WEBVTT

00:00:00.000 --> 00:00:05.920
JACK: I love a good spy story. It’s so intriguing for me to think that someone among us might not

00:00:05.920 --> 00:00:10.600
be who we think they are. They’re fake in their name, their background, and their purpose trying

00:00:10.600 --> 00:00:15.560
to get information of some kind. It’s always interesting to see what kind of methods these

00:00:15.560 --> 00:00:20.480
people use to communicate right in plain sight, but to the untrained eye, you have no idea that

00:00:20.480 --> 00:00:24.600
a message was being sent. Like, for instance, there’s been times when spies would tie their

00:00:24.600 --> 00:00:30.080
shoelaces in a specific way to communicate certain things. So like, if your shoelaces

00:00:30.080 --> 00:00:34.640
had extra knots in them, it could mean something like don’t approach me, or if the shoe was tied

00:00:34.640 --> 00:00:40.160
with laces crossed over it or under it, that might mean okay, all clear; come give me the message.

00:00:40.160 --> 00:00:44.720
Or maybe if the shoe was untied, it means you’ve been spotted; get out. What’s cool

00:00:44.720 --> 00:00:49.480
about this trick is you can have one message on one shoe and a different message on another.

00:00:49.480 --> 00:00:53.360
This way the person could send a different message depending on the situation. Like,

00:00:53.360 --> 00:00:57.320
if one shoe said wait and the other shoe said all clear, the person could just put

00:00:57.320 --> 00:01:01.920
out their shoe that had the right message on it at the time and cover up the other shoe somehow,

00:01:01.920 --> 00:01:07.120
like by sitting on it or something. I love hearing about spy tricks and methods that

00:01:07.120 --> 00:01:17.257
they call trade craft, and in this episode, we’ll hear a story about a spy and how they operate.

00:01:17.257 --> 00:01:48.272
(INTRO): [INTRO MUSIC] These are true stories from the dark side of

00:01:48.272 --> 00:01:52.752
you, it’s crazy. In fact, I’m pretty sure I’m not gonna be able to fit it all in one episode,

00:01:52.752 --> 00:01:58.512
so this is just gonna be a two-parter. But yeah, seriously, where do I even start? Okay,

00:01:58.512 --> 00:02:03.432
okay, I’ll start with my favorite part which is not the beginning of the story. Alright,

00:02:03.432 --> 00:02:08.312
so one day on Twitter I got this message from a guy named Igor. He said, I listen

00:02:08.312 --> 00:02:12.712
to your episodes. Very good pods. Then he says, if I can ever help with anything,

00:02:12.712 --> 00:02:19.072
let me know. I said okay, thanks. Well, what are you good at? He says he does surveillance

00:02:19.072 --> 00:02:24.192
in New York City. While I don’t need anyone to do surveillance for me in New York City,

00:02:24.192 --> 00:02:28.032
I was immediately curious to hear more, so I called him up.

00:02:28.032 --> 00:02:28.872
IGOR: Hello?

00:02:28.872 --> 00:02:31.822
JACK: Hey. This is Jack.

00:02:31.822 --> 00:02:32.192
IGOR: Hi, how are?

00:02:32.192 --> 00:02:32.472
JACK: Igor?

00:02:32.472 --> 00:02:36.252
IGOR: Yeah, this is Igor. Nice to meet you.

00:02:36.252 --> 00:02:40.832
JACK: Nice to meet you, too. What are you doing now?

00:02:40.832 --> 00:02:46.452
IGOR: Right now I’m sitting in my car in Queens in New York. I’m on the surveillance, just waiting.

00:02:46.452 --> 00:02:47.952
JACK: What are you surveiling?

00:02:47.952 --> 00:02:52.952
IGOR: Oh, this is a – an insurance defense job,

00:02:52.952 --> 00:03:01.312
so we’re waiting for a guy who has claimed an injury and he’s receiving some benefits

00:03:01.312 --> 00:03:06.592
from the insurance carrier, and they want to see how he’s actually physically doing,

00:03:06.592 --> 00:03:14.552
if it’s true with what he’s claiming. Their goal is to see exactly what’s the real situation,

00:03:14.552 --> 00:03:20.112
and then if it doesn’t match, they have a reason to offer him less money or jam him in

00:03:20.112 --> 00:03:26.992
the corner and tell him they’re not gonna give him anything, or decline his claim, et cetera.

00:03:26.992 --> 00:03:29.652
JACK: How can you do that and talk on the phone at the same time?

00:03:29.652 --> 00:03:32.872
IGOR: Right now, the person I’m watching, he’s inside his house,

00:03:32.872 --> 00:03:38.392
so I’m waiting for him to leave. Until he comes out of his house, gets in his car,

00:03:38.392 --> 00:03:44.832
starts the car – I know him already, so he warms up the car. So, I’ll have about five,

00:03:44.832 --> 00:03:51.032
six minutes to react. I’ll be able to say Jack, I’m gonna have to go in a few minutes. But I’m

00:03:51.032 --> 00:03:57.418
also working with another guy, so we have two sets of eyes on the house and the car.

00:03:57.418 --> 00:04:02.072
JACK: [MUSIC] That’s how I met Igor. Igor’s a Ukrainian immigrant and he’s a private eye in

00:04:02.072 --> 00:04:06.512
New York City; sitting in cars, watching people and buildings. That’s what he does

00:04:06.512 --> 00:04:13.712
all day and sometimes all night. He sees a lot. Naturally, I was curious and fascinated. I asked

00:04:13.712 --> 00:04:19.672
if he has any interesting stories from doing this kind of work and oh boy, does he ever.

00:04:19.672 --> 00:04:25.512
IGOR: So, I was working with a friend of mine, a guy I knew for many years,

00:04:25.512 --> 00:04:30.472
as a subcontractor. We were working for Black Cube which is an Israeli intelligence company.

00:04:30.472 --> 00:04:37.912
JACK: Wait, what? Black Cube, the Israeli intelligence company? I’m not familiar with them,

00:04:37.912 --> 00:04:43.692
so let’s take a quick detour and listen to some news clips to hear who Black Cube is.

00:04:43.692 --> 00:04:48.232
ILANA: Behind a heavy locked door, a high-tech environment,

00:04:48.232 --> 00:04:52.992
and also the salary and benefits of the group of brilliant people who sit there,

00:04:52.992 --> 00:04:57.552
some of them are graduates of the Mossad and other classified units. But the product which

00:04:57.552 --> 00:05:01.912
they are producing can be dark and much more dangerous [00:05:00] than what they imagined.

00:05:01.912 --> 00:05:06.432
They are called Black Cube and their official goal is to provide business intelligence.

00:05:06.432 --> 00:05:11.592
JACK: That was a clip from the Israeli TV show Uvda, and the reporter is Ilana

00:05:11.592 --> 00:05:16.472
Dayan. In that episode, she revealed that Black Cube was hired by people to carry out different

00:05:16.472 --> 00:05:22.232
spying campaigns. Like, sometimes billionaires hire Black Cube to spy on political opponents.

00:05:22.232 --> 00:05:27.112
Sometimes foreign countries will hire Black Cube to spy on their adversaries. But in this case,

00:05:27.112 --> 00:05:32.952
Black Cube was contacting Igor’s boss to do some spying for them. This is likely

00:05:32.952 --> 00:05:37.632
because Black Cube probably doesn’t have permission to do surveillance in New York,

00:05:37.632 --> 00:05:43.792
so they contracted the work to two New York surveillance guys; Igor and his boss. See,

00:05:43.792 --> 00:05:47.952
Igor did not know he was working for Black Cube at this point. He was just working for a guy

00:05:47.952 --> 00:05:53.432
named Roman Khaykin, and it was this Khaykin guy who was being contracted by Black Cube.

00:05:53.432 --> 00:05:59.432
IGOR: We were doing different types of jobs for them, all involving some form of surveillance,

00:05:59.432 --> 00:06:05.212
and at some point they assigned us to follow Ronan Farrow and Jodi Kantor.

00:06:05.212 --> 00:06:09.432
JACK: Whoa, wait a minute these are some famous names I recognize. Ronan Farrow

00:06:09.432 --> 00:06:13.272
is a journalist for the New Yorker and Jody Kantor is a journalist for

00:06:13.272 --> 00:06:18.312
the New York Times. And Ronan Farrows parents are Mia Farrow and Woody Allen.

00:06:18.312 --> 00:06:31.892
IGOR: My boss Roman Khaykin sent me the pictures with the pin drops.

00:06:31.892 --> 00:06:35.672
JACK: Pin drops are locations on a map where these two people are.

00:06:35.672 --> 00:06:43.232
IGOR: I was sitting on Jodi’s Kantor’s house and while I was at Jodi Kantor’s house,

00:06:43.232 --> 00:06:51.352
Khaykin messaged me and says hey, the client has new information. You need to go to the city.

00:06:51.352 --> 00:06:58.032
We’re gonna try to get Ronan Farrow’s location, so let’s meet in the city. I’m at a dentist.

00:06:58.032 --> 00:07:04.512
Once we get his location, we’ll go from there. I said okay, cool. I’ll head to the city. We made

00:07:04.512 --> 00:07:10.312
a little plan, like, I’ll head to Ronan Farrow’s house, and Khaykin would come to the city and he

00:07:10.312 --> 00:07:16.192
would go to the area closer to downtown, so we would kind of – whenever we got the location,

00:07:16.192 --> 00:07:20.906
we would not be too far away from any potential spot where Farrow may be.

00:07:20.906 --> 00:07:23.352
JACK: They were expecting more pin drops from Black Cube to

00:07:23.352 --> 00:07:25.972
know the exact location of where Ronan Farrow was.

00:07:25.972 --> 00:07:30.752
IGOR: You know, Black Cube is a private intelligence company, so they operate in a

00:07:30.752 --> 00:07:37.552
compartmentalized kind of basis. Khaykin wouldn’t tell me exactly where they’re coming from,

00:07:37.552 --> 00:07:45.072
but he explained the method to me. The method was that a text message with some sort of an

00:07:45.072 --> 00:07:52.472
annoying spam would be sent to Ronan Farrow. Farrow would be offered two options. Yes,

00:07:52.472 --> 00:07:59.392
they receive more spam; no to stop receiving spam. He replies yes or no,

00:07:59.392 --> 00:08:07.352
the geolocation gets received with the reply. So, it’s not a constant tracking but whenever

00:08:07.352 --> 00:08:13.452
a target replies, the geolocation comes with the reply. They were able to do it a couple of times.

00:08:13.452 --> 00:08:18.032
JACK: So, they drive into downtown New York City to look for Ronan Farrow,

00:08:18.032 --> 00:08:22.432
but they never actually find him. But Igor is a curious person and started

00:08:22.432 --> 00:08:27.632
trying to figure out why someone might be paying him to spy on Ronan Farrow. So,

00:08:27.632 --> 00:08:32.952
he starts reading all these articles that Farrow is putting out. One of the articles he publishes

00:08:32.952 --> 00:08:39.432
says Ronan thinks he’s being watched by Black Cube. This is when Igor connected the dots.

00:08:39.432 --> 00:08:42.992
IGOR: [MUSIC] I went to my boss, my friend, my boss,

00:08:42.992 --> 00:08:47.512
Roman Khaykin. I confronted Khaykin and he confirmed that we’re working

00:08:47.512 --> 00:08:52.072
for Black Cube and in fact, that we are working on the Harvey Weinstein story.

00:08:52.072 --> 00:08:57.672
JACK: Ronan Farrow was doing a story on Harvey Weinstein who was accused of sexually harassing

00:08:57.672 --> 00:09:03.032
women in the Hollywood movie industry. Well, his investigation uncovered that Harvey Weinstein had

00:09:03.032 --> 00:09:09.512
hired Black Cube to spy on his victims that he sexually assaulted to try to find information

00:09:09.512 --> 00:09:14.952
on them and discredit them. Somehow, Weinstein discovered that Ronan Farrow was working on this

00:09:14.952 --> 00:09:22.312
story and hired Black Cube to also spy on Farrow to try to discredit him, too. Igor realized that

00:09:22.312 --> 00:09:27.632
he was wrapped up in all this and that yeah, he was actually working for Harvey Weinstein.

00:09:27.632 --> 00:09:33.592
IGOR: I felt very uneasy being sent to do surveillance on journalists because these

00:09:33.592 --> 00:09:37.392
are publications that I respect, The New Yorker and The New York Times. I’ve been

00:09:37.392 --> 00:09:42.872
reading The New York Times since I was in high school. It was a very important

00:09:42.872 --> 00:09:48.592
thing in my life. I enjoyed it. I thought it’s very – you know, it’s a very good,

00:09:48.592 --> 00:09:54.872
informative paper. I always thought it’s a cool model, you know, all the news that’s fit to print.

00:09:54.872 --> 00:10:00.352
I felt uneasy and in my mind I was thinking, I have to follow through with this. But I think

00:10:00.352 --> 00:10:05.872
what we’re doing could potentially be [00:10:00] a negative thing, because I was told that our job

00:10:05.872 --> 00:10:11.072
was to ascertain their sources. I knew that if we’re looking for sources of two different

00:10:11.072 --> 00:10:16.752
journalists at two different publications, it’s either – it’s – could be used to scoop them but

00:10:16.752 --> 00:10:23.512
it could also be probably used to basically kill the story or to damage them in some way.

00:10:23.512 --> 00:10:28.952
I already knew that we’re working for a company that’s a little bit iffy and I was on guard,

00:10:28.952 --> 00:10:35.032
but I went through with it anyways. I said okay, whatever, I’ll continue. No problem. We continued

00:10:35.032 --> 00:10:43.872
working together. We were doing other jobs for Black Cube, and I tried to contact law enforcement

00:10:43.872 --> 00:10:49.712
with very little success. I tried to get advice from friends who knew people in law enforcement,

00:10:49.712 --> 00:10:54.792
and nothing panned out of it, so at some point I felt that there was no outlet for me to go

00:10:54.792 --> 00:11:03.992
to to kind of expose this problem of a private intelligence company following journalists for a

00:11:03.992 --> 00:11:12.392
rapist to be able to kill their story. I decided to call Ronan Farrow, so I contacted Farrow and

00:11:12.392 --> 00:11:18.052
we met up. I said hey, I’ve been following Jodi Kantor. I was assigned to follow you.

00:11:18.052 --> 00:11:23.392
JACK: Wow, to be assigned to spy on Ronan Farrow but then completely flip

00:11:23.392 --> 00:11:26.992
and actually call Ronan to tell him that you’re spying on him,

00:11:26.992 --> 00:11:31.552
that must have been some meeting. As the two talked, Ronan did confirm he

00:11:31.552 --> 00:11:36.832
was receiving a lot of spam text, and Igor explained that’s how they knew where he was.

00:11:36.832 --> 00:11:42.392
IGOR: Ronan Farrow, I thought I was gonna talk to him and say hey, we followed you. Your hunch

00:11:42.392 --> 00:11:47.752
is right. Be careful; Black Cube seem like bad people. Nice to meet you. Good luck. Maybe text

00:11:47.752 --> 00:11:54.352
time if I ever see you, sign the book that you wrote. I bought his book. He says I’m writing a

00:11:54.352 --> 00:12:01.792
book about this Weinstein thing. You want to stay in touch and help me? I said okay, I’ll help you.

00:12:01.792 --> 00:12:07.232
I said, you seem like a nice guy. He convinced me a little, but then I felt it’s a very noble cause.

00:12:07.232 --> 00:12:11.712
JACK: This is how Igor sort of switched sides; one day doing

00:12:11.712 --> 00:12:18.352
dirty work for Harvey Weinstein and the next helping journalists like Ronan Farrow out.

00:12:18.352 --> 00:12:25.072
IGOR: After meeting with Farrow, I’m talking to him periodically, I’m sharing information of what

00:12:25.072 --> 00:12:31.672
work I’m doing with Khaykin from Black Cube. I’m sharing with him almost like, immediately.

00:12:31.672 --> 00:12:37.152
Whenever I have something from Black Cube, I share with Farrow. He tries to figure out if this is

00:12:37.152 --> 00:12:44.312
relevant to him or to something he’s working on or whatever. One day in January, I get – I’m with

00:12:44.312 --> 00:12:51.352
Khaykin and Khaykin tells me that [MUSIC] he has to cover a job for Black Cube, but he can’t make

00:12:51.352 --> 00:12:57.192
it because he has plans with his daughter. I said hey, I’m free. I could – you know, it’s an evening

00:12:57.192 --> 00:13:02.792
job or whatever. It’s a late afternoon job. I said if you want, I’ll fill in for you. He says no,

00:13:02.792 --> 00:13:06.832
it’s a very important job. I have to be there myself. I said well, why don’t you tell the

00:13:06.832 --> 00:13:13.592
client you’ll go there with me and when you have to leave, you go hang out with your daughter?

00:13:13.592 --> 00:13:21.392
I’ll go and I’ll stay in your place. We agree on this plan. We head into the city,

00:13:21.392 --> 00:13:29.312
to the Peninsula Hotel, and Khaykin tells me the agent will be there. You already know him.

00:13:29.312 --> 00:13:35.072
He’s the guy that you saw last summer that wears a goatee and glasses. That’s basically kind of how

00:13:35.072 --> 00:13:40.472
he described him, ‘cause they didn’t use names. They never told me any names. They were very

00:13:40.472 --> 00:13:46.512
secretive about that. I said okay, I know that guy. I’ve seen him multiple times. I said okay,

00:13:46.512 --> 00:13:51.872
Roman, I recognize who you’re talking about. Then he showed me a picture of John Scott-Railton. He

00:13:51.872 --> 00:13:57.832
said, this is the target. So, this is who’s gonna be at the meeting who Black Cube is targeting.

00:13:57.832 --> 00:14:05.192
JACK: Oh, John Scott-Railton? JSR is the target? That name is very familiar. Actually,

00:14:05.192 --> 00:14:11.192
in Darknet Diaries Episode 79 called Dark Basin, I interviewed John Scott-Railton to hear about

00:14:11.192 --> 00:14:16.512
how a private intelligence company tried to hack and steal information from certain targets. John

00:14:16.512 --> 00:14:22.632
works for Citizen Lab and does investigative work to try to uncover hacking campaigns. Of course,

00:14:22.632 --> 00:14:27.712
when he publishes this work, those companies he exposes probably get pretty mad for having

00:14:27.712 --> 00:14:33.312
their cover blown. JSR and Citizen Lab does amazing investigative work,

00:14:33.312 --> 00:14:39.752
but still, I’m surprised that he’s being targeted by Black Cube. Oh man,

00:14:39.752 --> 00:14:44.092
this is just getting deeper. Well, we’ve gotta call JSR now to find out what happens.

00:14:44.092 --> 00:14:48.552
JOHN: What happened is one of my colleagues was basically approached

00:14:48.552 --> 00:14:56.952
by somebody who claimed to be interested in financial solutions in banking for refugees

00:14:56.952 --> 00:15:00.992
which is a really important problem. If you’re a refugee and you flee a conflict,

00:15:00.992 --> 00:15:05.472
you probably don’t flee with access to your bank account. [00:15:00] So, this is a huge

00:15:05.472 --> 00:15:08.672
problem that refugees face and my colleague was extremely sympathetic to this issue. So,

00:15:08.672 --> 00:15:14.512
he goes to a meeting, meets this guy, and what the guy really wants to do is not talk

00:15:14.512 --> 00:15:20.912
about refugees and banking, but to quiz my colleague on his background, his family,

00:15:20.912 --> 00:15:27.512
his family history, and then ask a lot of questions about the Citizen Lab. My colleague,

00:15:27.512 --> 00:15:31.512
Bahr Abdul Razzak, is a very thoughtful, smart guy. He immediately recognized that something

00:15:31.512 --> 00:15:37.752
was amiss, played it cool, and then as soon as he left the meeting called me up and said look,

00:15:37.752 --> 00:15:43.052
something really strange is going on here. I think I was the target of some kind of an operation.

00:15:43.052 --> 00:15:49.712
[MUSIC] So, immediately after this happened, at the lab we began trying to figure out well,

00:15:49.712 --> 00:15:55.032
who did Bahr meet with? Who was this guy? It didn’t take long for us to determine the

00:15:55.032 --> 00:16:00.792
digital identity that the guy had created was almost paper-thin. There was like,

00:16:00.792 --> 00:16:06.672
an accommodation address somewhere in Spain, some company; FlameTech. But it all looked

00:16:06.672 --> 00:16:13.192
fake. This gave us the impression that we were looking at some kind of an operative,

00:16:13.192 --> 00:16:18.552
some kind of an agent. We began to ask ourselves like well, so who would do this? Going through

00:16:18.552 --> 00:16:23.512
the questions that he asked Bahr, it seemed like the main objective was learning about

00:16:23.512 --> 00:16:28.552
Citizen Lab’s work and then potentially finding something that could be used against the lab,

00:16:28.552 --> 00:16:35.192
maybe to discredit our work. As we were moving on with our investigation, we got in touch with

00:16:35.192 --> 00:16:39.512
a reporter and said well, we should – this is a really interesting story, researchers working on

00:16:39.512 --> 00:16:49.472
NSO targeted by this weird attempt, a mystery man. That story was just about ready for publication

00:16:49.472 --> 00:16:55.912
with Raphael Satter, then at the Associated Press, when I got a message claiming to be from

00:16:55.912 --> 00:17:03.632
a guy named Michel Lambert. Michel pronounced himself extremely interested in the work that

00:17:03.632 --> 00:17:11.292
I had been doing almost a decade before, using kites to fly robotic cameras over West Africa.

00:17:11.292 --> 00:17:15.912
JACK: See, on JSR’s blog, he has this research that he did about using kites

00:17:15.912 --> 00:17:20.432
to conduct aerial photography, and this guy Michel was acting

00:17:20.432 --> 00:17:25.432
very fascinated with all the aspects of aerial photography using kites,

00:17:25.432 --> 00:17:30.072
seemingly wanting to do this method himself to conduct some kind of similar research.

00:17:30.072 --> 00:17:36.472
JOHN: I immediately sensed that something was off because anybody, even people living under a rock

00:17:36.472 --> 00:17:42.032
know that drones have happened in the interim, and there’s no real reason to deal with the

00:17:42.032 --> 00:17:47.472
vicissitudes of the wind and some kite and strings and so on. Like, what’s that all about? So,

00:17:47.472 --> 00:17:53.072
I contacted Satter and said why don’t you hold off on this story? Let’s see where this goes.

00:17:53.072 --> 00:18:08.552
JACK: [MUSIC] Michel wanted to talk on the phone, so John gave him his phone number.

00:18:08.552 --> 00:18:10.993
JOHN: [RINGTONG] Hello?

00:18:10.993 --> 00:18:11.009
MICHEL: [FRENCH]

00:18:11.009 --> 00:18:16.072
JOHN: [FRENCH] English as well. [FRENCH] There’s this little – there’s this crazy little detail,

00:18:16.072 --> 00:18:22.072
so like, when the Lambert alias first called me on the phone, there was a strange moment;

00:18:22.072 --> 00:18:27.152
he just immediately started speaking French to me. The thing is, I speak French but I don’t

00:18:27.152 --> 00:18:30.592
advertise it. At that point, it wasn’t really something that I felt people knew

00:18:30.592 --> 00:18:35.592
about me. I remember this moment; this guy picks up and – bonjour. I’m thinking like,

00:18:35.592 --> 00:18:38.752
do they have some dossier on me? They must. Maybe he just does it to

00:18:38.752 --> 00:18:49.176
everyone. But in any case, he immediately launched into this French conversation.

00:18:49.176 --> 00:18:49.192
MICHEL: [FRENCH]

00:18:49.192 --> 00:18:54.712
JACK: Of course, JSR being JSR, he’s trying to record and document everything that this

00:18:54.712 --> 00:18:59.392
Michel Lambert guy is telling him. So, what you’re hearing is the actual phone

00:18:59.392 --> 00:19:03.512
call between them, because JSR knows something strange is going on here and

00:19:03.512 --> 00:19:08.192
having evidence of it might be really helpful at figuring all this out. So,

00:19:08.192 --> 00:19:14.832
the phone call ends with Michel wanting to meet up in New York City in a swank hotel restaurant

00:19:14.832 --> 00:19:22.992
to talk about how to do aerial photography with kites, and JSR agrees to the meeting.

00:19:22.992 --> 00:19:23.650
MICHEL: Au revoir.

00:19:23.650 --> 00:19:23.666
JOHN: Au revoir.

00:19:23.666 --> 00:19:26.832
JACK: This is when Igor gets told about this meeting,

00:19:26.832 --> 00:19:31.232
and he needs to watch the agent Michel and keep an eye on the target, JSR.

00:19:31.232 --> 00:19:37.152
IGOR: So, in my mind, I understand the agent is the operative from Black Cube and the target

00:19:37.152 --> 00:19:41.112
is somebody that Black Cube is trying to put in a situation where they’re trying

00:19:41.112 --> 00:19:49.992
to embarrass them or they’re trying to get them to say something racist or antisemitic

00:19:49.992 --> 00:19:58.512
or something that’s embarrassing on tape. My job is to take pictures with the back of the

00:19:58.512 --> 00:20:04.072
head of the agent and the face of the target. [00:20:00] In case that they do

00:20:04.072 --> 00:20:09.272
get the target to say something negative, they could potentially throw the story to the press

00:20:09.272 --> 00:20:19.792
with a nice picture of the target just for face value, for having a picture on – with the story.

00:20:19.792 --> 00:20:26.392
Then once they split up, once the meeting is over, my job now involves a counter-surveillance role,

00:20:26.392 --> 00:20:33.152
so now I follow the Black Cube agent for a few blocks and I make sure to check if he’s

00:20:33.152 --> 00:20:41.792
being followed. Because for instance, if JSR had suspicions of Michel and he decided to go to the

00:20:41.792 --> 00:20:46.632
first meeting without journalists but he decided to just go there to see what it’s about, and he

00:20:46.632 --> 00:20:54.272
decided to bring a surveillance team to figure out who Michel really is, my job was to make sure that

00:20:54.272 --> 00:21:00.872
if somebody’s following Michel, I don’t get caught but I tell Michel through Khaykin; hey, there’s a

00:21:00.872 --> 00:21:08.592
guy following you. Then at that point, Black Cube would be able to make a decision and would be

00:21:08.592 --> 00:21:13.272
able to understand that the person that they met with did not have full trust of them, you know?

00:21:13.272 --> 00:21:17.072
JACK: Oh man, this is about to get crazy,

00:21:17.072 --> 00:21:23.312
because this is becoming a game of spy versus spy. Igor will be watching the agent’s back,

00:21:23.312 --> 00:21:37.879
and JSR is all set up to spy on the spy. Stay with us because after the break,

00:21:37.879 --> 00:21:42.319
JOHN: The thinking was pretty simple; this person is obviously coming under a false

00:21:42.319 --> 00:21:49.119
pretense and they may be coming with the objective of harming me, harming my colleagues’ reputations,

00:21:49.119 --> 00:21:57.279
but most importantly, probably the objective is to deny justice to the victims of hacking by

00:21:57.279 --> 00:22:03.959
trying to discredit their research in some way, or otherwise create problems for the lab. So,

00:22:03.959 --> 00:22:08.999
we decided that the best approach would be to play it into a meeting and actually have an in-person

00:22:08.999 --> 00:22:16.199
sit down with this character, Michel Lambert, but bring some people with us, a reporting team led by

00:22:16.199 --> 00:22:21.679
Satter who would at the right time confront Lambert while we were meeting and ask him

00:22:21.679 --> 00:22:26.559
some pointed questions about why he didn’t really exist and why his company didn’t appear to exist.

00:22:26.559 --> 00:22:29.279
JACK: JSR meets up with Raphael Satter,

00:22:29.279 --> 00:22:32.599
the reporter from the Associated Press, and prepares for the meeting.

00:22:32.599 --> 00:22:37.359
JOHN: The period before the meeting was pretty intense for us because of course

00:22:37.359 --> 00:22:41.439
you’re second-guessing everything. You’re wondering well, what on the off-chance you do

00:22:41.439 --> 00:22:48.839
if actually this turns out to be a legitimate meeting? [MUSIC] Is the person going to guess

00:22:48.839 --> 00:22:55.639
that we’re onto them? Am I gonna be able to maintain this deception? I really wanted it

00:22:55.639 --> 00:23:01.199
to work and I felt very strongly that to protect my colleagues, it was important

00:23:01.199 --> 00:23:11.759
that I do this job really well. So, up to late – or the early hours in the night beforehand,

00:23:11.759 --> 00:23:18.439
I was assembling my own video camera necktie. The reason was, I had sort of felt like, maybe I

00:23:18.439 --> 00:23:23.799
should bought – buy a pen camera or something like that, you know? Something I can – some spy tech.

00:23:23.799 --> 00:23:30.759
Then I thought well, if I buy something spy-techy, if this guy’s any good, he’s gonna look at it and

00:23:30.759 --> 00:23:35.959
he’s gonna be like well, I know what that is, right? He’s pointing a pen camera at me. So,

00:23:35.959 --> 00:23:38.719
I didn’t want a scenario where we were both pointing our pen cameras at each other or

00:23:38.719 --> 00:23:42.199
something like that so I thought well, I’ll have to make my own thing. So, I buy a necktie,

00:23:42.199 --> 00:23:47.799
cannibalize a bunch of the things in the hotel room that I’m staying at, disassemble a baby

00:23:47.799 --> 00:23:52.679
video monitor and a bunch of other things and create a reasonable approximation of a covert

00:23:52.679 --> 00:24:01.879
camera video necktie. So, the day of the meeting comes and of course, things start going wrong. I

00:24:01.879 --> 00:24:05.959
had this plan to make a bunch of time available so that I’d get there in due time but not too

00:24:05.959 --> 00:24:13.919
early. Wouldn’t want to be suspicious. Instead, I shamble out and discover that it is pouring rain.

00:24:13.919 --> 00:24:18.799
As anybody who’s been in New York will tell you, getting a taxi in the pouring rain ain’t easy.

00:24:18.799 --> 00:24:26.639
Finally I find myself a ride and get in, and I’m already wearing my video necktie and I’m super

00:24:26.639 --> 00:24:33.519
jazzed up, but also quite concerned. I begin to become concerned that I’m gonna be late and

00:24:33.519 --> 00:24:41.119
they’re gonna smell a rat and call it off. We’re getting there, getting closer, getting closer,

00:24:41.119 --> 00:24:49.439
and a couple blocks away there’s a complete premium New York gridlock traffic jam. I just sort

00:24:49.439 --> 00:24:59.799
of say well, to hell with it, and pop out and just run [MUSIC] with my pockets filled with recording

00:24:59.799 --> 00:25:08.599
gear towards the meeting venue. [00:25:00] I had actually managed to break my necktie camera. I

00:25:08.599 --> 00:25:14.799
had to change out; I brought a spare, changed out my necktie, and make it. I arrive soaking

00:25:14.799 --> 00:25:23.919
wet and feeling about as awkward and ill-prepared as I probably felt when I took the SAT as a kid.

00:25:23.919 --> 00:25:28.439
So, I make it to this swank restaurant. I show up and I’m just like, I’m evaporating. I’m soaking

00:25:28.439 --> 00:25:34.939
and exhausted and just sure that the whole game is up; everything’s gonna fall apart. The maître

00:25:34.939 --> 00:25:39.759
d’ comes up to me and he’s like well, can I help you? I said yes, I’m – and I realized I don’t know

00:25:39.759 --> 00:25:43.959
what to tell this person. So, I just – well, I’m here with Mr. Michel Lambert. Ah, of course, the

00:25:43.959 --> 00:25:50.719
man says, and walks me to the back. As we reached the back of the restaurant, a man is sitting at a

00:25:50.719 --> 00:25:57.559
table behind a pillar, not visible from the front. He stands up and greets me and then

00:25:57.559 --> 00:26:03.399
walks me to another table right by the window. So, already it’s an awkward piece of stage direction

00:26:03.399 --> 00:26:09.959
footwork. Like, what is this weird table-shift that this guy’s doing? But he’s very cordial and

00:26:09.959 --> 00:26:14.859
we immediately begin on small talk. I’m sitting there evaporating and hoping I don’t mess up.

00:26:14.859 --> 00:26:17.959
JACK: Okay, so where is Raphael Satter at this point?

00:26:17.959 --> 00:26:23.799
JOHN: Well, so, Satter has brought a videographer with him, and we have a sports

00:26:23.799 --> 00:26:29.639
photographer stationed outside the hotel to sort of catch them if they walk out, right? We want

00:26:29.639 --> 00:26:38.319
close and some long shot cover. Satter and his colleague didn’t have a budget for this and so,

00:26:38.319 --> 00:26:42.959
I think they ordered – this is a fancy restaurant – they ordered a shrimp cocktail and some waters,

00:26:42.959 --> 00:26:51.959
and they are sitting at a booth not super-far as luck would have it, from where we end up sitting,

00:26:51.959 --> 00:26:56.399
eating their shrimp cocktail. We had kind of thought about where these operators would

00:26:56.399 --> 00:27:01.119
have wanted the meeting to take place, figuring that well, they’re gonna be recording for sound

00:27:01.119 --> 00:27:05.919
and audio, so they’re gonna have a certain set of desirables, and we kind of guessed where we should

00:27:05.919 --> 00:27:11.759
put Satter and his colleague if at all possible to record or catch things. It ended up working quite

00:27:11.759 --> 00:27:19.599
well. So, I get in and scrupulously avoid looking at Satter and his colleague, right? The plan was

00:27:19.599 --> 00:27:24.519
for them to arrive before even this Lambert alias got there, so he wouldn’t necessarily feel a rat,

00:27:24.519 --> 00:27:28.559
right, and just act normal. Somehow, despite the fact that they were carrying a camera

00:27:28.559 --> 00:27:34.279
in a duffel bag, like a big production camera, nobody seems to have noticed them.

00:27:34.279 --> 00:27:40.459
JACK: As soon as JSR arrives, Michel insists that JSR has a martini with him.

00:27:40.459 --> 00:27:44.879
JOHN: No martini for me. You know what? Tea would be great, black tea.

00:27:44.879 --> 00:27:50.039
JACK: But JSR refuses the drink and asks for tea instead. They sit down near a window where they

00:27:50.039 --> 00:28:00.299
can both be clearly seen from the street, and together they sit and talk in French.

00:28:00.299 --> 00:28:00.313
JOHN: [FRENCH]

00:28:00.313 --> 00:28:04.919
JACK: About nothing, really; just like, where they both know French from and what countries

00:28:04.919 --> 00:28:09.759
they’ve visited. It’s meaningless chit-chat, and while JSR’s camera necktie was broken,

00:28:09.759 --> 00:28:16.423
he did manage to still record the audio. They order a fancy meal and eat it together.

00:28:16.423 --> 00:28:19.093
WAITER: We have lobster bisque.

00:28:19.093 --> 00:28:22.269
JOHN: Ah, lobster bisque. Okay, great.

00:28:22.269 --> 00:28:22.313
WAITER: We have nice Beef Bourguignon today.

00:28:22.313 --> 00:28:29.239
IGOR: Let me tell you this part in detail. [MUSIC] We arrive, we park. I park my car

00:28:29.239 --> 00:28:35.799
in the garage. Khaykin parks on the hydrant, and I have to jump in Khaykin’s car to keep

00:28:35.799 --> 00:28:41.999
the car from getting a ticket. Khaykin goes inside. When you walk inside the restaurant,

00:28:41.999 --> 00:28:47.919
there’s three sections to the right and the target and the agent are in the furthest

00:28:47.919 --> 00:28:54.519
section to the right. To the left there’s a single section which is a bar. I’ve been

00:28:54.519 --> 00:29:00.259
there before ‘cause we’ve covered a few meetings there before, so I know the layout very well.

00:29:00.259 --> 00:29:07.639
JOHN: I tried to be very surveillance-unaware. I tried to really never stare and never look.

00:29:07.639 --> 00:29:13.679
But I did clock a guy holding up his cell phone in a really awkward way and was pretty convinced

00:29:13.679 --> 00:29:19.279
that he was taking my picture. He was sort of behind Michel and to the side. They try to have a

00:29:19.279 --> 00:29:24.279
recorder stationed in such a way that the fact of the operative is not included in the video footage

00:29:24.279 --> 00:29:28.259
so they don’t have to blur it or something or they don’t have footage with an operative’s face in it.

00:29:28.259 --> 00:29:34.799
IGOR: Khaykin comes back out a few minutes later, maybe twenty minutes later. He shows me

00:29:34.799 --> 00:29:40.959
the pictures that he had already sent me by text message. I show him the pictures I took outside,

00:29:40.959 --> 00:29:48.679
and Khaykin says to me Igor, the meeting is going very well. [MUSIC] This is very unusual,

00:29:48.679 --> 00:29:56.959
so this is like a very interesting point. My ears kind of point up. I’m like, okay, the meeting is

00:29:56.959 --> 00:30:03.679
going very well. Igor, I want you to sit at the bar where you’re going to have a limited

00:30:03.679 --> 00:30:09.399
view. [00:30:00] You’re not gonna be able to see the meeting anymore. We don’t need to be close to

00:30:09.399 --> 00:30:14.239
them. We don’t need to be in the restaurant. I want you to be in the bar where you’re going to

00:30:14.239 --> 00:30:20.639
have a view of the top of the stairs. When the subjects leave, right, when the target and the

00:30:20.639 --> 00:30:27.639
agent leave, you are going to follow them. The meeting is going so well, in fact, they might

00:30:27.639 --> 00:30:34.879
even go to have drinks somewhere else. They might go hang out. The meeting is going great.

00:30:34.879 --> 00:30:41.159
Very unusual. Usually these meetings, they split up and they don’t continue hanging out. Usually

00:30:41.159 --> 00:30:47.239
they have a set time and once they’re done, they leave, and we do the counter-surveillance bit,

00:30:47.239 --> 00:30:53.599
and it’s over. I say Roman, I understand. Totally, totally cool. I’m gonna sit, watch the top of the

00:30:53.599 --> 00:31:00.519
stairs. When I see the agent and the target leave, if they stay together, I’m gonna follow them until

00:31:00.519 --> 00:31:05.799
they split up. When they split up, I’m gonna make sure that the agent is not followed and I’m free

00:31:05.799 --> 00:31:12.359
to go. Khaykin says Igor, it’s going so great, I want you to relax. Again, something that usually

00:31:12.359 --> 00:31:18.719
never happens. Usually it’s very tense, we’re going over possibilities, we’re prepping, we’re

00:31:18.719 --> 00:31:24.639
talking about what could happen, we’re discussing who’s parked outside. Roman says don’t worry;

00:31:24.639 --> 00:31:32.319
it’s going really well. Relax. Have a drink. Have a burger. Have whatever you want. Again,

00:31:32.319 --> 00:31:37.399
something very unusual because Black Cube are very cheap. I mean, these guys are such cheapskates.

00:31:37.399 --> 00:31:44.919
They send me to a restaurant to do a job that had a prix fixe menu. They picked the restaurant and

00:31:44.919 --> 00:31:49.959
I chose the cheapest prix fixe option and they questioned me on the bill. I took a picture of

00:31:49.959 --> 00:31:53.599
the menu ‘cause I had a feeling that somebody’s gonna ask me like, why’d you eat so much,

00:31:53.599 --> 00:31:58.519
you know? But in reality, it’s not a lot of food; it’s a prix fixe menu. You don’t have any options,

00:31:58.519 --> 00:32:05.119
right? It’s very unusual for Black Cube to tell Roman or to Roman to have the liberty to say hey,

00:32:05.119 --> 00:32:12.599
go ahead; splurge for a latte today. Relax. But I’m thinking that since things are going very

00:32:12.599 --> 00:32:18.919
well and the client, he was very particular about you following instructions. They would

00:32:18.919 --> 00:32:23.679
get very angry if I deviated a little bit and I took pictures more liberally

00:32:23.679 --> 00:32:28.839
including the face of their agent. They would get really pissed at that. So, I go in the bar.

00:32:28.839 --> 00:32:31.679
JACK: When – can you explain what kind of equipment you have

00:32:31.679 --> 00:32:34.099
with the pictures and the microphones and stuff?

00:32:34.099 --> 00:32:39.719
IGOR: Oh, yeah. No microphones because we can’t eavesdrop by law,

00:32:39.719 --> 00:32:43.039
and for pictures, I use my phone. I use an iPhone.

00:32:43.039 --> 00:32:43.999
JACK: Okay.

00:32:43.999 --> 00:32:50.199
IGOR: I have a video camera. I use a camcorder. It’s like a prosumer Panasonic camcorder. It’s

00:32:50.199 --> 00:32:55.079
about a thousand bucks. So, I go in the hotel and Khaykin has to leave. [MUSIC] He takes

00:32:55.079 --> 00:33:00.439
his car off the fire hydrant and he drives home to do his thing with his daughter. As

00:33:00.439 --> 00:33:07.919
I walk into the hotel, there’s a photoshoot with models and professional photographers,

00:33:07.919 --> 00:33:12.239
equipment, people bringing coffee and water. We’re talking about a real photoshoot,

00:33:12.239 --> 00:33:18.679
right? It’s in the lobby of the hotel. Khaykin just came out of the lobby of the hotel. He

00:33:18.679 --> 00:33:23.679
didn’t say anything to me and I think to myself, well, it’s a professional photoshoot. This is

00:33:23.679 --> 00:33:31.079
not some kind of secret photoshoot to catch the agent, right? Because this is a real photoshoot.

00:33:31.079 --> 00:33:35.199
I talked to the people who work – who are working at the photoshoot and they tell me that they’re

00:33:35.199 --> 00:33:40.799
working for the hotel magazine. It’s an internal magazine for their guests and they’re making this

00:33:40.799 --> 00:33:47.759
photoshoot for that. I’m content because they’re working with the hotel management.

00:33:47.759 --> 00:33:52.439
I do a little bit of amateur photography, so I know that the equipment they’re using,

00:33:52.439 --> 00:33:58.079
it’s – you know, they’re using lenses that are not like telephoto lenses;

00:33:58.079 --> 00:34:04.079
they’re basically using lenses that are for – they’re portrait lenses and they have a couple

00:34:04.079 --> 00:34:09.439
of wide angle lenses. I see that they use nice Canon cameras. Sounds good to me. It’s

00:34:09.439 --> 00:34:16.439
a pro photoshoot. Nothing to do with me. I’m going upstairs to the bar. I get into the bar,

00:34:16.439 --> 00:34:24.919
I watch the stairs, I order some stuff, and I’m watching the stairs. An hour passes by or so.

00:34:24.919 --> 00:34:30.679
JACK: Now, Igor can’t see JSR or Michel from the bar. He’s just around the corner,

00:34:30.679 --> 00:34:34.039
but he knows this place well and knows that there’s only one way in and out,

00:34:34.039 --> 00:34:38.439
so he’s watching the exit. He sees the people from the photoshoot downstairs

00:34:38.439 --> 00:34:44.879
come up and have a drink. He sits there stationed with his eyes on the doorway.

00:34:44.879 --> 00:34:49.079
JOHN: Within a couple of minutes of the conversation starting,

00:34:49.079 --> 00:34:55.479
he was using this weird offensive term to refer to the way that Africans speak

00:34:55.479 --> 00:35:01.319
French and trying to get me to laugh along. It was the strangest conversational gambit.

00:35:01.319 --> 00:35:07.239
I began to feel at this point [00:35:00] that this guy maybe wasn’t sure how long he’d have

00:35:07.239 --> 00:35:10.959
me at that table for or how long the deception would work, and so, he wanted to get me saying

00:35:10.959 --> 00:35:20.697
something perhaps racist or offensive right away, something that could be laughed about.

00:35:20.697 --> 00:35:20.713
MICHEL: [FRENCH]

00:35:20.713 --> 00:35:25.959
JOHN: Then the conversation was an hour of sort of him semi-boasting, semi-chatting,

00:35:25.959 --> 00:35:30.399
trying to get biographical details on me, talking about all the African leaders he’d met, the time

00:35:30.399 --> 00:35:35.999
that he’d spent in Africa, various other things. But the strangest part of this whole conversation

00:35:35.999 --> 00:35:42.719
is that the guy had cue cards with him. They were like, green and yellow and red pastel cue cards,

00:35:42.719 --> 00:35:51.399
big index cards. [MUSIC] As the conversation is going on, the boring questions to me are green

00:35:51.399 --> 00:35:57.719
cue cards. Then right around the one-hour mark, as the conversation starts getting a little bit more

00:35:57.719 --> 00:36:03.919
interesting, as I recall it, the yellow cards come out. Then he’s starting to ask questions

00:36:03.919 --> 00:36:07.719
about Citizen Lab. Up until that point, he had been sort of preserving the ruse that he’s just

00:36:07.719 --> 00:36:14.039
a rich guy who would really like to hire me to fly kites in Africa or something. Then he kinda

00:36:14.039 --> 00:36:18.039
doubles in for the really good questions, like oh, tell me more about Citizen Lab,

00:36:18.039 --> 00:36:22.959
and at various times tries to prompt me to say things like Citizen Lab’s work

00:36:22.959 --> 00:36:30.639
would be somehow motivated by racism or some – I mean, really wild stuff, and deeply offensive.

00:36:30.639 --> 00:36:32.599
JOHN: Who would be using that racist element?

00:36:32.599 --> 00:36:39.233
MICHEL: You said that it was journalists in Mexico, etc, etc.

00:36:39.233 --> 00:36:43.799
JOHN: Well, that would be very upsetting if it were happening, I think. I began to feel

00:36:43.799 --> 00:36:50.879
that he had this list on his cards that were like, well, if you can’t get some good, juicy

00:36:50.879 --> 00:36:55.479
information about the lab, maybe he can get me to say something offensive. I felt like he had this

00:36:55.479 --> 00:36:59.959
shopping list. He was going through it all and going through it all. Our conversation plods on

00:36:59.959 --> 00:37:09.159
for like, it must have been about ninety minutes. He will come in conversationally on a tangent, try

00:37:09.159 --> 00:37:14.999
to get me to say something about the lab or NSO and then back right off if I push back a little

00:37:14.999 --> 00:37:19.399
bit. For somebody who, at various points in the conversation, pretended to have no knowledge of

00:37:19.399 --> 00:37:29.639
technical stuff, he seems remarkably well-informed about export controls. The impression of him as

00:37:29.639 --> 00:37:39.119
a bumbling spy was kinda cemented by the fact that he had this pen in his hand, big thick pen,

00:37:39.119 --> 00:37:45.839
and at various points when I’d be talking, he’d be like holding the tip of the pen pointed at me,

00:37:45.839 --> 00:37:49.879
like the tip of the pen cap pointed at me. There was a hole in the middle of the pen cap,

00:37:49.879 --> 00:37:54.119
and I thought it was undoubtedly a camera and he wanted to get me on video.

00:37:54.119 --> 00:38:02.079
I think I learned later that it might have been a microphone, but it really felt bumbling. As

00:38:02.079 --> 00:38:11.199
this is going on, I am getting messages from the – from Satter saying like, everything okay? Is

00:38:11.199 --> 00:38:16.399
it going alright? Yeah, yeah, it’s going alright. Then I get this alarmed message that’s like hey,

00:38:16.399 --> 00:38:24.519
our batteries are running low. Can you wrap it up? So, I have to come up with some pretext to wrap

00:38:24.519 --> 00:38:30.919
this – at this point ridiculous conversation up. At one point he invites me to leave with him to go

00:38:30.919 --> 00:38:42.359
to a cigar bar. Like, we’ll go together, it’ll be great. So, I find a way to distract him, talking

00:38:42.359 --> 00:38:46.199
about kites flying and buildings. I point at the window next to us and I say, look out the window;

00:38:46.199 --> 00:38:49.119
if I was trying to fly a kite on this building, here’s what I’d do. You’d think like, how could

00:38:49.119 --> 00:38:55.399
you even use a kite out in this? The answer is, it’s still possible. You get on the rooftops. He

00:38:55.399 --> 00:39:00.299
dutifully looks out the window, and when he looks back at me, Raphael Satter is pulling up a chair.

00:39:00.299 --> 00:39:05.319
RAPHAEL: Hi. My name’s Raphael Satter. I’m a journalist with the Associated Press,

00:39:05.319 --> 00:39:11.319
England. I’d like to speak to you about your company, CPW Consulting.

00:39:11.319 --> 00:39:13.433
MICHEL: I don’t have to speak with you.

00:39:13.433 --> 00:39:18.999
JOHN: Satter then pressures him and the guy doesn’t really have any good answers about

00:39:18.999 --> 00:39:23.319
why his company isn’t real, why he doesn’t appear to be real. So, as Satter is asking him questions

00:39:23.319 --> 00:39:31.879
about who he is, he really is, the guy makes a gambit to leave and then, realizing his mistake,

00:39:31.879 --> 00:39:39.839
he comes back and tries to pay for the – his lunch. [MUSIC] As he’s trying to pay,

00:39:39.839 --> 00:39:44.479
Satter and the camera are right there asking questions. By then, the restaurant has basically

00:39:44.479 --> 00:39:48.159
cleared out. The only people left, I – at this point I think, are probably the people on his

00:39:48.159 --> 00:39:51.479
team. That’s what I’m thinking, the people on his team or the people on my team and maybe a

00:39:51.479 --> 00:39:57.359
few lunch stragglers. So, it’s really a crazy scenario. The guy is just trying to avoid the

00:39:57.359 --> 00:40:04.679
camera which is really hard to do in a rather limited space restaurant while trying to pay.

00:40:04.679 --> 00:40:12.999
[00:40:00] So, is peppered by questions, and finally you can just feel his terror grow and

00:40:12.999 --> 00:40:16.799
there’s almost like a Yakety Sax moment as he’s being followed around by me, by the cameraman, by

00:40:16.799 --> 00:40:21.319
Satter asking him all these questions. He finally spots an open door in the back to a private dining

00:40:21.319 --> 00:40:29.519
room and goes inside. There’s a restaurant staffer there. He tries to pull the door closed behind him

00:40:29.519 --> 00:40:33.279
but he’s clearly had such an adrenaline dump that he’s just like, tunnel vision and doesn’t notice

00:40:33.279 --> 00:40:38.119
that there’s a stopper on the door, so he’s trying to pull this door closed, doesn’t get it, and asks

00:40:38.119 --> 00:40:41.799
the restaurant employee for help; these people are bothering me. So, the restaurant employee

00:40:41.799 --> 00:40:52.079
dutifully pushes out the stopper and closes the door, and that’s the last we see of this guy.

00:40:52.079 --> 00:40:59.199
IGOR: At some point, now my phone starts ringing and I see it’s Khaykin calling. I’m watching the

00:40:59.199 --> 00:41:05.679
stairs; nobody has left, but I see at the top of the stairs a guy with bushy hair and

00:41:05.679 --> 00:41:12.479
a guy with a camera, with a video camera that they use for news broadcasting or something,

00:41:12.479 --> 00:41:19.319
for live news. I think, that’s a little weird but considering there’s a photoshoot going on here,

00:41:19.319 --> 00:41:24.319
maybe these guys just are working with the photoshoot, you know? I pick up the phone.

00:41:24.319 --> 00:41:30.039
I’m looking at those guys, and I’m thinking ah, those guys – probably doesn’t mean anything.

00:41:30.039 --> 00:41:34.759
Roman Khaykin is screaming into the phone, Igor, what’s going on? [MUSIC] Who are those

00:41:34.759 --> 00:41:39.079
people with the cameras? I go Khaykin, what are you worried about? They’re doing

00:41:39.079 --> 00:41:44.439
a photoshoot for the hotel magazine. I talked with them. He goes oh, are you sure? I go yeah,

00:41:44.439 --> 00:41:48.959
yeah, I’m looking at them right now. There’s a dozen people; there’s two guys with cameras.

00:41:48.959 --> 00:41:55.279
They got lights set up. It’s a professional photoshoot. He’s waiting, he’s kind of silent,

00:41:55.279 --> 00:42:01.559
then he’s like no, no, no, who are the people with the cameras? Who’s the journalist? Now it clicks

00:42:01.559 --> 00:42:08.079
in my mind that I’m staring at basically – I’m staring at Raphael Satter and the AP videographer.

00:42:08.079 --> 00:42:12.039
But I don’t know them, right? I don’t know their names. I’ve never seen them before but I’m staring

00:42:12.039 --> 00:42:17.599
at them and I’m like, Roman, there is a guy here with a big video camera and another guy with bushy

00:42:17.599 --> 00:42:25.199
hair. He’s like okay, the agent is in trouble. He’s hiding in the back somewhere. We need to help

00:42:25.199 --> 00:42:29.839
get him out of there. Help get him out of there. Figure out what’s going on. Take pictures of

00:42:29.839 --> 00:42:35.159
everybody. This is a problem. This is a problem. Where did they come from? I said Roman, I don’t

00:42:35.159 --> 00:42:41.359
know. I’m gonna go figure out, but they must have been here when you arrived because they never came

00:42:41.359 --> 00:42:47.159
in and they never came out. This is the first time I’m seeing them. If they’re coming from inside the

00:42:47.159 --> 00:42:53.279
restaurant, clearly they’ve been there longer than me and they’ve been there when you came in, right?

00:42:53.279 --> 00:42:59.559
Okay, figure it out. I’m running around now trying to figure things out. He’s still yelling into my

00:42:59.559 --> 00:43:05.319
ear. I’m calling him back and I’m taking videos with my phone. I have an app – oh,

00:43:05.319 --> 00:43:10.279
this is kind of neat; I have an app on my phone that you could double-tap the screen and it turns

00:43:10.279 --> 00:43:15.719
the screen off. So, it can – it’s rolling video but the screen is blank. It’s just a

00:43:15.719 --> 00:43:20.399
black screen as if the phone is off. That’s the kind of – that’s the cool feature about it. So,

00:43:20.399 --> 00:43:26.639
I’m taking video of what’s going on, taking identifiable video of people, of Raphael Satter,

00:43:26.639 --> 00:43:31.479
of the videographer from Associated Press, of John Scott-Railton, and I’m trying to figure

00:43:31.479 --> 00:43:41.359
out what’s going on, kind of listening with – for all the commotion. Roman tells me you know,

00:43:41.359 --> 00:43:45.519
we have to help get Michel out of there, but he’s not calling him Michel. He say, we have to help

00:43:45.519 --> 00:43:52.959
get the agent out. The agent is somewhere; he’s hiding. You need to help him get out. I said okay,

00:43:52.959 --> 00:43:58.359
tell me where – tell me what to do. How do I help him get out? What does he need? He goes,

00:43:58.359 --> 00:44:02.479
I’ll call him back. You get the video; figure out what’s going on. In the meantime,

00:44:02.479 --> 00:44:07.599
get pictures of everybody so we could figure out who’s who later. So, I’m doing that.

00:44:07.599 --> 00:44:14.319
Periodically Khaykin is calling me, yelling into the phone frantically, and I’m waiting outside.

00:44:14.319 --> 00:44:20.399
Raphael Satter, John Scott-Railton, and the two AP people; the photographer, the videographer,

00:44:20.399 --> 00:44:28.079
gather outside. I get some pictures of them, and they split up and they leave. I take notice that

00:44:28.079 --> 00:44:35.159
JSR’s wearing a very professional outfit and he’s a very smart-looking guy. I watch people all the

00:44:35.159 --> 00:44:39.999
time, so I’m thinking this guy’s very smart. I hope I get to meet him one day ‘cause it looks

00:44:39.999 --> 00:44:46.959
like he organized all this. He clearly looks like the smartest guy in the room. He knows

00:44:46.959 --> 00:44:54.399
what’s going on. In my mind I put a checkmark; JSR, smart guy, smart dress, interesting. I look

00:44:54.399 --> 00:44:59.079
at Raphael Satter and I say Raphael Satter, he’s not prepared for the weather. We’re in New York;

00:44:59.079 --> 00:45:04.439
it’s cold. It’s wet outside. He’s wearing ASICS running shoes. [00:45:00] I said, he must be the

00:45:04.439 --> 00:45:09.999
guy who’s here doing something else. [MUSIC] I don’t know what his role is, but we’ll put a

00:45:09.999 --> 00:45:14.919
checkmark that he’s not prepared to be outside for a while. Then the videographer, the photographer

00:45:14.919 --> 00:45:18.399
from the Associated Press are dressed like they’re ready to hike up Mount Everest.

00:45:18.399 --> 00:45:23.399
They got hiking boots, they got cold weather gear, they got good jackets,

00:45:23.399 --> 00:45:27.799
they got – they’re ready to spend a lot of time outside. I said okay, these guys are

00:45:27.799 --> 00:45:33.919
the professional photographers that are gonna be – that were told to be prepared to wait,

00:45:33.919 --> 00:45:39.679
and they were ready to wait outside in the cold. I report back to Khaykin. He says okay, good,

00:45:39.679 --> 00:45:44.799
you got their pictures. I got their pictures; great. Send them to me later. You need to go to

00:45:44.799 --> 00:45:50.599
the Marriott hotel around the corner, get your car, pick up the agent. I say okay,

00:45:50.599 --> 00:45:55.079
he was able to get out? He says, yeah. He found the back exit somewhere? ‘Cause I’m standing in

00:45:55.079 --> 00:46:00.319
the front lobby and I’m watching the front. So, he found another way to get out of the

00:46:00.319 --> 00:46:06.999
building. He got out, and he made his own way to the Marriott hotel around the corner. I go get my

00:46:06.999 --> 00:46:13.359
car and I have – my car’s tinted out, so you can’t really see inside. Even the windshield is tinted,

00:46:13.359 --> 00:46:20.279
so you can’t make faces out when you’re standing next to my car. I drive to the Marriott hotel.

00:46:20.279 --> 00:46:26.079
I tell Khaykin I’m there. The agent comes out, gets in the back of my car,

00:46:26.079 --> 00:46:32.159
and Khaykin tells me on the phone, whatever he needs, offer him whatever he needs. You are

00:46:32.159 --> 00:46:36.159
to do whatever he says. In my mind I’m thinking yeah, yeah, whatever he says,

00:46:36.159 --> 00:46:41.839
but I’m not putting no fucking dead bodies in the car. I mean, whatever he says,

00:46:41.839 --> 00:46:46.119
it’s a very wide meaning, but meanwhile I’m agreeing with Khaykin. I said yeah, of course,

00:46:46.119 --> 00:46:53.519
Roman. Anything he needs. The guy gets in the car; he’s a very pleasant old man. Kinda reminded me a

00:46:53.519 --> 00:46:58.959
little bit of a grandpa character from a movie of some sort. He’s talking either in Hebrew or

00:46:58.959 --> 00:47:07.359
in French. He’s not speaking English. He’s talking to someone. I shake his hand. He gets in the back;

00:47:07.359 --> 00:47:16.119
he doesn’t introduce himself. I say my name is Igor. He tells me, go to this hotel. I

00:47:16.119 --> 00:47:20.119
drive to this hotel and I drive around to make sure that I’m not being followed.

00:47:20.119 --> 00:47:23.359
JACK: Are you good at that? Are you good at lose – like,

00:47:23.359 --> 00:47:25.753
seeing if you’ve been followed, and you know the way around?

00:47:25.753 --> 00:47:29.679
IGOR: Well, yeah. I follow people all the time, so it’s easy for me to figure out how

00:47:29.679 --> 00:47:33.799
to check if I’m being followed, right? I guess sometimes we get paranoid, so we just check.

00:47:33.799 --> 00:47:37.319
JACK: Can you explain how to check if you’ve been followed,

00:47:37.319 --> 00:47:40.959
if you’re being followed? Like, your – kind of your methods?

00:47:40.959 --> 00:47:44.599
IGOR: [MUSIC] So, I’ll tell you about that specific scenario. We were in midtown

00:47:44.599 --> 00:47:50.359
Manhattan where the traffic in the evening is pretty heavy. There’s a lot of traffic

00:47:50.359 --> 00:47:55.279
lights and there’s a lot of movement. So, it’s not easy to drive in a – like,

00:47:55.279 --> 00:48:01.119
ideally if you’re driving on the highway, right, if you slow down or you speed up,

00:48:01.119 --> 00:48:04.559
the person who’s following you has to match what you’re doing, so that’s how you could

00:48:04.559 --> 00:48:10.159
force somebody to show themselves that they would be distinct from the rest of the traffic.

00:48:10.159 --> 00:48:14.599
You could get off the highway and see who gets off the highway with you. You could go

00:48:14.599 --> 00:48:21.239
to a McDonalds drive-through, come out, you could go to a bank drive-through, come out,

00:48:21.239 --> 00:48:27.119
and you’re seeing who is constantly showing up in the same cars? Who’s making the same turns?

00:48:27.119 --> 00:48:31.879
You get back on the highway; who is back on the highway? Who was there a half-hour ago?

00:48:31.879 --> 00:48:36.559
In midtown, you can’t do that because there’s so many cars. You’ll never – you can’t possibly

00:48:36.559 --> 00:48:43.159
remember all the cars. So, in midtown, the goal is to drive down quiet streets,

00:48:43.159 --> 00:48:50.359
force somebody to stay behind, and then have to chase you down when you get to the next corner,

00:48:50.359 --> 00:48:55.279
or go into – in midtown there’s a lot of garages that you enter, let’s say, at 51st Street,

00:48:55.279 --> 00:48:59.679
but you exit on 52nd Street, and they’re going in – they’re one-way streets, so they’re going

00:48:59.679 --> 00:49:05.759
in opposite directions. The avenues are going in opposite directions also. So, if I go into

00:49:05.759 --> 00:49:12.759
a garage let’s say on 51st, exist on 52nd and I come out to the avenue, and – so, I’m changing my

00:49:12.759 --> 00:49:18.199
direction of travel and I’m forcing someone to go through a garage, because there’s no way that they

00:49:18.199 --> 00:49:23.159
could circle that block and get to the corner where I’ll come out. You know what I’m saying?

00:49:23.159 --> 00:49:23.969
JACK: Yeah.

00:49:23.969 --> 00:49:31.359
IGOR: So, I do a couple of those things. Rush hour traffic is dying down now and

00:49:31.359 --> 00:49:37.359
everything is cool. I’m content. There’s no cars following us. He’s the professional;

00:49:37.359 --> 00:49:45.479
he seems content. He’s just talking constantly into his phone. I drive to his hotel,

00:49:45.479 --> 00:49:53.959
also in midtown. He gives me a claim check to give to the guy in the lobby to take his

00:49:53.959 --> 00:50:01.199
luggage out of storage, which immediately in my mind, I say oh shit, I’m gonna have this guy’s

00:50:01.199 --> 00:50:05.839
luggage in my hand. [MUSIC] [00:50:00] What are the chances that this professional spy is gonna

00:50:05.839 --> 00:50:10.639
have his name tag on his luggage in case it gets lost? If he has it, I gotta get a picture ‘cause

00:50:10.639 --> 00:50:18.999
I’ll have his name. The second thing that I’m thinking; it’s PM, right? It’s in the evening.

00:50:18.999 --> 00:50:25.759
His luggage is in the hotel lobby in storage. That means that he stayed at this hotel, but he checked

00:50:25.759 --> 00:50:32.279
out the same morning. So, he had plans to leave the hotel and probably leave New York tonight.

00:50:32.279 --> 00:50:37.239
JACK: I love the way a private investigator thinks. When you think about that – I don’t

00:50:37.239 --> 00:50:40.739
think about it like that, but I love hearing the way you think it through.

00:50:40.739 --> 00:50:45.759
IGOR: Yeah, I mean, it’s just – for me, it’s like, I guess we’re overthinking everything.

00:50:45.759 --> 00:50:52.839
It’s just helpful at work. So, whatever, I give the guy five bucks because I want the guy to get

00:50:52.839 --> 00:50:58.359
the luggage and not make me wait. I have Michel in my car. It’s parked illegally. It’s tinted out;

00:50:58.359 --> 00:51:01.959
nobody could see him, and I explained that to him before I leave. I say look,

00:51:01.959 --> 00:51:06.439
the car has tinted windows. No one can see your face. Stay in the car;

00:51:06.439 --> 00:51:11.439
no one will see you. We were not followed. I get the luggage in the lobby,

00:51:11.439 --> 00:51:16.199
I look at the – this guy, this fucker has a name tag on the luggage and I’m thinking,

00:51:16.199 --> 00:51:22.359
are you a – seriously, are you a spy? I look; it has his name tag and his address on the luggage.

00:51:22.359 --> 00:51:27.019
JACK: His luggage did not say Michel Lambert. It had a completely different name.

00:51:27.019 --> 00:51:29.999
IGOR: I think alright, I’m gonna snap a picture of this,

00:51:29.999 --> 00:51:33.039
but I’m not gonna do it in the lobby ‘cause I don’t know where Michel is,

00:51:33.039 --> 00:51:37.919
‘cause now I left him uncontrolled. He’s in my car but I don’t know if he came out, if he’s looking

00:51:37.919 --> 00:51:42.359
over my shoulder. I’m gonna put the luggage in the trunk. When I put the luggage in the trunk,

00:51:42.359 --> 00:51:48.359
Michel’s head is going to be facing forward ‘cause I have an SUV. He’s not gonna see me. I put my

00:51:48.359 --> 00:51:54.519
camera app on with the black screen and I snap a picture of the luggage when I put it in the trunk,

00:51:54.519 --> 00:52:02.799
and I close the trunk. I swipe my finger and the app goes away. It’s gone, so when I put my phone

00:52:02.799 --> 00:52:10.079
back on the magnet on the dashboard, Michel is not gonna see that I had the camera app on. He tells

00:52:10.079 --> 00:52:15.439
me to drive him to another hotel in the area. I drive him to a hotel, but he doesn’t like it.

00:52:15.439 --> 00:52:20.799
He says, where’s the lobby? [MUSIC] I say, it’s on the second floor, I think. This is New York,

00:52:20.799 --> 00:52:25.799
so sometimes the lobby is not gonna be on the first floor ‘cause they have a business there.

00:52:25.799 --> 00:52:31.479
He goes no, no, no, I need a hotel with a street-facing lobby. I say okay, I understand;

00:52:31.479 --> 00:52:36.799
you want to be able to see outside and you want to be able to see what’s going on. I say okay,

00:52:36.799 --> 00:52:41.239
give me a second, there’s another hotel around the corner. The only thing that he

00:52:41.239 --> 00:52:47.439
asked me in the car – he asked me, who were those people at the restaurant? I said I’m not sure,

00:52:47.439 --> 00:52:53.399
but I think the guy you met with brought the guy with the bushy hair and I think that they

00:52:53.399 --> 00:52:56.959
brought those people with them because those people were dressed like paparazzi

00:52:56.959 --> 00:53:01.239
would dress to wait for a celebrity outside. They might be paparazzi ‘cause they had very

00:53:01.239 --> 00:53:05.879
professional photo equipment. He says okay, thank you, whatever, and he continues talking

00:53:05.879 --> 00:53:11.159
on the phone. The only thing that I picked up from him talking on the phone is that he was

00:53:11.159 --> 00:53:19.599
trying to get a flight to Israel because he was saying the word direct Tel Aviv.

00:53:19.599 --> 00:53:27.759
Then he was saying some other phrasing, and then he would say London, Heathrow, or he would say

00:53:27.759 --> 00:53:35.479
Berlin or Paris, and then he would say direct Tel Aviv, so I couldn’t understand the context,

00:53:35.479 --> 00:53:41.559
but he was offering options of cities where there are airports that you could connect a flight to

00:53:41.559 --> 00:53:47.239
Israel. I think he was trying to get somebody, whoever was on the phone, to get him home,

00:53:47.239 --> 00:53:56.199
to get him to Israel. Later, analyzing this post-fact, I realized that they’re a very

00:53:56.199 --> 00:54:02.719
economic company, so what I have a feeling was going on is he probably had another gig lined up,

00:54:02.719 --> 00:54:09.199
so he had travel plans to go somewhere else. But because the operation went to shit,

00:54:09.199 --> 00:54:15.599
there were photographers taking his picture and the journalist talking to him, he believed

00:54:15.599 --> 00:54:24.359
that his face could end up being on TV or in a publication tomorrow. So, in the scenario where

00:54:24.359 --> 00:54:29.239
an intelligence operative gets his picture taken, it’s the worst thing. Intelligence operatives

00:54:29.239 --> 00:54:35.359
typically don’t want their picture taken because it prevents them from doing things covertly.

00:54:35.359 --> 00:54:41.359
So, he needed to get home just in case. I don’t think that there was a risk that

00:54:41.359 --> 00:54:47.439
he was gonna get thrown in jail, but I think as a standard operative procedure,

00:54:47.439 --> 00:54:53.639
when you get your picture taken, you gotta go to a safe place which for him was Israel.

00:54:53.639 --> 00:55:00.639
I take him to the Riu Plaza in New York which has a very big glass lobby, and I thought right – but

00:55:00.639 --> 00:55:05.399
once he told me he wants a street-facing lobby, [00:55:00] I tell him there’s a spot around the

00:55:05.399 --> 00:55:09.959
corner with a big glass lobby and you could sit in the restaurant or the bar and you could see

00:55:09.959 --> 00:55:14.679
the street and you could be far away, removed from the street, that nobody would see you. I

00:55:14.679 --> 00:55:23.239
take him there, I shake hands, and that was it. He went on his way and I went on my way.

00:55:23.239 --> 00:55:29.879
JACK: Well, after all this, Raphael Satter went back to the Associated Press to investigate

00:55:29.879 --> 00:55:36.239
this Michel person. At the same time, Igor was sending all this information to Ronan Farrow.

00:55:36.239 --> 00:55:42.599
IGOR: I send Farrow all the pictures and I say Ronan, I don’t know what happened here. Do you

00:55:42.599 --> 00:55:49.279
know anybody in these pictures? He goes yeah, in fact, I do know them. One of them is a reporter

00:55:49.279 --> 00:55:58.119
for the Associated Press, Raphael Satter, and one of them is a researcher, John Scott-Railton. I go,

00:55:58.119 --> 00:56:04.639
great. As me and Farrow are talking, a couple hours later, Farrow tells me that Raphael

00:56:04.639 --> 00:56:11.439
Satter happened to send all of their media to Farrow to review just because Satter knew that

00:56:11.439 --> 00:56:23.239
Farrow was working on the story. They decided to I guess share or discuss, and Farrow was looking

00:56:23.239 --> 00:56:31.359
at pictures of Khaykin and other pictures from the – that Satter and JSR took. I asked Farrow;

00:56:31.359 --> 00:56:35.759
I said Farrow, is my picture in there or no? He goes, your picture is not in there but your

00:56:35.759 --> 00:56:41.679
boss is. I said, good for my boss. I’m glad my picture is not in there. That’s awesome.

00:56:41.679 --> 00:56:47.959
JACK: So, Raphael Satter puts all this together and publishes the story in The New York Times,

00:56:47.959 --> 00:56:53.719
titled The Case of the Bumbling Spy: A Watchdog Group Gets Him on Camera. The

00:56:53.719 --> 00:56:58.559
story explains that they reached out to Uvda, that Israeli investigative journalism show,

00:56:58.559 --> 00:57:03.239
which you actually heard a clip from earlier in this episode. Uvda recognized the photo

00:57:03.239 --> 00:57:08.119
of Michel and was able to identify him as someone who works for Black Cube.

00:57:08.119 --> 00:57:16.559
JOHN: What happened rather quickly after the initial story is that people saw his face and

00:57:16.559 --> 00:57:24.719
people saw his face in his home country of Israel and tipped off reporters. Within a few days,

00:57:24.719 --> 00:57:28.799
The New York Times had the story that he was a former Israeli intelligence officer

00:57:28.799 --> 00:57:35.599
or official named Aharon Almog-Assoulin. He also was some kind of a city councilman in his city,

00:57:35.599 --> 00:57:43.719
or had been. This of course was bad news for the guy because not only was he named,

00:57:43.719 --> 00:57:49.479
which is obviously poison if you’re a – an intelligence operative, but also

00:57:49.479 --> 00:57:54.239
he seemed to be uniquely ill-prepared for what was going on, and bumbling.

00:57:54.239 --> 00:58:01.599
IGOR: Next day, I’m meeting up with Khaykin and Khaykin tells me that because of what happened,

00:58:01.599 --> 00:58:08.279
we’re gonna have a team meeting with Black Cube next week on Wednesday. I say okay,

00:58:08.279 --> 00:58:16.199
cool. I’m thinking in my head, next week Wednesday I’m gonna get to meet a manager from Black Cube

00:58:16.199 --> 00:58:22.079
which will be awesome. They’re probably going to give us some professional training and explain to

00:58:22.079 --> 00:58:28.679
us what we did wrong. There’s probably gonna be a debrief of this situation. This is great. So,

00:58:28.679 --> 00:58:32.639
I get in touch with Farrow. I tell him next week on Wednesday there’s gonna be a

00:58:32.639 --> 00:58:36.839
manager from Black Cube coming here. We’re gonna have a team meeting. I can’t wait;

00:58:36.839 --> 00:58:43.999
I’m so excited. So, as we get into next week, Khaykin tells me tomorrow

00:58:43.999 --> 00:58:50.479
you’re gonna be polygraphed. Don’t have any alcohol and don’t take any drugs tonight.

00:58:50.479 --> 00:58:54.699
JACK: [MUSIC] Long story short, he gets a lawyer who tells him not to take the polygraph.

00:58:54.699 --> 00:58:59.679
IGOR: So, whatever, I gave them an excuse why I’m not gonna be taking the polygraph,

00:58:59.679 --> 00:59:08.159
and Khaykin was very upset. He tried to convince me to go there. When I told him

00:59:08.159 --> 00:59:12.479
finally I’m definitely not going there, he asked me the polygraph questions on the phone and I

00:59:12.479 --> 00:59:16.559
think somebody from Black Cube was listening in on the call, like kind of on a three-way

00:59:16.559 --> 00:59:22.339
call. Some of the questions they asked me is they wanted to know how much the journalists paid me.

00:59:22.339 --> 00:59:28.239
JACK: They thought that JSR or Raphael Satter paid him to tip them off that Michel wasn’t who

00:59:28.239 --> 00:59:33.559
he said he was. They had no idea how JSR was so prepared and figured all this out.

00:59:33.559 --> 00:59:39.679
IGOR: That totally made – that totally blew my mind up inside. I wanted to really throw

00:59:39.679 --> 00:59:46.919
something at them through the phone, you know? I got so angry. I was thinking these people are so,

00:59:46.919 --> 00:59:57.399
so ignorant of the way that the American system of journalism, of our freedom that they don’t have

00:59:57.399 --> 01:00:03.719
this concept. They think the journalists paid for stories? It really pissed me off. [01:00:00] Of

01:00:03.719 --> 01:00:09.279
course, I didn’t show that I told them. I said Khaykin, what do you think I’m worth? I said,

01:00:09.279 --> 01:00:14.599
I don’t know anybody’s name. I don’t know what we’re doing. I don’t know anything. I said, why

01:00:14.599 --> 01:00:20.159
would anybody pay me? Plus, I don’t even know in advance what we’re gonna be doing tomorrow. It’s

01:00:20.159 --> 01:00:27.519
always last-minute, which is also kind of a way to compartmentalize. If I’m the guy on the ground,

01:00:27.519 --> 01:00:31.639
they don’t tell me anything in advance. Khaykin may know in advance that there’s

01:00:31.639 --> 01:00:37.519
a job for tomorrow but he’s not gonna tell me until the day before. So, I don’t have time

01:00:37.519 --> 01:00:44.399
to tell anybody else, you know? I was just very offended by that, that they had this concept that

01:00:44.399 --> 01:00:51.119
they believed journalists would pay for a story or pay a source to be a source. So, whatever.

01:00:51.119 --> 01:00:56.199
I told him, I said listen; they didn’t pay me anything. I’m worthless. I said,

01:00:56.199 --> 01:00:59.359
why would any journalist want to talk to me? What am I gonna tell them? My name is Igor.

01:00:59.359 --> 01:01:04.359
I live in New Jersey. I said you know, these guys, they need to get off their high horse and

01:01:04.359 --> 01:01:09.159
– or take me down from the pedestal. I forget what I said, but I basically said – I said,

01:01:09.159 --> 01:01:16.199
this is nonsense. Why would any journalist care about Igor? I said ah, I – and I explained to

01:01:16.199 --> 01:01:25.599
Khaykin – because Raphael Satter’s story already printed, I explained to him that in the story,

01:01:25.599 --> 01:01:34.519
Raphael Satter explains how John Scott-Railton figured out that he was being targeted by Black

01:01:34.519 --> 01:01:41.879
Cube because his colleagues were being targeted and other people were being targeted. They were

01:01:41.879 --> 01:01:52.839
recycling the plot. It was easy for JSR to catch onto that, and once they started looking into

01:01:52.839 --> 01:01:59.959
the fact that this guy’s company, the company – I think it was called CPL Consulting or something,

01:01:59.959 --> 01:02:04.719
that the company was fake, there was nothing at that address and all these things,

01:02:04.719 --> 01:02:12.919
and they figured out that yeah, this was really – this was truly a ploy to get

01:02:12.919 --> 01:02:19.639
information out of John Scott-Railton. But Roman didn’t want to hear that.

01:02:19.639 --> 01:02:24.839
He was just – kept asking me how much the journalists paid me. I mean, at some point

01:02:24.839 --> 01:02:28.679
I told him this conversation is going in a circle, so I said okay, I’m not taking the

01:02:28.679 --> 01:02:33.919
polygraph. You want to fire me? Fire me. He said well, the client is gonna fire me. I said well,

01:02:33.919 --> 01:02:37.759
tell them you fired me and maybe they wouldn’t fire you. But what do you want me to tell you?

01:02:37.759 --> 01:02:42.799
I said, I gave you a heads-up back like, three, four months ago or six months ago. I

01:02:42.799 --> 01:02:49.559
said when they’re gonna need a guy to blame, you’re gonna be the blame guy. [MUSIC] So,

01:02:49.559 --> 01:02:54.679
you’re not seeing that because you’re not looking at this from the side, but when Black Cube are

01:02:54.679 --> 01:03:00.919
gonna need a fall guy, when they’re gonna need a guy to point the finger and say he broke the law,

01:03:00.919 --> 01:03:06.839
they’re gonna say you broke the law. You’re the guy who has a license in New York. They’re gonna

01:03:06.839 --> 01:03:11.159
say that you knew the law and you did something illegal. They’re not gonna say we did something

01:03:11.159 --> 01:03:17.119
illegal. They’re gonna say we’re in Israel, we’re a foreign company, we’re untouchable in New York

01:03:17.119 --> 01:03:23.719
but you guys got Roman over there; he’s the lawbreaker. It ended up kind of being that way.

01:03:23.719 --> 01:03:32.639
At some point later, I talked to Ronan Farrow and when they called for comment from Black Cube,

01:03:32.639 --> 01:03:38.279
Black Cube said oh, that illegal stuff with the phone tracking, oh, we weren’t doing that. That

01:03:38.279 --> 01:03:47.279
was all Roman’s idea. So, it’s kind of – that’s – anyways, that’s how it played out. I didn’t meet

01:03:47.279 --> 01:03:54.599
JSR for a long time. I kept asking Farrow to introduce me to Raphael Satter, but Farrow was

01:03:54.599 --> 01:03:59.439
ready to book it. He didn’t want to get scooped, so he kept telling me he’ll introduce me to

01:03:59.439 --> 01:04:05.439
Raphael later. I just wanted to shake Raphael’s hand and just shake John’s hand and say guys,

01:04:05.439 --> 01:04:11.919
you did a great job. I happened to be there and I thought it was amazing. You guys are awesome.

01:04:11.919 --> 01:04:18.439
I’ve been reading about you. I’m your biggest fan. You guys are amazing guys. Farrow kept delaying

01:04:18.439 --> 01:04:26.119
the meeting, so at some point I just messaged Raphael and I started talking to him. I sent him

01:04:26.119 --> 01:04:34.319
some pictures from that day so he knew that I was really there. He introduced me to JSR and I said

01:04:34.319 --> 01:04:43.059
we should all hang out sometime, have dinner in New York. At some point we arranged to do that.

01:04:43.059 --> 01:04:49.999
JOHN: It’s a remarkable thing; when you’re in a situation like that,

01:04:49.999 --> 01:04:59.519
not that I’ve been in very many, but this one was stressful and fraught. I feel like I remember most

01:04:59.519 --> 01:05:04.639
of the moments from it better than many things that have happened in my life. [01:05:00] Yeah,

01:05:04.639 --> 01:05:16.799
this was a very intense experience for me. Of course, I had spent hours, hours and hours trying

01:05:16.799 --> 01:05:21.999
to think about the opposition, trying to figure out what – and put myself in the mind of whoever

01:05:21.999 --> 01:05:26.519
was planning on the Black Cube side, whoever was doing the organizing and the thinking,

01:05:26.519 --> 01:05:35.559
who might be responsible for that. I had another sense of a person outside of the hotel who,

01:05:35.559 --> 01:05:42.199
when we left and did a regroup, who kind of monitored us and was very attentive to

01:05:42.199 --> 01:05:46.519
us. I remembered his clothing really well. That turned out to be Igor. So,

01:05:46.519 --> 01:05:50.719
during the conversation I had with Igor, there was a moment where I was like, were you wearing this?

01:05:50.719 --> 01:05:53.039
I remember you when you were talking to the doorman. Yes,

01:05:53.039 --> 01:06:02.399
yes. But to set the stage emotionally, this was a thing where I had spent a lot of time

01:06:02.399 --> 01:06:06.759
trying to figure out who was on the other side and what they might have been thinking,

01:06:06.759 --> 01:06:12.479
and to not only get an opportunity to meet one of them but one of them who had done a righteous

01:06:12.479 --> 01:06:19.599
and good thing by turning whistleblower, was a profound experience for me. I had deep respect

01:06:19.599 --> 01:06:28.359
for Igor and his choice to turn whistleblower when he realized that this was really bad. [MUSIC] So,

01:06:28.359 --> 01:06:38.159
meeting him was in some ways like a beautiful coda to what had been an attempt to try to subvert my

01:06:38.159 --> 01:06:41.799
work and that of my colleague and the ability of the victims that we support to get justice,

01:06:41.799 --> 01:06:46.239
and turns out I pick up a friend in the process. So, no complaints.

01:06:46.239 --> 01:06:55.559
JACK: Yeah. So, what does this mean that Black Cube was spying on you, I guess?

01:06:55.559 --> 01:06:59.919
JOHN: Well, I think it raises the obvious question; a lot of money was clearly spent

01:06:59.919 --> 01:07:04.959
to make this happen. Who spent that money and what were they interested in? Why was

01:07:04.959 --> 01:07:12.079
discrediting us so worth it? As we learned, the story doesn’t end there. Others including

01:07:12.079 --> 01:07:20.079
lawyers representing victims of NSO Group were also targeted by the same operation,

01:07:20.079 --> 01:07:26.079
also to meetings or attempted to be lured into meetings.

01:07:26.079 --> 01:07:29.239
JACK: Well, so, hold on, how does this tie into NSO?

01:07:29.239 --> 01:07:38.319
JOHN: Well, the lawyers representing a group of victims of NSO spyware in

01:07:38.319 --> 01:07:51.279
court cases brought in Israel and elsewhere, those lawyers were also targeted by spies,

01:07:51.279 --> 01:07:56.679
by anonymous spies who tried to wine and dine them and get them to say things about the case.

01:07:56.679 --> 01:08:00.759
JACK: So, this might have been in connection with the NSO Group? It’s

01:08:00.759 --> 01:08:06.759
not clear exactly if it is and there isn’t any hard evidence which definitely links it,

01:08:06.759 --> 01:08:13.359
but we can infer that it was them. I mean, NSO did come up in their meeting quite a few times,

01:08:13.359 --> 01:08:19.279
so it’s a strong theory. But this means just as we were about to get to the bottom of this story,

01:08:19.279 --> 01:08:24.079
the bottom just fell out because JSR has been investigating the NSO Group

01:08:24.079 --> 01:08:30.039
for years and years and has published multiple reports about what the NSO has done. So yeah,

01:08:30.039 --> 01:08:37.199
let’s talk about them next. Who is the NSO Group and why has JSR been investigating them for years?

01:08:37.199 --> 01:08:42.619
That’s exactly where we’ll pick up in the next episode. John, do you have any closing thoughts?

01:08:42.619 --> 01:08:48.359
JOHN: I think at the end of the day, the experience that I had gave me something

01:08:48.359 --> 01:08:55.679
really interesting which is I had ten years of my life working with victims of spyware,

01:08:55.679 --> 01:09:02.639
people who were targeted by spyware as part of the efforts of their repressive government to

01:09:02.639 --> 01:09:12.079
mute their voice. I had heard countless stories of victims and of what it felt like to know that

01:09:12.079 --> 01:09:17.599
you were being targeted by a government or by spyware. In the smallest of ways,

01:09:17.599 --> 01:09:22.599
what this moment gave me was a bit of a sense of what that feels like,

01:09:22.599 --> 01:09:26.479
to be in a city and to not know whether someone is following you, to have the sense that there’s

01:09:26.479 --> 01:09:32.519
a well-resourced entity that’s trying to dig up dirt on you, maybe to discredit you,

01:09:32.519 --> 01:09:49.463
to target your friends and your colleagues, it’s a terrible feeling and I wouldn’t wish it on anyone.

01:09:49.463 --> 01:10:02.199
(OUTRO): [OUTRO MUSIC] [01:10:00] A big thank you to Igor and JSR

01:10:02.199 --> 01:10:06.599
for sharing this crazy story with us. If you found this episode interesting,

01:10:06.599 --> 01:10:11.599
you might want to check out Ronan Farrow’s podcast called The Catch and Kill. In fact,

01:10:11.599 --> 01:10:16.319
Episode 1 of that podcast is the story you just heard, but from Ronan Farrow’s perspective. It

01:10:16.319 --> 01:10:20.879
even has JSR and Igor as the guests in it. Igor is who brought me this story,

01:10:20.879 --> 01:10:25.639
though. I only heard the podcast after I did my interviews with him. Anyway, after Episode 1 of

01:10:25.639 --> 01:10:30.439
The Catch and Kill podcast, it goes into all the Harvey Weinstein stuff which is a different path

01:10:30.439 --> 01:10:37.119
than where we’re going. We’re going to be veering directly into the NSO Group in the next episode.

01:10:37.119 --> 01:10:41.199
Do you get mad when you’re all caught-up on new episodes and have to wait two weeks for the

01:10:41.199 --> 01:10:45.639
next one? Look, if that’s the case, it obviously means you really like the show and should consider

01:10:45.639 --> 01:10:50.119
donating to it to help it along. Donations to independent creators really go a long way at

01:10:50.119 --> 01:10:57.159
helping get new content out to you, so please visit patreon.com/darknetdiaries and consider

01:10:57.159 --> 01:11:02.039
supporting the show, or you can subscribe to Darknet Diaries Plus on Apple Podcasts. Thank

01:11:02.039 --> 01:11:07.119
you. This show is made by me, the secret squirrel, Jack Rhysider. Sound design this episode was

01:11:07.119 --> 01:11:12.279
done by the sound of silence, Andrew Meriwether. Editing help this episode by the feline supernova,

01:11:12.279 --> 01:11:17.719
Damienne, and our theme music is by the 3D waffle, Breakmaster Cylinder. Even though they

01:11:17.719 --> 01:11:36.279
never caught the hacker, why? Well, because he ran somewhere, this is Darknet Diaries.