JACK: I’ve always like the idea of fake it ‘til you make it, where you act like
someone you want to be until you become them. This sometimes comes with imposter syndrome,
but I think the antidote to that is just more experience. But how do you go from being a
total beginner to confidently doing something? I often turn to the book store to help me there. But
you know a book that’s always bothered me? It’s those For Dummies books, like the C Programming
For Dummies, or The Complete Idiot’s Guide. Even if I don’t have a clue where to start,
I would never buy one of those books because I don’t consider myself a dummy or an idiot,
because I want to fake it ‘til I make it, and I don’t want to fake being a dummy. I want to be
a great programmer. So, A Dummy’s Guide to Programming is not the direction I want to
be going. I think what those books fail to do is they seem to target who you are now,
not what you want to become, and that was their failure, at least for me.
I’ve bought tons of how-to books, but I will never buy one of those books. To me,
the key to success is in the aspiration. I would instantly buy books that were titled How to Be an
Amazing C Programmer, because that is what I want to become. The book could contain the exact same
words as the other book, that C Programming For Dummies, but it would have an entirely different
impact on me. Every time I saw the title, I’d feel like I’m becoming more and more like the person I
want to be, an amazing programmer, and that would give me that false sense of greatness, which is
exactly what it’s like to fake it ‘til you make it. Because it’s not about who you are today;
it’s about who you aspire to be tomorrow. It’s about embracing the journey of transformation and
allowing your actions to shape your destiny. So go ahead and fake it. You can lie to yourself if
you want, because sometimes the greatest lies are the ones that propel us towards our truest selves.
[Intro music] These are stories from the
dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries.
JACK:
Today I’m talking with Andrew.
ANDREW: Yeah, I’m Andrew Batey.
JACK: Andrew has a really unique job that I can’t
wait to ask him about. But first we should learn about how he got there.
ANDREW: So, I started on Facebook when it was still EDU-based, and then I was one of
the first fifty beta advertisers on Twitter and learning to kind of misuse their system.
JACK: [Music] Misuse their system. These systems are huge and complex; algorithms, likes, follows,
and a whole ad network. He wondered if he could manipulate any of that to his benefit.
ANDREW: The same thing with YouTube. You used to be able to break anything
into the front page of YouTube, and I guess I quickly became the guy that you would go to
if you wanted to sort of…like gray hat, black hats, and stuff.
JACK: Gray hat and black hat and white hat, let’s talk about that. That’s gonna come up a lot in
this episode, and we’ll start with white hat. White hat is doing something that’s 100% legal
and safe, such as hacking your own computer. Nobody is gonna come arrest you for that.
Black hat is doing something that’s illegal, such as hacking your ex’s lawyer to see what they’re
plotting against you. Gray hat is somewhere in-between. Maybe it’s technically not legal,
but you’re hacking into something only for research, but not to cause harm. But these
terms also apply to marketers, someone who follows the rules such as paying for ads the normal way.
That’s a white-hat marketer. But someone who uses bots, for instance, to artificially create
a bunch of five-star reviews for something, that would be a black-hat marketer in my opinion,
because they are lying and cheating with their so-called marketing and run the risk of being
thrown off the very platform that they’re trying to grow on. At least, this is what I think these
terms mean going into this episode, but my definitions might change as we go further. So,
in my opinion, Andrew was a black-hat marketer. He was trying to promote certain products
or people by tricking people or systems to artificially inflate something’s popularity.
ANDREW: My favorite thing at the time was like-jacking. It was a weird time period
because it was before fan pages. So, initially when Facebook first launched,
you could only friend-request somebody, and there was a 5,000-person limit. What you used to do is
you would hide the request — Friend Request button, or when fan pages launched, the fan
Follow button, but you would hide it in the pixels. I don’t know if you’ve come across that.
JACK: Yeah, I have. People who want to become popular on social media might do it, like
an up-and-coming band who wants as many likes and follows as possible. If others think you’re good,
then you’re probably good. So, you might show up in more people’s feeds because of that,
too. Facebook made it so you could add a Like button anywhere you wanted, like on your own
web page or blog. But if you were sneaky, you could trick people to clicking on that Like
button when they didn’t know they were clicking it. That’s what click-jacking is, or like-jacking.
ANDREW: In our case we ended up using it a lot on video or photo-sharing websites. So,
when people were clicking Next or going through video or photo carousels, every time they were
clicking — we sort of trained our users to double-click. We started buying these websites
that were high-volume websites. Then eventually we started doing web development for other sites and
then putting these in there. What would happen was — our hypothesis was that people did not log out
of their Facebook. It’s cached in their browser. So, what we would do is just hide that pixel
inside of other websites. [Music] So, we could drive millions of fans to things.
JACK: Man, how clever; they bought a popular video and photo-sharing site,
and as the users clicked Next or Play, it wasn’t the Next button. It was the
Facebook Like button. The users had to click twice because the first one was just liking the photo,
and then the second was going to the next photo. So, what Andrew would do is he’d advertise that
he can get your Facebook page 5,000 followers and thousands of likes, and people would buy
his service to promote their bands, and he’d artificially grow someone’s Facebook account.
ANDREW: So, that’s kind of where we started a lot. Another thing we did in the early days
was kind of an ad arbitrage. At the time, for example, when you charge an advertiser,
they cared about time on site and sort of CPMs, but they didn’t care that much about the actual
click-through or engagement with the ads. They just weren’t aware. I know that seems obvious now,
but back in the 2000s, no one really knew that those were metrics to look at,
like traditional advertisers. So, what we would do is we had these high-traffic-volume websites
and we would, for example, have a $5 CPM, let’s say. But we could buy traffic for like,
a dollar. So, we would blend enough garbage traffic in that we didn’t really ruin our
overall time on site or user stats, but we would be able to sort of print money.
JACK: Oh. So, he’d sell ads on his website but then pay fake visitors to click it,
making it look like a lot of people clicked that ad,
and then he would just collect the money for it. But really, it was just paid traffic. Huh.
ANDREW: Another one that we did that was really interesting at the time was around YouTube. So,
we figured out that you could basically — there were these pop-under ads back then,
and you could — most people recognized them from the penis-enlargement ads and things like that;
you’d click out of a website and there would be the annoying little open browser underneath it.
We would load it with YouTube videos on mute, and we were able to rack up
hundreds of thousands of plays to a YouTube video quickly. If we could get 300,000 to 400,000 views
quietly in the background, we could basically break into the algorithm on the front page.
Back then, people would go to the front page of YouTube to see what was trending. So,
we would be able to break a bunch of different content pieces onto the front page of YouTube. At
that point they had to sink or swim. You basically had to have good content that people liked or not,
but pretty quickly it was evident; you either went viral or you were trash and you were removed
quite quickly. So, we could get you there, but the question was whether or not you’d stick.
JACK: Jeesh. Now, see, to me, this is all black-hat marketing. You aren’t bringing
real customers to your site or video page. Instead, it’s all fake. It’s not quite bots;
it’s real people clicking things, but they’re tricked into clicking things
and they don’t know they’re clicking it. The stuff they’re viewing is invisible to them,
but it’s playing in the background. So, I call this black-hat marketing because if YouTube found
out that you manipulated your way to the front page, they’d probably ban you. But I also think
if you have a bunch of fake followers, then that’s not real marketing, either. That’s cheating and
lying and manipulating. [To Andrew] Now, when you say ‘we’, what was this — where is ‘we’?
ANDREW: I had a couple partners that we did this with.
JACK: Was this like a black-hat marketing firm?
ANDREW: You know, that term wasn’t really a thing then. I would say we all considered it marketing,
but we didn’t — I mean, yes, it’s black hat, but I wouldn’t say that that’s what we visualized it
as at the time. At the time we really felt like we were just a marketing firm using all
the possible channels we could to give a brand an opportunity to take off. What I got known
for at the time was — we launched an artist on Facebook, and he had no label, no major label,
nothing. He was found at a bonfire in Nantucket. So, it was kind of like an interesting thing.
When we went to the labels back then and tried to convince them that you could use Facebook
to launch an artist, everyone laughed at us and said Facebook’s for kids. We have a website. We
do e-mail lists. We do paid marketing. This isn’t part of our mix. No one believed it
was possible until we did it. Then after we did it, everyone wanted to pay us to do it.
The hardest thing was trying to continue to perform, because then — everyone that finds a
vein that works — everyone starts copying you, and then you have to find a new way. It’s like
you’re constantly on a treadmill for finding new, innovative ways that you can break an artist or
that you can just get attention. I think from our view, that’s the art of marketing. It’s less — it
doesn’t — I think for a lot of us it doesn’t feel like black hat ‘cause we’re just using a technique
or a tool that might only last for two months or three months until we have to find something else,
and we all safeguard it. When we learn something, we don’t tell people. So, when we learned about
like-jacking, which was the hypothesis we had, we definitely didn’t tell anybody because we didn’t
want anyone copying us. We didn’t want people to know how we could drive a million fans to
something, and they were all real fans. So, it was just kind of a — I think in that view,
it’s just a different era. I would also say that no one even called it social media marketing.
At the time there was digital marketing. New media was a term. There wasn’t even a term
for — growth-hacking wasn’t even a term. No one even used the word ‘growth-hacking’. It just was
not a thing at that moment. So, it is interesting to see how the whole thing has evolved. I do think
that if you asked us point blank is what you’re doing violating terms and services,
for sure we would have lied and told you — we would have told you no. But we all knew — we
weren’t drinking the Kool-Aid. Everyone in the company knew we were violating terms and
services. I think the thing we thought was, who cares? If a real user likes what we have to do,
like what we’re presenting them — we’re not faking the genuine product market
fit. We’re just trying to get in front of those eyeballs and see if we are a product market fit.
JACK: That was a stretch as well, but I agree with you that I think a good marketing
campaign is one that actually — ‘cause I think most people are like,
I hate marketers. I hate ads. I hate all this stuff. But do you? When a product lands
in front of you and it’s the perfect thing — it’s your new favorite song and you’re like,
holy cow, I can’t believe I just found this, then you don’t hate it, right?
ANDREW: Totally.
JACK: So, if you can match that person who needs this product with this thing,
and that is a marketing move that you’ve done, then that is fantastic marketing. I think — I
wish that’s how all marketing was, was to actually find the person who needs it and
then — and focus on them. Unfortunately marketing has a lot of wasted eyeballs looking at it.
ANDREW: For sure.
JACK: That’s a lot of wasted money.
ANDREW: Even back then, I remember seeing this thing in probably 2011, I feel like,
where there was this report that came out in an advertising researcher port that only
8% of people who saw an ad online were real. It was just technically a machine connecting
with another machine presenting the ad, but there wasn’t a real person on the other end.
That was fifteen years ago. I can only imagine how much worse it’s gotten.
JACK: Yeah. When you were doing this black-hat stuff, did you have any success stories of
people that you made or products that you launched well, and just huge success with these techniques?
ANDREW: Yeah. I don’t want to throw them under the bus, but we definitely did win a lot. We
took a brand in action sports that was like, seventeenth in their spot and moved them to like,
third in the market. We — and what was crazy is at the time you start doing these big activations.
So, when you start winning, all the big brands pile in. All of a sudden they all want to do a
collaboration or some deal with you. So, you end up doing really big brand partnerships or brand
collaborations with really established companies once they all perceive you as the winner. So,
the snowball sort of takes off, and then it becomes less black hat and more traditional
project management and release schedules and just creative, less like hacking.
JACK: Yeah. So, one sports brand went from seventeenth to third. What else?
ANDREW: Yeah. We had a musician that we launched that went number-one iTunes,
number-seven billboard with no label.
JACK: Okay, number-one iTunes, number seven, is that fake numbers? Is that fake numbers or…?
ANDREW: No, those are real numbers. That’s the crazy part. That’s what I’m saying;
I don’t feel like it was black hat because we got in front of all the people. We got in front of
people who decided they really loved this artist. Because they really loved that artist — and we
sort of had an eighteen-month plan. So, as we were building this artist with all these techniques,
we were providing them with content to get them more and more hooked and engaged with
the artist. When we released that artist’s EP, that artist went number one over everybody.
I remember we beat DJ Catalan, as an example. We beat everybody. No one could believe it.
We were called out. People thought we had faked the numbers. We didn’t fake
anything. It was all real. We just sort of met the consumer at the point — we were in
front of the consumer at the right moment when they quote, unquote “discovered this
artist” and then thought they really liked it. So, again, the techniques allowed us to
engage and have a real product market fit. But the techniques we used were definitely not approved.
JACK: Yeah, I mean, I’m — when I first started this podcast I was like, alright, let’s market
it. You start noticing some of these black-hat marketing techniques. I had to really sit and
look at myself in the mirror and be like, am I a guy who is going to cheat my way to success? Like,
fake it ‘til you make it. I had a long debate about it. I’m like, no, I’m a hacker; of course
I’m gonna use every trick in the book, right? This is great. Let’s try it all. Then I was like,
no, this is not honest. This is unethical and all that sort of stuff. So, I landed — this is funny;
I landed on no black-hat marketing, but I’m totally for guerrilla marketing,
which is unsanctioned marketing, right? So, if I go to a conference and there’s an empty booth
where a vendor didn’t show up, I might sit down at that booth, put a little banner up that says…
ANDREW: I love that.
JACK: …hey, this is Darknet Diaries, and I didn’t pay $10,000 for that booth. Until
the people come and say, hey, is this — did you pay for this booth? No. Okay,
well, get out. Alright, cool. So, I’ll put stickers on places…
ANDREW: That’s amazing.
JACK: …that aren’t supposed to be stickers and
all kinds of stuff like that. So, that’s what it is, guerrilla marketing.
ANDREW: No, I agree. I think that’s definitely — and I have some examples. Like, we launched an
app in 2013 called Hater App. It was Instagram for everything you hate. Our logo was a giant
thumbs down. We went — I never — we went to South by Southwest and we just started putting stickers
on people’s backs as they were walking, and there was thousands of people walking around
with these stickers. It went — we got so many downloads. The downside was we had built this
thing totally crappy just to see if it would work as an MVP, and it went — we had hundreds
of thousands of downloads overnight, and the app was not functional. It was a complete mess.
But it was such an interesting moment where I remember doing interviews with — we did
interviews with Wall Street Journal and everyone. It was like a huge story at the time ‘cause we
basically did this guerrilla approach and it kinda worked. I guess to your point,
I always viewed the stuff I did online — I mean, maybe I’m just justifying it now. Like, hindsight,
I have revisionist history. But I remember really feeling like the things we were doing
online was the guerrilla version of what we did in person for these types of techniques.
JACK: Something I noticed on the podcast world is that people can
fake their way to the top on Apple Podcast charts,
but most of them fall off a cliff as soon as they stop paying their black-hat marketer.
ANDREW: Totally. So, I have an — there’s an artist I know who I won’t throw under
the bus who is a major artist now. They were up for a Grammy,
a bunch of things. Their entire first album was fake.
JACK: Okay, I know who you’re talking about. Check this out. I saw this
article last week. Spotify accuses Drake of forging billions of fraudulent streams.
ANDREW: That’s not who I was talking about, but that’s also interesting.
JACK: [Music] Okay, so that’s what Andrew was busy doing for a while. He was living in Los
Angeles, and he wasn’t just doing black-hat marketing and launching people’s careers,
but also building websites and tech companies and buying and selling them.
He was solidly tuned into the internet and saw it in a way that not many did.
One of his friends is Morgan, and they liked going to football games together.
ANDREW: Back in the day we had tickets to the LA Rams. So, we would go to the games every week,
every — eight times a year or whatever. We’d go to the games all together. We had ten seats together.
So, it was Morgan, me, and a bunch of music exec guys that we had known just randomly together. So,
anyway, we’re there all the time, and around — I was everyone’s weird crypto friend. I started
mining in 2011 and sort of been really interested in technology and how it could be used. But anyone
who goes back to that day will understand, anyone who was in this thing — maybe you were in it back
then — but it was weird because pure tech people really didn’t like blockchain people. There was
this weird — if you were a crypto guy, you kinda got the scarlet letter put on you
when it came to tech, and it was — it really did feel like at the moment, if people found
out you were the crypto guy, that you would just get pigeon-holed and lose opportunities.
So, I was very careful to keep building tech and keep the blockchain crypto stuff
entirely separate. Around 2017, that sort of whole world merged together. All of a sudden,
inter — people in suits started showing up to crypto events, and next thing you know,
bankers are around and everyone’s talking about how it could be used for enterprise. It really
felt like the industry collided. The music people came to us and said, hey, could you use blockchain
to track the number of times songs are played? The reason is, until today, even, the streaming
services give the labels a CSD that says Snoop Dogg, 100 million plays. No one actually — there’s
no receipts behind that. It’s literally just a cell; the artist’s name, and the next cell over,
number of plays for the month. There’s no receipts for usage. Usage is the number-one driver to how
much money you should be making every month, so it’s really weird there’s no receipts there.
So, the way that it typically worked when streaming took off, the music industry just
adopted what they’d always done for physical, and that was always an audit period after three
years. So, every three years they go and audit the partner. To do a usage audit,
though, a forensic audit, not where I’m trapping the contract,
not where I’m trapping revenue coming in, but how many times the song was actually played,
that could take them up to two years to complete. So, you’re talking about five years later figuring
out that five years ago you should have been paid a million more dollars for this artist
and $2 million for that artist, and that adds up to a lot. But all that money’s been paid out. So,
you don’t have this ability to sort of recapture that money from the streaming services ‘cause it’s
gone. So, they came to us and said, we believe blockchain could be a solution. You’re our
weird crypto friend that also understands music, and we trust your whole team here.
Morgan, my co-founder, had been a lobbyist on behalf of a lot of the majors for copyright
protection, extending copyright law, and Poria was a really gifted machine-learning AI engineer,
but at the time we were doing a lot of crypto stuff together. So, they said,
we believe your team could solve this. Will you build a real-time tracking tool? The question we
were trying to answer at the time was how many times is every song actually played? Because
you can’t rely on the CSVs to just — that they hand over. They’re always wrong. What
we learned from the offline audits, where they pulled the usage logs in fifty different audits,
was on average anywhere between 20% and 31% discrepancy, always under-counted. So,
imagine you’re perpetually being paid 20% to 30% less than you thought you should have.
That is where we started, and we built one of the fastest blockchains in the world. At
the time we did 10 million transactions per second per region in a private permission
chain. We have over forty patents in seven countries filed, probably thirty-something
issued. We built this technology. When we went live is when we accidentally discovered fraud.
JACK: This discover would ultimately make him abandon this very blockchain company that he just
built and take his life in a whole new direction. We’re gonna take a quick ad-break here, but stay
with us because you’ll never believe the fraud he discovered. So, Andrew and his co-founders Morgan
and Poria built a tool to track how many times a song is played. Since the music labels wanted
him to do it, they were also helping him get in touch with these music-streaming services to try
to work out a way for Andrew to see the real-time streaming data they had. So, they made deals with
these streaming platforms that they were able to see the play counts for the few music labels that
they were dealing with. Their goal was simply to count the plays and make sure the artist got paid
for what was played. But little did they know, [music] counting plays was not accurate at all.
ANDREW: We started seeing these weird clusters of users, like 8,000 users playing the exact
same sequence of songs sixty-three times on a Sunday, or users suddenly getting play counts in
seventeen different countries in the same week. Like, how is that even possible? So, we started
noticing these discrepancies, and we went back to the labels and the streaming services and said,
we think you have a fraud problem. If we’re supposed to be the leader or the trusted source
of truth of how many times a song is played and we’re just telling you a song was played,
we’re not actually telling you the intent behind the play and if it should still be counted. You
can’t actually pay this out because there’s a bunch of fraud happening here that should
be removed. So, until we can solve the fraud problem, we don’t think we can solve audit.
That was the summary we came to after two and a half years, and it was a real challenging moment
for the company because it was like, you’ve been building this entire tool believing this
is the one problem, and then you get there and realize — someone said, hold my beer,
and you have a totally different problem you have to solve with a completely different skill set.
JACK: I’m still shocked at the point that the streaming services didn’t have
this capability to detect this sort of thing. In the podcast world we have the IAB, which is
a — it’s actually a certifiable way of measuring metrics for podcast listens, and they have a whole
list. They’re like, okay, if a user starts on their phone and then switches to their computer,
is that considered two listens or one? They have to download for over a minute before
they can actually be considered a listen. If it’s streaming on the watch, the watch does things to
grab MP3s very differently than how a computer might. So, it looks like 500 listens when you
come in from a watch, so you have to adjust for that sort of thing. There’s — you can look it up,
how to measure podcasts, which is very complex and complicated downloads. I just
can’t imagine these bigger streaming services not wanting to have accurate download numbers,
especially with paying before that. They must have had a whole team of people trying
to figure this out, and you’re saying, no, they didn’t. It was you that figured it out.
ANDREW: No, they didn’t. At the time major streaming services — enter your streaming
service — had less than half of a person dealing with this. It was probably some data scientist,
and they were mostly using rules-based anomaly detection. So like, did a song get played more
times than literally possible? Like, did someone play a song 10,000 times this week?
JACK: Well, that’s really eye-opening and — it’s hard to believe because when you’re
dealing with money, you have to pay accurately, and — crazy. Like I said,
IAB is a certifiable thing. You can actually pay them to come audit your monitoring,
your statistics, and they’ll confirm it, and then sponsors will be more likely to
pay those numbers ‘cause you could say, no, it’s been confirmed that we’re IAB-certified.
ANDREW: 100%. ‘Cause when I’ve done podcast advertising, I always ask for the certs because
I don’t trust any of the numbers to be real. So, I understand 100 — ‘cause especially in the early
days of podcasting, I feel like it was just like reading tea leaves. Nothing seemed to make sense.
JACK: So, this became Andrew’s pivot. He was able to go to the music-streaming services and convince
them, look, you have some major fraud happening. Here’s proof. They didn’t believe him at first,
so he had to really show them how much fraud there was. They eventually said,
okay, instead of monitoring just those music labels that you’re supposed to,
[music] do you mind looking at all our stream music and see what else you can
discover? That just snowballed. One streaming provider turned into two,
and he kept getting full, unfetted download data from many online streaming platforms.
ANDREW: Yeah, we’re definitely the leader. We’re the market.
JACK: You are such a unique position. I don’t imagine there
even being two companies that have this access compared to — you’re…
ANDREW: We have more data access than anyone in the music industry, especially…
JACK: No, I mean — I mean there’s no other person like you who’s measuring like that.
They don’t say, oh yeah, let’s open this up to 500 companies to come watch our stats
and make sure that we’re accurate. You’re probably the only one for these companies.
ANDREW: We are the only one. [Crosstalk]
JACK: The competition here is zero for you.
ANDREW: Yeah, totally, 100%. In a lot of ways we felt like we made the market. ‘Cause at the time,
I remember going back to the labels and the streaming services and saying,
I think you have a fraud problem. Literally, they laughed at us. Especially the major labels thought
it was less than one percent. Because keep in mind, their artists aren’t cheating. So,
what they see as only their data — and they’re like, there’s no anomalies here. But to them
it just looked like the independent market was growing. I would actually argue that most of the
independent music growth has been from fraud, not from true, independent market share increasing.
JACK: Okay. Yeah, you gave me a taste of a few of these things that you were noticing,
right, people playing things that are humanly impossible to play that much,
and a group of people playing in different regions all at the same time.
ANDREW: Yeah.
JACK: This suddenly sounds to me — ‘cause I come from cybersecurity
world — this suddenly sounds to me like not exactly threat intelligence, but yeah,
it sounds like you’re looking at a security incident tool and trying to build signatures
to detect when there’s a security incident. Just the one that comes to mind for me is if I had
fifty connections from some office all go to the same IP address somewhere from different computers
internally, why did that happen? There might be a botnet in our company that suddenly said,
oh, all phone home at the same time. Get new instructions. So, I would immediately flag
those fifty computers to be like, can someone do an antivirus on those to see what’s going
on here? I was right. There was a botnet on that computer. So, I was like, okay, we’ve got a way to
detect when a botnet happens just by — how in the world did this all happen in the same millisecond,
right? So, I imagine that’s kinda the tools or the signatures. How do you look at this?
ANDREW: 100%. We’re building — we have probably close to 700 models looking for different things,
and it’s constantly changing. [Music] So, to give you examples, we found one where somebody
had hacked a major artist’s delivery feed. So, imagine — it’s very common to have multiple
registration numbers for the same song because it may have been part of an album, a single,
a deluxe version. It could have been done multiple times with different people in the supply chain.
So, what ends up happening a lot of times is the streaming service will concatenate that and pick
one parent and a bunch — child sort of numbers. But that way they’re all grouped together. So, in
this case, someone had hacked the feed, put their version in, but the metadata for that, the pay,
was different than the actual label. So, in this case it looks like the same song, it sounds like
the same song, has the same artwork as the same song, but who the finance team pays is different.
They were able to promote their version as the parent and then manipulate those — the payouts.
So, in that case they stole millions of dollars from that artist over an eight-month period.
When we found it, we found it by some of the ways that they manipulated the streams. Like,
how do you become the parent to your — like, why did this happen right at the beginning? We found
the manipulation early and then it stopped. We were able to identify that there was something
wrong in their data because of their manipulation. Then when we found that, we then built a model to
find other artists it happened to. We found 1,700 other artists that had been hijacked the same way
over the course of a couple years. So, again, they’re constantly being creative. Another one
we found a little over a year and a half ago was a device we had never seen. So, why all of a sudden
is this very specific device running up a bunch of streams? We would normally see what — for example,
the Android system you’re on, what the operating system, what the device is, et cetera. This is
a device we had never seen. It turned out it was owned by the Department of Corrections, and
someone had hacked the prison system and turned all the prison tablets into a streaming farm.
JACK: Wow. Tell me more about that. How did that happen?
ANDREW: I don’t know how they hacked it, but the net effect was that they had turned — I think it
was like, 400,000 devices into a streaming farm where they were manipulating streams
from streaming players. So, I guess — I didn’t even know, to be honest,
that prisoners had devices. But in a lot of states they have — you sort of pay I think
by the minute or whatever. You pay for these devices, and there’s a handful of applications
that are approved. It turns out most of them are run or slash-owned by a private equity
company or a couple private equity companies, and someone had just simply hacked the devices
and were able to use them all in sort of a bot network that we hadn’t expected at the time.
JACK: How did you spot that?
ANDREW: Because the device type was suddenly new and different. We had never — ‘cause
we get all these different — so, why all of a sudden…? In context it seems small,
but we have all these types of community-clustering techniques
that are looking for different parameters and features. So, let’s say that we get,
I don’t know, 500 fields. We’ll get — at this point now from streaming services,
we get all kinds of stuff; gyroscope, battery life, orientation of phone, everything you’ve
done in app. We’re catching a lot of different data, anonymized but individual — but hashed.
JACK: The streaming service app is collecting that and then you’re seeing that as well.
ANDREW: We’re seeing an anonymized version, generally hashed data so that we didn’t have any
PII ever. But that’s — yes, we’re seeing all of this stuff and then triangulating it and saying,
why are all these exactly the same? We’ve never seen this unique device,
so what’s happening here? Then it just turned out that that one device is specifically made
for the Department of Corrections, and no one else buys it. So, it leads you to sort of one vendor,
which then allows you to unravel the rest. So, that was a very interesting case.
JACK: Then what do you do with that? Do you say, okay streaming service,
here’s a device type that we should just not…?
ANDREW: We demonetize it all.
JACK: Yeah?
ANDREW: So we don’t pay any of those streams now…
JACK: But you block that — I mean, not block,
but you demonetize that device type. You can do it that granular or…?
ANDREW: Yeah, for sure. We can say these don’t get paid. I mean,
at the end of every month what happens is we have three sort of primary checks. We check
daily to see what fraud we’re catching so that it gets removed out of product-level stuff. So,
recommendation engines, algorithms, et cetera. We sort of down-weight anything we see that’s
fraudulent so we don’t make the problem worse. The second thing we do is we do weekly updates
for charts, so if we see anything on the charting side, we will — you’re allowed to
update the charts weekly. So, we’ll update the charting information. That’s way less common,
‘cause again, most big artists aren’t cheating, at least from the streaming side. But again,
we sort of just safeguard that. Then the last one, which is the real one, is the money payout. So,
at the end of the — at the end of every month we do the check for the entire month. ‘Cause
there’s stuff we’ll catch, right? The really obvious fraud we’ll catch day one.
But there’s some fraud that takes us a long — you need more of a longitudinal view to see how
they’re interacting over the course of a week, two weeks, three weeks. There’s all kinds of cases,
for example, that when we first started we would catch that no longer happens anymore. So,
in the early days, I’m guessing his engineers were lazy. Or, it’s just easy — like,
how do you deal with checking for anomaly detections for months where they have
different days of the month? So, what we often — or, you know, they have twenty-nine days,
twenty-eight days, thirty days, thirty-one days. So, a lot of times what they would do at the end
of the month is pull the first twenty-eight days. I don’t know how fraudsters figured this out,
but starting on Day 29, they would jam all their bots. So, you’d see massive numbers; 29, 30, 31.
So, they would end up getting a large percentage of the pro rata pool, but they only ran their
fraud at the end to sort of get away from whatever was being checked, ‘cause a lot
of the anomaly-detection checks initially in the early days were the first 28 days,
just to simplify it. So, again, we find all these weird sort of techniques that they would use,
and we would shut them down or demonetize them. In some cases the streaming services,
when we returned the data back, they take action. So,
sometimes the streaming service will decide to completely remove all the content and
just say this is all fraudulent. So, in this case, for example, really obvious stuff. So,
less than a hundred real users have streamed this. 99.99% of all of their streams, historically,
are from fake accounts. You know, maybe they have less than a total of 2,000 streams total.
Whatever it is, they’re gonna have these rule sets we have in place to make sure it’s only
the worst of the worst fraud, and then we’ll — the streaming service will just straight
remove that content or take it off the platform entirely. That seems to be incredibly effective
because the fraudsters realize they’re caught and they just stop on that or go to different
services. So, I think our approach has been less — I’m not naive enough to believe we’ll
always stop fraud. I think historically you can look at all fraud and say that’s never the
case. There’s always going to be smart people and they’re gonna try different techniques.
But I think we can make it so difficult that they just go to other industries.
JACK: [Music] It’s so interesting for me to listen to him talk,
because this isn’t a cybersecurity story, yet everything he’s saying is exactly what happens
in cybersecurity land. You set up monitoring tools, you build rules to detect problems,
and then you make it harder for people to exploit those things again. They did it all
from scratch. We all know in cybersecurity you can never stop hackers, but what you want to
do is make it so hard for them that they move on to an easier target. That’s something I’ve heard
again and again, yet that’s what he’s doing in this world. Some people always reach out to me
and complain that when I do an episode that’s not cybersecurity-related that they get upset.
But listen, this show is about the dark side of the internet. To me, that encapsulates way
more than just cybersecurity. It’s about all the hidden stuff that you never see or experience.
I want to shine a light on that shady, dark, gritty, underground aspect of our digital life.
The fraud and the manipulation of algorithms, the websites and technology, the people who abuse it,
and of course, hacking in cybersecurity, too. [To Andrew] I was trying to find a link I had
a long time ago. There was a — I’ve actually seen many Reddit posts where people are saying,
hey, what’s up with my Spotify account? It suddenly shows that I’ve played a whole bunch
of these artists that I’ve never even heard of much less played. I don’t understand why
my Spotify is showing that I’ve played these, and it’s recommending all this other stuff.
ANDREW: Account takeovers. That’s a huge percentage of what we see now. If you
think about — you’re in cyber, so imagine it’s a giant arrow back to you. If all of your bots look
the same, it’s easy to cluster them. If they’re behaving the same way, it’s easy to cluster them.
If they are all streaming one artist specifically, it’s like a giant arrow back to that artist.
If they’re all streaming from one distributor, it’s a giant arrow back to the distributor. So,
you need to hide the needle in the haystack, and the easiest way today to do that, or what
we’ve — I’d say for the last three years put a lot of R&D in to catch, is account takeovers. So,
they’ll log in as you, play a song five or six times, and then leave. Then all of this stuff
you do naturally just hides whatever they did. So, they don’t have to create that. They don’t
need to make differences. You don’t need to program in artificial changes in your bots.
You just basically log in as somebody, play five streams, and hope they don’t notice. I would say
that that’s really common these days. That’s the number-one growth area for fraud that we catch,
is account takeovers in general, or adding devices to family plans. So, we’ll see a device
that’s an IOS that’s legit, a Tesla that’s legit, and then an Android that’s all fraud.
JACK: Wow. Okay, so, what I don’t understand is how they’re taking
over the accounts. You say it’s one of the biggest things you’re seeing.
How are they getting so many Spotify accounts or whatever streaming service?
ANDREW: So, there’s a couple ways. The simplistic ways are — 90% of internet log-ins are just people
trying different data-breached passwords and usernames. I would say that most streaming
services are not high on people’s priority list for protecting. So — and there’s a sort
of product question about how much friction do you add into a service to make it difficult for users,
‘cause it hinders growth, right? So, I think there’s an interesting friction point there
between how secure do you make a streaming service on the user end and how much do they
actually care, and do they really care if your account that was used to play a song ten or
twenty times? I don’t think they’re realizing how much damage it does in aggregate. So,
there’s that issue, I would say. I mean, you’ve been on — your whole series is called
Darknet Diaries. You get on the darknet and download these accounts quite easily.
I think at one point, to prove a point, we went on and downloaded and showed people,
some executives, that I could get 100,000 accounts on every single streaming service immediately. It
gives you the independent — the infection date and the last log-in date. You can even get — if
they have malware on the actual device, you can even get all of the browsing history, too. So,
if you want to warm up the IP before you use it, you can kind of mimic their behavior before
you log in. There’s lots of this stuff existing. There’s also an API that we found in the darknet
where they own tens of millions of these accounts, and they will spin them up for you. So, you
basically tell them the parameters of the types of plays you need, and they make sure that no single
account is overused or indexed too hard, and they actually create the fraud for you. [Music] So,
it is a fully professionalized, industrialized supply chain for fraud at this point.
JACK: Wow. Seriously, wow. He’s shown streaming service execs that he can get 100,000 accounts on
their platform instantly, because after a data breach there’s communities of people who will
parse through those usernames in the data breach and pluck out all the streaming service accounts,
or even try to use those usernames and passwords on a streaming service to see if they reuse
passwords. From that, they build the giant list of users for each streaming service, and that
list is valuable because if you can manipulate the streams, then you can get paid by these streaming
services. I’m just astonished because when I hear how bad the problem is like this and how
easy it is for people to get access to our stuff, it’s like a cold, wet slap in my face. I kinda go
through this process again and again when making the show. At the beginning of this episode I’m
like, ooh, these are some interesting techniques. Maybe I’ll try one of these on my show.
But by this point of the story, I’m so mad that these companies aren’t protecting our
data and it’s just exposed on the dark web only for fraudsters to use to make money
for themselves off my account. Because it’s our data; it’s not some nameless victim out
there. It’s yours and mine that these people are gaining from. I’ve done this show long enough to
know that there is no way from keeping our data from getting leaked, which makes me black-pilled,
right? Like, okay, I’m giving up. Oh well, my data’s out there. I might as well just assume I
have no privacy anymore because it’s out there like, all over the place. I just totally give
up protecting myself. But I don’t like feeling hopeless. I’m not someone who gives up forever.
I’m an optimist. I’m a fighter, and I don’t mind hard work. So, then I get this surge of ideas,
and it makes me white-pilled, because then I realize, wait a minute, who’s the ding-dong who
told them my address and gave them my password and username and telephone number and all that stuff?
I am. Hell no. No more am I telling these companies my real name or phone number.
I’m not going to reuse passwords or even reuse e-mail addresses anymore. It’s a war out there,
and I’ve got to take care of my own data since no one else will. Okay, anyway,
the name of the company that Andrew co-founded was called Beatdapp in order to analyze music streams
to detect fraud. He abandoned the original idea of using the blockchain to help these
labels get paid properly, and he focus on this now, pretty much entirely working for streaming
services now. [To Andrew] Yeah, well, I guess what I’m wondering is you almost need a black-hat
person who knows that, the cheating industry, who’s been there, to actually sit down and look
for these — to look for things you haven’t found yet, right? To find new signatures.
ANDREW: Totally agree. I think I’m that guy, probably. Yeah. You know,
the music industry often said I’m their hacker now. I’ve switched sides. I think
the side-switching is mostly industries. I would say the — for me, the difference is
that users no longer have to actually engage with the content for that artist to get paid.
What I did back in the day I really believe was in service of the artist. If the artist is good,
the people will listen, consume, and adopt it. If the artist is not, they will let you know right
away that it’s trash. I think that has changed in a sense that you can be a trash artist that
manipulates lots of streams and gets paid without actually being good or having real users or being
able to sell ten tickets to an event. So, I just think they’re now stealing from other artists.
JACK: Yeah. So, you’re saying it’s now more of a financially-driven thing and not so much a let’s
try to market this person and get them to break out. But I push back at you because you did that
ad arbitrage where you’re like, hey, we could print money by charging this much CPM and then
actually just paying for somebody to come here. So, you were financially driven in some aspects,
as well. It wasn’t always, oh, let’s just market someone.
ANDREW: I regret that, and thank god that the Statute of Limitations has passed,
‘cause it was definitely not my proudest moment, for sure.
JACK: What I didn’t realize is that musicians don’t get paid per stream on these platforms.
Instead, they get paid a percentage of what advertising revenue came in for that month,
which means fraudsters are stealing money from real artists.
ANDREW: Okay, so, the way the music industry works is that there’s one — I’m gonna simplify
this ‘cause it’s little more nuanced, but generally speaking there’s one pool of capital.
Every month a streaming service makes money from advertising revenue and subscription fees. Now,
this money goes into one pot, and it’s paid out every month based on play count. So, if you’re a
artist and you make — you did, let’s say, 100,000 streams, and that streaming service did a million
total streams that month, you get 10% of that pot. You get your percentage of streams for the whole
entire — of the whole, entire streaming ecosystem you’re in of the revenue. So,
it’s a performance pro rata. What happens is you could release a song in November and do a
million streams and get paid $3,000, and that’s correct. You could release the same song and
do a million streams in February and get paid, I don’t know, $500, and that could also be correct.
The reason the numbers could be different is that month the advertising might be
smaller because they’d spent — especially as February or January, they had spent a
bunch of money for Black Friday and holidays, and advertisers weren’t spending as much in January,
February. You could have less subscribers. You could also have had a major release. So,
say Taylor Swift released a track or an album, and all of a sudden the majority of streams
are going to Taylor Swift, then your pro rata goes down. So, you could actually have wildly
different amounts of money you make for the same general performance because it’s a performance
base relative to the entire industry. So, if you do one of ten streams, you get 10%. If you do one
of twenty streams, you get 5%, and so on. So, why that matters and how you steal is that fraudsters
will load millions of songs onto streaming services as if they’re independent artists.
[Music] They’ll create different independent artists’ names, different independent artist
labels, they’ll put them in different parts of the world so it just looks like they’re from different
people, different regions, different companies. They will load those direct do-it-yourself,
like DIY to streaming services through distributors. So, the distributor is an
aggregator who, if you’re an independent artist, you upload to like a DistroKid or a TuneCore or
a Symphonic or whatever, and they basically put all the data together and all the pieces
together and upload it to the streaming services for you. So, they do it in one shop for you. So,
instead of you going and uploading to a hundred different streaming services,
you go to this one provider and they aggregate it and put it on to all the stores for you.
So, these fraudsters will create fake artists, fake labels, they’ll use fifteen
or twenty different distributors so there’s not one point of failure,
they’ll upload — so, they’ll get millions of songs onto streaming services, and then here’s the key;
they will play a bunch of these songs small amounts of times. They do not want to get
noticed. You don’t want an artist that charts that’s not real. You want to generate 1,000,
3,000, 4,000 streams, but you don’t actually — no one notices the song with 3,000 plays. So,
if you create a small number of streams across a large number of artists,
then your aggregate pro rata, the amount that you actually have of all of the pools for that month,
can dramatically increase, ‘cause you’re stealing pennies. It’s basically like Office Space. You’re
stealing pennies from all of these different artists. They just don’t realize it. But in
aggregate it’s a large amount of money. So, the way that it works today is about $3 billion worth
is stolen from real artists, because it’s going to people that are not real artists.
JACK: Wow, $3 billion is going to fraudsters who are manipulating these streaming platforms. That’s
incredible. It’s apparently very profitable to go through all this process of making tons
of songs and getting someone else to play those songs across hundreds of thousands of accounts.
It seems like a lot of work, but man, it’s really paying off for them. If it’s paying off,
then that means it’s only gonna grow. [To Andrew] So, a few times
you’ve made my — the hair on my neck stand up when — ‘cause I’m a big privacy advocate,
right? I’m crazy into it. I’m a freak about it. So, you’ve talked about some of the
metrics you’re getting from some of these apps such as gyroscope and battery life.
As a privacy person, I don’t understand why I need — you need to get my gyroscope information
in order to just let me play a song. But on the other side, when I went to actually take ads out
on some of these platforms to say, hey, market a legitimate ad on the platform, they’ll ask you,
hey, when do you want someone to listen to this ad? Do you want them to listen while
they’re working out, while they’re having sex, when they’re making dinner? I’m like,
how the heck do you know when someone is making dinner? What is going on here? So,
the amount of information that these streaming platforms have on us is crazy. I don’t know what
question I have, but it just — like I said, it makes my hair stand up.
ANDREW: I agree, but I would say for us, just know that in most cases they treat that
data like it is the most important — I mean, they treat it — having come from healthcare
in the previous company, they treated it at a level way higher than healthcare, like crazy,
like HIPAA compliant times ten. They are insane with this data. They hash everything. They’re very
particular about how it gets to us, how it gets back. We get security audited. We have an entire
internal security team. It is — it’s partitioned in lots of ways so even if you get to one piece,
you can’t get to the rest. We are insane because they make us be insane with
it. Again, at the end of the quarter, you’re like, it’s just streaming data. But people
are stealing $3 billion a year. So, that’s a massive amount of money that is going sometimes
to people like terrorist organizations and organized crime, not some kid in a basement.
So, the argument also is I think that there’s some large-level implications for where this
money goes and what happens, but I will say that the streaming service side treats that
data — whether or not you want them to have it, they treat it like it’s very,
very important. I’ve never come across a streaming service that casually allows data. Even then,
when we decide exactly what fields we need from different streaming services,
we then reject the rest of the fields. We take the least amount that we need to do our job once
we’ve built the models, and then if we built a new model or find a new thing that we need to do,
we re-ingest that data and build again. But we don’t typically just sit on all this stuff,
even if it’s anonymized, because we just don’t want it. So, again, my point is I feel they’ve
been very responsible with it, if that makes you feel any better, even though they haven’t.
JACK: You said terrorist organizations?
ANDREW: [Music] Yeah. Imagine that you could move money through a streaming
platform without anyone noticing. So, what you do is you take dollars,
you turn it into crypto at crypto ATMs, you pay the streaming farm operators in cryptocurrency to
stream a certain amount of songs. Those songs are owned by different entities globally. So,
quite literally you could move money from Colombia to Doha through the streaming service. It’ll all
be washed and clean through the streaming services themselves, directly funding terrorist activity.
JACK: So, the artist that they’re playing is an
artist that they’re controlling because they’re getting paid…
ANDREW: They’re making fake artists. They’re putting fake artists’ names up. They’re taking
music that’s not theirs. So, they might hack, for example, Dropbox accounts. ‘Cause you figure one
out of every hundred songs typically an artist releases — so there’s a huge back catalog of
artist songs that have never actually been distributed, and when they’re distributed is
when they’re fingerprinted. So, a lot of these don’t have fingerprints. So,
if you upload them and there’s no fingerprint, the streaming service and the distributor
feels that you are the rightful owner of that song ‘cause they’ve never seen it before. So,
now you can take old songs that have never been digitized, make them your own,
and then manipulate the stream. So, the first step is just getting the music.
The second step is manipulating the streams so you get paid. If you were a terrorist organization and
you build all this infrastructure, you might have literally let’s say thirty different music label
entities around the world all using different distributors with, I don’t know, a hundred quote,
unquote “independent artists” in each, and then you’re going to just run small numbers of streams
to those on a hundred different streaming services and slowly get paid. But that money will be clean
and end up from one location to another without you ever having to actually transport the cash.
JACK: You think that’s…? I mean, looking at those numbers,
how much cash do you think they’re transporting? 80…?
ANDREW: Hundreds of millions of dollars.
JACK: Well, I was gonna guess a percentage here, right? So like,
if I have $100 million and I say I need to transfer this, 80% of it makes it?
ANDREW: Oh, percentage-wise of the dollar? Like 40% to 50%.
JACK: Yeah, ‘cause it’s not — see,
this is — they’re losing a ton of money on — in the transfer, then.
ANDREW: But it’s better than leaving it in cash. Honestly, that’s what typically — how do you move
this much cash? They’re gonna pay someone to wash their money regardless, sometimes 20%,
25%. They’re gonna pay a large amount of money anyway. Then they still need to move that money
and sort of pay taxes on that money when it ends up — you end up losing a lot anyway. So your other
approach is just to hide it somewhere or keep it as cash and find other fronts to move it through.
It actually ends up that over the last ten years, the music industry, as it was growing so fast,
was a really opportunistic place to hide or wash money because no one was watching it.
JACK: Now I think I’ve come full circle on you saying you were gray hat, because I was saying to
myself, if you’re breaking the terms of service, it’s black hat. Now I’m like, wait a minute,
if you’re breaking the law, that’s black hat. This is different than terms of service.
ANDREW: Yeah, that’s how I feel, you know? I didn’t break laws. I
just definitely didn’t agree that I wasn’t allowed to do something.
JACK: Yeah, and now it’s getting crazy,
where hundreds of millions of dollars are being sent from — from who? Who’s involved in this?
ANDREW: Well, imagine any kind of illicit activity; you can move the money to your
partners. You can send — how we potentially caught one, for example, is you’d see the
exact same percentage — like, let’s say that you have a million users all playing music. I’m just
gonna use Colombia as an example. But they’re — the beneficial — if you think about who the
artists are that’s benefiting from those plays, it would be abnormal — in one case, for example,
where we saw — I’ll give you — I don’t know the exact numbers so I’m gonna give you examples here;
like 12% always in a Hong Kong entity, and 30% in a Canadian entity, and 40% in a Middle-Eastern
entity, and, you know, maybe another 10% somewhere else. So, if all the numbers of streams are
changing every month but the beneficial owner percentage is exactly the same, it looks as
if someone’s moving money from one location to another location through these other entities.
JACK: So, the moving part is that they’re paying bots or listening to a stream…
ANDREW: Yeah, they’re paying a streaming farm to create the streams whether they’re doing it
through account takeovers or bots or whatever, but the end result is they’ve uploaded as owners under
these different entities all of these fake artists that have songs on the streaming services. There’s
roughly a hundred streaming services globally. So, they’re uploading it onto all these streaming
services and they’re telling these streaming farms to go play those songs across all the services.
JACK: Then the person who owns that account is getting paid for their streams,
and then the money is arriving to where they need to send it.
ANDREW: Yeah, exactly, because now the streaming service thinks, oh,
XYZ label in Hong Kong had X percentage of the total streams. We have to pay them out. So,
it gets paid to the distributor and paid to them, and they just get paid.
JACK: This is one of those stories that I feel like the floor has dropped out in my head,
of like, oh yeah, we have — I have a good understanding of how money laundering happens
and how things get sent here and there and how you clean money. But then when you hear about
stories like this where, oh yeah, they’re using a streaming service to launder money and send
it across the globe, suddenly my head’s like, well, you could do that with buying
and selling things on the Steam marketplace or Roblox accounts or any other marketplace
that has money shifted here and there. This isn’t even a straightforward like — here,
I’m buying something from another user. This is, oh, they’ll pay us for streams. If we
can get the streams, then we can get paid. It’s such a roundabout way of — a convoluted
way to launder money that it’s blowing my mind and it just makes me think that every
single place that has money going in and out is probably getting hit with something like this.
ANDREW: 100% agree. I think the more convoluted, the better for them,
‘cause it’s so much harder for the average person to understand how the money moves.
JACK: ‘Cause I mean, even something like Twitter is — you get paid for
how much engagement you have, right? So, you could totally…
ANDREW: Oh, yeah. Any of these engagement-based activities, especially in Web3, anything at the
time — a couple years ago there was this big push with treasury tokens. So, you’d get paid
every time people interacted with you on social five platforms or any of these game 5 stuff.
You could manipulate all of this stuff and then get the tokens, take it to market, and sell it.
JACK: It’s crazy to me that there’s a dark web API that has
access to millions of online streaming accounts, and if you feed it money,
you can get all your songs played a bunch. I bet whoever runs that hates Andrew.
ANDREW: I mean, I’ve had a couple of them do crazy stuff like reaching out or say things. But I would
say that generally — we were talking once — our lawyer for the company is this guy named
Jim Trustee. He was the former Chief of Organized Crime for the DOJ. He told me once that the good
news is they don’t typically shoot the border guards. It’s kind of a gentleman’s sport. So,
I would say that most of them just changed their tactics and changed the way they behaved. I also
think the industry has progressed. In the early days there was some real trepidation
or fear around what happens, ‘cause we’re just a handful of people that know what’s
going on here. I would say now every single streaming service has a trust
and safety department. Every single stream label has a fraud trust and safety person. So,
the industry has changed over the last three years in a way that I would say
I feel less scared about. Like, if you did something to me or my co-founders,
it’s not going away at this point. The cat’s out of the bag. But I would say there was a
real moment in the early 2021, 2022 where we were actually very concerned about what happens if…
JACK: Yeah, I mean, especially if you’ve got cartels that are moving money in big ways and
you’re like, okay, let’s put a stop to these guys. I could see them being upset with you.
ANDREW: I mean, that was my concern, but again, I think we sort of — whether
or not it was naive at the time, it was more like, oh, well, they don’t normally
shoot the border guards. They just find a different way to move the money, you know?
JACK: Do you ever point the feds to someone and be like, hey,
these guys are breaking a lot of laws? Like, I don’t know, the dark web API
or cartels moving money. We’ve gotta report this to someone more than just the streaming service.
ANDREW: Yeah, in some cases when we find things that are outside the data that is given to us
in privacy, then sure, we might tell people. But generally speaking, we report the results
back to the streaming services and then they determine — and the distributors, for example,
and the collection societies, right? They determine then who to — who they want to work
with on the government’s side to prosecute, ‘cause that’s typically a long road, three to five years,
sometimes — especially in multiple countries you’ve gotta deal with Interpol and all kinds
of different activities. So, I think — I would say that’s an area that’s emerging,
but we provide all the evidence that they need, and then they — and help them package
it to whoever agency they’re going to. But typically they are the ones that
are the ones actually determining whether or not they’re gonna pursue it.
JACK: Okay, I’m now changing my mind. What Andrew did when he was younger I used to
say was black-hat marketing, but now I’m gonna say he was doing gray-hat marketing.
Aside from the ad arbitrage stuff, all he did was violate the terms of use on websites
like Facebook and YouTube by artificially inflating the numbers. Coming into this,
I would have said that’s black hat, but not now. Now I think these cartels or terrorist
organizations that are moving hundreds of millions of dollars through these streaming platforms,
that’s black-hat marketing. That’s some real dark stuff. Any time these streaming services
have to call the authorities on someone, that’s what I think is black-hat marketing
at this point. I suppose because now that I’ve seen such an extreme side of this marketing,
I’m no longer so judgmental about somebody having a bunch of fake followers on their account to help
them break out. Because really, the fake followers and algorithm manipulation can only go so far.
If they’re a bad musician or whatever it is they’re creating, they’ll never take off no
matter how many fake streams they get. But if they are great and people really love them,
then that was just a growth-hacking technique to kick start their journey. After they break out,
there’s no longer a need for all the fake followers. You do run the risk of getting
banned off those platforms, so I don’t recommend doing it. But now that I think about it, banning
users is really tricky, because suppose Twitter has a way to detect when there are fake followers,
right, and they automatically ban someone if they have — like 60% of their followers are fake. Well,
then imagine someone gets millions of fake followers to follow Elon,
and he gets kicked off for having a majority of fake followers following him. You see, you
can use these bans as a weapon to get someone else banned that you don’t like. So, banning users for
having a bunch of bots following them is really, really tricky, and maybe you can’t even do it.
[To Andrew] With all this information you have,
you’ve gotta have probably some sort of restriction on what you’re allowed to say, because
if there is — you can see who the top artist of the day is. You have so much data. You could see
how many streams are getting — and all this sort of stuff. Magazines like — I don’t know Pitchfork,
but whoever is the music industry magazines would love to know who’s the top streamer of the day or
week or month or something like that. A lot of the stuff is kept quiet. We get to see some statistics
of what — how many downloads a song has, but we don’t see very much of that. You could have such
an outstanding blog of like, here’s what’s going on today, and people would just flock
to it. It would be huge, but you’re probably not allowed to share that kind of information.
ANDREW: It’s our core promise to all of our vendors. Like, you give us your data;
we do not monetize it in that way. So, we provide you results back as a true financial tool and
a trust-and-safety tool. We do not monetize it in any kind of marketing, any type of market
reports. We will not monetize the data they provide us. They pay us an annual service fee
so that we aren’t incentivized to find more fraud than there is. If there’s not a lot of fraud,
we tell them. If there’s a lot of fraud, we tell them. We are just the trusted source of truth,
but we do not — we don’t monetize that data in any way. Yes, we could probably build a massive
company, but I’m not sure they would trust us in the same way. I think that’s why a lot of these
marketing-level companies that do aggregate data, they get very limited data sets because
they — the biggest fear for these services is the state of being public or going other places. So,
we are allowed — we are privileged enough to handle it because we’ve built a large and strong
level of trust with all of our partners, and they know that we would never violate that trust.
JACK: Yeah, at first I was thinking as well of like, oh, you’re saving all these streaming
companies money by saying, hey, don’t pay these people ‘cause they’re not doing it.
But now — but at the beginning you told me, no, there’s a big pool and a percentage goes
out to whoever gets the streams. So, I don’t think you’re saving these streaming companies
any money at all because they have to pay out 100% every month or whatever.
ANDREW: Yeah.
JACK: Whether it goes to the right person or the wrong person…
ANDREW: We’re a cost of doing business for them.
JACK: Okay.
ANDREW: We’re a cost of doing business for them. I would say in some cases they save money. So,
there’s — this is where it gets nuanced. What I’ve been talking a lot about is what’s called
interactive streams, where people get to choose what song they listen to. But in cases where it’s
non-interactive — think of it like online radio — they have to pay a set rate out. There’s a rate
card that’s in. So, when you remove the fraud from those, they actually do save money. So,
in some cases, in some areas they’ll save money, but I would say generally across the board,
they’re probably not not making money off of us if they’re interactive. So, if they offer
a service where you get to choose what you listen to, they’re probably not making money off of us.
But they also — if I’m being honest — don’t want to be the executive who’s blocked for funding
terrorism. So, there is an existential risk. Also, you figure the major labels are huge victims here.
Keep in mind, if you’re a major label, you own and distribute probably over 80% of all
revenue-generating content. Not just all content but revenue-generating content like royalties
are coming primarily from the major labels or the independent labels they distribute as a major. So,
when you look at it as a whole, if you’re a streaming service and 80% of the things people are
listening to are controlled by these three parties and they’re saying we’re tired of being victims;
if you do not have a service like this, you cannot have our content, it moves a lot of needles.
JACK: Wow. Well, this — so much of this was so illuminating to me. I did not know about
this world much at all. I told you what I do know, and it was a few things here and there, but man,
there was so much I’ve learned here. Thanks so much for coming and telling me all this.
ANDREW: Yeah, thanks for having me on. It’s been really fun. Again,
I appreciate you making the time for me.
(Outro): [Outro music] This show is created by me, the hashed brown Jack Rhysider. Our editor
is our friendly sysadmin Tristan Ledger, mixing done by Proximity Sound, and our intro music is
by the mysterious Breakmaster Cylinder. I don’t know about you, but the next time someone makes
fun of me for the music I listen to, I have the perfect excuse; oh no, my account’s been hijacked!
It plays random stuff, I swear! I can’t stand this band. You kidding me? This is Darknet Diaries.