WEBVTT 00:00:00.290 --> 00:00:02.850 JACK: In my early twenties, I worked in a nightclub. 00:00:02.850 --> 00:00:05.790 I wasn’t doing anything special; just washing dishes and stuff. 00:00:05.790 --> 00:00:10.140 But one day I overheard something that I still remember today. 00:00:10.140 --> 00:00:14.580 One of the servers was taking a customer’s drink order and for some reason I heard the 00:00:14.580 --> 00:00:15.580 order. 00:00:15.580 --> 00:00:20.720 It was standard cocktail for some reason I knew this drink cost $4.00. 00:00:20.720 --> 00:00:24.789 When the server came back with the drink, the customer pulled out his cash and asks, 00:00:24.789 --> 00:00:25.920 how much is it? 00:00:25.920 --> 00:00:29.259 The server told him it was $5.00. 00:00:29.259 --> 00:00:32.579 She was scamming customers who paid in cash. 00:00:32.579 --> 00:00:38.270 She would pocket the $1.00 extra and claim it was a tip, and then give $4.00 to the bartender 00:00:38.270 --> 00:00:39.309 to ring it up. 00:00:39.309 --> 00:00:40.450 Clever stuff. 00:00:40.450 --> 00:00:43.989 I was even a little mad I didn’t think about it even though I didn’t have to deal with 00:00:43.989 --> 00:00:48.059 money at all, but still, I loved trying to figure out ways to exploit the system in my 00:00:48.059 --> 00:00:49.350 early twenties. 00:00:49.350 --> 00:00:52.360 But whatever; I was now in this new awkward position. 00:00:52.360 --> 00:00:56.149 Do I tell management about this? 00:00:56.149 --> 00:00:57.710 I get anxiety about stuff like this. 00:00:57.710 --> 00:01:02.030 She might lose her job because of me or maybe even get arrested because of me. 00:01:02.030 --> 00:01:06.510 I know some of you are saying no, no, no, it was her actions that caused her to lose 00:01:06.510 --> 00:01:07.590 her job. 00:01:07.590 --> 00:01:12.840 But still, do you understand that feeling I’m talking about where if you say something, 00:01:12.840 --> 00:01:16.340 it can have life-changing results for someone else? 00:01:16.340 --> 00:01:21.850 I didn’t say anything but the nightclub figured it out anyway and she ended up getting 00:01:21.850 --> 00:01:22.850 fired. 00:01:22.850 --> 00:01:24.320 This is a form of insider threat. 00:01:24.320 --> 00:01:27.240 She was in a position that she was taking advantage of. 00:01:27.240 --> 00:01:32.060 Insider threats are people who are hired by a company and then those people exploit the 00:01:32.060 --> 00:01:35.760 company that they’re working for for some kind of extra gain. 00:01:35.760 --> 00:01:41.390 Over 50% of companies claim to be victims of insider threats but what does this look 00:01:41.390 --> 00:01:43.740 like in the hacker world? 00:01:43.740 --> 00:01:51.770 (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. 00:01:51.770 --> 00:01:56.869 I’m Jack Rhysider. 00:01:56.869 --> 00:02:00.189 This is Darknet Diaries. 00:02:00.189 --> 00:02:06.829 [INTRO MUSIC ENDS] 00:02:06.829 --> 00:02:19.650 JACK: Okay, so, do you want to talk to me about probably the worst time of your life? 00:02:19.650 --> 00:02:21.990 You ready to relive this moment? 00:02:21.990 --> 00:02:23.970 G.EXODUS: Yeah. 00:02:23.970 --> 00:02:25.070 We can relive it. 00:02:25.070 --> 00:02:26.569 Let’s do this. 00:02:26.569 --> 00:02:27.569 JACK: Okay. 00:02:27.569 --> 00:02:29.690 Let’s start with what’s your name? 00:02:29.690 --> 00:02:31.340 G.EXODUS: My name is Ghost Exodus. 00:02:31.340 --> 00:02:33.069 JACK: Ghost Exodus. 00:02:33.069 --> 00:02:34.730 I like the sound of that. 00:02:34.730 --> 00:02:37.520 It actually does sound like a cool hacker name, doesn’t it? 00:02:37.520 --> 00:02:42.940 But to understand Ghost Exodus, I think it’s important to go back to a time; a time where 00:02:42.940 --> 00:02:46.909 we’re all waking up, looking around, looking for answers about life. 00:02:46.909 --> 00:02:49.599 G.EXODUS: I was nineteen just turning twenty. 00:02:49.599 --> 00:02:55.120 JACK: The year was 2004 and what Ghost Exodus is about to do is gonna drastically change 00:02:55.120 --> 00:02:56.120 his life. 00:02:56.120 --> 00:02:59.750 G.EXODUS: Well, I mean, the circumstances involved in my life might surprise you because 00:02:59.750 --> 00:03:03.190 I’ve never talked about them to anyone before on the internet. 00:03:03.190 --> 00:03:06.530 JACK: But let’s talk about what he’s doing just before this big change. 00:03:06.530 --> 00:03:10.500 G.EXODUS: Prior to that, I was a classical concert pianist. 00:03:10.500 --> 00:03:15.349 [PIANO PLAYING WITH MUSIC] Music was pretty much the center-focus to my life. 00:03:15.349 --> 00:03:19.440 JACK: He’s actually really good at piano and what you’re hearing right now is actually 00:03:19.440 --> 00:03:21.340 him playing. 00:03:21.340 --> 00:03:26.659 Not only that but he’s also really good at violin. 00:03:26.659 --> 00:03:28.330 Check this out. 00:03:28.330 --> 00:03:37.700 [VIOLIN PLAYING] When he was two years old, his mom and dad split up. 00:03:37.700 --> 00:03:41.120 She went to live in another state and gave full custody to his dad. 00:03:41.120 --> 00:03:45.659 His dad had other problems and a tough time raising a kid on his own. 00:03:45.659 --> 00:03:52.450 By the time Ghost Exodus was ten years old, he was adopted by the family next door. 00:03:52.450 --> 00:03:56.019 His mom would send him photos and letters sometimes but he would only be able to see 00:03:56.019 --> 00:03:59.209 them during psychological counseling sessions. 00:03:59.209 --> 00:04:07.120 Eventually, his real mom stopped sending letters and he lost contact with her. 00:04:07.120 --> 00:04:11.340 When he was a teenager, he hired a private detective to try to find his biological [00:05:00] 00:04:11.340 --> 00:04:12.340 mother. 00:04:12.340 --> 00:04:13.340 She was living in Texas. 00:04:13.340 --> 00:04:15.500 He went to see her; they reunited. 00:04:15.500 --> 00:04:19.540 He got to meet his biological brothers and sisters for the first time at nineteen years 00:04:19.540 --> 00:04:20.540 old. 00:04:20.540 --> 00:04:24.970 He decided this was the family he wanted to live with, so he moved in with his biological 00:04:24.970 --> 00:04:28.600 mother to rebuild his long-lost family. 00:04:28.600 --> 00:04:36.139 G.EXODUS: [MUSIC] My mother was a pastor married to a pastor and because of my music abilities, 00:04:36.139 --> 00:04:39.590 I became the music director for my family’s church. 00:04:39.590 --> 00:04:41.990 JACK: It makes sense, right? 00:04:41.990 --> 00:04:46.289 He wanted to be part of this family and he can, by playing music in the church that they’re 00:04:46.289 --> 00:04:48.289 involved with. Okay. 00:04:48.289 --> 00:04:53.860 G.EXODUS: But the extent of it was just so extreme that, I don’t know, I just felt 00:04:53.860 --> 00:04:57.630 choked, like all creativity was just being bled from me. 00:04:57.630 --> 00:05:02.889 JACK: The church was very strict and rigid and demanding of Ghost Exodus. 00:05:02.889 --> 00:05:05.110 He started wondering if this was a cult, even. 00:05:05.110 --> 00:05:09.390 G.EXODUS: It was led by a megalomaniac. 00:05:09.390 --> 00:05:13.370 My life was very micromanaged at the time. 00:05:13.370 --> 00:05:15.570 JACK: What the heck kind of recipe is this? 00:05:15.570 --> 00:05:20.380 A twenty-year-old looking for answers in life hires a private eye to find his birth mother, 00:05:20.380 --> 00:05:24.560 meets his brothers and sisters for the first time, moves in with them, gets inducted into 00:05:24.560 --> 00:05:29.789 a super-strict church, and is not happy with how his life is being micromanaged. 00:05:29.789 --> 00:05:35.270 G.EXODUS: From 2004 to 2008 is when I was involved with this ministry. 00:05:35.270 --> 00:05:38.650 But in 2008, I finally got myself excommunicated. 00:05:38.650 --> 00:05:44.490 That’s when I just, I don’t know, I just let loose. 00:05:44.490 --> 00:05:48.910 [MUSIC] I became this eccentric loose cannon. 00:05:48.910 --> 00:05:56.100 JACK: During this time, Ghost Exodus also had an interest in computers; playing video 00:05:56.100 --> 00:05:58.470 games and downloading pirated software. 00:05:58.470 --> 00:06:03.240 But he was also seeing what hacktivists like Anonymous were doing at the time, raising 00:06:03.240 --> 00:06:06.080 awareness for injustices in the world. 00:06:06.080 --> 00:06:11.259 This interested him so he gravitated towards where this kind of stuff was taking place 00:06:11.259 --> 00:06:12.259 online. 00:06:12.259 --> 00:06:19.090 G.EXODUS: There was a lot of injustice that really affected me by this type of ministry. 00:06:19.090 --> 00:06:25.950 Growing up in the rough neighborhoods that I grew up in, I saw this need to use hacking 00:06:25.950 --> 00:06:31.710 as the means to help people who didn’t have a voice and to help people who didn’t have 00:06:31.710 --> 00:06:34.840 the technical capabilities to defend themselves. 00:06:34.840 --> 00:06:41.150 This was during a time when cyber-bullying was this type of – it’s like an epidemic. 00:06:41.150 --> 00:06:48.930 There were no real, viable means to help people who were experiencing cyber-bullying. 00:06:48.930 --> 00:06:55.400 Schools were not up to – did not have a policy that knew how to deal with this. 00:06:55.400 --> 00:07:02.770 Law enforcement neither had any type of platforms where they could reach out and help people 00:07:02.770 --> 00:07:06.129 who were being affected by cyber-bullying. 00:07:06.129 --> 00:07:12.520 In my own life, my life being dominated and being controlled, being constantly subjected 00:07:12.520 --> 00:07:20.270 to ridicule and injustice, I just took my experience and then tried to find some type 00:07:20.270 --> 00:07:21.870 of solace by helping others. 00:07:21.870 --> 00:07:24.520 JACK: Everyone has their own soft spot for something. 00:07:24.520 --> 00:07:28.870 You know it’s your soft spot when you see someone or something suffer and it just tears 00:07:28.870 --> 00:07:30.280 you up inside. 00:07:30.280 --> 00:07:32.120 You can’t stop thinking about it. 00:07:32.120 --> 00:07:37.810 Ghost Exodus didn’t like seeing people getting bullied online because the results are horrible; 00:07:37.810 --> 00:07:42.449 like, a naïve kid might make a YouTube video and speak his mind about something, but he 00:07:42.449 --> 00:07:46.729 looks a little funny or talks a little funny and he gets mocked and made fun of. 00:07:46.729 --> 00:07:50.280 Somebody from the internet decides to get his real name and phone number and try to 00:07:50.280 --> 00:07:54.720 call him and mock him more, and maybe even call his parents and mock them. 00:07:54.720 --> 00:08:00.599 This kind of thing can easily result in years of depression all because you made one stupid 00:08:00.599 --> 00:08:02.630 video on YouTube. 00:08:02.630 --> 00:08:07.120 Ghost Exodus hated to see when the internet trolls would dogpile on someone and ruin that 00:08:07.120 --> 00:08:10.080 person’s life, so he wanted to do something about it. 00:08:10.080 --> 00:08:13.900 G.EXODUS: I originally was a member of the Insane Masterminds Crew. 00:08:13.900 --> 00:08:19.470 I had always been a lone wolf my whole life and I really didn’t want recognition. 00:08:19.470 --> 00:08:24.110 I didn’t want to join my peers doing any type of activities. 00:08:24.110 --> 00:08:28.840 I was completely content hacking on my own and learning on my own. 00:08:28.840 --> 00:08:35.360 But I had bought some books and I realized how much more I could learn if I had joined 00:08:35.360 --> 00:08:39.330 a crew. 00:08:39.330 --> 00:08:45.860 I found the Insane Masterminds Crew and they had recruited me. 00:08:45.860 --> 00:08:55.279 I enjoyed this great camaraderie and I was able to expedite or greatly and vastly learn 00:08:55.279 --> 00:08:59.740 more in a group setting. 00:08:59.740 --> 00:09:03.960 From there, I was like well, if I could be a member of this really cool-ass group, why 00:09:03.960 --> 00:09:09.980 don’t I start a group of my own that is fueled with my own ideals? 00:09:09.980 --> 00:09:14.240 [00:10:00] I could recreate it in my own way. 00:09:14.240 --> 00:09:16.950 JACK: Ghost Exodus became better at hacking. 00:09:16.950 --> 00:09:21.140 He learned a lot from this crew, so much that he was able to start his own hacking group, 00:09:21.140 --> 00:09:22.150 and he named it ETA. 00:09:22.150 --> 00:09:25.720 G.EXODUS: [MUSIC] The Electronik Tribulation Army. 00:09:25.720 --> 00:09:30.300 Social injustice was the forefront but that was like our buckler and sword. 00:09:30.300 --> 00:09:31.430 This is really legitimate. 00:09:31.430 --> 00:09:34.500 I’m not trying to sell myself here. 00:09:34.500 --> 00:09:40.529 We became vigilantes and that’s what I saw myself as, as some type of social justice 00:09:40.529 --> 00:09:47.430 mechanism to try to reach out and find people who were being affected ‘cause it was so 00:09:47.430 --> 00:09:53.370 easy to try to rectify what they were going through. 00:09:53.370 --> 00:09:58.180 Then try to empower them by teaching them ways to defend themselves. 00:09:58.180 --> 00:10:06.820 I don’t know, it started really small with just us doing stupid shit like learning SQL 00:10:06.820 --> 00:10:10.300 injections and cross-site scripting and phishing. 00:10:10.300 --> 00:10:13.740 We didn’t really have any type of modus operandi. 00:10:13.740 --> 00:10:18.620 We were doing these things for the sheer exploration of it. 00:10:18.620 --> 00:10:23.700 I come from a generation where hacking wasn’t to make a name for yourself. 00:10:23.700 --> 00:10:27.790 That was kind of the direction I was taking the group. 00:10:27.790 --> 00:10:32.260 We did things for the sheer curiosity of it. 00:10:32.260 --> 00:10:39.910 The internet was like, this great nexus of infinite puzzles and that’s what kept me 00:10:39.910 --> 00:10:48.329 going, is that every single nexus in this great, vast network called the internet was 00:10:48.329 --> 00:10:52.300 like this great, amazing puzzle. 00:10:52.300 --> 00:11:04.139 I’m always really drawn to puzzles so hacking for curiosity is where I started and that’s 00:11:04.139 --> 00:11:07.370 where the ETA originated with. 00:11:07.370 --> 00:11:12.399 I kind of took the vestiges of my generation and brought it with me. 00:11:12.399 --> 00:11:20.210 But as we became more sophisticated and we started bringing in these crazy Jedi hackers, 00:11:20.210 --> 00:11:23.520 we’ve seen that we could do more. 00:11:23.520 --> 00:11:30.839 We started evolving into hacktivism and then hacktivism took us into cyber-vigilantism 00:11:30.839 --> 00:11:37.209 and then that just took us into some really dark places where I started to kind of lose 00:11:37.209 --> 00:11:39.210 control of myself. 00:11:39.210 --> 00:11:46.110 We kind of lost sight of what we had originally wanted to accomplish in those original stages. 00:11:46.110 --> 00:11:50.750 JACK: Like many hacktivist groups, ETA grew and gained momentum. 00:11:50.750 --> 00:11:55.000 But the members of the group were getting sloppy, cocky, or trying to outdo each other. 00:11:55.000 --> 00:11:59.450 There was this sort of tick-tock swing that became unsustainable. 00:11:59.450 --> 00:12:01.450 G.EXODUS: We just lost control. 00:12:01.450 --> 00:12:05.010 I mean, I lost control, let’s just be honest. 00:12:05.010 --> 00:12:07.240 I was probably the one who lost control. 00:12:07.240 --> 00:12:10.639 JACK: Yeah? How so? 00:12:10.639 --> 00:12:15.209 G.EXODUS: It started really getting to my head and it started to take control of my 00:12:15.209 --> 00:12:17.310 life. 00:12:17.310 --> 00:12:22.790 This megalomaniac church cult took everything from me. 00:12:22.790 --> 00:12:29.670 It left me with a self-esteem that was completely broken and hacking was a way to rebuild myself. 00:12:29.670 --> 00:12:37.389 But in so doing, I became this narcissist, this ego-driven maniac. 00:12:37.389 --> 00:12:40.240 I just became this pathological hacker. 00:12:40.240 --> 00:12:42.810 The more I did it, the more I boasted of it. 00:12:42.810 --> 00:12:49.560 I lost control of who I was until I didn’t have an offline life anymore. 00:12:49.560 --> 00:12:50.970 At the time, I was married. 00:12:50.970 --> 00:12:53.350 I had just had a kid. 00:12:53.350 --> 00:12:55.510 I didn’t know how to stop. 00:12:55.510 --> 00:12:59.360 By 2009, I really realized I had a problem. 00:12:59.360 --> 00:13:04.649 JACK: He started playing around with botnets which simply defined, a botnet is a large 00:13:04.649 --> 00:13:09.459 group of computers that you control but you don’t own, so you really don’t have permission 00:13:09.459 --> 00:13:10.459 to control them. 00:13:10.459 --> 00:13:14.810 G.EXODUS: [MUSIC] When I had seen what they could do, I don’t know, my mind was blown. 00:13:14.810 --> 00:13:17.769 They’re so versatile. 00:13:17.769 --> 00:13:23.089 You can use them for good purposes, you can use them for bad purposes. 00:13:23.089 --> 00:13:27.050 You can sell them, you can lease them, you can rent them. 00:13:27.050 --> 00:13:34.610 I mean, they superseded anything that we were doing like keylogging, host-booters, denial-of-service. 00:13:34.610 --> 00:13:44.760 I had seen the potential for using them as this badass freaking weapon that can pretty 00:13:44.760 --> 00:13:46.490 much – you can do anything. 00:13:46.490 --> 00:13:50.070 You can use it to leverage other people. 00:13:50.070 --> 00:13:55.170 It’s just too much power in the hands of – in my hands. 00:13:55.170 --> 00:13:56.170 Yeah. 00:13:56.170 --> 00:14:01.389 JACK: Now, the story goes, another guy name Isaac starts messing with Ghost Exodus at 00:14:01.389 --> 00:14:05.670 this time, doing things like doxing Ghost and calling the cops on him, stuff like that. 00:14:05.670 --> 00:14:10.089 But not just that; Isaac was targeting other members of ETA, too, like finding out where 00:14:10.089 --> 00:14:13.220 one of them lived [00:15:00] and going and vandalizing his house. 00:14:13.220 --> 00:14:16.770 Isaac’s motives aren’t clear to me and I tried to message him but he never messaged 00:14:16.770 --> 00:14:17.770 me back. 00:14:17.770 --> 00:14:21.330 I’ve watched some of his streams and videos online and he does things that just don’t 00:14:21.330 --> 00:14:22.330 make sense to anyone. 00:14:22.330 --> 00:14:25.980 Like, he makes cringy internet prankster videos. 00:14:25.980 --> 00:14:29.170 It wasn’t just Isaac who was doing this; there were a few other people working with 00:14:29.170 --> 00:14:30.630 Isaac to do this, too. 00:14:30.630 --> 00:14:35.980 My guess is that they were just trying to cause chaos, maybe take over ETA or dissolve 00:14:35.980 --> 00:14:39.920 it somehow, or just flex in some weird internet way. 00:14:39.920 --> 00:14:44.750 I don’t know, but when Isaac was doxing and calling the cops on Ghost Exodus, this 00:14:44.750 --> 00:14:46.250 was really freaking him out. 00:14:46.250 --> 00:14:51.740 G.EXODUS: When these things started to escalate, I really started to panic. 00:14:51.740 --> 00:14:59.250 I made the decision to risk everything and make a complaint with the Internet Crime and 00:14:59.250 --> 00:15:07.310 Complaint Center, hoping that they might involve themselves and try to put an end to what Isaac 00:15:07.310 --> 00:15:09.079 was doing. 00:15:09.079 --> 00:15:13.450 But they never followed through with it and because at this time I had a thirteen-month 00:15:13.450 --> 00:15:22.310 old child and my wife at the time, she was stressing, I didn’t know how to stop this. 00:15:22.310 --> 00:15:28.350 What led to my crime was – my crime, in a nutshell, was my taking this circumstance 00:15:28.350 --> 00:15:32.779 into my own hands, taking the law into my own hands. 00:15:32.779 --> 00:15:40.529 What I thought of doing was infecting as many computers as possible in order to launch this 00:15:40.529 --> 00:15:46.600 botnet attack against some of the websites that these guys were using as a platform to 00:15:46.600 --> 00:15:52.529 communicate, to collaborate, as a means to send a message to try to show them hey, back 00:15:52.529 --> 00:15:53.529 off. 00:15:53.529 --> 00:15:57.160 JACK: Now, at the time, Ghost Exodus was working as an overnight security guard in the Carrell 00:15:57.160 --> 00:15:59.019 Clinic in Dallas, Texas. 00:15:59.019 --> 00:16:00.019 This place is huge. 00:16:00.019 --> 00:16:04.190 It looks like a hospital; it has six stories and it’s a big building. 00:16:04.190 --> 00:16:08.290 But it closes down at night, so there’s no patients in the building overnight or anyone 00:16:08.290 --> 00:16:09.860 except security. 00:16:09.860 --> 00:16:13.790 This is a clinic that treats spine, shoulder, knee, and ankle injuries. 00:16:13.790 --> 00:16:17.120 Ghost Exodus was the night security guard for this building. 00:16:17.120 --> 00:16:20.990 [MUSIC] He would walk the grounds and make sure the doors are locked and no vandalism 00:16:20.990 --> 00:16:22.440 was occurring. 00:16:22.440 --> 00:16:26.300 He would often sit in the front lobby of the building where he could watch the security 00:16:26.300 --> 00:16:28.380 cameras for the entire clinic. 00:16:28.380 --> 00:16:34.851 G.EXODUS: Now, where I worked in the foyer, in the entrance at the Carrell Clinic, they 00:16:34.851 --> 00:16:38.960 had a wireless access point that was really, really weak. 00:16:38.960 --> 00:16:41.600 At nighttime, that was the time when I did my studying. 00:16:41.600 --> 00:16:50.940 That’s when I did my hacking, and that’s the time I used to really direct my crew. 00:16:50.940 --> 00:16:54.040 But the access point was so weak, it would always drop my connections. 00:16:54.040 --> 00:16:58.779 JACK: So, he started hunting and poking in the network, looking for a computer that had 00:16:58.779 --> 00:17:00.519 a more reliable internet connection. 00:17:00.519 --> 00:17:04.299 G.EXODUS: I ended up finding this computer which turned out to be a server. 00:17:04.299 --> 00:17:09.160 JACK: This server he got access to controlled the heating, ventilation, and cooling for 00:17:09.160 --> 00:17:10.289 the whole building. 00:17:10.289 --> 00:17:18.530 G.EXODUS: It ran the SCADA software used to control the heating, ventilating, and air 00:17:18.530 --> 00:17:21.470 conditioning system for the Carrell Clinic. 00:17:21.470 --> 00:17:27.620 But the idea was, I’m gonna use this computer, I’m gonna install LogMeIn so I can access 00:17:27.620 --> 00:17:31.980 it remotely from my laptop at my guard station. 00:17:31.980 --> 00:17:39.129 But the firewall was blocking the incoming connection and instead of reconfiguring LogMeIn 00:17:39.129 --> 00:17:44.270 – excuse me, reconfiguring TeamViewer, I decided to use the browser-based LogMeIn. 00:17:44.270 --> 00:17:49.940 JACK: With that, he was able to establish a persistent remote connection to this HVAC 00:17:49.940 --> 00:17:50.940 server. 00:17:50.940 --> 00:17:59.169 G.EXODUS: Basically, I used it for chatting on AOL Instant Messenger, using it for MySpace, 00:17:59.169 --> 00:18:03.409 and I used it to buy card magnets off of Vistaprint. 00:18:03.409 --> 00:18:08.409 JACK: Definitely against the rules of what he should be doing as a security guard. 00:18:08.409 --> 00:18:12.080 But I’m not sure if it’s against the law. 00:18:12.080 --> 00:18:17.490 Now, sitting there in a large medical clinic all night long, he started to realize how 00:18:17.490 --> 00:18:19.929 many computers are in this building. 00:18:19.929 --> 00:18:24.230 At the same time, he’s fascinated with botnets and is trying to build one himself, [MUSIC] 00:18:24.230 --> 00:18:30.340 so he gets the idea to try to get some of the computers in this clinic to join his botnet. 00:18:30.340 --> 00:18:35.260 All he would need to do is execute one tiny program on that computer and this would make 00:18:35.260 --> 00:18:36.810 it join his botnet. 00:18:36.810 --> 00:18:41.820 So, during his night patrol, he would wander the halls and look for potential computers 00:18:41.820 --> 00:18:43.630 he could exploit. 00:18:43.630 --> 00:18:47.510 But each computer he came across was locked, password protected. 00:18:47.510 --> 00:18:51.230 Unless you were a nurse or a doctor, you would not be able to unlock it. 00:18:51.230 --> 00:18:57.250 He looked up how he could get into a locked computer and found a tool called Ophcrack. 00:18:57.250 --> 00:19:00.600 See, Windows stores your password as a hash. 00:19:00.600 --> 00:19:04.610 Windows creates the hash when you set the password by running it through a special algorithm. 00:19:04.610 --> 00:19:08.690 But a hash only works in one direction; you can’t take a hash and convert it back to 00:19:08.690 --> 00:19:09.690 a password. 00:19:09.690 --> 00:19:13.250 So, whenever you enter [00:20:00] your password, Windows runs it through that same hashing 00:19:13.250 --> 00:19:17.710 algorithm and if the resulting hash matches that hash from when you created the password, 00:19:17.710 --> 00:19:20.289 then Windows knows you entered a matching password. 00:19:20.289 --> 00:19:26.900 Ophcrack looks at the hashes stored in Windows and tries to find a password that matches 00:19:26.900 --> 00:19:27.930 that hash. 00:19:27.930 --> 00:19:32.740 It’s sort of a brute-force password-cracking method because it’s gonna look at millions 00:19:32.740 --> 00:19:36.480 of hashes to try to find one that matches the one in Windows. 00:19:36.480 --> 00:19:40.309 Basically, Ophcrack is a way to find passwords for Windows computers. 00:19:40.309 --> 00:19:45.120 But what’s more is that you could put an Ophcrack CD in a computer and boot to it and 00:19:45.120 --> 00:19:50.220 it’ll try to search through the hashes in Windows to find a matching password to it. 00:19:50.220 --> 00:19:55.860 Ghost Exodus loaded Ophcrack on a CD and his botnet on a USB drive and he made his rounds 00:19:55.860 --> 00:19:59.300 through the clinic, looking for a computer to sit down and use. 00:19:59.300 --> 00:20:03.500 He would put the Ophcrack CD in the tray, reboot the computer, wait for Ophcrack to 00:20:03.500 --> 00:20:07.990 find a password, then he’d write that password down, take the CD out, reboot the computer, 00:20:07.990 --> 00:20:10.450 and now he has the password to log in with. 00:20:10.450 --> 00:20:15.730 Once he’s in, he’d popped the USB drive into the computer and run the malware to join 00:20:15.730 --> 00:20:16.880 this computer to his botnet. 00:20:16.880 --> 00:20:22.559 From there, he’d take the USB drive out, lock the computer, and walk away. 00:20:22.559 --> 00:20:24.840 He did it. It worked. 00:20:24.840 --> 00:20:29.640 He had a new node on his botnet so he went and did it again. 00:20:29.640 --> 00:20:34.440 But while he was doing it again, he realized this could be a good motivator for some of 00:20:34.440 --> 00:20:37.360 the other people in his hacking group to do this, too. 00:20:37.360 --> 00:20:43.210 He brought a little laptop with him to work, turned on the webcam for it, and made a video. 00:20:43.210 --> 00:20:44.870 G.EXODUS: Hey, what’s up, everybody? 00:20:44.870 --> 00:20:46.860 [JAMES BOND MUSIC] It’s Ghost Exodus. 00:20:46.860 --> 00:20:50.590 You’re on a mission with me; infiltration. 00:20:50.590 --> 00:20:55.169 JACK: His video has this James Bond music in it and he’s got a hoodie on. 00:20:55.169 --> 00:20:57.570 He’s walking around the building, looking over his shoulder, acting super suspicious, 00:20:57.570 --> 00:20:58.580 like a spy. 00:20:58.580 --> 00:21:02.020 G.EXODUS: What we gotta do is we gotta drop a botnet. 00:21:02.020 --> 00:21:04.820 Oh my gosh, what an audacious bastard. 00:21:04.820 --> 00:21:10.840 JACK: He’s claiming it’s an office he broke into but you and I know this was the 00:21:10.840 --> 00:21:13.240 clinic where he worked as a security guard. 00:21:13.240 --> 00:21:18.140 G.EXODUS: I actually purposely avoid that video because it makes me really embarrassed. 00:21:18.140 --> 00:21:25.951 It’s a propaganda video that was aimed at some of the younger generations, some of the 00:21:25.951 --> 00:21:29.730 younger hackers ‘cause they’re so easily impressionable. 00:21:29.730 --> 00:21:38.630 I was trying to make this video to inspire them to emulate the things that I was showing 00:21:38.630 --> 00:21:42.080 in the video, ‘cause I wanted them to spread our bots. 00:21:42.080 --> 00:21:47.460 JACK: He shows a key card that has the word ‘security’ written on it with a marker. 00:21:47.460 --> 00:21:53.130 G.EXODUS: I tell my viewers that this was a key card that I’ve swiped. 00:21:53.130 --> 00:21:56.270 In other words, I want them to believe that I stole it. 00:21:56.270 --> 00:21:58.330 JACK: He holds up a CD for the camera. 00:21:58.330 --> 00:22:03.760 It says Ophcrack on it and he holds up a USB drive which he says has the botnet on it. 00:22:03.760 --> 00:22:08.700 He goes up the elevator, walks the halls, uses his key card to get into places, finds 00:22:08.700 --> 00:22:10.450 a desk, and sits down. 00:22:10.450 --> 00:22:15.020 It’s actually a nurse’s station but the video just seems like it’s a typical office. 00:22:15.020 --> 00:22:19.900 He starts typing stuff on the keyboard but then he stops and puts on latex gloves. 00:22:19.900 --> 00:22:25.280 G.EXODUS: Yeah, you know, what’s funny is I already start touching the computer before 00:22:25.280 --> 00:22:28.460 I put on the gloves. 00:22:28.460 --> 00:22:30.340 All of that was just, yeah, tricks. 00:22:30.340 --> 00:22:35.799 JACK: He gets into the computer using Ophcrack, then plugs the USB stick into it and begins 00:22:35.799 --> 00:22:37.770 copying files over to the computer. 00:22:37.770 --> 00:22:40.179 You can see all this on the video. 00:22:40.179 --> 00:22:42.130 The botnet he was using was called Rxbot. 00:22:42.130 --> 00:22:46.900 It’s an open-source botnet made in C++ that anyone can just download and use. 00:22:46.900 --> 00:22:57.470 G.EXODUS: We had done our research of what antivirus software would detect the Rxbot. 00:22:57.470 --> 00:23:01.631 On some of these systems, you might actually – I don’t know if it’s in the video 00:23:01.631 --> 00:23:08.159 but they had McAfee Antivirus, so I was disabling it. 00:23:08.159 --> 00:23:13.580 JACK: He disabled the antivirus and ran the program to join this computer to the botnet. 00:23:13.580 --> 00:23:16.559 The script runs, then deletes itself. 00:23:16.559 --> 00:23:17.590 Job’s done. 00:23:17.590 --> 00:23:19.650 G.EXODUS: There it goes. 00:23:19.650 --> 00:23:20.679 It’s melted. 00:23:20.679 --> 00:23:22.740 That’s all I needed. 00:23:22.740 --> 00:23:27.370 JACK: Now, he was building this botnet so he could wage a denial-of-service attack on 00:23:27.370 --> 00:23:31.049 Isaac on July 4th which was about a month away. 00:23:31.049 --> 00:23:35.520 He released this video on YouTube to get other people to be inspired to do similar acts to 00:23:35.520 --> 00:23:36.980 build up his botnet. 00:23:36.980 --> 00:23:40.740 What is the reaction from people when you dropped this video? 00:23:40.740 --> 00:23:43.120 G.EXODUS: It was mixed. 00:23:43.120 --> 00:23:48.419 There were some who had the right mind to tell me, you know, Ghost, I don’t think 00:23:48.419 --> 00:23:49.419 this is a good idea. 00:23:49.419 --> 00:23:51.450 Ghost, I think this is gonna backfire. 00:23:51.450 --> 00:23:53.940 I’m like no, no, it’s not gonna backfire. 00:23:53.940 --> 00:23:56.440 I’ve never been caught, I’m never gonna get caught. 00:23:56.440 --> 00:23:59.010 I’m too careful. 00:23:59.010 --> 00:24:03.390 Then there was other people, those to who it was catered for. 00:24:03.390 --> 00:24:07.630 They’re just like oh, you’re such a badass, oh, you’re so cool. 00:24:07.630 --> 00:24:09.289 Where can we get this botnet? 00:24:09.289 --> 00:24:13.029 That’s what [00:25:00] drove me, is that type of reaction. 00:24:13.029 --> 00:24:16.669 I wanted it to be controversial. 00:24:16.669 --> 00:24:19.650 I didn’t want it to just always go my way. 00:24:19.650 --> 00:24:27.210 That was my objective, to be controversial and to really just create this persona of 00:24:27.210 --> 00:24:28.399 controversy. 00:24:28.399 --> 00:24:30.200 I certainly did that to a T. 00:24:30.200 --> 00:24:35.070 JACK: Ghost Exodus would eventually install this botnet on fourteen computers within the 00:24:35.070 --> 00:24:36.980 medical clinic. 00:24:36.980 --> 00:24:40.110 Then once they were installed, he would go back to the lobby where he would normally 00:24:40.110 --> 00:24:43.520 sit to do his job, and he would open up his tiny laptop. 00:24:43.520 --> 00:24:49.080 From the security desk, he would tell his botnet to attack, [MUSIC] flooding the target 00:24:49.080 --> 00:24:53.250 computer with so many packets that it would take the target offline. 00:24:53.250 --> 00:25:00.289 G.EXODUS: I tested out the bots, the botnet pool that we had accumulated back in June 00:25:00.289 --> 00:25:06.740 of 2009 during the Iranian presidential elections, OpIran. 00:25:06.740 --> 00:25:15.649 I used these bots in OpIran and in response to the death of Neda Agha-Soltan, that peaceful 00:25:15.649 --> 00:25:17.960 women’s rights protester who was murdered. 00:25:17.960 --> 00:25:24.000 It didn’t cause any significant damage to the systems. 00:25:24.000 --> 00:25:27.130 I had actually used the bot several times from there. 00:25:27.130 --> 00:25:34.250 But yeah, after we had – after I had installed them, yeah, we had tested them out. 00:25:34.250 --> 00:25:40.230 On several occasions, I attacked 94chan with them. 00:25:40.230 --> 00:25:43.140 But I especially used them, like I said, in OpIran. 00:25:43.140 --> 00:25:47.090 JACK: When he would have his botnet all put together and enter a target victim and hit 00:25:47.090 --> 00:25:51.179 launch and see his target go down, this was the feeling of winning. 00:25:51.179 --> 00:25:52.960 G.EXODUS: It’s euphoria. 00:25:52.960 --> 00:25:56.480 It’s like winning the lottery. 00:25:56.480 --> 00:26:00.580 Whatever chemicals are secreted by the brain whenever you’re gambling, that’s the same 00:26:00.580 --> 00:26:01.580 feeling. 00:26:01.580 --> 00:26:07.370 That’s the same chemical reaction that is going on in my mind that just keeps me pathologically 00:26:07.370 --> 00:26:09.480 doing it over and over and over. 00:26:09.480 --> 00:26:16.870 It’s this great gratification that’s like, if you’re not gratifying yourself in this 00:26:16.870 --> 00:26:20.340 fashion, then you’re not relevant, basically. 00:26:20.340 --> 00:26:27.250 I don’t know, it was a feeling of relevance, of the utmost relevance. 00:26:27.250 --> 00:26:34.730 JACK: I mean, you can’t be thinking that this is gonna play out right. 00:26:34.730 --> 00:26:45.980 G.EXODUS: You know, in some of my – I kept an online journal, okay, on vampirefreaks.com. 00:26:45.980 --> 00:26:52.289 This was a feeling I had on the forefront of my mind at the time, that I believe I’m 00:26:52.289 --> 00:26:53.650 going to be arrested. 00:26:53.650 --> 00:26:55.190 I knew that time was coming. 00:26:55.190 --> 00:27:00.299 JACK: After the break, we’ll find out if Ghost Exodus’ premonition comes true. 00:27:00.299 --> 00:27:05.490 At this point, Ghost Exodus was posting screenshots of this HVAC computer that he hacked into 00:27:05.490 --> 00:27:06.490 in the clinic. 00:27:06.490 --> 00:27:11.070 He didn’t say where this HVAC computer was that he accessed; he just wanted to flex a 00:27:11.070 --> 00:27:15.169 little and get some street cred that he hacked into a computer and this one happened to control 00:27:15.169 --> 00:27:16.840 the heating and cooling of a building. 00:27:16.840 --> 00:27:24.510 G.EXODUS: There was a new recruit in the ETA who went by the moniker Immortal. 00:27:24.510 --> 00:27:35.112 He had taken the screenshots of the HVAC SCADA software that I had taken and posted it on 00:27:35.112 --> 00:27:41.020 a security blog that was seen by Wesley McGrew. 00:27:41.020 --> 00:27:44.590 WESLEY: My name is Wesley McGrew. 00:27:44.590 --> 00:27:45.650 That was 2009. 00:27:45.650 --> 00:27:51.740 At that time, I was a research associate at Mississippi State University where I was working 00:27:51.740 --> 00:27:59.549 on a PhD dissertation [00:30:00] on control – industrial control systems and SCADA security. 00:27:59.549 --> 00:28:03.660 There was a tie-in with that and that’s partially how I got involved with it. 00:28:03.660 --> 00:28:08.269 JACK: Now, Wesley, being a smart student, had a blog where he was just writing stories 00:28:08.269 --> 00:28:09.500 about information security. 00:28:09.500 --> 00:28:11.080 WESLEY: Called mcgrewsecurity.com. 00:28:11.080 --> 00:28:16.049 JACK: Sometimes hackers would write to him and call out other hackers or brag about what 00:28:16.049 --> 00:28:19.610 they did, or just send him weird stuff to see if he would post it. 00:28:19.610 --> 00:28:26.240 WESLEY: Another member of the group, he went by the name Immortal, got in touch with me 00:28:26.240 --> 00:28:31.169 and was in touch with me for a good period of time apparently just to brag about different 00:28:31.169 --> 00:28:32.779 things to see if I would write about them. 00:28:32.779 --> 00:28:37.309 JACK: Immortal was claiming to be part of the Electronik Tribulation Army and was boasting 00:28:37.309 --> 00:28:40.640 about what he had done and wanted Wesley to write about it. 00:28:40.640 --> 00:28:42.700 I guess Immortal wanted to be famous. 00:28:42.700 --> 00:28:46.450 WESLEY: I was in touch with Immortal over a period of I don’t even know how long. 00:28:46.450 --> 00:28:49.740 He would message me various things. 00:28:49.740 --> 00:28:55.710 The most memorable one of which being – around about that time, there was a North Korean 00:28:55.710 --> 00:29:04.549 missile test and he had it in his head that he wanted to hack North Korea; this being 00:29:04.549 --> 00:29:08.330 very difficult due to their limited attack service. 00:29:08.330 --> 00:29:09.659 But he thought he’d done it. 00:29:09.659 --> 00:29:12.919 He thought he had found a target for his attacks. 00:29:12.919 --> 00:29:19.429 He showed it to me via MSN Messenger or AOL Instant Messenger or whatever it was at the 00:29:19.429 --> 00:29:20.429 time. 00:29:20.429 --> 00:29:23.340 I had to let him know that hey, this is a South Korean site. 00:29:23.340 --> 00:29:27.529 He didn’t know the difference between North and South Korea so that sort of sets the stage 00:29:27.529 --> 00:29:29.180 there for Immortal. 00:29:29.180 --> 00:29:36.640 Later on, and probably a few weeks after that, he was aware either from my site or from something 00:29:36.640 --> 00:29:42.200 that I had published that I was interested in industrial security systems and SCADA security. 00:29:42.200 --> 00:29:47.500 So, he sent me some screenshots of a system that he had claimed to have hacked. 00:29:47.500 --> 00:29:52.940 It was screenshots of an HVAC system at a hospital. 00:29:52.940 --> 00:29:58.250 JACK: Wesley was writing his PhD thesis on the security of industrial control systems 00:29:58.250 --> 00:30:00.720 so this really interested him. 00:30:00.720 --> 00:30:02.650 He began investigating it further. 00:30:02.650 --> 00:30:09.730 WESLEY: [MUSIC] At that point, all I had was a set of PNG or JPEG screenshots that he had 00:30:09.730 --> 00:30:13.159 sent me, static screenshots. 00:30:13.159 --> 00:30:20.620 What I saw in those was sort of a – the human-machine interface of this SCADA system 00:30:20.620 --> 00:30:28.630 showing operating rooms, showing the heating, ventilation, and air conditioning, chillers 00:30:28.630 --> 00:30:35.160 for medicines and medical equipment and implants and things like that, that sort of stuff. 00:30:35.160 --> 00:30:40.330 That piqued my interest right there and I wanted to find out more about it but not through 00:30:40.330 --> 00:30:41.940 talking to Immortal. 00:30:41.940 --> 00:30:49.200 I started doing image searches and open-source intelligence based off the pictures that I 00:30:49.200 --> 00:30:53.409 was seeing in these HMI screenshots. 00:30:53.409 --> 00:30:57.789 I was able to identify this being the Carrell Clinic. 00:30:57.789 --> 00:31:03.862 I’ve never physically been there but there are other facilities connected to it that 00:31:03.862 --> 00:31:06.289 used the same HVAC system. 00:31:06.289 --> 00:31:13.639 I was also able to find a forum post on a hacker forum where Ghost Exodus had posted 00:31:13.639 --> 00:31:16.070 these screenshots saying that he had hacked into these things. 00:31:16.070 --> 00:31:21.330 JACK: While it was a thrill for Ghost Exodus to launch a DDoS attack on his targets, it 00:31:21.330 --> 00:31:25.860 was also a thrill for Wesley to try to track down who Ghost Exodus was. 00:31:25.860 --> 00:31:27.190 WESLEY: It’s very exciting, right? 00:31:27.190 --> 00:31:34.389 I mean, I don’t think anybody – I tell folks even now, I don’t do anything I don’t 00:31:34.389 --> 00:31:35.389 enjoy. 00:31:35.389 --> 00:31:40.570 Back then, we worked for the forensics training center and loved investigating things, loved 00:31:40.570 --> 00:31:44.210 doing computer forensics, loved doing the open-source science; still love doing the 00:31:44.210 --> 00:31:46.970 open-source intelligence thing. 00:31:46.970 --> 00:31:51.970 Yeah, it was very exciting and interesting to do that sort of stuff. 00:31:51.970 --> 00:31:55.309 JACK: So much fun that it practically consumed Wesley. 00:31:55.309 --> 00:32:02.549 WESLEY: From there, I wanted to [MUSIC] find out as much about Ghost Exodus as I could. 00:32:02.549 --> 00:32:11.639 That being a Thursday, I spent the rest through that weekend amount of time, so, three, four 00:32:11.639 --> 00:32:18.529 days, gathering as much as I could through open-source intelligence, though searches 00:32:18.529 --> 00:32:26.960 and various – anything I could to put together what wound up being two burned DVD-fulls of 00:32:26.960 --> 00:32:32.130 information about Ghost Exodus, who I didn’t even know. 00:32:32.130 --> 00:32:36.899 Despite finding all this about him, despite finding eight gigs worth of information, I 00:32:36.899 --> 00:32:38.200 didn’t know his name. 00:32:38.200 --> 00:32:41.040 I knew that he was a security guard at that hospital. 00:32:41.040 --> 00:32:50.269 I had the videos from YouTube of him putting malware onto the nurses’ station computer. 00:32:50.269 --> 00:32:57.640 I had other videos that he had recorded while he was at work, [00:35:00] just gigs and gigs 00:32:57.640 --> 00:33:02.870 of stuff about him. 00:33:02.870 --> 00:33:11.220 That following Monday, we contacted the Jackson, Mississippi FBI and handed that information 00:33:11.220 --> 00:33:12.220 over. 00:33:12.220 --> 00:33:16.460 JACK: Now, the FBI likes handling bigger cases than this; threats against the country or 00:33:16.460 --> 00:33:21.850 civilians or crimes over one million dollars in damage, but the evidence that Wesley collected 00:33:21.850 --> 00:33:24.860 made it real easy for the FBI to follow up on. 00:33:24.860 --> 00:33:29.289 Like, Ghost Exodus had a YouTube video of him breaking into office buildings. 00:33:29.289 --> 00:33:33.450 I mean, come on, if a hacker’s gonna post videos like that and show their face and everything, 00:33:33.450 --> 00:33:36.679 they’re definitely asking for a knock on the door, right? 00:33:36.679 --> 00:33:41.149 But also, the way Wesley framed it to the feds made it seem pretty important. 00:33:41.149 --> 00:33:48.659 WESLEY: Right, well, I think this is a little bit different than a website defacement or 00:33:48.659 --> 00:33:55.230 some active hacktivism in that, from all the information and it’s visible about this, 00:33:55.230 --> 00:34:00.279 it’s a healthcare facility, right? 00:34:00.279 --> 00:34:03.269 It’s patient information. 00:34:03.269 --> 00:34:09.099 People’s personal healthcare records are sensitive and there’s a potential for that 00:34:09.099 --> 00:34:15.090 to be exposed here or to be accessed in some unauthorized way. 00:34:15.090 --> 00:34:22.800 The HVAC system, the controls on that, had the potential to spoil medicines, to cause 00:34:22.800 --> 00:34:28.560 them to have to re-sterilize equipment, to cause them to have to throw away implants 00:34:28.560 --> 00:34:33.600 that had gone above or below acceptable temperatures, things like that. 00:34:33.600 --> 00:34:41.220 There’s an impact of this to the victim organization. 00:34:41.220 --> 00:34:52.720 I did not see this as an act of activism that had any particularly positive result. 00:34:52.720 --> 00:34:56.070 That sort of factors into the decision to report this. 00:34:56.070 --> 00:35:04.220 You report it because it’s a crime and it seems to have – it’ll have a [MUSIC] potential 00:35:04.220 --> 00:35:07.580 real impact on organizations and individuals. 00:35:07.580 --> 00:35:10.630 JACK: The FBI took Wesley’s report and got to work. 00:35:10.630 --> 00:35:14.210 They did some Google searches and found Ghost Exodus’ Gmail address. 00:35:14.210 --> 00:35:18.680 From there, they searched for his Gmail address and found a Craigslist post that Ghost Exodus 00:35:18.680 --> 00:35:23.490 made which had his resume on it but not Ghost Exodus’ real name. 00:35:23.490 --> 00:35:27.500 They contacted the security companies on his resume and then cross-referenced it with the 00:35:27.500 --> 00:35:30.320 security guards working for the Carrell Clinic. 00:35:30.320 --> 00:35:33.400 Just like that, they had the name of their suspect. 00:35:33.400 --> 00:35:36.710 Ghost Exodus was Jesse McGraw. 00:35:36.710 --> 00:35:41.930 The FBI created an indictment for Jesse McGraw and got a warrant for his arrest. 00:35:41.930 --> 00:35:45.820 [MUSIC POWERS DOWN] 00:35:45.820 --> 00:35:54.430 G.EXODUS: It’s Friday evening at 11:00 p.m. on June 26, 2009. 00:35:54.430 --> 00:36:04.960 One of the things I used to do was drive around the clinic just to make sure nobody was breaking 00:36:04.960 --> 00:36:06.760 into the underground parking garage. 00:36:06.760 --> 00:36:12.320 I see this van and I’m thinking, ah, that’s gotta be the cleaning crew’s van. 00:36:12.320 --> 00:36:14.140 I don’t think much of it. 00:36:14.140 --> 00:36:21.740 [MUSIC] It’s my last night and I’m training a new employee who has never worked a shift 00:36:21.740 --> 00:36:22.740 a day in his life. 00:36:22.740 --> 00:36:28.620 It’s my last night because I’m also about to start my new job at Global Data Guard as 00:36:28.620 --> 00:36:33.300 an entry-level network security analyst. 00:36:33.300 --> 00:36:38.000 I’m driving around, I park, I go inside. 00:36:38.000 --> 00:36:46.150 I meet the new employee and suddenly, out of nowhere, I’m surrounded by about three 00:36:46.150 --> 00:36:54.160 FBI agents and two, I don’t know, state police or senior police officers just shouting 00:36:54.160 --> 00:36:55.890 ‘where’s the gun? 00:36:55.890 --> 00:36:56.910 Where’s the gun? 00:36:56.910 --> 00:36:57.920 Where’s the gun?’ 00:36:57.920 --> 00:36:59.220 I’m like, I lock up. 00:36:59.220 --> 00:37:04.230 I don’t even know what’s going on. 00:37:04.230 --> 00:37:06.740 I still reel from that night. 00:37:06.740 --> 00:37:09.460 I’m like, what gun? 00:37:09.460 --> 00:37:12.260 They’re like, the one from your video. 00:37:12.260 --> 00:37:14.690 I’m like, which video? 00:37:14.690 --> 00:37:17.500 Now, we’re having a shouting match ‘cause we’re trying to figure this out. 00:37:17.500 --> 00:37:18.900 They’re like, the one from your MySpace! 00:37:18.900 --> 00:37:20.660 I’m like, which MySpace? 00:37:20.660 --> 00:37:25.599 He pulls up his phone and looks. 00:37:25.599 --> 00:37:26.599 I was like oh, that’s fake. 00:37:26.599 --> 00:37:27.760 Besides, I can’t carry a gun here anyways. 00:37:27.760 --> 00:37:30.490 He was like, are you Jesse McGraw? 00:37:30.490 --> 00:37:32.030 I’m like, yes. 00:37:32.030 --> 00:37:35.270 He’s like, are you Ghost Exodus? 00:37:35.270 --> 00:37:38.339 I’m like, maybe. 00:37:38.339 --> 00:37:43.730 I can’t remember what it was but I think that’s what I said. 00:37:43.730 --> 00:37:49.050 But anyways, what I’m gonna tell you is being raided by the FBI, there’s nothing 00:37:49.050 --> 00:37:50.119 quite like it. 00:37:50.119 --> 00:38:00.930 There’s a level of sheer terror that they use [00:40:00] to immobilize people that they’re 00:38:00.930 --> 00:38:08.670 putting under arrest and to get them to cooperate, to get them to confess. 00:38:08.670 --> 00:38:13.530 Just being swarmed like that, I still look over my shoulder to this very day. 00:38:13.530 --> 00:38:21.540 Even though I know that that type of thinking is irrational, I still get those feelings. 00:38:21.540 --> 00:38:23.190 It pretty much ended very quickly. 00:38:23.190 --> 00:38:27.400 They take me down to the station and then they interview me. 00:38:27.400 --> 00:38:29.030 I’ve never been arrested before. 00:38:29.030 --> 00:38:34.520 He says, if you confess to everything that you’ve done here, then maybe the judge will 00:38:34.520 --> 00:38:36.040 go easy on you. 00:38:36.040 --> 00:38:39.850 Here’s a paper and pen; I know you’re a good writer. 00:38:39.850 --> 00:38:45.560 I’m thinking, maybe if I confess to what I’ve done, I can go home. 00:38:45.560 --> 00:38:49.060 I didn’t know that I would be incriminating myself. 00:38:49.060 --> 00:38:50.700 This is what really sealed my fate. 00:38:50.700 --> 00:38:54.420 There was no way I could fight this case after I had self-incriminated. 00:38:54.420 --> 00:39:00.320 You know, a lot of people think that once you’ve been arrested by law enforcement 00:39:00.320 --> 00:39:04.890 or the FBI or the Secret Service, that they’ve been watching you, they know everything about 00:39:04.890 --> 00:39:06.140 you, but that is not true. 00:39:06.140 --> 00:39:10.460 ‘Cause if they knew, then they would not need you to confess. 00:39:10.460 --> 00:39:16.510 That’s something that I had learned years later, was that one of the tactics that law 00:39:16.510 --> 00:39:22.520 enforcement use other than fear is to convince you that things are gonna go lenient, things 00:39:22.520 --> 00:39:28.930 are gonna go and work in your favor as long as you confess. 00:39:28.930 --> 00:39:36.800 But by self-incriminating, you’re basically handing them – you’re basically signing 00:39:36.800 --> 00:39:37.800 your life away. 00:39:37.800 --> 00:39:39.140 I just didn’t see it at the time. 00:39:39.140 --> 00:39:41.630 JACK: So, you fessed up. 00:39:41.630 --> 00:39:48.589 G.EXODUS: I confessed to everything that I had done in relation with the Carrell Clinic. 00:39:48.589 --> 00:39:54.319 The one thing I didn’t do, and this is pretty well-known, is that I did not give up my friends. 00:39:54.319 --> 00:39:56.360 JACK: The police didn’t let him go home that day. 00:39:56.360 --> 00:39:58.220 They just put him right in jail. 00:39:58.220 --> 00:40:05.450 G.EXODUS: I’m transferred to Seagoville Jail where I remained for two years as I’m 00:40:05.450 --> 00:40:08.100 fighting my case. 00:40:08.100 --> 00:40:12.520 My first week in jail, I was just so terrified. 00:40:12.520 --> 00:40:14.480 I didn’t shower for a week. 00:40:14.480 --> 00:40:16.200 I didn’t eat, hardly. 00:40:16.200 --> 00:40:20.380 I actually had my cell mate bring me food for a while. 00:40:20.380 --> 00:40:25.680 JACK: Now, once news spread of his arrest, Wesley blogged about this case, claiming he 00:40:25.680 --> 00:40:28.310 was the one who called the FBI on Ghost Exodus. 00:40:28.310 --> 00:40:32.250 As you can imagine, this had some consequences for Wesley. 00:40:32.250 --> 00:40:38.230 WESLEY: I had sex toys mailed to me, I had lots of phone calls. 00:40:38.230 --> 00:40:46.859 I have just gigs and gigs of crap here on my computer of logs of them talking about 00:40:46.859 --> 00:40:53.550 coming to my house and kidnapping me, and just various attacks. 00:40:53.550 --> 00:40:58.750 Overall, more bluster than anything. 00:40:58.750 --> 00:41:07.520 I don’t know that I ever felt personally, physically threatened by any of them but there 00:41:07.520 --> 00:41:12.700 was a lot of talk and a lot of harassment from other members of McGraw’s hacker group, 00:41:12.700 --> 00:41:15.089 the Electronik Tribulation Army. 00:41:15.089 --> 00:41:24.269 Various members of that group would try to attack my website, denial-of-service attacks. 00:41:24.269 --> 00:41:32.560 One of them, he went by the handle Fixer, he was the main bad actor along those lines, 00:41:32.560 --> 00:41:35.460 along the harassment lines. 00:41:35.460 --> 00:41:46.140 Eventually, he pled guilty to charges of CFA, Computer Fraud and Abuse Act, for denial-of-service 00:41:46.140 --> 00:41:51.890 attacks against my website in order to – as part of an agreement to have charges against 00:41:51.890 --> 00:41:55.220 him dropped for witness intimidation. 00:41:55.220 --> 00:42:01.220 He was the main bad actor on that. 00:42:01.220 --> 00:42:06.670 JACK: When you’re posting it publically, did you kind of expect something like that? 00:42:06.670 --> 00:42:12.859 WESLEY: You know, I really didn’t know what to expect one way or the other. 00:42:12.859 --> 00:42:17.520 Obviously, that’s the sort of thing that can happen. 00:42:17.520 --> 00:42:25.940 You would think that with the leader of your hacking crew, such as it is, being arrested 00:42:25.940 --> 00:42:32.310 and having given the feds all of the information about all the members of the crew, you’d 00:42:32.310 --> 00:42:38.710 think they’d be on their best behavior and wouldn’t want any additional bad attention, 00:42:38.710 --> 00:42:40.760 but there you go. 00:42:40.760 --> 00:42:46.010 JACK: [MUSIC] Ghost Exodus’ court case dragged on and on. 00:42:46.010 --> 00:42:49.839 You might wonder why there would be such a lengthy trial considering he had already confessed 00:42:49.839 --> 00:42:51.320 to hacking the clinic. 00:42:51.320 --> 00:42:54.250 Well, they were trying to pin extra things on him. 00:42:54.250 --> 00:42:57.950 [00:45:00] Like, the cops were saying he hacked into NASA but he was saying he didn’t do 00:42:57.950 --> 00:42:58.950 that. 00:42:58.950 --> 00:43:03.510 They wanted him to turn in other members of ETA so he could get less time. 00:43:03.510 --> 00:43:05.079 But he wasn’t gonna turn anyone else in. 00:43:05.079 --> 00:43:12.040 This went on for two years before his sentencing and that whole time, he was in jail. 00:43:12.040 --> 00:43:15.190 On March 17th, 2011 is your sentencing. 00:43:15.190 --> 00:43:16.190 G.EXODUS: Yes. 00:43:16.190 --> 00:43:18.880 JACK: What did they give you? 00:43:18.880 --> 00:43:24.280 G.EXODUS: 110 months which equals nine years. 00:43:24.280 --> 00:43:27.500 JACK: Nine years for two counts? 00:43:27.500 --> 00:43:31.900 One was hacking into that HVAC server and the other was installing malicious code on 00:43:31.900 --> 00:43:33.700 the nurses’ stations. 00:43:33.700 --> 00:43:38.350 But remember; he only got into that HVAC computer because his WiFi was spotty and he wanted 00:43:38.350 --> 00:43:43.090 to browse the internet faster, not because he did anything bad to the HVAC system. 00:43:43.090 --> 00:43:47.180 I mean, okay, yes, he did; he wasn’t supposed to install remote-control software on that 00:43:47.180 --> 00:43:51.750 server and he wasn’t even supposed to access that system and he did that, but he did it 00:43:51.750 --> 00:43:57.190 only to chat online and to shop, not to be malicious and attack the clinic or anything 00:43:57.190 --> 00:43:58.190 else. 00:43:58.190 --> 00:44:01.540 You could compare this to him breaking into an office that he shouldn’t have gone in 00:44:01.540 --> 00:44:03.740 just to watch TV or something. 00:44:03.740 --> 00:44:08.920 But he was charged as if he stole stuff, caused damage or ruined something. 00:44:08.920 --> 00:44:14.900 It’s just odd here that his intent had nothing to do with his sentence. 00:44:14.900 --> 00:44:18.800 The court was harsh on him because this was a medical clinic. 00:44:18.800 --> 00:44:22.220 Because what kind of jerk hacks into a medical clinic, right? 00:44:22.220 --> 00:44:27.790 The court showed how he had access to patient records and private info but he insisted he 00:44:27.790 --> 00:44:32.530 never took any of that or looked at any private info at all, and he just used these computers 00:44:32.530 --> 00:44:36.079 to wage a denial-of-service attack on other computers. 00:44:36.079 --> 00:44:38.480 Nine years seems like an awfully long time. 00:44:38.480 --> 00:44:43.970 But I think the court didn’t recognize or understand the intent and use of these computers. 00:44:43.970 --> 00:44:48.480 They simply saw that someone hacked into a bunch of computers at a medical clinic and 00:44:48.480 --> 00:44:51.440 this seemed to cloud their judgement of what that meant. 00:44:51.440 --> 00:44:56.210 I mean, people who are convicted of manslaughter often serve less than nine years. 00:44:56.210 --> 00:45:00.400 Not that I think Ghost Exodus should go without punishment, but nine years? 00:45:00.400 --> 00:45:01.400 Really? 00:45:01.400 --> 00:45:02.830 That just seems extra-harsh. 00:45:02.830 --> 00:45:09.710 So, he went to prison for a long, long time. 00:45:09.710 --> 00:45:13.690 Spending that long of a time in prison can really mess you up. 00:45:13.690 --> 00:45:21.530 G.EXODUS: Whenever you spend a long time in prison, you get used to the environment. 00:45:21.530 --> 00:45:24.290 It becomes a part of you, a part of your psyche. 00:45:24.290 --> 00:45:30.970 You’re controlled on a minute-to-minute, day-to-day, hour-to-hour basis. 00:45:30.970 --> 00:45:32.800 You become accustomed to violence. 00:45:32.800 --> 00:45:38.369 You become accustomed to all types of things that are only exclusive if you’ve ever been 00:45:38.369 --> 00:45:39.369 a prisoner. 00:45:39.369 --> 00:45:44.470 JACK: At some point, he somehow sneakily borrowed a computer to contact his lawyer while he 00:45:44.470 --> 00:45:45.980 was in prison. 00:45:45.980 --> 00:45:51.040 When he was caught doing this, they threw him in the SHU, [MUSIC] solitary confinement, 00:45:51.040 --> 00:45:55.980 where he had almost no interaction with other people, very little activity, and it’s extra 00:45:55.980 --> 00:45:56.980 strict. 00:45:56.980 --> 00:46:00.000 He stayed a whole year in the SHU. 00:46:00.000 --> 00:46:02.700 This affected him physically and psychologically. 00:46:02.700 --> 00:46:07.750 Fluids began collecting in his lungs and he began to lose weight and became very frail. 00:46:07.750 --> 00:46:12.740 He describes this experience as torture. 00:46:12.740 --> 00:46:19.660 But after thirteen months, he got out of the SHU and was able to serve normal prison time. 00:46:19.660 --> 00:46:25.950 After seven and a half years in prison, they let him out on good behavior. 00:46:25.950 --> 00:46:30.950 When he got out, he was able to connect with his wife but he was a different person now. 00:46:30.950 --> 00:46:32.890 She was a different person, too. 00:46:32.890 --> 00:46:39.750 G.EXODUS: My family was very worried that I was playing them, like I hadn’t really 00:46:39.750 --> 00:46:40.750 changed at all. 00:46:40.750 --> 00:46:46.790 Any time I sat down at a computer my wife immediately began to panic ‘cause she thought 00:46:46.790 --> 00:46:47.790 I was hacking. 00:46:47.790 --> 00:46:50.090 If I said I wasn’t, she thought I was lying. 00:46:50.090 --> 00:47:01.329 These are things she was revisiting because that’s how we used to be over a decade ago. 00:47:01.329 --> 00:47:06.290 In her mind, I’m still playing the same games; I’m still playing them. 00:47:06.290 --> 00:47:08.090 But I wasn’t. 00:47:08.090 --> 00:47:15.930 While I was on home confinement, while serving home confinement through a halfway house, 00:47:15.930 --> 00:47:21.349 she’s so afraid that I’m doing this again that she kicks me out of the house, threatens 00:47:21.349 --> 00:47:24.380 to call the FBI to search my laptop. 00:47:24.380 --> 00:47:27.260 I now realized I’m in a dangerous situation. 00:47:27.260 --> 00:47:29.260 I’m financially co-dependent. 00:47:29.260 --> 00:47:30.490 I have nowhere to go. 00:47:30.490 --> 00:47:36.109 JACK: At the same time, he had a friend who wanted to go to Nigeria to visit some friends 00:47:36.109 --> 00:47:40.630 and ultimately end up in Israel which would be quite the adventure. 00:47:40.630 --> 00:47:44.230 Ghost Exodus knew this guy and thought ‘this guy is not gonna be able to make this kind 00:47:44.230 --> 00:47:45.230 of trip on his own.’ 00:47:45.230 --> 00:47:50.690 G.EXODUS: He was just a mama’s boy, a Cosmopolitan-type of kid, very preppy. 00:47:50.690 --> 00:47:54.960 He’d never had any – doesn’t have any street [00:50:00] smarts. 00:47:54.960 --> 00:47:59.730 JACK: The combination of Ghost Exodus needing a place to go and being afraid of the FBI, 00:47:59.730 --> 00:48:04.910 and this guy wanting to leave the country, go to Nigeria, Ghost decides to go to Nigeria 00:48:04.910 --> 00:48:05.910 with him. 00:48:05.910 --> 00:48:10.830 G.EXODUS: [MUSIC] That’s one of the things that I picked up in prison, is this need to 00:48:10.830 --> 00:48:17.840 escape ‘cause you spend years ruminating on leaving. 00:48:17.840 --> 00:48:27.440 The environment is so depressing, so stressful, you constantly just daydream and fantasize 00:48:27.440 --> 00:48:29.710 about escaping. 00:48:29.710 --> 00:48:36.000 When you leave prison, sometimes you find yourself in that same feeling because you 00:48:36.000 --> 00:48:40.560 haven’t fully acclimated back to society yet. 00:48:40.560 --> 00:48:45.240 I kind of carried that over when I was released. 00:48:45.240 --> 00:48:53.460 The extremity of those thoughts or those actions were based on thoughts I had originally had 00:48:53.460 --> 00:48:54.650 while incarcerated. 00:48:54.650 --> 00:49:03.250 What I ended up doing is I started doing research on cargo ships. 00:49:03.250 --> 00:49:10.020 I come to find out leaving the country by cargo ships is the easiest way to come in 00:49:10.020 --> 00:49:15.080 and go undetected. 00:49:15.080 --> 00:49:18.820 I ended up getting this commercial marine tracking software. 00:49:18.820 --> 00:49:26.630 I end up finding a ship that just so happens to disable its automatic identification system. 00:49:26.630 --> 00:49:32.859 Usually when ships disable the AIS system, it’s because they’re engaged in some type 00:49:32.859 --> 00:49:38.220 of illegal trafficking activity in international waters. 00:49:38.220 --> 00:49:48.809 I’m tracking this ship; [MUSIC] I hop on a plane, go to Florida, and I amazingly manage 00:49:48.809 --> 00:49:59.440 to slip past border patrol and customs agents to actually get to this ship without a ticket, 00:49:59.440 --> 00:50:06.070 without being authorized with a passport, a ticket, and a shuttle. 00:50:06.070 --> 00:50:15.099 We go up there and I pose as an Israeli-American. 00:50:15.099 --> 00:50:27.549 I explain to him that I am an ivory dealer and that I want them to take me to Nigeria, 00:50:27.549 --> 00:50:34.120 to take me to Nigeria because my main goal was to try to start over in Israel and I was 00:50:34.120 --> 00:50:36.069 afraid that customs would turn me back. 00:50:36.069 --> 00:50:42.099 JACK: Now, I should point out here that when he flew from Texas to Miami, he violated his 00:50:42.099 --> 00:50:43.610 probation and wasn’t allowed to leave the state. 00:50:43.610 --> 00:50:48.319 But at this point, he’s standing at the docks with his traveling partner, talking 00:50:48.319 --> 00:50:50.329 to the captain, trying to get on this ship. 00:50:50.329 --> 00:50:52.040 G.EXODUS: I managed to get on the ship. 00:50:52.040 --> 00:50:58.960 This ship was very interesting because this company is one of the biggest cargo shipping 00:50:58.960 --> 00:51:02.270 companies in the world but they’re also one of the dirtiest. 00:51:02.270 --> 00:51:08.240 This is why we specifically selected this as our means to leave the country, because 00:51:08.240 --> 00:51:09.530 they don’t have much of a conscience. 00:51:09.530 --> 00:51:18.380 They’ve been busted several times trafficking weapons to Russia, a disassembled tank to 00:51:18.380 --> 00:51:21.420 North Korea, and ivory to Florida. 00:51:21.420 --> 00:51:23.130 It’s like, you know what? 00:51:23.130 --> 00:51:26.250 This is the shipping company we need. 00:51:26.250 --> 00:51:32.359 We get on board and I explain to them, look, I know that you’re disabling your AIS system. 00:51:32.359 --> 00:51:38.500 I know you won’t really have a big problem taking us to Nigeria but here’s the deal; 00:51:38.500 --> 00:51:41.810 I’m into ivory, I know that you’re into ivory. 00:51:41.810 --> 00:51:43.690 You want to make a buck? 00:51:43.690 --> 00:51:44.940 Take us to Nigeria. 00:51:44.940 --> 00:51:48.799 JACK: The captain said, you’re gonna have to pay if you want a ride, you know. 00:51:48.799 --> 00:51:50.640 So, the captain gave them a price. 00:51:50.640 --> 00:51:55.270 They tried to haggle this down but they just couldn’t get the price down to an amount 00:51:55.270 --> 00:51:59.650 that they could actually pay, so they didn’t get a ride out of there. 00:51:59.650 --> 00:52:04.040 They waited in Miami for the next ship to arrive, hoping that they might find a better 00:52:04.040 --> 00:52:05.040 rate. 00:52:05.040 --> 00:52:10.809 But by that time, his travel partner had called his mom and told her what they were doing. 00:52:10.809 --> 00:52:15.690 His mom thought it was Ghost Exodus’ idea to leave the country, so she called the police 00:52:15.690 --> 00:52:17.299 on Ghost Exodus. 00:52:17.299 --> 00:52:21.450 The police saw this was a violation of his probation to leave the state, so they issued 00:52:21.450 --> 00:52:25.270 a warrant for his arrest and went down to the docks and arrested him there. 00:52:25.270 --> 00:52:30.030 G.EXODUS: When I was leaving prison the second time, I had nowhere to go. 00:52:30.030 --> 00:52:38.369 I had basically burned every bridge I had and I still had probation to serve; three 00:52:38.369 --> 00:52:39.369 years. 00:52:39.369 --> 00:52:40.920 In my mind, I was thinking you know what? 00:52:40.920 --> 00:52:44.309 I’ve been locked up for so long, I’m constantly worried. 00:52:44.309 --> 00:52:48.680 I’ve never really decompressed from this experience. 00:52:48.680 --> 00:52:51.859 Even in society, I felt like I’m still locked up. 00:52:51.859 --> 00:52:54.370 I still feel that way. 00:52:54.370 --> 00:52:58.140 [00:55:00] Having nowhere to go, I just said you know what? 00:52:58.140 --> 00:52:59.140 Screw this. 00:52:59.140 --> 00:53:01.920 I’m just gonna go on the run. 00:53:01.920 --> 00:53:03.700 When they pick me up, they’ll pick me up. 00:53:03.700 --> 00:53:07.430 During that time, I lived in Cedar Hill State Park. 00:53:07.430 --> 00:53:11.770 JACK: He was actually living in a forest, homeless at the time. 00:53:11.770 --> 00:53:14.270 G.EXODUS: My wife notified my mother. 00:53:14.270 --> 00:53:23.640 My mother was the one who notified my probation officer who called park authorities. 00:53:23.640 --> 00:53:27.960 They actually freaking sent a drone to come and try to find me. 00:53:27.960 --> 00:53:29.970 Can you believe that? 00:53:29.970 --> 00:53:31.890 I’ve never seen that before. 00:53:31.890 --> 00:53:36.520 I’ve never heard that type of whine that those drones make before. 00:53:36.520 --> 00:53:39.680 The thought of it just scared the living daylight out of me. 00:53:39.680 --> 00:53:44.900 They did this for the better part of about a week looking for me, but they never found 00:53:44.900 --> 00:53:45.900 me. 00:53:45.900 --> 00:53:50.850 But then I found myself on a Greyhound bus going to Onalaska, Texas which is by Goodrich 00:53:50.850 --> 00:53:56.339 in Lake Livingston and I stayed there for about five months, living in the forest. 00:53:56.339 --> 00:53:59.359 On my way back is when I got picked up. 00:53:59.359 --> 00:54:03.619 JACK: ‘Cause of a traffic stop or something? 00:54:03.619 --> 00:54:04.619 G.EXODUS: Exactly. 00:54:04.619 --> 00:54:09.290 JACK: He was given two more years of prison time for this but this time when he would 00:54:09.290 --> 00:54:11.559 get out, he would have no probation. 00:54:11.559 --> 00:54:15.080 The judge saw that he couldn’t serve his probation so he just said, you’re gonna 00:54:15.080 --> 00:54:18.480 have to stay in prison until all your time is served. 00:54:18.480 --> 00:54:23.119 But after about a year and a half, they let him go on good behavior which means now, in 00:54:23.119 --> 00:54:27.830 2020, he’s finally free; no probation, no more prison time. 00:54:27.830 --> 00:54:30.720 He can use electronics if he wants and he could focus on rebuilding his life. 00:54:30.720 --> 00:54:34.880 He’s currently a fry cook since he doesn’t have a car, and needs to find a job within 00:54:34.880 --> 00:54:36.099 walking distance. 00:54:36.099 --> 00:54:42.520 In total, he served nine years and eight months in prison all because he installed software 00:54:42.520 --> 00:54:52.160 on some computers he wasn’t supposed to in the very building he was supposed to be 00:54:52.160 --> 00:54:54.430 protecting from threats. 00:54:54.430 --> 00:54:58.950 As for what he plans to do next, he tells me he thinks the forensic examiner on his 00:54:58.950 --> 00:55:03.890 case was not very good and was one of the reasons he got such a long incarceration, 00:55:03.890 --> 00:55:08.980 so he’d like to study digital forensics because he doesn’t want an incompetent forensics 00:55:08.980 --> 00:55:13.599 examiner to ruin anyone else’s life. 00:55:13.599 --> 00:55:24.490 (OUTRO): [OUTRO MUSIC] A big thank you to Jesse McGraw, Ghost Exodus, for coming on 00:55:24.490 --> 00:55:26.140 the show and sharing your story. 00:55:26.140 --> 00:55:28.790 Stay safe out there and good luck in your future. 00:55:28.790 --> 00:55:32.970 Also, thanks to Wesley McGrew for coming on and telling us your story. 00:55:32.970 --> 00:55:37.280 Wesley has finished his PhD in Computer Science and is now a director at cyber operations 00:55:37.280 --> 00:55:38.839 for a cyber-security company. 00:55:38.839 --> 00:55:43.020 If you’re all caught-up on Darknet Diaries episodes and want more, you’re in luck; 00:55:43.020 --> 00:55:46.170 there are now six bonus episodes for Patreon subscribers. 00:55:46.170 --> 00:55:50.109 By supporting the show through Patreon, it tells me that this show brings value to you. 00:55:50.109 --> 00:55:57.720 It also shows a new ethic in supporting something you appreciate, so please visit patreon.com/darknetdiaries 00:55:57.720 --> 00:56:00.790 to unlock bonus episodes in an ad-free feed. 00:56:00.790 --> 00:56:03.010 Thank you very much. 00:56:03.010 --> 00:56:06.550 This show is made by me, the local ghost, Jack Rhysider. 00:56:06.550 --> 00:56:10.910 Original music and sound design was done by the quick blade Andrew Meriwether, editing 00:56:10.910 --> 00:56:16.920 help this episode by the mega-biter Damienne, and our theme music is by the bz-bz-beep-beep-bloop-boop 00:56:16.920 --> 00:56:18.650 Breakmaster Cylinder. 00:56:18.650 --> 00:56:22.280 Even though there’s some CEOs somewhere out there that are now just figuring out what 00:56:22.280 --> 00:56:26.339 blockchain is and think it’s a cutting-edge technology when actually it’s ten years 00:56:26.339 --> 00:56:29.320 old now, this is Darknet Diaries.