, we will take you on. So I went to a bank in Scotland and asked for a career development loan. And I got my private pilot's license.

• 6:53Jack Rhysider?

  Well, now this pilot is different than ROV pilot. This is airplane.

• 6:56Speaker 01

  Yes, this is a small, yeah. So I can fly a Cessna, although I haven't in America. I can do that. And so they, it was supposed to be quite similar. And then I called the company back and said, hey, like, I've got this. And it took, it takes months. So, and I was getting further and further into debt. So I, um, called them back and said, hey, I've got this. And there had been this change of management. And they were like, it's not actually, we don't know why they said that. It's not a private pilot's license you need for a plane. It's, we're, we're more like as an ROV pilot, it's closer to a helicopter. So I changed my name. I went back to the bank in Scotland, got another career development loan and went back and got my PPL for helicopters.

• 7:39Speaker 01

  Then I went back to them and said, okay, I've got this. But listen, like, no more surprises and can I have a job now? And they took me on and it was, it was sort of life changing for me.

• 7:51Jack Rhysider?

  This job required her to travel a lot. North America, South America, Europe, Asia. She got to travel the whole world while working as an underwater ROV pilot and sometimes flying helicopters.

• 8:01Speaker 01

  So I lived in Venezuela for a while. I lived in Trinidad. I have been to sort of everywhere from Nigeria to Australia, a lot of coastlines. I've seen a, seen a lot of water.

• 8:14Jack Rhysider?

  While she was doing this work, she started getting more fascinated with IT. Computers became her passion. She was enrolled in remote learning courses and was able to get a degree in computer science. Then she took a month off work and landed in Los Angeles, California, just to take a break for a while. But she fell in love with LA. And while there, she started going to a gym to exercise and work out.

• 8:34Speaker 01

  One of the people that I was training with in the gym was a stuntman. And I was, I sort of begged him to please like, let me hang out with you. Let me be cool too. So um, eventually he sort of, he got me some training in stunts. And he actually got me one of my first jobs.

• 8:53Jack Rhysider?

  She was in a few independent films, did a few stunts for them. She got an opportunity to be in House of Cards and she does stunt for them, but they decided not to use it for some reason. While that was cool, it was also short-lived because while it's exciting, she didn't see it as a long-term career.

• 9:08Speaker 01

  I studied quantum computing and it was really difficult. It was, it was, it was extremely difficult for my feeble mind, but it was really enjoyable and I, I loved it.

• 9:20Jack Rhysider?

  This turned her attention to new technologies and companies. At some point, she got a job for a company in Australia and moved there.

• 9:27Speaker 01

  My first entry point into both social engineering really and pen testing was in Australia. And I worked for a big company down there. They gave me a shot on their graduation team for, for cybersecurity.

• 9:40Jack Rhysider?

  This company had penetration testers, people who try to break into a building or a network to test the security of it. She got to watch one of these pen testers work by monitoring their activity through cameras.

• 9:51Speaker 01

  And I was witnessing a pen test, but with a social engineering component. And it was a guy, he was a, he was a really good hacker and he had gone into the network of one of our targets. And he was opening all of the security doors and automated doors for one of the team, the cybersecurity team. And they were just walking through and they were filming the whole thing. And you know, it was being broadcast live back to us and it was amazing. And I was thinking, okay, this is a good job. This is the kind of job that I would like to do.

• 10:25Jack Rhysider?

  Being a physical penetration tester seemed like just the thing for Maxi. Breaking into a building, acting like a spy, that seemed really fun. She asked if she could do that.

• 10:36Speaker 01

  And they were like, well, your luck is in because we have to test them without these technical capabilities. So we're just doing a physical pen test. Would you like to be involved?

• 10:48Speaker 01

  Jumped at the chance.

• 10:49Jack Rhysider?

  So they gave her an assignment, which was to try to get into a company and film what they were working on inside it. And to start figuring out how to get in, penetration testers often use OSINT, which is just gathering data on a target through open, public searches online. So she does a little OSINT and starts learning about the company more.

• 11:08Speaker 01

  They had some very interesting IP. They were a transport company and they were building some unique buses and large transport vehicles within this whole complex. So my job was to get into their past reception, past all security, get in and look at all of the assets and the IP. And I didn't need to, you know, hack any computers or even plug into any computers. It was, it was simply to get in and to essentially have a look at them.

• 11:45Jack Rhysider?

  How fun, right? Can you get into this factory, take a few photos of what they're building and get out without them knowing you're a spy? As she starts learning more about this company, she found out that they had some big connections with Sweden, as in some of their offices were located in Sweden.

• 12:01Speaker 01

  If you squint your eyes and you were very far away from me, I could probably pass as Swedish. So I had decided, and no one stopped me, I'd like to point out, I decided that I was gonna, I was gonna pretext or present myself as like a Swedish ambassador for this, for this company. And I had the CEO's name and some other top exec's names and things like that.

• 12:28Jack Rhysider?

  She does have blonde hair, but even though she may be able to pass as Swedish looking, there's no way she's gonna sound Swedish, not with that Scottish accent. So her plan was just to put "yah" on the end of everything and hope they didn't notice.

• 12:43Speaker 01

  No, and it gets worse because even I, because they're Australian, right? They're not idiots. So I was thinking that will never work.

• 12:49Jack Rhysider?

  But that was her plan and she decided to go forward with it. She liked the idea of acting like someone else. So she was set on being the Swedish ambassador for this company. Walk in, tell them she's from the Swedish branch and she's just flown in to inspect the building. But in order to do that, she's got to look the part. So she takes a trip down to a local clothing store, buys a new outfit, something that would make her look like an executive.

• 13:11Speaker 01

  I bought a clipboard and I looked professional and I had like a little briefcase. And I was really trying to look professional.

• 13:19Jack Rhysider?

  She's all set, ready to go in. Outfit on, camera rolling, deep breath. Let's go.

• 13:26Speaker 01

  So I go into reception and I approached the receptionist with like a warm smile and, you know, being as nice as I can be. And I'd said, "I'm here for this. I'm here for this appointment and this is what I want to do and this is where I'm from." And she said, "Okay." And I was like, "What? It was that easy? This doesn't make sense." But, you know, I'm not going to get in my own way. So I followed it and she took me to this little room, just sort of directly behind reception. And I was greeted by this adorable little old lady. And there was one other person in the room, but we didn't really talk. So I had to present ID, which is another stumbling block.

• 14:10Speaker 01

  And I got to talking to them. So they asked me why I was there again and all those things. And they said they weren't expecting me, but it wasn't a problem. And I thought, "Well, this is really easy. This is great." And I gave them my ID and I had an Australian ID at the time. And they said, "You're from Sweden and you've got an Australian ID." And I said, "Yeah, and I've got a dodgy accent. I went to school in the UK, so I tried to get around it like that." And it works beautifully and I don't know how. So I got in.

• 14:40Jack Rhysider?

  Okay, at this point, she's doing pretty good, passing as this Swedish person from another office. She got into the building, check, passed reception, check, and passed the two people that she was handed off to, check, check, check. Now she's in and she's trying to film things, take pictures of what's going on. There's an engine room. That looks interesting. Film that. So she goes in closer to take a look.

• 14:59Speaker 01

  And I was walking towards one of these large engines.

• 15:05Speaker 01

  And this man was walking towards me with, I think it was like two of their men. And he stood out. He had this beautiful blonde hair and these big blue eyes, like completely stereotypical Nordic look. And he came up to me and he said something in a language I don't understand, but immediately guessed correctly, this is Swedish. I'm supposed to be Swedish. I don't know any Swedish. So I'm racking my room for the limited amount of Norwegian that I know. And he, whatever he said, I kind of just looked and I felt my body get tense and I

• 15:46Speaker 01

  felt like the, my brain say, grim, open up, like let me cannonball into hell. This is torture. Please no. And so I said, um, yeah. And he looked at me like, okay, maybe that, that doesn't make sense, but okay. And then he repeated it. And so I tried the one word I could remember in Norwegian, which is nai for no, because if yes didn't work, then maybe no word, which was maybe one of my dumbest moments. But, um, so then he quickly just understood like this isn't right. And then security was called. They, they had a very prompt security team. They came, I was detained.

• 16:31Jack Rhysider?

  Oh no, she was caught. This is every pen tester's fear. But just because she's caught doesn't mean it's over. Maybe she can somehow get out of trouble, convince security that everything's fine, or at least just try to leave the building without being caught more. She tried to change the story. No, no, I'm, I'm not from Sweden. I'm just working with the Swedish team. I'm based in England. So they asked to see her ID again and it just wasn't checking out. They were very confused by the whole thing. At that point, she just couldn't see any way out of it. So she pulled out her get out of jail free letter. This is a letter that all penetration testers have that gives them authorization to do what they're doing. It has a phone number on it, which is typically the head of security and says, who actually authorized her to sneak in?

• 17:15Jack Rhysider?

  So they called the number on it and the head of security says, yep, this is all a pen test. Good job for catching her.

• 17:21Speaker 01

  We had like this sort of laugh after it. And even the security guy was like, why would you pretend to be Swedish? I was like, I don't know, I'm Scottish. He's like, I can tell and you don't look Swedish. I was like, I know.

• 17:33Jack Rhysider?

  That was Maxi's first pen test, where she tried to break into buildings. But she loved it. This was adventurous, adrenaline fueled. You need to keep your wits, be quick on your toes and know all about computers all at once. She felt like this is where she was meant to be. This was cool and decided to pursue a career in pen testing. She did a number of penetration testing engagements while in Australia, learning new techniques and getting official training on how to get better, reading a bunch of books on how to improve. And one of the things that intrigued her was thinking like an attacker. That attacker mindset was something she spent a lot of time thinking about. How do people with bad intentions act? Soon it was time for another penetration test, still while she was working for a company in Australia.

• 18:15Speaker 01

  The company I worked for was working with the local government in the city that we were in. And I won't say the name because I don't want any further embarrassment.

• 18:25Jack Rhysider?

  Now, penetration tests are not always physical. In fact, I'd say most of them are just done over a computer. Like the penetration tester might be outside the company and just trying to hack their way into the company through the internet. Or sometimes companies will just invite the penetration tester right into the building and give them a desk and a network jack and say, go for it from the inside. Because even if you get into the network, there should be layers of security which should still keep you from getting into important things. That's called defense in depth. So this was a pen test on a local government office. And with this one, they invited her to come into the building and plug into a port and see what vulnerabilities she could find from within the company. She wasn't alone on this one, though. There were two other people with her.

• 19:08Jack Rhysider?

  And the two other people were very experienced network penetration testers. And she was still learning how to do this. So she was shadowing them and watching what they were doing.

• 19:19Speaker 01

  So I wasn't a noob, but I was, this was my first job in cybersecurity. I have a very technical background, building ROVs, flying them or steering them, I suppose. That's all technical, even stunts are technical to a certain degree. This was a step further because there are no physical components to it. That's why it was so difficult for me. I, it's all on screen and like Linux is its own beautiful scary world for me. So I was still getting to grips with this whole world and all of the commands and what these things meant and how to undo things.

• 20:00Jack Rhysider?

  And they all sat down, pulled out their laptops and plugged into the network. She starts by firing up a network vulnerability scanner.

• 20:07Speaker 01

  I got to run the Nessus scan, which was not the most technical job in the world, but it felt good at the time. And I got to look at what vulnerabilities were there and I got to go and see exploits for those. And I got to like run nmap.

• 20:25Jack Rhysider?

  These are fine, basic tools to start with. It'll scan the network for known vulnerabilities. They're easy to use and typically benign, as in they're not going to cause any trouble on the network just by running them. And when you run these tools, it's not hacking, it's just to try to find what's hackable. And she wasn't exactly sure how to hack into this company.

• 20:45Speaker 01

  When you're around experienced pen testers who love their job and these two loved everything that they, every like line they wrote was sort of like a piece of art for them. They loved it and they, they really like got this high out of it and that's contagious. So I started to think like, this is amazing. This is so cool. Like how far we're in. And one guy, one of the guys that I was there with got a call from one of our points of contact. And he was saying, I can see you in the network and it was this big game and it was fun and it was interesting. And I got caught up in that.

• 21:19Jack Rhysider?

  So after seeing all the cool things that those other penetration testers were doing, Maxie wanted to have some fun too. How far could she get into this network? She saw there were vulnerabilities on certain systems on her scan. She tried to exploit those vulnerabilities and get into those systems. Because there's a sort of high you get from getting into a computer when you shouldn't be able to. And she was making progress. She got into a few systems and she was looking around, making notes on how she got in. She would look over her shoulder and always see those other penetration testers many steps ahead of her. So she kept looking around to see what else she could get into.

• 21:54Speaker 01

  I found my way to some internal environment and I hit the kill switch on a city's water supply.

• 22:07Jack Rhysider?

  She accidentally typed the wrong command into the wrong computer, which controlled the flow of water to the whole city.

• 22:16Speaker 01

  The person I was with immediately saw within the network that that wasn't right. I will assume that he was sort of with me, like following me throughout the network and you can see a lot of what I was doing. And then I was thinking, yeah, this isn't, I don't think that was maybe good, right? And so I looked at him and I could sort of see in his face and he comes over to me and he said like, what did you do? And I, you know, you can look at your history quite quickly and I still had quite a lot on screen. I showed him and he put his head in his hands and I was like, what, is it really bad?

• 22:52Jack Rhysider?

  It was really bad. Shutting off the water to the whole city, showers, faucets, sinks, even toilets were not functioning citywide. Her two other penetration testers immediately tried to figure out ways to fix the issue. One was looking at how the system operated and if it was possible to just turn it back on, but you don't want to just do that if it's going to cause a problem. The other pen tester immediately phones the point of contact, letting them know this is a major problem. Maxie was sort of in shock and incredibly embarrassed. She took her hands off the keyboard and just waited.

• 23:22Speaker 01

  I was detained by security guards and they, they were not very pleased.

• 23:30Jack Rhysider?

  Now, this is a completely different situation from the last time she was detained by security. The last time she had a get out of jail free card. This time, they knew that she was supposed to be there. In fact, it was her point of contact that called security on her. She was authorized to be there and do this, but this was not supposed to be disruptive to the organization. Not only was it disruptive to the organization, but it was disruptive to the whole town. So they wanted to at least get her recount of the matter recorded, so they had it for later.

• 23:56Speaker 01

  I go down to a windowless room, and I'm questioned. And all of a sudden, one of the accusations, if you want, was that I was a Russian spy. I was thinking, how did we get there so quickly? Like, what happened?

• 24:13Jack Rhysider?

  Apparently, she spoofed her IP at one point to make herself look like she's coming from Russia to try to test to see if they could detect that. But that was just very brief, and she was definitely not a Russian spy. But this was becoming scary now because it wasn't just a confession of a mistake she made. It was like they were treating this more like an investigation.

• 24:30Speaker 01

  So I was held there for like a couple of hours. And of course, the police were called. The police had to be called. I didn't have any ID on me. I had my work card, but that doesn't really matter because it's just a photo I could have printed myself. And I kept saying to them, you know, if you let me go back to my apartment, I can get my passport for you. I'm British, and I'm not a spy, and you can contact my employer, and I'm actually here with two people. And I kept going, and they didn't want to hear it. And that's OK. That's kind of their job to do, to not believe me and to, you know, look for the worst because they've got to protect themselves against the worst. And eventually, at some point, I said to them,

• 25:14Speaker 01

  like, I need a glass of water. And the look would have been enough to like, you know, turn most people to stone. I was thinking, yeah, that was not an ideal question. And then eventually, my employers at the time called in, and it did get sorted. And I narrowly escaped,

• 25:36Speaker 01

  essentially, what I think you would call a prosecution. I escaped any legal action because of that. And I was on the graduation teams. That lent me some credibility in the fact that, OK, she doesn't know what she's doing, and it's OK.

• 25:52Speaker 01

  And my employer didn't fire me, and I will be eternally grateful for that.

• 26:03Jack Rhysider?

  She doesn't know how long the water was out that day. It could have been hours, minutes, seconds. It doesn't matter. The fact that it could be shut off and it did get shut off is why the police had to respond. But she narrowly got out of serious trouble from that one. But this sort of baptism by fire is how we learn the most important lessons in life. I mean, knowing firsthand what kind of true power a penetration tester has is profound. And this feeling sometimes flips back and forth, too. Sometimes you feel completely blocked with no access to anything, and it makes you feel dumb. And other days, you feel like with a single keystroke, you can wreck this entire business. It almost reminds me of visiting a barber and getting an old fashioned shave. The barber has this razor and they're shaving your neck with it.

• 26:47Jack Rhysider?

  You feel very vulnerable in that situation. And I think many companies do feel vulnerable when they allow a penetration tester to come in. Who knows what they saw or took? In my last job, we had a penetration tester come in and see what they could do. And they were able to crack 25% of all our passwords company-wide. That's like thousands of passwords. Of course, I read the report to see whose passwords got popped, but it only contained statistics, not passwords or usernames. And it made me think, you know, this pen tester is walking out of our building with a bunch of our passwords. I've never felt more vulnerable at work before. We're going to take a quick ad break here, but stay with us because Maxie's going to tell us about a penetration test story that changed her life.

• 27:34Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch-up when audit season is coming around the corner again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year-round, cutting your audit prep by 82%.

• 28:15Jack Rhysider?

  Plus, you can access the Vanta agent everywhere you work. Whether your team is in Vanta every day or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. Vanta.com/darknet.

• 28:42Jack Rhysider?

  Making some big mistakes on past pen tests did not make Maxie back down from pen testing. Instead, she doubled down. She was fascinated by the power of the pen tester. But more so, the attacker mindset allured her. But she had to leave Australia.

• 28:57Speaker 02

  Well, yeah. So I'd come back from Australia. My visa had run out. Moved back to the States. My motto in life is like, if I'm free to do it and I want to do it, then I will do it. I kind of always want to be infatuated with what I'm doing and focused. And I'm OK if whatever the thing is that I want to do changes. And it has, obviously. But I want to love what I do because functionally, right? I'll live for 70 years. Maybe I'll live to 90, but functionally, I've got max 70 good years. And I want to do, well, we might do, two interesting things a year. So I've got 140 interesting things that I'll do in my life. That doesn't sound like a lot. So I just always wanted to do the things that were most interesting.

• 29:42Speaker 02

  They would get me the most sort of interesting, exciting experiences.

• 29:46Jack Rhysider?

  And for her, the thing that excited her the most was red teaming, penetration testing, social engineering. Physically breaking into buildings was just a thrill to her. So she looked for more jobs doing that.

• 29:57Speaker 02

  So I was hired on a sanctioned red team contract to test this high-security logistics company. And there were two testers that were booked.

• 30:06Jack Rhysider?

  It was a large company, but they wanted the two of them to try to get into one of their satellite warehouses. They told her, look, there's a locked fence around this whole property. Security alarms are on the doors. There's security cameras watching the whole property. There's active security patrols at night. And they just wanted to prove that she could get to them. They didn't want her to do anything to those machines. And they gave her a little USB device and said, hey, if you can actually get to it, plug it in and take a picture that you got there, and this will prove that you made it. Because presumably, if somebody wanted to get a customer list or shipment list or whatever, it would be just as easy for them to plug in a USB device, grab the stuff, and unplug it. So they asked her to see if she could do that. So her and her coworker take a drive out to this facility during the day and just drive by, just to look at the place.

• 30:51Jack Rhysider?

  And driving by is too quick, you can't see anything. So they decided to get out and just walk down the sidewalk and go around the whole property, just to see what they can notice. Any points of entry? Are there any areas where the cameras aren't pointed?

• 31:06Speaker 02

  When we had kind of gone around, the very edge of the perimeter was like metal fence, like chain link fencing. So the chain link fencing had just, it wasn't, it was years old, probably decades old. And so it was a bit rickety, so you could just kick the edge up. So we knew that.

• 31:26Jack Rhysider?

  They took some other notes and got an idea of what the place was like. There's a two-story warehouse building with loading docks and sort of two parking lots, one normal one with big transport trucks and cargo trucks, and a second one that had a chain link fence around it with many more of those big cargo trucks. We're talking eight-wheelers here, the big trucks. This warehouse would load stuff onto them and then they'd deliver it. So they leave and decide to come back at 9:00 PM. But Maxi's coworker called her up.

• 31:56Speaker 02

  He's like, "I'm sick." And I was like, "I hate you. You're not, I know you're not sick, you're hungover." But anyway, last minute, he gets sick. So the scope allowed for a solo run, so I was like, "I'm gonna do it."

• 32:08Jack Rhysider?

  She waits until night and then drives back to the facility at 9:00 PM. By that time, the place was all closed and there should be no workers there and just those security patrols that she was told about.

• 32:17Speaker 02

  I then parked behind a tree line outside of the logistics park. I was keeping away from, you know, the lights. I was staying where the shadows fell at night.

• 32:31Jack Rhysider?

  Okay, it's go time. I like the quiet approach of being on foot myself, too. You can hide easier, change directions more quickly, be more stealthy.

• 32:40Speaker 02

  So come up through a tree line, off to the side of the whole complex. Moving pretty slow, I'm far enough from the walls to see the whole facade. I'm close enough to spot like opportunities and I do the usual first pass. I don't force anything, I don't touch anything.

• 32:58Jack Rhysider?

  She passes by the building, the classic first pass. Gives you plausible deniability, right? If you don't touch anything or don't go on the property, you can just say you're passing by if anyone asks. But it's quiet. There seems to be no signs of life inside, no noise, no doors open, no lights on. There were a lot of trucks in the parking lot, but all of them were dark and quiet. No regular cars there. But surprisingly, she didn't see any security patrols. So since she's around the back of the building, she starts jiggling door knobs and windows to see if any of them will open.

• 33:34Speaker 02

  And everything obvious that you would look at to gain entry was a no. So doors, no, hatches, couldn't see them. Grounded windows, they didn't open, they were just double pane windows. So yeah, so you know, good security is frustrating in some sense. But it was this like corrugated, all of the warehouses in the area were these corrugated sort of steel structures or metal structures. And this, the warehouse that I had, there was sort of this grass alley in the back, at the back of it. And its neighboring warehouse also had stacks of pallets.

• 34:19Speaker 02

  So there was just these stacks of pallets all the way like through this almost alley. And there was this high stack of pallets that kind of touched, it was within four, three, four feet of a second floor window. There was just this little, it was like a little rectangular window, but it was open. And I was like, oh, that sounds like a great way to get in there. So kind of moved a couple of pallets, start to climb up these other, like this other high stack of pallets. And most of them were kind of being like secured to one another. So it's, they're still a little rickety. It wasn't like, I wasn't feeling very confident that they wouldn't crash to the ground, but.

• 35:04Speaker 02

  They didn't, I'm, you know, pretty light on my feet. I'm built, I am built for speed and not power. Um, so I do end up getting to the top, poke my head through.

• 35:16Jack Rhysider?

  While the building looks two stories tall, it's really just a single story, but just with really tall walls. So when she looks down, it's straight down all the way to the warehouse floor. That's not good. That's too high to jump down. So she looks around and notices that the walls are made of.

• 35:33Speaker 02

  Like a lockboard? It is essentially is pegboard. So pegboard is basically, if you aren't familiar, it's steel or aluminum sheeting. And it's got this regularly spaced, like square or rimmed holes that you, you basically you put on walls in warehouses usually, and then you hang like heavy trailing on it. So I'm looking at this lockboard pegboard and I'm like,

• 36:00Speaker 02

  all right, well, climbing down it, you know, gravit, gravity is your friend. So it's like fingers in and got my little sneakers on and I, I actually get down. It's, it wasn't as difficult as you think.

• 36:10Jack Rhysider?

  Okay, she did it. She got into the building. Nice. Now her objective is to simply see if she could get into those computers in the building. So she looks around for them. They were easy to find since the monitors were on and they were glowing in the dark.

• 36:23Speaker 02

  Get to the terminals and they're all, they're all open. It was, it was beautiful. It was, you know, when in movies that they're like, ah, the, like the heavens light. I was like, this is great. So they were, yeah, they were all unlocked. And so I connected this approved device. I snapped the required photos, um, you know, proof I could touch, one attack I would want to touch. And then I fell by the exit and I was like, I looked at the pegboard and I was thinking, well, cause climbing up is a little bit different than climbing down.

• 36:57Jack Rhysider?

  Okay. So climbing out the way she came was not going to work. She looked around for another way out. There are a lot of doors. She's inside. She could just open one up and walk out. No way. Hold on, that's not going to work because there's security alarms. And she looked around the doors and yes, they were armed. Okay. Scratch that. You can't open those doors. It would trigger noises. And since she hasn't had any security on her yet, she doesn't want to get their attention now. So she looks around for other points of exit.

• 37:22Speaker 02

  It was a loading door that wasn't in the best shape. So a loading door, like a dock where the truck backs in so it can get whatever the load is. It can get into the warehouse and you don't always need a forklift and so on and so forth. So it was essentially that. So it was on a pulley system and it wasn't attached to an alarm, which was mental for what they, you know, for how secure they want it to be.

• 37:51Speaker 02

  So yeah, so I kind of, it was a little bit buckled at the side. And maybe that's why it wasn't on that alarm. I'm not sure. But a little pulley system, pull the chain up, just enough to sneak out. And I get back to my car through a forest, which is by far, by the way, the worst part of the story for me because I do not like insects. But so yeah, so then I backed my car, or I think I'm roughly back to my car. And I phoned my point of contact and I report what is a success, right? I got in, I've managed it, I've got the files, I'll write your report. And he listened and he was like, I want to issue a scope change.

• 38:33Jack Rhysider?

  A scope change? This means the client wants to change what he wants her to do? I guess he was impressed that she was able to do everything he tasked her with and wants her to try more? So he says to her, you know, all those moving trucks in our parking lots? See if you can steal those trucks. And she's like, I don't know how to hotwire a truck. And he's like, no, no, no. See if you can find the keys to any of them and if so, take them.

• 38:57Speaker 02

  I was like, all right, let's do it. Because 140 interesting things in my life, this might be one of them.

• 39:03Jack Rhysider?

  She walks back through the woods, cursing at all the spider webs that she comes across, and then looks at the facility. There are a lot of trucks here.

• 39:11Speaker 02

  And they're the big trucks, like they're long trucks, you know, they've got 20 to 40 foot containers on the back, and I've never driven one of them.

• 39:20Jack Rhysider?

  Some are parked inside the fenced area and some aren't. She starts with the trucks that aren't in the fenced area. Step one, see if the door is unlocked. The first one she tries, the door is unlocked. Whoa, so she opens it, gets in the driver's seat. She looks at the ignition. The keys were not there. But to her surprise, the key was sitting right there in the cup holder in the center console.

• 39:41Speaker 02

  A little bit humorous, I'm like, eight billion people on the planet. I'm the best driver. So what I'm gonna do is I'm gonna move all these trucks. I'm not gonna worry about it reversing that truck. I was like, I'm gonna have to leave this here because I'm not gonna be able to do this. So yeah, so I took them up just other end of the cul-de-sac almost. It was like a little sort of quiet area, a little logistical parking spot, I guess. So I just parked them all up there.

• 40:10Jack Rhysider?

  She parked it about a quarter mile away and then ran back to get another truck.

• 40:14Speaker 02

  The keys were not consistently controlled. And the fleet wasn't consistently parked on the inside of the secure perimeter. So basically, it just became this live demonstration of risk.

• 40:26Jack Rhysider?

  One after another, she was able to find keys for these trucks.

• 40:29Speaker 02

  So when a driver comes back to this area and it's past hours, they they sometimes leave the keys, like they'll leave them under mudflaps or just actually inside of the truck.

• 40:41Jack Rhysider?

  It was incredible how many keys she found in and around these trucks.

• 40:44Speaker 02

  Sometimes they were still in the ignition. Sometimes they were on the seat. Sometimes they were in the, you know, the visor, the sunflaps. Sometimes they were in the mudflaps and sometimes they weren't there at all.

• 40:53Jack Rhysider?

  Some trucks were locked and she couldn't get into or move them. She thought about climbing back in through the window of the building and looking for the keys inside, but she already proved she can get in there. Maybe it's just better to try another truck instead. After taking the ones from the unsecured parking lot, she wanted to get into the fence area and try to take one of those. She remembered where you can lift the fence up and get in there. So she scurries under the fence and looks at the trucks inside. Sure enough, same story. Keys were typically aiming around the trucks there, too. So she hops in one, finds the keys, starts it up and starts to drive out, but realizes, oh, wait, this fence is locked. She gets out, looks at the padlock. She thinks about picking the padlock.

• 41:34Speaker 02

  That did not work and I was like, I bet there's a key for this someplace. And I'm thinking, do I go back inside? Do I climb up the pallets, climb down the grate and look for the keys? And I was thinking, you know what? This is probably proof enough. This is bad enough because the report is going to say, well, I couldn't break into your secure perimeter. Why don't you park your trucks in there?

• 41:54Jack Rhysider?

  By 2:00 AM, she had stolen a bunch of trucks and felt like she accomplished the mission. Security never stopped her. There was no one around all night. So she goes back to her car and calls her point of contact and says, she stole the trucks. He's like, wow, okay, great. Hey, can you come into the office in the morning and tell us how it went? She's like, sure, but let me sleep first because I'm exhausted. So she goes home and then the workers start coming to the warehouse in the morning.

• 42:21Speaker 02

  Day shift did arrive and they didn't notice anything was wrong for like a fair amount of time. When I think it like, how I would say it maybe is, it took a beat for the penny to drop for them. And yeah, a headquarters finally called and my contact, I think, walked them through the findings. And eventually we gave a report and, you know, where was security? They're supposed to have 24-hour rolling security. Where was it? Because I didn't see them. Like, why were there pallets? Why were there unlocked windows? Why weren't the loading base connected to the alarm system? Things like that. Like, it was, you know, treat keys like access badges, not.

• 43:06Speaker 02

  Souvenirs.

• 43:07Jack Rhysider?

  Did you have to give like a debrief to that facility and say, hey, by the way, if you're wondering what happened, let me tell you.

• 43:15Speaker 02

  Not to the facility. So I I didn't go back to that facility. We I gave it to my like to their headquarters, essentially. We went in and we gave a presentation and a report and, you know, as is all it's always the case, people's sort of mouths drop, and I think their tummies probably drop too. And they're like, how has this? How has this happened? Sort of thing, but.

• 43:38Jack Rhysider?

  Yeah, but it's it's another thing to be like, wait, who did this? Oh, we hired this person Max to do it. This guy Max, it must it must be a jerk to be breaking in and all this. And then if you were to actually show up and be like, hi, I'm Maxie, and I'm the one who stole all your trucks.

• 43:54Speaker 02

  I'm so sorry. You have to you have to be soft with them. Like, well, maybe that's just personality. Maybe that's a preference of mine, but stylistically, I think be soft with them. They do not know, for the most part, that our industry exists. Yes, they know that there are, you know, bad actors out there, but they don't know that some of us are making a career out of it. And you have to go in and you have to be soft. It isn't their fault. There's that's what it is to run a company. Not everything's safe. You can make it a little harder for people, but that's our job to tell them. And I just think tell them that in the most direct but soft way possible.

• 44:39Speaker 02

  You don't. It's not a blame game. And so, yeah, I I went to headquarters and I was like, hi, guys. It was, I think you might have heard what happened. And like, yes, from now on, my resume, I've got, you know, expert climber and truck driver.

• 44:54Jack Rhysider?

  She did a lot more penetration tests and got so serious about it that she wrote a book called The Art of Attack, Attacker Mindset for Security Professionals.

• 45:03Speaker 02

  Yeah. Well, here's what I'd say about my book. I'm gonna explain it. If you don't like the sound of it, just buy it for somebody you don't like. If you do like the sound of it, it was all me. You should buy it. It'll be great. No, in all seriousness, it's called The Art of Attack. And its central argument is that in order to design.

• 45:25Speaker 02

  Defenses that truly work, security professionals must adopt this quote unquote attacker mindset. And its basic position is that simply focusing on tools, networks, or policies is completely insufficient. It's necessary, but it's not sufficient. So understanding how an attacker thinks, how they strategize, manipulate, persist, is fundamental to building resilient systems. And I would probably finish on it by saying the skills of a good attacker are the same skills that A, I want as a person going through life, normal life. Also, the things that I would teach and will teach to my children,

• 46:08Speaker 02

  like grit, determination, we're goal oriented, we're resilient, so forth, so on. They are cognitive skills that we need, and how you apply them is what matters. And that is basically the premise of the book.

• 46:27Jack Rhysider?

  Somewhere in her life, she went on a penetration test that changed the whole trajectory of her life.

• 46:33Speaker 02

  It was probably the most highly strung, you know, tensioned job of my career. It was for a company that we've all heard of and that we all use. And we had their internal red team accompanying us.

• 46:52Jack Rhysider?

  This company had a big data center, and they wanted to see if they could get unauthorized access inside.

• 46:59Jack Rhysider?

  Now, I don't know if you've ever gone into one of these data centers, but sometimes these things are extremely secure. I've seen them where there's like a big fence around the company, and just to get into the parking lot, you have to go through a gate guard. And they'll check your ID and make sure that you're authorized to be there. And then when you finally park your car and get to the front door of the building, the front door is locked. And so you need a badge to get in. Forget about any open windows. They don't open ever. Then upon walking in, there's a security guard watching what you're doing, but you're only in the lobby. You're not even in the data center part of the building yet. To get in there, you need a second key. And sometimes they do an eyeball scan to verify your identity. And there are man traps, meaning there's only one person allowed through at a time so they can check you. But then, once you're in the data center, there's sometimes a cage around the server racks you need to get to.

• 47:44Jack Rhysider?

  And you might need a third key to get into those and maybe an extra form of identification, like a fingerprint scan or something. In short, It's extremely hard to sneak into a data center.

• 47:54Speaker 02

  They're actually on this job, armed guards, patrolling this perimeter. And there are vehicles that are scanned for anomalies. Like, it is a very, in terms of security, a very robust, comprehensive site.

• 48:08Speaker 02

  And, you know, inside everything, it's a data center. Everything is controlled, temperature, humidity are controlled to the decimal. The power and the fiber run through, they're redundant, there's blast proof, like conduits. Every corridor, every door, every bite is sort of like locked. But once you're in, you're in, and nation state actors will, will get in and they're willing to do what it takes. And so that was, that was our job.

• 48:36Jack Rhysider?

  Well, she decided to try going right in through the front gate. So she just drove her car right to the security checkpoint and acted like she was supposed to be there and talked to the guard.

• 48:45Speaker 02

  Hello, yeah, we're visitor. Yeah, like, hi, can we, you know, we're here to do this. Because your OSN can find you some of those entry points. Like, if they're doing immersion cooling, we know there is maintenance required on immersion cooling for the fluid, for instance. So you go up and you're like, here, we're here to do this. And you, you know, you, some sites that will work and they'll be like, oh, okay. Um, we just tell the right person or here, wait here. They were like, you're not on the list, you're not coming in.

• 49:13Jack Rhysider?

  Okay, so there's a list, this is a clue. Maybe she could get on that list. Who maintains that list? What if she called acting like the maintenance team and says they have to do a fluid change or something? And they're coming out?

• 49:25Speaker 02

  So we, we had tried to get on that list. We tried to call ahead. We tried to spoof phone calls so that it looked like we were calling from, hopefully, the right point of contact. It wasn't working, there was too many checks. They were comprehensive, they were robust, they were sharp. And so we're like, how are we going to get in here? And it's like, you know, sort of a bit like, they've built a wall. Do we dig under it? Do we go over it? Like, it wouldn't have mattered, it was the sensors, the security, they were on top of it. And so we're like, all right, what do we do?

• 50:07Jack Rhysider?

  Time to step back and think about some sort of out of the box way to get into this data center. But one way to try to think through something like that is just to learn more about this company. Maxi was curious how the building was built.

• 50:20Speaker 02

  So we actually went to the municipalities. We'd gotten some, like, almost, you could think of them as blueprints. And we figured out that there was, in fact, a sewage line.

• 50:33Jack Rhysider?

  Sewage lines are too small and would be way too disgusting for a person to go into. However, they sometimes run through underground tunnels that are accessible by service workers, like a smaller pipe inside a big tunnel. So she traced where the lines leave the property.

• 50:50Speaker 02

  It sat at a point where we could get to another access point through, basically, a junction.

• 50:58Jack Rhysider?

  Well, it's worth a shot to try. So they drive over to where they expect there to be a manhole which is off the property. And if their calculations are right, these pipes would lead right into the data center. But the question is, will there be a service tunnel also leading to the data center? So they pried open the manhole lid and looked in. It was big enough to crawl down into, so they did. And then they saw a tunnel going towards the data center. So they crawled through it.

• 51:28Speaker 02

  And it's a long, shall we call it, journey from one access point, one manhole to the other, but we have to do it. It's not glamorous. It wasn't enjoyable, but we got through it.

• 51:40Jack Rhysider?

  Sure enough, it led them right to the data center.

• 51:43Speaker 02

  And then make our way up into the site and then into the data center.

• 51:49Jack Rhysider?

  They got in, snapped a few photos to prove they were in there, unauthorized. And then they called the security team to tell them they got in. And the security came and it was like, what? How did you get in here?

• 51:59Speaker 02

  And so our report was...

• 52:03Speaker 02

  Your guys' security is bomb on. We hate it. It was amazing. You didn't let us in here. We weren't able to phone ahead. We weren't able to forge documents. We weren't able to do any of the things that we would try to do ordinarily. We couldn't have created a diversion to, you know, have security take their eyes off of the gates to get through while they weren't looking. It wasn't, it wasn't gonna happen. We got into your data center through a manhole for a sewer line. And that was the bulk of our report. The, the, the rest of it was going, but it kind of didn't matter to them. They're like, yeah, but you still got in.

• 52:41Jack Rhysider?

  But this made Maxie think even more. If a data center wants ultimate security so nobody ever gets in, how could they improve this? And that's when it occurred to her.

• 52:53Speaker 02

  And I was like, well, if you want to keep them that safe, you put them underwater.

• 52:57Jack Rhysider?

  An underwater data center? Could that even work?

• 53:01Speaker 02

  Then I started to think, oh, is that, did I just have a good idea? Amazing. So I called my old boss, who I used to work offshore for and with. I was like, hey, what do you, what do you think of this? And he's like, I've actually have thought something fairly similar. And I had this like autocad drawn at this point. He tweaked it, tweaked the design. I was like, would you consider working with me? Here's what I want to do. I want to, I want to put data centers underwater. I want to do it in a modular fashion. And I want to do it because it keeps them safe.

• 53:34Jack Rhysider?

  So the two of them got busy designing and building modular underwater data centers, where you load up the servers into what looks like a small shipping container that's watertight. And she will then drive them down to a safe spot on the bottom of the ocean.

• 53:48Speaker 02

  It's also a lot cheaper to do. So it's about 80% less expensive in terms of, in terms of CapEx to get compute underwater, the way we do it.

• 53:57Jack Rhysider?

  How, I, I don't know anything about underwater data centers. This is all new to me. So I didn't even know this was possible, or even this was happening. But you're telling me this is something you've made.

• 54:08Speaker 02

  This is something we've made. This is something we've, we've done, performed. And, and now there are actually a lot of companies popping up.

• 54:14Jack Rhysider?

  Is there like a long, like, extension cord that goes to these things to keep them?

• 54:19Speaker 02

  There essentially is. So what's really interesting about the Subsea environment, and we touched upon it earlier, is that Everything you and I use, one way or another. Um, so there are power cards under, under the water. That's how we, you know, that's how we light up oil and gas platforms. That's how we manage to eat on them and things like that. And there are also countries that export, so France exports power to Denmark. We, that's a long go lead a cable to do that for them. So there's actually a lot of subsea cables. There's also a lot of subsea cables for, there's like seven hundred cables or something like that, maybe more now, that carry the internet signals, so they, they pulse the light.

• 55:04Jack Rhysider?

  So you don't have to lay your own cables, you could just tap, tap off some of the stuff that's there?

• 55:08Speaker 02

  Yeah, it depends where we're, so if we're in a port, then we might extend from an on land substation. If we're further offshore, then we'll splice the power cable, put it in wet, so we've got offshore, there are wetmate, wetmate cables. So we'll, they look like headphones with a mic jacks on them. Like they look like that, they're just really big ones of that essentially. And we plug them into our units, our, our units look like twenty foot shipping containers. And they, we put them on the subsea floor, we secure them there through guideposts, lock them in, uh, plug in the power wet, wetmate the power and do the same for the fiber. And then it's up and running and we can do about three megawatts in a unit just now,

• 55:53Speaker 02

  which is meaningless to most people, but uh, that's kind of what we need just to do a small amount of compute. And yeah, we, we set them on the seafloor.

• 56:04Jack Rhysider?

  But what if, uh, what about maintenance and stuff? Like you need to change out a hard drive?

• 56:09Speaker 02

  Yeah, so there's a few ways that we perform maintenance. So it's, it's actually not that much different than, than um, online, so. What I will say is the maintenance cycles are reduced because there's no dust, right? We've got the, the servers are filled or are surrounded by this dielectric fluid. So there's no dust, there's no debris, there's no people jostling the cables. And those are the biggest factors in maintenance. That's why compute goes down eighty percent of the time. We don't have that then, but you know, it happens. We do have to maintain, there's some faults. So we do that a few different ways. If one server fails, it kind of doesn't matter.

• 56:50Speaker 02

  We'll load balance, we'll shift the load and it'll go to some other server or some other site that we have. Um, if a whole rack fails, it may fail in place. And again, load balancing, or if a rack fails and it's important, depending on what the client, depending on who the client is and what the client is doing, we may have to bring the unit up. And it takes, we, we guarantee you can do it within about 12 hours. Um, so we've got a vessel at site.

• 57:27Speaker 02

  The vessel goes, picks the unit up with an R O V because that's my background and that's how I knew how to do it. So picks up, put it on deck, we drain it, we do the fixes. You can also do them remotely a lot of the time. Um, so it really just depends, but it, it, it doesn't cost any more time and it doesn't cost any more in terms of the financials. And, and before people like come for me, it does not heat the water. We are not heating the oceans. So I have to say it. So water warms up more slowly than air and it can actually hold more heat. So the specific key of water is higher than most other substances.

• 58:12Speaker 02

  And what that means is that it absorbs more heat before its own temperature increases by one degree. So said another way, water needs about four times as much energy to raise its temperature by one degree Celsius as the same mass of air does. So what we've measured in our testing is that the water heats up by about a thousandth of a degree, which is statistically insignificant, and that's within a meter of the unit. You put a data center on land, first of all, you have to use air conditioning to cool it. For the most part, that's what people are doing. So about forty to fifty percent of all the power that that data center is pulling is used to air conditioning.

• 58:55Speaker 02

  And then that is pushed out as heat. And then the ocean has to take that because that's our heat sink. The ocean takes that and now you're warming oceans. So it's like a very unintuitive of the very like scientifically proven method of getting rid of heat. Put it into water. And so, yeah.

• 59:14Jack Rhysider?

  And I imagine if someone does try to pen test this place or break into it, as soon as they open the door, it just gets flooded and then all the computers shut off.

• 59:22Speaker 02

  You can't open the door. So it's like you would, basically, our biggest day is like a sub, you know, like a Russian sub movie. Let's see. So what happens is you'd have, you need a sub or you need a vessel with an R O V attached. Or maybe if we're, if we're a, like a shallow depth, you could use a diver. But a diver's not going to be able to do anything. You can't pull the door open because of the pressure of the water. So basically, you couldn't really pen test it without getting a vessel, an R O V, or a bunch of divers, or a submarine. And good luck to you. I don't even know how I would do that. And if anybody's going to pen test it, it's going to be me because that is a, that is a fun job.

• 1:00:03Speaker 02

  But, um, basically, let's say a, a nation state sub came along. Great. It would have to connect it and it would have to pull it off of its security mechanisms that we've got sort of fastened to the seabed. And once you'd done that, you would basically self-destruct the data that was on the servers. Because now you've ruined the housing that, that is, you know, keeping them safe from the, the water and the pressure of the water. So physically, they are very, very secure.

• 1:00:42Speaker 02

  Digitally, there is the same footprint. Like, you pen test the same way you would any other server, data center company.

• 1:00:50Jack Rhysider?

  Incredible. I think I'm stunned by that sort of thing. I mean, my, I, my brain goes in weird directions here. Like, is it, are there laws offshore where you can host things that aren't legal in this country or whatever and all this sort of stuff? And now, now suddenly I, I like this idea of pirated websites or piracy. There's piracy in the sea as well. Like, my brain is, just goes in all directions here.

• 1:01:17Speaker 02

  It's rife. Yes, there are maritime laws, very difficult to enforce them. And you rely on satellites to some level, you rely on like boats to police. But the ocean is vast, so it is very difficult to enforce. So basically, we're counting on people doing the right thing. And that doesn't always work. So what we do is we make sure that we're in the green. So we co-locate with existing assets offshore, whether it be in national or international waters. Every country has an E E Z, an economic zone essentially. And that's about, it goes from coastline to about 12 miles out.

• 1:02:01Speaker 02

  And then, just a little further out from that, you start to get into what is essentially international waters. You can do what you want inside of them. Who's going to stop you? But we choose not to as, you know, an American company. And so we co-locate with other assets in the area. Usually like offshore wind platforms or rigs or anchored boats. So, yeah, I, I think subsea is definitely part of the, the future for data centers.

• 1:02:45Jack Rhysider?

  A big thank you to Maxie Reynolds for coming on the show and sharing these stories. You can learn more about her underwater data center at subseacloud.com. If you want to get her book, it's called The Art of Attack: Attacker Mindset. It's the one with the chess pieces on the cover. If you like this show, if it brings value to you, consider supporting the show by giving directly to the show. It helps keep ads at a minimum, it keeps the lights on here, but most of all, it tells me you want more of it. Not only that, but you'll get bonus episodes and an ad-free version of the show, too. So please visit plus.darknetdiaries.com. That's plus.darknetdiaries.com. Thank you. The show is made by me, The Packet Tickler, Jack Rees-Cider, editing by Control-Alt-Delight Tristan Ledger, mixing by Proximity Sound, and our theme music is by the mysterious

• 1:03:29Jack Rhysider?

  Breakmaster Cylinder. I have a bad habit of doom-scrolling social media, but lately I've been trying to break it by confusing the algorithm as much as possible. I'll play, like, long recordings of foghorns blaring, or I'll watch curling matches from 2006, or I'll just search for, like, the most bizarre things I can think of, like, "Can I legally marry a ghost in Ohio?", or baroque interpretations of dial-up modem sounds. "Can you potty-train a squirrel using jazz?" Not because I'm interested in those results, but because I like tossing the algorithm a bag of trail mix, just watching it chew on that for a while. This is Darknet Diaries.