[00:00.730 --> 00:11.190]  So thank you all for for being here, and thanks to HOPE and 2600 for, you know, letting me come back and address this topic here.
[00:12.670 --> 00:25.990]  Today I'm going to be talking about a couple of things that I've been looking into over the last year or so, and what this means for us in general, and kind of the questions that it raises about...
[00:26.710 --> 00:27.830]  Oh, I'm sorry.
[00:28.410 --> 00:42.690]  Some of the questions that it raises about our obligations to sources, and the public in general, and how we resolve those conflicts, because they're not always the same thing.
[00:45.330 --> 00:56.050]  So before we get into the main discussion, which I guess we'll be talking about four sets of things, really.
[00:56.310 --> 01:06.850]  We'll be talking about Anonymous briefly, and then we will move on to Russia and operations that happened after Russia's invasion of Ukraine in 2022.
[01:07.530 --> 01:18.350]  And then we're going to finish up by looking at a couple of times that the cyber realm has interacted directly with kinetic effects.
[01:19.290 --> 01:23.210]  And, you know, kind of how fucked up that is in general.
[01:26.210 --> 01:34.990]  And so before we get into the actual data, let me just talk about like the sources that I compiled and I'm using for this.
[01:34.990 --> 01:38.970]  First, there's a lot of recordings that I managed to get a hold of.
[01:39.090 --> 01:40.050]  Some of them were public.
[01:40.370 --> 01:42.530]  Some have been memory hold since then.
[01:43.450 --> 02:01.210]  But in a lot of instances, you know, one of the difficulties with, you know, reading chat logs and text communications and things is that it does get hard at times to discern intent.
[02:02.270 --> 02:07.710]  You can't tell what someone is feeling at any given moment just by reading their text.
[02:07.870 --> 02:14.030]  Even sometimes when it seems obvious, we all know that there's room for doubt at times.
[02:14.650 --> 02:23.350]  And so getting to hear things from people's own voices, see it, you know, come out of their lips, and a lot of times that was really helpful in clarifying.
[02:24.150 --> 02:40.690]  Next, we've got chat logs, which, you know, I just mentioned, a lot of them are direct chat logs, as well as screenshots of messages and screen recordings of messages, which is, you know, lots of messages being scrolled through and recorded as a video.
[02:42.210 --> 02:46.710]  Several of the hackers who have been involved in these operations agreed to talk to me.
[02:47.190 --> 02:58.690]  I'm not going to get into identifying any of them, except that, well, I guess we'll get to that specific when we get there.
[03:00.030 --> 03:09.630]  What they told me was also corroborated by several other witnesses who were not necessarily involved in things directly, but they were in positions to observe what was happening.
[03:10.110 --> 03:15.450]  They knew the hackers when things were happening, so they were aware of those conversations.
[03:15.450 --> 03:22.750]  They were aware of just a lot of things that, you know, helped corroborate the specifics of what was going on.
[03:22.750 --> 03:32.450]  And one of the most important pieces was I was actually given access to a digital workspace used by the hackers for one of their operations.
[03:32.970 --> 03:41.390]  And this retained a complete history of everything that they had done, who was logging on and accessing things, who did what edits when.
[03:41.830 --> 03:51.270]  And that was very persuasive in terms of documenting exactly, you know, the who, what and when of things.
[03:54.540 --> 04:01.000]  So first up, we have anonymous, which I think everyone here is pretty much familiar with it.
[04:02.720 --> 04:11.620]  But let's do the obligatory refresher in case anyone isn't or, you know, this gets posted and taken out of context or something.
[04:11.800 --> 04:13.000]  I'm sure that'll happen.
[04:13.600 --> 04:14.840]  So what is anonymous?
[04:14.840 --> 04:18.380]  It's a loose knit collective of trolls, hackers and activists.
[04:18.380 --> 04:21.360]  There's no single belief system structure goal.
[04:22.500 --> 04:27.480]  And one of the defining attributes of anonymous was the way it evolved.
[04:27.720 --> 04:28.740]  Anyone could be anonymous.
[04:28.820 --> 04:32.680]  You say that you're anonymous, boom, you're anonymous.
[04:33.620 --> 04:39.600]  And it's literally unfalsifiable because saying it makes it so.
[04:39.880 --> 04:42.020]  It's like declaring a new discordian pope.
[04:42.020 --> 04:45.260]  You can't, you can't dispute it.
[04:46.040 --> 04:56.260]  Some of Anonymous's most infamous things involve their war with Scientology and for supporting the Occupy movement, the Arab Spring and WikiLeaks.
[04:59.690 --> 05:09.750]  So, when I said anonymous, I don't know how many of you people listening thought about Aubrey Kurtaner Cottle.
[05:10.430 --> 05:22.110]  He has somewhat recently been arrested and is going through court currently for hacking, allegedly, Epic and the Texas GOP.
[05:22.110 --> 05:26.370]  Which, you know what, those, those were pretty decent hacks.
[05:26.750 --> 05:27.890]  I don't know.
[05:31.660 --> 05:32.540]  Moving on.
[05:32.860 --> 05:34.280]  Not going to get into specifics.
[05:37.080 --> 05:43.320]  Not going to get into specifics of what exactly I didn't know when at this point.
[05:43.540 --> 05:53.480]  Because, yeah, I don't, I don't think we should really be talking about the details of a hack that, you know, someone is currently undergoing trial for.
[05:53.480 --> 05:58.040]  It wasn't a DDoS secrets release, but like, still, we mirrored it.
[05:59.040 --> 06:03.380]  So, there's two different stories when it comes to Kurtaner's early days.
[06:03.640 --> 06:09.020]  He, you know, as most of you know, claimed that he was a founder or the founder of anonymous.
[06:10.840 --> 06:15.060]  And Kurtaner has told this story to a number of people in different settings.
[06:15.060 --> 06:16.340]  Usually, it's public.
[06:16.840 --> 06:19.620]  And, you know, we get about half the story.
[06:19.980 --> 06:32.480]  And in that CSIS agent, which is Canadian law enforcement and intelligence, they came and visited Kurtaner and said, like, wow, these are some really incredible raids you're doing.
[06:33.040 --> 06:37.360]  You're fucking with Hal Martin and, you know, all this other stuff.
[06:37.620 --> 06:47.380]  And, you know, this was in the area where we had the Fox News segment that was infamous, the hackers on steroids thing with the exploding truck, which was truly ridiculous.
[06:48.860 --> 06:52.320]  And so, he came and said, like, do you want to work for us?
[06:52.720 --> 06:54.380]  And Kurtaner said, no.
[06:54.540 --> 06:58.860]  That has been consistent in every telling that I've heard.
[06:58.960 --> 07:00.680]  He said, I don't want a salaried job.
[07:02.240 --> 07:03.880]  But then there was another offer.
[07:04.360 --> 07:07.520]  And this usually gets left out of the tellings that he does.
[07:09.200 --> 07:16.580]  The CSIS agent then asked if he would help run raids on Middle Eastern forums and extremist forums.
[07:17.360 --> 07:21.220]  And publicly, Kurtaner has said that, you know, he was open to it.
[07:22.320 --> 07:29.200]  You know, he told them maybe, and then just kind of stopped answering their calls and waited for them to stop calling them back.
[07:29.420 --> 07:31.980]  And that was, you know, where it ended.
[07:32.260 --> 07:38.100]  But privately, in a number of chats, he has acknowledged that he accepted that offer.
[07:38.640 --> 07:45.440]  And that he received, basically, forms of immunity for this, additional tolerance.
[07:46.960 --> 07:54.000]  Now, at times, you know, he has addressed these contradictions online and in various appearances.
[07:54.000 --> 07:56.080]  And he basically says, I was just trolling.
[07:56.080 --> 08:00.460]  Who from the image boards hasn't said, LOL, I'm a fed.
[08:00.920 --> 08:03.120]  And you know what?
[08:04.400 --> 08:04.960]  Maybe.
[08:07.200 --> 08:07.760]  Maybe.
[08:08.940 --> 08:13.560]  But let's go ahead and just take a quick look at what he's acknowledged publicly.
[08:14.440 --> 08:27.140]  This was two months before the Atlantic article came out calling him a founder of Anonymous, in which Kurtaner admitted to weaponizing the collective for alphabet agencies.
[08:27.320 --> 08:37.220]  He says, quote, I was the lucky one to have the blessing of alphabet agencies to weaponize Anonymous, as an anti-terrorism thing to boot, those that came after me, not so much.
[08:37.220 --> 08:38.760]  I'm Canadian, too.
[08:38.920 --> 08:40.180]  So that changes the calculus.
[08:40.560 --> 08:42.640]  And it was a laughable concept, too.
[08:43.580 --> 08:47.180]  The last part, we can, you know, debate whether or not it's laughable.
[08:48.000 --> 08:59.080]  But this was a very public, in plain text, admission that he did before his media comeback was truly staged, which, from what I understand, had been in the works for a little bit.
[08:59.280 --> 09:05.440]  He had started claiming founder status of Anonymous as early as 2018, according to some individuals.
[09:07.620 --> 09:11.280]  But, you know, again, you could debate this.
[09:12.060 --> 09:14.400]  You could debate the intent of that tweet.
[09:14.720 --> 09:16.100]  Was it just trolling?
[09:16.340 --> 09:18.340]  Was he fucking with people?
[09:18.620 --> 09:19.960]  What did he actually mean?
[09:20.680 --> 09:25.920]  So, let's hear him explain it, in his own voice, his own words.
[09:34.290 --> 09:34.690]  What?
[09:35.810 --> 09:36.390]  Are you?
[09:37.370 --> 09:37.770]  Truly.
[09:57.140 --> 10:00.220]  It is starting to play the audio, and then it immediately cuts out.
[10:01.400 --> 10:01.800]  Oh.
[10:02.160 --> 10:03.860]  After I turned down the salary.
[10:04.000 --> 10:04.260]  Finally.
[10:04.420 --> 10:04.880]  No, no, no.
[10:04.980 --> 10:05.740]  I don't think I want to be in.
[10:06.660 --> 10:07.060]  Oh.
[10:12.180 --> 10:12.840]  All right.
[10:14.040 --> 10:15.480]  High-tech stuff, folks.
[10:21.780 --> 10:23.040]  Lovely clicking sounds.
[10:24.780 --> 10:27.720]  I promise, we're hopefully not going to have to do this every time.
[10:28.560 --> 10:28.720]  Shit.
[10:31.100 --> 10:32.640]  Three, two, one.
[10:32.840 --> 10:33.300]  Please.
[10:33.560 --> 10:37.500]  And after I turned down the salary, I'm like, no, no, no.
[10:37.560 --> 10:40.100]  I don't think I want to be in something like that.
[10:40.720 --> 10:47.140]  And Duke goes, well, would you be willing to raid Al-Qaeda forums for us?
[10:47.140 --> 10:48.440]  Shit, you're not.
[10:50.040 --> 10:51.820]  He just fucking drops that on me.
[10:53.300 --> 10:55.880]  He wanted us to raid the goddamn Al-Qaeda forums.
[10:57.660 --> 10:58.560]  What did you say?
[10:59.920 --> 11:01.280]  Uh, maybe.
[11:02.460 --> 11:15.660]  Well, at the same time, if you actually go, if you go on the Wayback Machine, you start digging through the old Slash High archives that you can go and stuff out, you will find terrorist forum raids, left and right.
[11:15.660 --> 11:17.380]  Like, they were fucking all over the place.
[11:17.520 --> 11:18.480]  They were around, yeah.
[11:18.900 --> 11:19.400]  And, uh...
[11:19.400 --> 11:20.820]  Yeah, those were, those were fed posts.
[11:21.860 --> 11:23.740]  Uh, I used to wonder about those, you know.
[11:25.160 --> 11:26.560]  Yeah, well, now you know for sure.
[11:27.000 --> 11:33.860]  And I used to, uh, look at the invasion board and, and I would look at some of the threads that came up that got traction.
[11:34.120 --> 11:45.580]  You know, the, the not your personal army ones are obviously going to fall to the bottom and get deleted, but the ones that did gain traction and that, that were at a gray area, I would wonder, I said, who's going to get the visit?
[11:47.080 --> 11:48.000]  And, uh...
[11:48.000 --> 11:48.900]  Nobody ever did.
[11:49.260 --> 11:49.620]  Yeah.
[11:49.760 --> 11:50.220]  That's the fun part.
[11:50.700 --> 11:52.760]  Yeah, it really, it really makes you think.
[11:53.080 --> 12:10.620]  Uh, pretty much my entire run, all of that shit, you take a look at everything that happened afterwards and then you take a look at, uh, my period and you, you can go, you can dig through news, you can dig through arrest records, all that shit, not a single motherfucker got touched.
[12:10.800 --> 12:15.640]  It was like we had a magic umbrella just, just protecting everyone under me.
[12:16.140 --> 12:16.620]  That's true.
[12:16.620 --> 12:17.260]  You know I'm right.
[12:20.320 --> 12:20.800]  Trolling?
[12:21.420 --> 12:21.600]  Trolling?
[12:21.940 --> 12:22.420]  Maybe.
[12:24.040 --> 12:25.120]  I don't think so.
[12:25.400 --> 12:30.980]  I've seen him talk about this stuff in chat logs with hackers that he was trying to recruit and work with at the time.
[12:31.160 --> 12:45.240]  He has acknowledged this as an influence in the past and he has specifically attributed the non-prosecution over the Epilepsy Foundation hack in 2008 to his cooperator status.
[12:45.640 --> 13:05.220]  Uh, those of you who may not remember, they hacked the, uh, Epilepsy Foundation website and put a lot of GIFs on there that flashing images so that people who went to, you know, get help for their epilepsy or information about it, uh, instead were triggered.
[13:05.220 --> 13:08.560]  And, you know, this had real world consequences for some people.
[13:08.920 --> 13:13.880]  Um, and, you know, Kurt has said, like, I was never touched for that.
[13:13.980 --> 13:16.680]  I've even publicly acknowledged being, being part of that.
[13:16.820 --> 13:17.440]  He has said that.
[13:17.920 --> 13:24.820]  And, uh, what's interesting is the FBI did, uh, they did basically drop it.
[13:24.980 --> 13:36.560]  Um, you can go back and in a CNN interview where they're debating anonymous, the host on CNN jumps in and says that, no, uh, the FBI actually said that this wasn't anonymous.
[13:36.800 --> 13:44.100]  Anonymous had nothing to do with this, which was very interesting because it was publicly and widely attributed to anonymous at the time.
[13:44.440 --> 13:48.320]  People found the posts where they were planning this on the image boards.
[13:48.320 --> 13:50.180]  It was written about.
[13:51.080 --> 13:57.040]  There was really no reason to conclude that, but they did.
[13:58.880 --> 13:59.720]  I don't know.
[13:59.860 --> 14:01.240]  Maybe the FBI is trolling us.
[14:04.040 --> 14:09.020]  Now, I mentioned before, Kurt Tanner turned down the salary from CSIS.
[14:09.440 --> 14:17.900]  Uh, and he has consistently said in every chat log I've, I've been given that, you know, he could never really be a kept, a kept pet.
[14:18.040 --> 14:19.600]  He could never really be a kept asset.
[14:19.940 --> 14:24.340]  And he never, he never worked as a contractor or had any sort of formal arrangement.
[14:25.280 --> 14:40.660]  Instead, he has given grace for his activities specifically when, you know, they happen to align with some of the government's interests, similar to the, the Middle Eastern, uh, forum raids that they discussed earlier.
[14:40.900 --> 14:47.520]  And, um, again, he has discussed this publicly in an audio piece of audio that I can share.
[14:50.940 --> 14:52.200]  Just takes a second.
[14:53.860 --> 14:55.300]  We'll be patient this time.
[14:55.480 --> 14:55.680]  Come on.
[14:58.830 --> 14:59.310]  Really?
[15:04.640 --> 15:07.060]  What is wrong with you?
[15:14.390 --> 15:15.390]  Oh my goodness.
[15:25.670 --> 15:27.890]  Just breathe and it should come on.
[15:27.890 --> 15:35.070]  There is a distinct difference between dead ass being a patriot and doing it for the greater good, uh, than, than being an asset.
[15:35.310 --> 15:43.850]  Like, um, yeah, you know, there's, there's, there's a level of tolerance versus being something that you could classify as a designated asset.
[15:44.070 --> 15:45.150]  I'm sure you can agree there.
[15:47.430 --> 15:51.690]  So again, you know, in his own words, never a designated asset.
[15:51.950 --> 15:55.670]  Just, um, I don't know.
[15:55.830 --> 15:56.490]  What's the word?
[15:56.570 --> 15:57.130]  Useful idiot.
[16:01.170 --> 16:10.050]  So, uh, you know, let's, let's go ahead and talk about the, uh, epic hack and criminal complaint real quick, because there's a couple things that are kind of relevant.
[16:10.310 --> 16:16.870]  First off, um, to the FBI agents reading my discord logs, eat my ass.
[16:17.190 --> 16:20.050]  Your sedition charges, I helped your sedition charges.
[16:20.430 --> 16:22.710]  Least you could do is pay for my therapy.
[16:25.650 --> 16:26.830]  Great, great stuff.
[16:27.490 --> 16:35.170]  Um, one of the interesting things that jumped out at me, though, was, this is kind of just a fun little fuck up on the FBI's part.
[16:35.790 --> 16:42.090]  Uh, they say that on January 18th, 2022, he posted these four messages.
[16:42.090 --> 16:51.150]  If you look at the dates, no, this was 2021, September 26th.
[16:51.730 --> 16:54.690]  And, uh, fun fact, neither indicate anything.
[16:54.990 --> 16:59.210]  Uh, they're both quotes from articles published by the Washington Post.
[16:59.550 --> 17:01.150]  Uh, two separate articles, I believe.
[17:01.150 --> 17:06.170]  One of which, uh, I mentioned in, along with DDoS secrets.
[17:06.430 --> 17:17.210]  Uh, for some reason, the FBI didn't think that, hey, we should redact Emma's name in this, even though they went ahead and redacted Rob Monster's name in the criminal complaint.
[17:17.450 --> 17:24.070]  Uh, he was the CEO of Epic and is publicly cited and acknowledged in many places.
[17:24.070 --> 17:29.330]  So, why the fuck he deserved privacy and I don't, who the hell knows.
[17:29.950 --> 17:37.310]  But, um, you know, the, the Epic data, we didn't publish that until after it was already out.
[17:37.630 --> 17:45.170]  It was released on a torrent and allegedly there was just one seeder at the time and their IP address happened to match Kirtaner's.
[17:46.010 --> 17:50.570]  A couple of interesting things that I found while, while researching this.
[17:50.570 --> 17:52.670]  And I, I just want to mention them.
[17:52.970 --> 18:05.430]  Um, in private messages, he brags about, hey, wow, when they were rating me, they missed this big box of hard drives sitting next to my computer.
[18:06.690 --> 18:09.570]  And then there's a picture of a box of hard drives.
[18:09.790 --> 18:21.310]  More, more recently, um, this was, this was public in either Discord or I think actually on his Twitter account, GB Milady, uh, Game Boy Milady.
[18:21.510 --> 18:22.970]  It's some NFT bullshit.
[18:23.450 --> 18:24.530]  Um, fun fact.
[18:24.650 --> 18:30.190]  There's apparently some like extreme white supremacist background ties to that.
[18:30.430 --> 18:33.610]  So, you know, NFT space, always, always great.
[18:33.750 --> 18:34.670]  Gotta, gotta love it.
[18:35.270 --> 18:37.970]  Um, he posted about, oh, wow.
[18:38.230 --> 18:40.750]  When they did the raid, they also missed these phones.
[18:41.470 --> 18:44.430]  One was in a shoe box and the other was in my bed.
[18:44.850 --> 18:53.750]  Because who's ever heard of a, of a, of a search warrant being executed where they tear a place apart and bother to check the bed.
[18:53.910 --> 18:56.570]  Like that's, no one hides anything under a mattress.
[18:57.230 --> 18:58.610]  That's just silly talk.
[18:58.790 --> 19:01.070]  And again, he posted pictures of them.
[19:01.270 --> 19:05.710]  Uh, and this was actually apparently a threat against his ex Libby Shaw.
[19:05.710 --> 19:08.450]  If you know the name, you know the name.
[19:11.640 --> 19:16.560]  So there's a couple other examples in anonymous history that should try and talk about real quick.
[19:16.860 --> 19:23.020]  Um, first, backtrace, basically, Anons hated Anons.
[19:23.600 --> 19:24.960]  They started fighting.
[19:25.220 --> 19:30.400]  They said, uh, I don't want to be anonymous anymore or you're not anonymous or whatever.
[19:30.860 --> 19:34.580]  And they started doxing each other and harassing each other.
[19:34.580 --> 19:40.060]  And this led to the arrest of some people, including almost certainly Sabu.
[19:40.680 --> 19:47.420]  Uh, many of you will recognize that name immediately and felt your buttholes tighten up and I'm right there with you.
[19:47.700 --> 19:54.240]  But, um, some interesting things that I found while doing the research for this.
[19:55.040 --> 20:01.820]  There's long been speculation that the FBI knew more than they acknowledged about the strat for hack.
[20:02.620 --> 20:10.480]  And, you know, the FBI has consistently denied this in public statements and said, um, and this was an anonymous official, of course.
[20:10.640 --> 20:12.700]  No one, I think, bothered to put their name to this.
[20:13.000 --> 20:18.260]  We didn't find out about the hack until December 6th when it was already too late.
[20:18.260 --> 20:22.020]  And that is a half-truth at best.
[20:23.200 --> 20:27.340]  Yes, the credit card system of Stratford had been hacked weeks before.
[20:27.760 --> 20:44.700]  However, the FBI, based on their own descriptions of the surveillance of Sabu while he was cooperating, which was during this period, and their description of debriefings of him, which have been acknowledged by him and his legal team in filings, they should have known about this right away within
[20:44.700 --> 20:46.440]  hours, end of the day at most.
[20:47.220 --> 20:51.980]  Sabu actually became aware that Stratford was hacked late December 4th.
[20:53.100 --> 20:54.740]  This is in sealed chat logs.
[20:58.480 --> 21:08.140]  By December 5th, he was talking to the original hacker of the Stratford server and agreed, like, hey, no, we'll cover you for this.
[21:08.280 --> 21:10.160]  You know, you want to keep your name out of it, that's fine.
[21:11.160 --> 21:21.560]  And it wasn't until December 6th that, like, yes, they started sharing it internally with other Anons, anti-Sec, Lul-Sec, all this fun stuff.
[21:22.060 --> 21:31.780]  But the FBI knew about it or was grossly incompetent because Sabu recognized the importance of this right away.
[21:34.300 --> 21:35.900]  They said nothing.
[21:36.300 --> 21:52.820]  And it wasn't until, according to public statements, December 5th, that the president, I believe it was, of Stratford, George Friedman, found out about the hack from, I believe it was, Fred Burton, the senior VP for intelligence, if I'm remembering correctly.
[21:52.820 --> 21:55.340]  And if not, I am very sorry.
[21:55.560 --> 21:57.480]  Please don't sue me for getting your title wrong.
[21:59.820 --> 22:01.900]  So they knew about this well ahead of time.
[22:01.960 --> 22:23.060]  And then when they finally exfiltrated the emails and further penetrated the server, which was done by Jeremy Hammond, who recently, by the way, got kicked out of DEFCON for saying, free Palestine, which, hell yeah, from the river to the sea, right?
[22:23.960 --> 22:31.200]  And protesting the presence of military officials and embracing them and taking shots while saying, go army.
[22:31.920 --> 22:36.720]  And, you know, generally just embracing the genocidal war machine that engulfs us all.
[22:38.000 --> 22:40.380]  And so, yeah, they decided to kick him out.
[22:40.380 --> 22:42.740]  Fun additional side fact.
[22:42.940 --> 22:45.120]  I will get back on course soon, I promise.
[22:45.320 --> 22:53.360]  But one of the goons at DEFCON is a hacker with known ties to military intelligence.
[22:56.240 --> 22:59.800]  If you started naming colors, you would eventually get their name.
[23:00.080 --> 23:01.840]  That's as much as I'm going to say.
[23:02.120 --> 23:05.120]  But, yeah, fun fucking shit.
[23:05.380 --> 23:09.460]  They are connected to a few of the things we'll talk about later.
[23:09.460 --> 23:11.200]  But let's go ahead and move on.
[23:11.960 --> 23:16.580]  Also, compromising anonymous and infiltrating anonymous was Maxim Popov.
[23:17.100 --> 23:21.380]  He was a Russian contractor and former FBI informant.
[23:21.500 --> 23:23.100]  He was written about and wired.
[23:23.320 --> 23:37.240]  And then I wrote a follow-up piece, which got into more details about his infiltration of anonymous, his dealings with Sabu, and getting access to the Syria emails before they were published online.
[23:37.240 --> 23:39.420]  The complete unredacted version.
[23:39.840 --> 23:46.660]  And, yeah, about a million of them still seem to be offline and never published in any form.
[23:48.720 --> 23:50.720]  Op ISIS, Op Paris.
[23:51.020 --> 24:06.120]  Pair of anonymous, side ops, where people were going around after the Charlie Hedbo and Paris attacks and basically doxing lots of people with alleged ties to Middle Eastern extremists.
[24:06.720 --> 24:12.520]  They, in several instances, dealt directly with governments or through proxies.
[24:12.680 --> 24:16.500]  In at least one instance, they claimed to have stopped a terror attack.
[24:16.680 --> 24:27.040]  And in another instance in private chats, I found a participant bragging about how they had spoken to people in the intelligence community and it indeed bought them goodwill.
[24:27.320 --> 24:33.280]  Stay away from NATO targets, do the ISIS stuff, and we'll leave you alone for everything else.
[24:34.380 --> 24:35.420]  Anonymous Egypt.
[24:36.120 --> 24:37.460]  Not a lot to say.
[24:37.660 --> 24:42.360]  They used anonymous name and branding, but were financially motivated and ransomware affiliates.
[24:42.460 --> 24:45.680]  They worked with both Lockbit and Medusa.
[24:47.500 --> 24:50.180]  More recently, we have Anonymous for Justice.
[24:50.400 --> 24:56.740]  This is actually Iranian intelligence, and they hacked and released a lot of stuff from Israel.
[24:57.140 --> 24:58.960]  And honestly, it's good shit.
[24:59.420 --> 25:00.560]  A lot of it is.
[25:00.640 --> 25:03.900]  Some of it, they kind of, you know, futzed about the value for.
[25:04.240 --> 25:07.560]  But massive troves from the Ministry of Justice.
[25:08.240 --> 25:09.740]  DDoS secrets republished that.
[25:10.720 --> 25:19.640]  But, you know, it's another instance of state hackers just directly using the anonymous name, branding and images.
[25:21.940 --> 25:26.640]  So, let's go ahead and leap ahead to Russia.
[25:27.920 --> 25:32.640]  We are going to have some brief thoughts shared by Mr. Assange.
[25:33.680 --> 25:37.440]  If I can get the microphone to point correctly.
[25:38.420 --> 25:38.720]  And...
[25:38.720 --> 25:40.360]  Said, you won't disclose your sources.
[25:40.580 --> 25:41.060]  Fair enough.
[25:41.640 --> 25:48.860]  But you've also indicated during a Meet the Press interview that you would be open to accepting verifiable material from intelligence services.
[25:49.080 --> 25:54.960]  Saying, quote, if you're asking, would we accept information from U.S. intelligence that we've verified to be completely accurate?
[25:55.240 --> 25:57.040]  The answer is yes, of course we would.
[26:00.130 --> 26:01.090]  But, okay.
[26:02.550 --> 26:09.390]  Would WikiLeaks take materials from U.S. intelligence services that we verified to be true?
[26:09.390 --> 26:10.230]  Of course.
[26:10.490 --> 26:11.170]  Of course.
[26:11.370 --> 26:11.590]  Of course.
[26:11.590 --> 26:14.590]  We're in the business of educating the public.
[26:15.110 --> 26:18.770]  Now, let's leap forward a couple of years.
[26:19.050 --> 26:31.190]  Let's imagine that rival intelligence services in the U.S. and China want to settle their conflicts about who's right.
[26:32.190 --> 26:33.710]  Who's the good actor?
[26:33.850 --> 26:35.910]  Who's the bad actor on a particular situation?
[26:36.210 --> 26:39.490]  By presenting the public the truth.
[26:40.170 --> 26:45.410]  That's the most amazing advance that I can think of.
[26:45.770 --> 26:48.210]  We would strongly encourage that.
[26:48.430 --> 26:55.510]  Instead of intelligence agencies planting dodgy stories, trying to whip up wars to mainstream media outlets.
[26:55.510 --> 27:04.950]  Instead, understanding the filters for accuracy that organizations like WikiLeaks have.
[27:05.150 --> 27:11.210]  Instead pushed into a position where they have to fight it out in the public with the truth.
[27:11.710 --> 27:15.230]  I think all journalists would enjoy that.
[27:17.990 --> 27:19.710]  So this isn't about Julian.
[27:20.070 --> 27:27.210]  This isn't about the 2016 election or Guccifer 2, the source for the DNC emails.
[27:28.750 --> 27:32.870]  It is about what Julian called the most amazing advance.
[27:33.130 --> 27:35.370]  And in theory, it sounds great.
[27:36.110 --> 27:39.790]  Intelligence agencies, governments releasing mass amounts of information.
[27:39.790 --> 27:41.370]  Yes, I want this.
[27:41.510 --> 27:42.350]  Do it about yourself.
[27:42.550 --> 27:43.510]  Do it about your enemies.
[27:43.750 --> 27:46.670]  Do it about everyone, but the private citizens.
[27:46.870 --> 27:50.430]  And we can actually maybe get along, you know?
[27:52.530 --> 28:08.410]  But while they were asking in the context of, you know, the Russian interference in the U.S. presidential election, Julian was answering in a slightly different context that we didn't really know about at the time.
[28:08.410 --> 28:15.090]  And that's Vault 7 and the Shadow Broker files, which both the Shadow Brokers and WikiLeaks said they had.
[28:16.670 --> 28:20.130]  Julian in his statement said, we will protect U.S. intelligence.
[28:20.130 --> 28:27.350]  That is not just a deflection of talking about Russia and saying, oh, we would protect Russians.
[28:27.550 --> 28:30.010]  It was a message to those individual sources.
[28:32.070 --> 28:37.610]  But, you know, let's go ahead and just move on to Russia in general.
[28:38.050 --> 28:43.290]  Let's talk about the invasion of Ukraine and the response to it.
[28:45.980 --> 28:48.180]  After this brief word from Hillary Clinton.
[28:50.360 --> 28:51.380]  Last one.
[28:51.560 --> 28:54.420]  I promise I'm like 99% sure.
[28:58.010 --> 28:59.090]  Come on.
[29:00.550 --> 29:02.130]  Why are you delaying?
[29:02.410 --> 29:08.430]  What I would argue for government support, but also non-governmental support.
[29:08.650 --> 29:15.570]  There were reports overnight that Anonymous, a group of hackers took down Russian TV.
[29:15.570 --> 29:33.430]  I think that, you know, people who love freedom, people who understand that, you know, our way of life depends upon supporting those who believe in freedom as well, could be engaged in cyber support for those in the streets in Russia.
[29:33.430 --> 29:37.590]  We did some of that during the Arab Spring when I was secretary of state.
[29:37.810 --> 29:49.770]  I think we could be also attacking a lot of the government institutions and, again, the oligarchs and their, you know, their way of life through cyber attacks.
[29:51.750 --> 29:52.310]  All right.
[29:52.410 --> 29:55.550]  So there's basically two parts to that that are worth paying attention to.
[29:55.550 --> 29:59.470]  And the first and most obvious is probably what jumped out to everyone.
[29:59.770 --> 30:03.250]  That was hearing Hillary say something nice about Anonymous.
[30:04.470 --> 30:07.030]  The second, it's a little bit more tricky.
[30:07.330 --> 30:13.250]  She acknowledged that they did something similar during the Arab Spring.
[30:14.930 --> 30:17.190]  They don't really talk about this at the time.
[30:17.710 --> 30:22.870]  There's seemingly no mention of it in her emails that were released through FOIA.
[30:25.350 --> 30:30.110]  So, confirming exactly what she meant there is a little bit tricky.
[30:30.490 --> 30:49.170]  But I would highly recommend further examination be given to Tunisia, where members of Anonymous, who were not previously known to the ones they were interacting with, suddenly appeared and said, hey, we have the keys to the kingdom.
[30:49.170 --> 30:52.990]  We have the... we can get you into all their websites.
[30:53.410 --> 30:54.650]  And they did.
[30:54.990 --> 31:01.990]  And Anonymous, a lot of American, European Anons, began hacking and defacing those websites.
[31:02.770 --> 31:09.490]  There's also Egypt, where, interestingly, Facebook helped intervene.
[31:10.370 --> 31:33.870]  According to Anonymous member Greg Housh, who some of you may know from his many media appearances, and more infamously and controversially, having been an FBI informant who helped get people arrested, acknowledged that when they were generating support for the protests in Egypt,
[31:33.870 --> 31:39.090]  there was an event that was created on Facebook for the Tahir protests.
[31:39.710 --> 31:48.570]  But they had a problem because nobody wanted to sign up and show up and say, like, oh, I'm the one person here, like, yeah, black bag me.
[31:49.410 --> 31:56.790]  So their solution was to mass-generate profiles, which then signed up for the protest.
[31:57.090 --> 32:03.130]  And this did, in fact, help encourage a lot of other genuine accounts to sign up for the protest, too.
[32:04.050 --> 32:09.570]  The actual influence that that had on the turnout for the protests is debatable.
[32:10.110 --> 32:15.650]  And people better versed in those local politics should look at that.
[32:15.650 --> 32:30.090]  But one of the most interesting admissions that Greg made was that they had a Facebook employee disable spam filters for several IP addresses that they were using to generate all these accounts.
[32:31.470 --> 32:45.630]  This is, by several years, the earliest instance that I know of that Facebook, through its employees, used its infrastructure to interfere in the politics of a foreign government.
[32:46.170 --> 32:51.370]  And, you know, to be clear, I'm in favor of, you know, the revolution.
[32:51.370 --> 32:54.670]  I think that they made a lot of improvements.
[32:54.810 --> 32:57.550]  We can definitely talk about current politics.
[32:57.830 --> 33:03.950]  But it is a very interesting note that Facebook was used for that.
[33:03.950 --> 33:07.170]  But let's stay focused on Russia.
[33:07.710 --> 33:22.590]  So we've got Network Battalion 65, a group of hacktivists who were described publicly as being members of Anonymous, former members of Anonymous, or Anonymous adjacent.
[33:23.370 --> 33:26.750]  They were recruited to work on this project.
[33:26.750 --> 33:35.310]  They were recruited primarily by an individual known as John Jackson, Mr. Hacking, a founder of Sakura Samurai.
[33:36.190 --> 33:48.400]  Now, they decided to do this to coordinate their hacks with Ukrainian intelligence.
[33:48.700 --> 33:52.940]  And that is where, as far as I can tell, most of the actual coordination happened.
[33:54.440 --> 33:55.900]  But U.S.
[33:56.180 --> 33:59.100]  intelligence was aware the entire time.
[33:59.480 --> 34:06.740]  After a certain point, there were regular briefings that, I'm told, went very, very high in the Biden administration.
[34:07.820 --> 34:14.420]  But there are several things about Network Battalion 65 and B-65 that we should talk about.
[34:14.620 --> 34:16.280]  First is the ROSCOSMOS hack.
[34:16.660 --> 34:19.340]  This was a hack of Russian satellite systems.
[34:19.360 --> 34:23.640]  It was exaggerated by Russians so that the hack itself could be denied.
[34:24.320 --> 34:27.140]  Russians denied that, oh, satellites were affected.
[34:27.140 --> 34:28.740]  They didn't hack into satellites.
[34:29.420 --> 34:30.840]  This was never the claim.
[34:31.000 --> 34:38.720]  They did access facilities that were used as part of the general control mechanism, and they offlined one of those machines.
[34:39.100 --> 34:40.480]  That was verifiable.
[34:40.800 --> 34:53.860]  But while denying the exaggerated form of the hack, there was a telling comment from one of the Russians involved who I think worked at ROSCOSMOS where he referred to it as a cause...
[34:53.860 --> 34:54.840]  Oh, my.
[34:55.020 --> 34:55.920]  A cause for war.
[34:57.560 --> 35:05.160]  After they hacked the Nuclear Institute, NB-65 was asked by contact in U.S.
[35:05.280 --> 35:08.760]  intelligence and military to stay away from critical infrastructure.
[35:09.000 --> 35:10.280]  And after that, they did.
[35:10.380 --> 35:16.680]  They started switching to more traditional hacks like VGTRK, you know, Russian state media and all that.
[35:17.800 --> 35:23.380]  Very controversially, there was the Kaspersky hack and leak, which was widely considered a hoax after it came out.
[35:23.900 --> 35:25.900]  Several members insist that it was real.
[35:26.160 --> 35:29.000]  Other members say, no, they're crazy.
[35:30.380 --> 35:35.240]  The people who say that it was real, I find fairly credible.
[35:35.680 --> 35:42.660]  The data seems to have been diverted at some point, and what was published was the publicly accessible Kaspersky code.
[35:43.400 --> 35:59.300]  And very tellingly and importantly, about a week after all of this went down, intelligence agencies began issuing fresh warnings about Kaspersky and their software, which has a whole history that I'm told we do not have time to get into.
[36:00.120 --> 36:04.720]  Very stupidly, several members of NB65.
[36:05.120 --> 36:09.060]  And I think I mentioned a DEFCON goon earlier.
[36:09.060 --> 36:12.660]  I'm just going to mention that again right now for no particular reason.
[36:13.260 --> 36:20.780]  These goons, sorry, these people decided to go on Vice and do an interview.
[36:21.040 --> 36:42.940]  What was produced was a relatively short piece where they actually appeared alongside at one point, or not directly alongside, but intercut with the director of CISA at the time, Jen Easterly, where again, they raised the issue of things being possible acts of war or interpreted as such,
[36:43.060 --> 36:45.820]  used to escalate against the U.S., and they largely dismissed this.
[36:46.360 --> 36:49.740]  Several interesting traps that may have been laid by NB65.
[36:50.280 --> 37:03.100]  At one point, they tried to submit data to WikiLeaks, they did this while it was already known in public that WikiLeaks' submission system was down and had been reported on by the Daily Dot at the time, I believe.
[37:04.420 --> 37:11.400]  And they made sure that I was there to witness it when they went into a WikiLeaks research channel, said, hey, this is who we are.
[37:11.560 --> 37:12.920]  Someone needs to contact us.
[37:12.960 --> 37:14.020]  We have data.
[37:15.600 --> 37:28.420]  Several years ago, another instance happened where I presented at DEFCON, got off stage, and while speaking to several journalists, was approached by someone who identified himself as Greg Hoosh.
[37:28.660 --> 37:30.840]  He said, I'm here with NB65.
[37:32.000 --> 37:35.520]  I'd never met Greg before, but I later confirmed that it was him.
[37:35.660 --> 37:38.260]  At the time, I considered it a fucking trap.
[37:38.760 --> 37:43.420]  Why would you walk up in front of journalists and say, I'm with this hacktivist group that's right here?
[37:43.660 --> 37:47.380]  They are potentially, you know, involved in all this very sensitive stuff.
[37:47.900 --> 37:51.680]  Also, I mentioned Greg's history as an informant.
[37:52.220 --> 37:55.380]  But, you know, why did they do a lot of this?
[37:55.480 --> 38:01.540]  In John Jackson's own words, more recently, and to be clear, he was not talking about these operations in particular.
[38:01.540 --> 38:05.340]  He said, people tend to trust their government less when they don't feel protected.
[38:05.660 --> 38:10.740]  And so, vast amounts of economic damage was done to Russian industries.
[38:12.120 --> 38:15.140]  This brings us to Russia's National Republican Army.
[38:15.380 --> 38:18.380]  They were a resistance group allegedly made up of Russians.
[38:18.700 --> 38:28.260]  Their very existence is doubted, but they've claimed responsibility for at least two assassinations and numerous acts of sabotage and other issues happening in Russia.
[38:28.500 --> 38:32.480]  In October 2022, they claimed responsibility for the TechnoServe hack.
[38:32.720 --> 38:36.760]  This was publicized in the Kiev Post by Jason J.
[38:37.000 --> 38:45.560]  Smart, who, very interestingly, works with John Jackson at a place called Shogunai Consulting.
[38:45.640 --> 38:54.360]  They informally started working together in 2022 after the invasion of Ukraine, according to their website, before formalizing their efforts in 2023.
[38:55.220 --> 38:58.300]  Now, the story is that the hackers were all Russian.
[38:58.560 --> 39:05.760]  I know from speaking to several of them that that is not the case and that the timeline given in the Kiev Post was inaccurate.
[39:05.760 --> 39:09.940]  They said they were informed about the data and the hack on the day that the article was published.
[39:10.940 --> 39:18.500]  However, I viewed the hackers' workspace, which included notes about finishing the article and screenshots.
[39:18.840 --> 39:23.780]  The article included cropped versions of the screenshots in their space.
[39:24.060 --> 39:31.160]  So, he knew about it, it seems, prior to what was publicly disclosed and was indeed part of the release.
[39:31.340 --> 39:37.860]  They tried to release it through RSync and Onion Services, but basically no one could figure that out except DDoS secrets.
[39:38.140 --> 39:41.000]  We refused to make it public.
[39:41.000 --> 39:48.040]  We have it listed as a limited distribution reserve data for journalists and verified researchers only because of the state involvement.
[39:48.360 --> 39:59.900]  We didn't know about the state involvement at the time, but we flagged it with the cyber war category and said, like, there's a lot of red flags, here's several of them, and now we've confirmed what those red flags mean.
[40:00.280 --> 40:02.540]  Moving on very quickly while we still can.
[40:02.800 --> 40:06.780]  They were both given a number of medals and certificates for their work.
[40:06.780 --> 40:09.320]  They have both acknowledged this openly.
[40:10.840 --> 40:19.260]  That's why I decided to focus on the two of them and Cretaner, because they are both, all three of them, rather, are public figures.
[40:19.440 --> 40:20.160]  Their names are known.
[40:20.280 --> 40:21.800]  Their stories are somewhat out there.
[40:21.980 --> 40:24.460]  And while John Jackson and Jason J.
[40:24.580 --> 40:33.940]  Smart were not previously associated with these hacktivist groups, they did participate with others as well, and their general work for the Ukrainian military was acknowledged.
[40:33.940 --> 40:37.560]  And to be clear, fuck the Russian government.
[40:38.620 --> 40:40.200]  Fuck the invasion of Ukraine.
[40:40.520 --> 40:44.000]  I have no problem with these hacks and these leaks, for the most part.
[40:44.840 --> 40:54.760]  What I have a problem with is state actors co-opting hacktivists, recruiting actual hacktivists, and then putting them into positions where they're compromised.
[40:57.880 --> 40:59.860]  This brings us to kinetic and cyber.
[41:00.200 --> 41:04.080]  This will be very brief, but it's the part that upsets me the most.
[41:05.080 --> 41:08.280]  I learned about two sets of operations.
[41:08.960 --> 41:11.220]  One I was able to observe in real time.
[41:11.220 --> 41:23.240]  The other was confirmed to me by several people afterwards, where hacks were proposed of various systems to identify the exact location of people.
[41:24.600 --> 41:28.760]  High-ranking officials in the Russian military, in one instance.
[41:28.760 --> 41:32.140]  The idea was, we're going to drone them.
[41:34.060 --> 41:35.560]  Thankfully, that never happened.
[41:35.820 --> 41:42.620]  The hackers refused, or in the latter case, where I was able to observe it in real time, interest just dissipated.
[41:42.780 --> 41:45.320]  They wound up not doing that, thankfully.
[41:46.380 --> 41:53.640]  That operation was not against Russia, but against a Latin American country.
[41:53.640 --> 42:08.420]  In at least one instance that I learned of, and I confirmed this with multiple people who were involved, they sabotaged an industrial system in Russia through hacking, and as a result, people died.
[42:09.020 --> 42:17.680]  There was an explosion, and more Russians than I can count, on one hand, died as a result.
[42:21.760 --> 42:25.080]  It's war, but they weren't soldiers.
[42:27.720 --> 42:37.020]  You can decide that they're just casualties in a larger struggle that they had no role in, but when you do that, you invite them to do the same.
[42:37.960 --> 42:45.700]  And I have seen, through decades of records, and memoirs, and first-hand accounts, that is always the pattern.
[42:45.900 --> 42:49.960]  They always say, Communist Russia is doing these horrible things.
[42:50.700 --> 42:52.620]  They're so bad, you guys.
[42:52.780 --> 42:54.200]  We have to do them, too.
[42:55.020 --> 43:04.780]  And in some instances, yeah, other people were doing those things, but in a lot of instances, they weren't until we started, and then they mimicked our programs.
[43:05.980 --> 43:08.960]  This goes for everything from rendition to torture.
[43:09.200 --> 43:11.220]  We have seen this pattern played out with propaganda.
[43:11.220 --> 43:15.220]  We have seen it so many times, and I am fucking sick of it.
[43:15.420 --> 43:22.260]  And now, it is costing lives, and people want to continue pairing kinetic and cyber operations in this way?
[43:22.640 --> 43:23.460]  Fuck you!
[43:35.120 --> 43:36.180]  Be better.
[43:37.760 --> 43:38.480]  Be better.
[43:38.480 --> 43:43.600]  We are supposed to collectively be better than the people we oppose.
[43:44.220 --> 43:49.060]  When we mimic exactly what they do, and what we criticize about them,
[43:53.380 --> 44:03.160]  well, then we just get Julian's flash-forward in a nightmare scenario, instead of something that, in some way, moves us closer to transparency and enlightenment.
[44:03.160 --> 44:13.920]  We just get people fucking each other up on national levels, until eventually, it is used to support actual actions on the ground.
[44:14.160 --> 44:17.420]  Like, this was an act of war, we're going to go after you.
[44:17.540 --> 44:24.140]  And we are so lucky it hasn't happened yet in a way that will blow up for all of us so goddamn massively.
[44:29.760 --> 44:31.460]  Thank you all for having me here.
[44:31.900 --> 44:32.600]  Abolish ICE.
[44:32.820 --> 44:33.540]  Free Palestine.
[44:45.400 --> 44:46.420]  Thank you for the talk.
[44:46.520 --> 44:47.020]  Appreciate it.
[44:47.320 --> 44:57.100]  I'm curious to see what your comment would be on, say, like the IT Army of Ukraine, and their DDoS attacks, and then also OneFist.
[44:58.160 --> 45:04.260]  And I know that they have been, they have OneFist put themselves out there to identify themselves.
[45:05.120 --> 45:09.680]  So I'm just curious to see, you know, those weren't mentioned in the talk, just curious to see if you have any comments on those too.
[45:09.860 --> 45:12.540]  Yeah, that's a great question about the IT Army.
[45:13.180 --> 45:15.920]  I think that the IT Army was a really novel idea.
[45:16.180 --> 45:27.360]  And, you know, I'll tell you that after they announced their thing, we sent them an email from DDoS secrets and said, hey, if you're gonna, if you're hacking and leaking stuff, like, here's our submission information.
[45:28.220 --> 45:36.540]  We thought it was great that this is a state actor being transparent about their involvement in a grassroots movement and giving people a way to do that.
[45:38.000 --> 45:44.700]  There's always a risk that those things can escalate, but at least with that transparency, we all knew what we were getting into.
[45:45.100 --> 46:02.400]  It's, you know, when you find out later that, oh, the state was involved in this, the state was selecting targets, the state was deciding, you will execute this exploit on this server because it'll have a high impact, but not this one because we don't give a shit.
[46:04.100 --> 46:04.540]  Yeah.
[46:05.140 --> 46:05.580]  Thanks.
[46:09.000 --> 46:09.540]  All right.
[46:09.660 --> 46:12.780]  I guess if there's nothing else, thanks for having me, folks.