Transcription performed by LeahTranscribesJACK: So, back in 1988 there was this identity theft incident that happened which, when I read it, it infuriated me so badly and, well, now I want to infuriate you. So, check this story out. [Music] This all started in Albuquerque, New Mexico, like I said, 1988, and there was a hot dog stand there which seemed to hire people who were really down and out. Like, if you had a past criminal record, that’s fine. You’re hired. Homeless? Okay, here’s a job, buddy. Get yourself together. William Woods was a homeless guy working there, and then they hired Matthew Kierans. Matthew had a long criminal record and was trying to separate himself from that past. He was new in town; just needed a little cash to probably just get him to the next town or something. But as soon as Matthew started working at this hot dog stand, he stole William Woods’ wallet, the homeless guy that was also working there. William found out that Matthew stole his wallet and confronted him, and he threatened him, and he got the wallet back.
But geesh, what kind of jerk steals someone’s wallet like that? Neither of them lasted long at this hot dog stand. William, the homeless guy, actually left town to find a new job. He went over to Texas for a while. He did some day-labor jobs there, then went over to Las Vegas and worked in a laundromat, and eventually he ended up in Los Angeles scavenging for gems and metals. But little did he know, while he was struggling to get his life together, Matthew had started calling himself William Woods. [Music] See, since Matthew didn’t have a house, he carried all his important documents with him. So, when Matthew stole his wallet, his birth certificate and social security card was in his wallet. So, Matthew copied those things down and then moved to another state and then started to register stuff in that name. He asked for an official birth certificate from the state and a social security card for William Woods, and got them.
He got a driver’s license with William Woods’ name on it, but it had Matthew’s picture on it, and he got a job as William Woods. Because remember, Matthew had a criminal past, and he was eager to leave that behind. A fresh start was really great for him. But he didn’t stop there. Matthew opened a bank account as William Woods, too. By 1994, six years after stealing William’s wallet, Matthew had completely took on this new identity, and William had no idea. Matthew even got married to a woman who thought his name was William Woods, and then they had kids, and they called themselves the Woods family. Matthew wanted to know more about William to have a solid backstory, and went on ancestry.com and convinced them that he’s William Woods, and he learned all about his childhood and his family. Actually, this all had a huge payoff for Matthew. This was great for him because he had a criminal past, but that was essentially erased.
Now he got a $100,000-a-year IT job at the University of Iowa and a car, and even took out a loan for a house under his assumed identity. This fresh start was looking great for him. The real William still had no clue and was busy scavenging for gems and minerals in California. He was an off-the-grid kinda guy, so he wasn’t filing his taxes or opening bank accounts himself, and he only used cash wherever he went. He kept a pretty quiet life. Because of that, Matthew was able to use William Woods’ name for decades without anyone knowing. In 2019, the real William started getting a hunch that someone might be using his identity, and talked to someone about it, and they gave him some money to do a credit check, and that’s when William discovered there’s loans out at a bank under his name. So, he goes in the bank, identifies himself as William Woods, shows them his California ID, and they’re like, okay, how can we help you? He’s like, well, I don’t have an account here.
Someone else is using my social security number and name or whatever, because that account is not mine. The assistant branch manager walks over and he looks at William’s account, and there are some security questions associated with it, and a PIN. William cannot answer any of the security questions and doesn’t know the PIN, obviously. So, the manager’s like, okay, well, there’s a phone number here. William’s like, that’s not my phone number. So, the manager’s like, well, let’s see what happens when I call it. So, he calls the number and Matthew picks up over in Iowa. But Matthew abandoned that name Matthew long ago. He’s like, yeah, I’m William Woods. What’s the problem? They ask him the security questions, and he got it right. [Music] So, now the bank has two people who have authenticated themselves to be the owner of this account, and they have to figure out who’s the real owner.
The manager is still on the phone with Matthew, and since he knows all the answers to the security questions and the real William looks like some homeless guy, he’s more convinced that the guy on the phone is the true account holder. So, he tells Matthew, well, there’s someone here in the bank claiming to be you. Matthew’s like, in California? I’m in Iowa. Nobody in California should be accessing my account. So, William’s standing there, and the manager’s looking at him, and the manager starts thinking, this guy in the bank must be faking his identity to get into this guy’s account. So, he calls the cops on William for identity fraud. The cops call Matthew and they ask for proof that he’s actually William Woods, and Matthew just sends them his driver’s license, social security card, birth certificate. At this point Matthew had been using William’s identity for thirty-one years, which means he has tons of supporting evidence to prove he’s really William.
What do you want? W-2s, electricity bills, library cards, credit cards, a marriage certificate? I can give you supporting documents for days. I am the real William Woods. In the meantime, the real William Woods has very little to show that he’s actually who he says he is. He has an ID from the state of California, but that’s about it. He just didn’t have much documentation to prove he was actually William. But that’s just the beginning. Get this; Matthew must have known what was going on, because when William went to court in California, he was tried under the name Matthew Kierans. So, that must mean that Matthew told the cops that William is probably this guy, Matthew Kierans, which is so messed up and backwards. Now William is going out of his mind. He is disgruntled. He is furious. He’s confused and absolutely angry with the cops and the court. I mean, I would be, too. But it’s not helping his situation at all. He seems wild and crazy, which makes everyone in the court think he’s actually nuts.
Even his lawyer doubted the story. He got so wild and furious with everyone that they really did think he was having a psychotic breakdown and decided that he’s not fit for court, and sent him away to a mental hospital without even having a trial. So, poor William got thrown in the mental ward. Not only that, but they forced him to take psychiatric drugs. The whole time they were calling him Matthew, and he’s like, no, I’m not Matthew. Matthew stole my identity. I’m William Woods — and was forced to stay in the mental hospital for five months. When he finally calmed down, they said, okay, now we can have your trial. The judge looked at the case and found him guilty for trying to steal William Woods’ identity. So, they sent him to jail. Not only that, but they charged him a $118,000 fee for his hospital fee. [Music] This is the stuff that makes me furious. I mean, absolutely furious that the victim gets treated like this and the actual identity thief got away with it.
I’m sure William must have thought he was crazy at times, and it’s no fun when you start doubting your own reality and don’t even know who you are anymore, because the court forced him to call himself Matthew. He was admitted to jail as Matthew. The guards called him Matthew, and they made him call himself Matthew. So, poor William just had to serve his jail time. He didn’t have any resources to fight this. So, months go by in jail. A year goes by. After a year and a half, he served his complete sentence and was able to get out. When he gets out, he is mad, so mad at Matthew for putting him through all this that he calls Matthew’s work, University of Iowa, to report him. This makes its rounds to some people at the University of Iowa, and someone decided to do their own little investigation. They thought, what if William is right and Matthew did actually steal his identity instead of the other way around? Surprisingly, at this point, no one had done a DNA test on either man.
So, the person from the University of Iowa figured out who William Woods’ real father was, which wasn’t easy, and was able to get a DNA sample from the father. Then he went to California and took a DNA sample from William Woods, and bingo, there was a clear match. The investigator called Matthew and asked him what his father’s name was, and Matthew had no idea. So, after a year and a half in jail and five months drugged in a mental hospital, everyone finally realized that William was telling the truth the whole time. Ugh. The courts apologized. They exonerated him of all wrongdoing and even cancelled out his $118,000 medical fee that they charged him with. Like, oops, sorry, that was our mistake. He was free to go on calling himself William once again. But then the cops turned towards Matthew in Iowa and were like, uh, bro, you lied to us. You lied under oath in court, and you made a poor man suffer for years because of this. Not to mention, you conducted identity theft. So, they arrested Matthew and sentenced him to twelve years in federal prison. His expected release date is 2037.
Intro: [Intro music] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries.
JACK: A few years ago a friend messaged me and said, look out, an APT just followed you on Twitter. I’m like, what? He’s like, yeah. The US government is classifying this account as an APT, an active persistent threat to the US government. I’m like, whoa, which account is this? He said, oh, the account name is USDoD. USDoD? As in Department of Defense, and they’re an APT and they’re following me? No, no. That’s just their hacker name. It could be a group, could be a solo person, but they’re calling themselves USDoD to be funny, edgy, and confusing. [Music] So, this began my relationship with the APT known as USDoD. He was active in the hacking scene and would post what he’s doing right there on Twitter. I started commenting on his post, and he started commenting on mine, and we laughed and we giggled. We started forming some kind of weird, parasocial relationship through Twitter. I always had a hard time getting a good read on him. He contradicted himself a lot.
He seemed to be young in the way he was talking and was really hard to figure out if what he was saying was true or just something he exaggerated or even made up. I think a few times I caught him talking to himself, even. Like, you know, just some weird gibberish that probably only he understood. I asked him for an interview. He said, okay. But then I realized his story’s just beginning. If I interview him now, I’m sure there’s gonna be much more that comes. So, I just held off, waiting for the story to ripen more. I think a year went by, and I just watched him do more and more crazy stuff, and it was hard to tell what was real and what wasn’t. But then he suddenly disappeared. The account was banned, and I never heard from him again. Turns out, his story is much more crazier than I realized. Are you ready? [Music] So, let me give you an example of how strange he is. A few years ago the reporters at databreaches.net did, in fact, interview him, and this interview is all over the place.
Like, here, check out this one story he told them. Back in 2012, the hacker known as USDoD was living in Brazil and said he went to New York for cancer treatment. During his time there, he fell in love with one of the hospital employees. They became deeply involved with each other. They started talking about how corrupt the hospital is. So, him being the little hacker that he was, he decided to hack the hospital and expose the corruption. She said she would help him. With an insider, well, it’s super easy to hack into a hospital. So, she helped him get into the network, and he took incriminating evidence that proved the hospital was corrupt. He said he was gonna take this to the media and tell reporters and expose the whole hospital, and together they were gonna make a big deal of this. But the day before he was gonna meet with the media, she suddenly disappeared. His attention shifted entirely to find her. He became frantic, depressed, emotional.
To go from a deeply-involved relationship with her to hacking into the hospital together to suddenly being alone in New York, he was distraught. He hired a private investigator to try to track her down, but even the PI couldn’t find her. She vanished like a ghost. So, with no reason to stay in the US, he returned to Brazil and never blew the whistle on the hospital. This made him extremely bitter with the US. It’s not entirely clear why he’s mad at the US government over this, but says this was the thing that made him upset at the US government. Maybe he thinks they made her disappear somehow or kept them apart. I don’t know. But this is what I mean. What a wild story to start with, right? He came to the US, fell in love with a hospital worker, found corruption in the hospital, hacked the hospital, went to expose it, but then she vanished. He was left holding the smoking evidence that could ruin the hospital, but decided not to publish it due to a heartbreak?
It sounds like a movie plot, and who knows how much of that is true since it was just the story he told reporters. Anyway, he says her disappearance gave him a personal vendetta against the US, and this is what started his decade-long campaign to attack the US. He says it wasn’t politics, which is just wild because you decided to become an APT because you were heartbroken? Okay, I’ve heard stranger things on this show. Let’s go. Let’s see where this goes. [Music] He joined dark web communities, met criminals from far-off places; Russians, Iranians, North Koreans, and learned more about hacking techniques from them. He trained up by breaking into small companies that made easy targets. He started making a name for himself among the hackers in the hacker community, unknown to the rest of the world, though, until one day he was approached by an associate, a Russian who claimed to be developing some kind of AI platform named Tulip.
The Russian needed help and asked DoD, hey, can you help us collect military data? It would be useful for Tulip. I want to clarify, whenever I say USDoD in this story, I’m always talking about this hacker from Brazil. That’s the name he was going by. So, USDoD accepted the job, and over the next six months, some Russian folks he partnered with were able to build an exploit for an unknown vulnerability in the US army IT platform called the Program Executive Office Enterprise Information System, PEO. While the Russians did that, USDoD discovered that a way into this network could be to impersonate one of the developers who made it. So, he discovered who developed PEO and started working on getting closer to them. He tried getting access through the developer using social engineering techniques, and this strategy worked. Humans are always the weakest link, and it was a pincher move, attacking the system from two sides.
Together the Russian hackers and USDoD were able to steal source code and get different databases from agencies that used PEO, agencies like the Department of Defense’s Strategic Command, Central Command, Special Operations Command, and Defense Technical Information Center, an army specialist operation center, the defense contractor Lockheed Martin, too. The Russians took what they wanted from the deal, and USDoD got to take credit for the breach. In three days, in February 2022, he leaked lists of full military e-mails and passwords to the dark web. [Music] That is how he got the hacker name USDoD, by breaching the Department of Defense and publishing tons of military e-mails. Talk about an entrance onto the hacker scene. It was here where the US considered him a threat. You don’t attack the military like that and expect them to ignore you. They were working hard to figure out who USDoD was. USDoD didn’t stop there. He went on a roll after that. His next target was InfraGard.
This is basically the tip line to the FBI. If you have an important business, you can register for an account in InfraGard and then you can report incidents to the FBI directly and fast. Think critical infrastructure companies like gas companies, dams, water treatment facilities, or banks that might need to contact the FBI quick to take action on an incident. That’s what InfraGard is, and that was the site that USDoD was trying to attack. It’s normal for companies to apply to join InfraGard, so USDoD figured why not try to apply himself? But his plan was to steal someone’s identity who would qualify to be accepted and submit them to join. So, first he looked around for a finance company that would qualify, and he looked up the CEO’s name, the guy’s personal information; probably just bought it off the dark web. USDoD filled out an application on their behalf, put in the CEO’s information that he knew, and just faked the rest. InfraGard replied back; there’s some errors on your forms.
These parts need fixing. He was like, okay. So, DoD fixed them and sent it back again. A few weeks later he got another reply. His application was accepted. Just like that, he was in the InfraGard system, not quite hacking his way in, but faking his way in. He tricked the FBI that he was someone else. Once there, he saw that you could talk to other members. So, he started chatting them up, and they thought he was a genuine CEO. But then he started poking around the site, trying to test the database or server to see if there’s something weak here. He found that the site has an API, which is basically a way to query the database, but it uses a different authentication mechanism. While he was examining the API, he discovered that you can ask it for all the members’ contact information, and it would give it to you. [Music] Like a big phone book, basically, but you had to be a member to see everyone else’s details.
Nobody knew about this huge vulnerability, maybe because nobody who belonged to InfraGard would ever think to attack the site like this. It was a perfect opportunity. USDoD asked a friend to write him a Python script to grab the data, then he used it to steal every InfraGard member’s contact information; 80,000 CEOs, executives, and security officers, and again, he posted it all for sale on the internet. It was around here when he started following me on Twitter. So, you can see why they thought of him as an APT. He was advanced enough to sneak into the FBI’s InfraGard and persistent to attack the US government again and again. Definitely a threat. Advanced persistent threat; title acquired, which means the US government would be actively investigating him more now than ever. I’m not sure how they figured it out, but they figured out his name, and his name was Luan Barbosa. He’s from a small city in Brazil, but Brazil doesn’t extradite their own citizens.
So, I think the US government had a hard time figuring out a way to take him down. But despite being actively investigated by the feds, his vendetta was just getting started. He thought he was untouchable, taunting the feds and anyone else. I mean, his Twitter photo was just a picture of the cutest kitty you ever saw. He found a certain formula for hacking which was working surprisingly well for him. [Music] Step one; search through data dumps on the dark web for someone he can impersonate to help him reach his target. Step two; impersonate that target or use their account to get in. Step three; profit. Using this formula, USDoD, or Luan, broke into Cybersecurity Defense Center at NATO and a Washington DC club for politicians, and the aerospace company Airbus and their 3,000 vendors. In two or three years, Luan breached so many US government and government-related organizations that he was planning on building a business out of it, a full-on company selling military intelligence.
He had some pretty wild access and information, and he knew that people around the world would want to have this or buy it from him. So, why not make a business out of stealing this and selling it? To get his business off the ground, though, he needed a steady supply of people to impersonate, people with military connections and enough of their information to do it right. He was buying identities from places on the dark web, but this process had friction. I think what he was doing was looking to see who worked in a US military place and then tried to search for their names on the dark web so that he could get their data and impersonate them, but time after time, the people he looked for weren’t listed. That data wasn’t available. So he thought, what if I just had a big list of people’s identities and then figured out who on that list worked in the military or intelligence, and then I could just go impersonate them? But he didn’t have such a list.
He knew lists like that existed, though, and went on a hunt to find one that he could have full access to. We’re gonna take a quick ad break here, but come back, because this story is about to take a whole new turn. There’s a new character who comes into our story now. His name is Salvatore Verini Jr., but I’m just gonna call him Sal. He wanted to get into the entertainment business and decided to produce and star in his own TV shows, and he was swimming in it. He owned a mini-mansion near Miami with palm trees and a three-car garage, had a hot-red ‘57 Chevy Bel Air and a hot wife. He was a successful guy. But I went and watched his biggest show, which is called Country Dayz with a Z. It streams on Amazon Prime. It’s a staged reality show starring him and his friends. Here’s a clip from two minutes into the first episode. See what you think.
SAL: [Music] Hey everyone, I’m Sal, the CEO of Everything Country. You know the best part about owning your own business? You get to hire all your friends.
MIKE: Yeah, baby. I look good. Hey, what’s up, Sal?
SAL: What’s going on, Big Mike?
MIKE: Ah, nothing much, man. What are you up to?
SAL: Ah, nothing what are you doing?
MIKE: Ah, nothing. Hey, man, I gotta tell you something. I got a video. I got 100% proof the Earth is flat. [Music] You gotta take a look at this.
SAL: Okay, so, a little backstory on Mike. Mike is what they call a Flat Earther, and, well, they think the Earth is actually flat. I mean, like really? Dude, again with this? I’m telling you, it’s round.
MIKE: It ain’t round.
SAL: Mike.
MIKE: Just take a look.
SAL: No. I’m gonna lose five minutes of my life watching this again.
MIKE: You’ll probably gain five minutes.
SAL: Oh, dude, come on.
MIKE: I’m telling you. I promise you you will.
SAL: Copernicus, it’s round.
MIKE: Pocernicus is the guy that…that guy…
SAL: You can’t even say it.
MIKE: Whatever.
SAL: That guy is rolling over in his grave.
MIKE: He’s the guy who thinks it’s round. I’m the guy who knows it’s flat.
JACK: Okay, I have to stop there because they just keep going on and on like this for a long time, like way longer than they need to. But I played this clip for you to give you a sense of what Sal is like, and I think Sal is not only the star of the show but also the writer, the director, the producer, the editor. He did it all. [Music] I was curious, so I checked; turns out, nobody watches this show. If you go on IMDB, reality shows usually have like five, maybe ten thousand reviews. Country Dayz has eleven reviews. Nobody’s watching it. Sal’s personal IMDB page lists his other shows and movies. Some of them don’t even exist. There’s a few pictures of him in an action movie, except if you go on his Instagram, he admits that those pictures were just taken in a photoshoot that he paid for, which now I think about it, I admit I did that once, too. In high school I somehow faked my way into the picture with the football team. So, if you open up the yearbook that year, it looked like I made the football team, but I was never on the team.
So, who even is this Sal guy, though? Where is all this money coming from? If his shows don’t have any audiences, how has he got that big house and all the money to run a film studio? Well, here’s the truth; he always wanted to be an actor. He was in school plays and got on a Burt Reynolds show as an extra. He studied theatre in college, but it didn’t work out for him at all. But his dad, Sal Sr., is a prominent lawyer in Florida, and when Sal crashed out as an actor, Sal Sr. probably hooked him up with his next gig in a sheriff’s office as a deputy. Yeah, Sal became a cop. It was a huge setback for his dream, but Sal didn’t give up. He believed in himself and he hatched a new plan to rekindle his Hollywood dreams. I think it was here while working in the sheriff’s office that he noticed something which gave him an idea to make money to pursue his dreams again.
Years ago, if you wanted to get someone’s photo or know their daily routine or who they’re in a relationship with or get their phone number, stuff like that, you’d have to hire a private investigator who would tail the person and gather what they can. But today everyone is posting their own private data voluntarily online, especially social media. We see photos of people’s kids, their accomplishments, their vacation photos. We see them with their new lover or their new home renovation. Sometimes you just see people post their whole day on social media. We don’t need a private investigator to get information about where people are and what they’re doing and what they look like or any of that stuff anymore. It’s just all there on social media. So, there are companies that go on social media and scrape all that data to provide it to cops. Like, I remember a few years ago there was a whole controversy about a company called Clearview AI.
They were raiding major social media websites. They’d take Facebook, for example, grab every picture and bit of information they could off of everyone’s account and then add it to a file that was created about them. Then they’d repeat for Twitter and LinkedIn and wherever, automatically. Of course, the social media companies got mad. They were like, hey, that’s our data. You’re profiting off our data. Then they sent Clearview AI a cease and desist letter, but even those mega-corporations couldn’t stop it. If anything, Clearview is bigger today than they’ve ever been before. [Music] I just saw that they signed a $10 million-contract with ICE. So, keep that in mind. Your social media posts are likely scraped and processed through AI and are easily accessible by ICE agents even if you deleted your post. For the record, I don’t think this is right. The Fourth Amendment says we should have a reasonable expectation of privacy.
It says the government has to have a warrant to conduct a search, yet ICE is able to get tons of data about us without a warrant. The loophole they found is that they’re allowed to just buy data from data brokers. It’s the data broker loophole. The thing I hate most about this is we never gave them permission to exploit this loophole. We never voted on this. We never collectively agreed that data brokers are cool and it’s totally fine for the government to buy data from them and get around having to have a warrant to conduct a search. This was all decided without our input or support, and the government hides all this from us. They hide how much they pay data brokers to get information on us. I’m disgusted by how much the government spies on us without a warrant when it’s clearly a violation of the Fourth Amendment. The thing is, this business model is very profitable for data brokers.
They are incentivized to gather as much private data about us as they can, since the more they have, the more the government will spend on it. They are in the business of brokering your personal data, and I think Sal saw how important these data brokers are to law enforcement, and maybe he even caught a glimpse of how much the contract was with one of these. He might have been like, whoa, I’m in the wrong business. So, Sal quit his job as deputy and decided to start his own data broker service. He created three almost identical websites; Records Check, Criminal Screen, and the flagship site, National Public Data. He hired some cheap programmers in Bangladesh to code the initial website for him, then he started collecting everyone’s data. You can think of the data he collected in two buckets. There’s what the government publicly posts about us, such as bankruptcy filings, court records, motor vehicle records, death records. You’d be surprised how big this bucket is. You ever buy property? Yeah, you’re in a public database. You got married? Yep, that’s public data, too.
Registered to vote? In some states you are in a public database. Then there’s bucket two, the dirty work; scraping it, sneaking it, stealing it, buying it. I’m not sure what the rules are here, but it seems like data brokers treat rules more like guidelines than actual rules, because they’ll go to great lengths to get private data from people. Sal either bought or scraped data from other data brokers, subscription and marketing lists, loyalty and rewards programs, social media, and other apps. Some brokers even collected the data leaked by hackers like USDoD. Eventually Sal had collected not thousands, not hundreds of thousands, not millions, but hundreds of millions of Americans’ personal data records. Then he packaged it into individual profiles and sold access to law enforcement or whoever wanted to do people search, and it worked unbelievably well. In 2022, Sal made $750,000 from selling our data, and in 2023 he made $1.15 million. He almost instantly turned around and used the money to make his own TV shows. Here’s what he spent his money on.
MIKE: I’m telling you.
SAL: It’s round.
MIKE: It ain’t round.
SAL: Mike.
MIKE: Just take a look.
SAL: No!
MIKE: You ever watch those NASA videos? CGI, bro.
SAL: Oh, please, CGI. They’re sitting under — they’re flying over the Earth, you see the Earth below.
MIKE: Fake.
SAL: You see the aurora borealis.
MIKE: Fake.
SAL: You see it cruising around, whatever.
MIKE: Green screen.
SAL: Green screen?
MIKE: It’s all fake.
SAL: They green-screen the aurora borealis.
MIKE: They proved it on here.
SAL: Oh, come on.
MIKE: Would you just take a look at it?
SAL: No!
MIKE: Trust me on this.
SAL: I’m getting dumber by the minute.
JACK: I’m looking at Sal’s financial records now, and there’s something telling about the way he spent his money. The data broker company’s total cash in the bank is $563. Insurance expense; $1,327. Cybersecurity budget; zero. Salaries? Yeah, there were no salaries. He ran it all by himself with two desktops, a laptop, and file servers in his home office. To me, the way I see it, Sal’s data broker business was only set up for him to make as much money as possible, and didn’t spend a lot of effort protecting this data or securing it. [Music] So, now that you know what Sal was cooking up, let’s go back and focus on Luan, AKA, USDoD. By this point in 2023, Luan was trying to get his military intelligence business set up and needed a lot of military identities to impersonate to get more data, and decided to hunt around for vulnerable data brokers. He found Sal’s data broker site called Records Check. Records Check advertised instant background checks, social security number traces, and more.
Perfect. Luan was now laser-focused on this site, locked in, trying to look behind the curtain to see everything the site had on people. He used a tool to try to scour the site and see every file and image that was publicly viewable on this site, and one file stood out, members.zip. What is this file, and why is it just in the open for anyone to grab and look at? He grabbed it and looked at it. Members.zip had Sal’s site’s source code, and buried inside the code were admin credentials. Luan just got the e-mail and password to access any corner of this site and all the data in it. So, Luan logged in to Records Check as Sal, but then discovered the site was connected to two other sites, and guess what? Sal reused passwords, which allowed Luan to log in to National Public Data, which gave Luan access to the biggest set of data that Sal had. Luan took everything, 2.9 billion lines of data, 277 gigabytes worth, personal information about hundreds of millions of people. If you’re listening to this and you’re American, chances are you were likely in this database. Then Luan does what Luan does, and he posts it for sale online as USDoD with the cute, little kitty picture, and he put the data up for sale for $3.5 million. TikTok was outraged.
SPEAKER1: This is a public service announcement to remind you to check your credit files. I just received an alert from my credit card and also from my credit reporting agency about my data being leaked online.
SPEAKER2: 2.9 billion records, one of the largest data breaches in recent time. Why is this one important? Because you’re not a subscriber to this service. This is for running background checks and fraud prevention, and so, they just randomly collect data about billions of people without your consent.
SPEAKER3: We have to protect ourselves now. Although we’re going to have a lawsuit against NPD — they did not protect our data sufficiently — the problem is the data still got out into the public domain. The problem with the NPD data breach is that it is a scraping company that was designed to find out everything it can about you. Now, if they’re a data brokerage company that has other information about you, a hacker can start to put together an identity profile on you, and then with that identity profile, breach your security.
SPEAKER4: We all know that data breaches happen all the time, but the most recent one has been with National Public Data. It was over — three million people’s data was breached. That’s from the UK, US, and Canada.
JACK: [Music] At the beginning of this episode I told you about how that guy Matthew Kierans stole William Woods’ wallet, and later his identity, and all it took was for him to get William’s name, birthday, and social security number. From there, it was enough to impersonate William for decades. National Public Data leaked full names, birthdays, social security numbers, home addresses, past addresses, e-mail addresses, and phone numbers all in plain text. A lot of it had errors, but most of it was accurate. The ramifications of a data broker having a data breach is huge, catastrophic to some people listed in the breach. Researching this episode, I came across all kinds of horror stories of people who had their identities stolen after a data breach, like a bunch of people in Oakland, California.
After the city was attacked with ransomware, they interviewed one guy who was on the news, and he said that criminals had impersonated his identity and they were taking tens of thousands of dollars in loans out and making purchases in his name, and he was on the hook to pay it all back. So, you can imagine the huge nightmare that he had to try to convince the bank that he didn’t spend any of this money. That hardly compares to this other girl I read about. She was in Florida, and she tried to sign up for her first credit card when she went to college, but she got denied because they told her that she already owes $1.5 million, and she’s in huge debt. Apparently someone had been using her identity since she was nine years old. Another crazy story happened to an LA Times reporter after her wallet was stolen at a bar. She knew it was gone minutes after it happened, so she thought there was enough time to act before something bad happened, so she called the bank, she called the police, she called everyone, but it didn’t matter.
The thieves used her info from her wallet to get her social security number online, and for a whole year they opened dozens of credit cards in her name. They rented cars in her name, got new iPhones, and wrote tons of checks, sometimes more than $10,000. that’s just a couple of things criminals can do if they get your information. We’ve already talked on this show about SIM swaps. If a scammer knows enough about you, they can convince the phone company to transfer them your phone number. Then they can log into your bank account or crypto accounts and steal all your money. I read about multiple people who have lost millions of dollars this way. So, I’m sure the victims exposed in the National Public Data breach have faced a lot of similar nightmare scenarios, and despite victims being hit with this, they might not even have a clue that National Public Data is what leaked their data.
It’s really hard to know how a thief got your info, you know? The worst part is Sal isn’t going to be on the hook for any of the damage done to the victims, because how can you prove that the criminals got their data from this data breach when these criminals hide in the shadows of the internet and are seldom caught? [Music] This is one reason why I despise data brokers. They mistreat our private data and don’t care how negatively it impacts us. They’re incredibly greedy for our data, and then it gets abused in the worst way possible. This is why I’ve become a privacy freak over the course of making this show. I know these data brokers exist and are trying so hard to get my information, and I know there’s nothing I could do once they get it. I can’t opt out or ask them to delete me. Gah, I would love to send a cease and desist letter to Equifax and tell them, please delete all my data and stop spying on me. But, no.
I know it’s just a matter of time before criminals get their hands on my data either from a data breach or buying the data somehow. There’s no way to protect it. Since I know if someone gets my data, it can be catastrophic to my life, so that’s why I take extreme steps to hide from these data brokers, even so much as wearing a disguise when I go in public sometimes. In fact, many of you even have met me in disguise and only know what I look like in my disguise. It’s the only way that I feel like I can empower myself to stay safe in today’s internet age. I use fake personas, burner phones, burner e-mails, even burner credit cards, and I’m super secretive about my personal life when I go online. Anyway, gah, these episodes always get me ranting about privacy. Sorry, I know some of you don’t care about your privacy, so I’m gonna move on. But someday I hope to get through to you. I mean, I just want you to understand this one thing; most companies won’t protect your privacy even if they say they do.
They share it with data brokers and they’ll profit off of it, or they’ll just lose it in a data breach. The only one who can protect you is you. A couple months after this leak, he taunted CrowdStrike, a cybersecurity company, claiming he hacked into them and he got all their threat actor lists and their indicators of compromise, and he has it up for sale. Well, the thing is, CrowdStrike has some pretty impressive cybersecurity researchers and investigators, so they started looking to see who USDoD was, and they discovered he uses the same e-mail address for GitHub, all the blogs and social media accounts he has everywhere. It turned out that for years, Luan only used one e-mail for everything he did, hacking or non-hacking. So, CrowdStrike was able to figure out his name, address, phone number, tax registration ID, and more. Basically, Luan got doxxed, but privately, and CrowdStrike, law enforcement, some news outlets had his details.
Luan admitted to what he had done, and the dox were true, but he wasn’t done. I saw him tweet, ‘this is not my end’. Then he offered his services to the Brazilian government, but that didn’t go well. Now that law enforcement knew his name and location, the Brazilian police swarmed in on him and arrested him and took him to jail. [Music] Sal was doxxed, too, by reporters, but he just lawyered up and went silent. It didn’t go well for him. Congress wrote him a letter calling National Public Data’s lack of transparency staggering. Now he’s being sued for everything he’s got and then some. Multiple class-action lawsuits are against him by people who were in the data set. Unless Country Dayz takes off this year, he will not be able to pay off even a fraction of that. You would think after having a catastrophic incident like this Sal would just shut down National Public Data and maybe go back to acting or something, but if you visit nationalpublicdata.com, it’s still there.
The site’s still up, collecting our data and selling it. Sal tried to declare bankruptcy to wipe out his debt to society, but the judge just saw right through that and did not accept his bankruptcy plea. So, then Sal supposedly sold his data broker company to another company which is ironically called Perfect Privacy LLC. But you won’t find much about Perfect Privacy LLC online, but you’ll find plenty about yourself if you search your name on their website. The revamped National Public Data advertises that you could find pretty much anything you need from someone’s contact information, location, age, and birthday, to workplace, relatives, and criminal records. [Music] Which has to be the craziest thing about this whole story; like, a data broker can have a total breach and then continue operating scraping my data, storing it without my consent like nothing happened. So, what’s the solution here? I don’t think politicians are an ally here.
They aren’t going to enforce any kind of data privacy law since they’re the customer for many of these data brokers themselves. I mean, the government is who mandates that Equifax must be allowed to collect data off of all US citizens without their consent. Even if the government wasn’t using data brokers, they’d claim that they need our data for national security reasons. So, I think they are no help here. But then I was caught off guard when I read that 85% of the members of Congress were also included in the National Public Data breach, and a lot of them seemed pretty upset about this breach and wanted to do something about it. So, in April 2024, they did. Weeks after Luan put the 2.9 billion records up for sale, Congress and the Senate proposed a nationwide privacy law called The American Privacy Rights Act. It listed protections Americans should have, but also had a rule where anybody could file a form with the government to prevent data brokers from collecting their information.
That is, submit a single form, and all the American data brokers would have to delete your information if you want to opt out. Democrats and Republicans like this bill. It went up for a vote. But then the day before they voted on it, it was sabotaged. Lobbyists came in and put pressure on politicians, who then started watering down the bill until most of the useful privacy protections were gone. After that, the whole thing died. So, The American Privacy Rights Act never got off the ground. This is what I mean; no one is going to save you. No one is gonna protect your privacy. You have to do it. [Music] Lucky for you, there are easy steps that you can take to protect it. I mean, just thinking right off the bat, stop using text messages. Those things historically have been insecure, and they typically aren’t end-to-end encrypted, and they could be monitored by phone companies. So, a chat app like Signal takes extreme steps to never be able to see chats.
Even if someone pointed a gun to their head, they would not be able to read your messages. The same goes for end-to-end encrypted e-mail providers like Proton or Tuta. They cannot see what’s in your e-mails. Compare that to something like Google, who looks through all your e-mails to provide ads for you. I also highly recommend a web browser that cares about your privacy. Google Chrome is the worst on the list. Every character you type into the address bar gets key-logged and sent to Google. They want to know everything about you. So, I use the Brave browser, which makes enormous effort to not collect anything from me. So, those are three quick and easy wins; use Signal, use an end-to-end encrypted e-mail provider, and use a privacy-focused browser, because it’s not just about stopping Sal or Luan from grabbing at your data and exposing you.
You want to future-proof yourself from tyrannical regimes that are also trying to hoard your data. You might be okay with who’s in charge now in the world, but that’s gonna change one day, and whoever inherits your data next might decide that you’re a criminal. Then it’s too late for you to do something about your privacy. In the end, Luan, AKA USDoD, is still in a jail in Brazil. Since Brazil doesn’t extradite their citizens to the US, he’ll probably just serve his jail time in Brazil and is likely never gonna go to the US. One newspaper speculated that he’s facing about four years in prison, but we don’t quite know what his prison sentence was.
(Outro): [Outro music] Are you a premium subscriber of Darknet Diaries? If not, why not? Listen, I’m certain that you’ve bought a book or paid to go see a movie before you knew if that book or movie was any good. I don’t want to do that to you. I want to give you the show for free in order to prove its value to you and show you that I’m worth pitching a few bucks at. Have I done that? Does this show bring you value? Do you learn from it? Do you get entertained? Does it help you get through a long car ride without being too bored? If so, I want to ask you to become a premium subscriber to show your thanks. Hey, if you do, you’ll get ad-free episodes and bonus episodes. There’s actually twelve episodes in the premium feed that don’t exist anywhere else.
So, please consider signing up. Go to plus.darknetdiaries.com. I really appreciate it. This show is made by me, the pasta pwner, Jack Rhysider. This episode was written by the DDoS attack dog, Nate Nelson, sound design by the VHS vandal, Garrett Tiedemann, and this episode was assembled by the cruise controller, Tristan Ledger, mixing by Proximity Sound, and our theme music is by the mysterious Breakmaster Cylinder. My data has been in many data breaches, and once a hacker messaged me saying, I have everything, bro. I have your name, your password. I’m like, no way. Oh my god, thank you, I’ve been looking for that password for years. This is Darknet Diaries.