And of course, once a journalist was in a room and I had a camera person with me, it all went wrong. They messed it up. They got locked in a cage.

They had to set off the fire alarm to get let out. It turned into total slapstick. Smashing Security, episode 490.

How Jared Kushner's iPhone was allegedly hacked twice, with Graham Cluley and special guest James Ball. Hello, hello, and welcome to Smashing Security, episode 490.

My name's Graham Cluley.

You are suffering a little bit, not that our listeners will be able to tell, but if anyone sees you on video.

Yes, I apologise to anyone looking at this on video who has to see my eyes, which look as if I'm sort of either auditioning for a sort of cold and flu advert, or else that I've been crying all day.

I promise you neither is true, but yeah, I've been better.

All right, well, we won't keep you for too much longer than we need you, but we are gonna need you for the next 45 minutes or so as we look at some of the biggest security stories of the last week.

But before we kick off, let's thank this week's wonderful sponsors, 360 Privacy, Origin, and Vanta. We'll be hearing more about them later on in the podcast.

This week on Smashing Security. We're not gonna be talking about how a bug in Signal could let someone keep listening after you've hung up.

You'll hear no discussion of how more than 4,500 Bluesky accounts were compromised by a phishing attack that posed as a government payment.

And we won't even mention how a massive Chinese crime ring hacked the Staples retail giant to steal millions. So James, what are you going to be talking about this week?

And I'm gonna be talking about how Dutch spies allegedly hitched a ride on a Russian hack of Jared Kushner's iPhone.

Plus, we've got a featured interview with Chuck Randolph of 360 Privacy about how the internet has made it scarily easy to put company executives and public officials in danger.

All this and much more coming up in this episode of Smashing Security.

Today's episode of Smashing Security is sponsored by 360 Privacy, and to explain what they do, I've brought in Joe.

360 Privacy is a digital exposure reduction firm.

They help executives, high-profile individuals, and the organisations behind them shrink the digital exposure that turns into real-world risk.

Data brokers, social media, public records, and AI — it's all making it faster and easier to find that information and connect the dots, which is a bit rude, frankly, because I wanted my dots left unconnected.

Here's how they fix it.

Through their technology platform and a team of expert intelligence analysts, 360 Privacy identifies exposed personal information, works to remove it at the source, and continuously monitors for new exposures so it doesn't just pop back up next week.

In other words, 360 Privacy creates friction, making sensitive information harder to find, harder to connect, and harder to use against you, your family, or your company.

So if Joe tried this again after working with 360 Privacy—

Now, chums, I've got a story for you. And as the story progresses, you can decide for yourself whether it might be true or not.

It's a story which has just been published in Vanity Fair, of all places.

There is an extract of a brand new book which has just come out that makes some pretty eyebrow-raising claims.

The book is called Princes and Thieves, and it is by an investigative journalist called Matthew Cole. Have you ever encountered Matthew Cole at all?

I think about four different members of SEAL Team 6 claimed to be the actual one who shot Osama bin Laden and tried to get book deals off the back of it, et cetera.

And as I understand it, Matthew Cole was one of the journalists who dug into which of them it actually was and how it all really went down. So he's a pretty experienced sort. Yes.

This isn't his specialist beat.

Because, okay, for anybody who doesn't remember this, if I remember correctly, the Trump administration said there's been no evidence whatsoever of any Russian messing around with the US elections or any hacking.

And someone who worked inside the American establishment actually leaked an NSA document which revealed that they had found evidence of that kind of thing going on.

And they shared it with The Intercept, with Matthew Cole, one of the journalists there.

And unfortunately, and I think this was unintended obviously, when The Intercept took that evidence to the authorities and said, well, what about this then?

When they published their photos and things, what they hadn't realised was there were tiny little micro dots which had been printed on the piece of paper, which identified where the document had been printed.

Is this your memory as well? And that helped identify the leaker who was Reality Winner, who ended up in jail as a consequence.

It's a pretty unforgivable screw-up. I will say in The Intercept's defence that they would have found Reality Winner anyway.

Their mistake was revealing that they'd got a printed copy of the document in the first place.

But if you looked, that particular memo had only been printed two or three times ever, because people don't print anymore.

And Reality Winner had, from a work computer, emailed The Intercept previously.

Now, it was just a customer service type email, it was saying, hey, is there something wrong with your podcast feed type thing?

has printed the document and reads and cares about The Intercept enough to contact them from work, they'd have got her.

I should say, by the way, there is a superb movie about the Reality Winner case, just called Reality, and of all people, it stars Sydney Sweeney, who is a controversial enough figure in her own right.

But what's unusual about it is everything that's said in the movie is verbatim from the court records of Reality's arrest.

So, superb film about a whistleblower and about cybersecurity and American politics. Why not give that an early plug?

So we've given you some background now, Matthew Cole.

So a slightly checkered history, and you have to bear that in mind when you hear the rest of this story, I suppose, to put everything in balance.

But the excerpt of this new book published in Vanity Fair says that hackers at the GRU, which is Russia's military intelligence, broke into the phone of Jared Kushner, who of course is the son-in-law of Donald Trump and was one of his senior advisors in the White House during Trump's first term.

And that would be a big enough story in itself, but what the story carries on to claim is that Dutch intelligence found out about that hack and were able to access Kushner's phone themselves.

That story, as Vanity Fair are sharing it, is that in late 2017, the Netherlands Military Intelligence Service learned that a hacker working for Russia's GRU was travelling to the UK.

According to the report, they were going there on some spying mission, whether they were going to spy on a cathedral or something, whether they were going to do a little tour of the Cotswolds, who knows what they were up to.

But the Dutch, when they heard wind of this, oh, hang on, a Russian hacker coming to the UK, they said to their UK counterparts, would you mind if we sort of had a word with him?

When he arrives, and the Brits apparently agreed. And so when this chap landed, the Dutch basically gave him two options.

They said, "Look, you can work for us against the GRU, effectively becoming a double agent, or you can be arrested by the British and charged with espionage and potentially locked up for the next ten years or so in a British prison." And surprise, surprise!

He apparently chose to work for Dutch intelligence.

And one of the things he subsequently did — it is claimed in this book — is that he gave the Dutch access to a GRU server based in Russia where the GRU's hacking team stored information which they'd hacked and exfiltrated and stolen.

And now the Dutch have got access to what the Russians have hacked.

And apparently when they were scouring through all the files, they found these screenshots of Jared Kushner's iPhone X.

Which sort of proves how long ago this story is based — it was an iPhone X.

I think that was the first one which had Face ID. Because of course, Jared Kushner wouldn't have an iPhone X now, would he?

He probably has got an iPhone which hasn't been released yet. Tim Apple would have sent him one personally because all the tech millionaires want to keep in with the family.

Like Trump Mobile. Well, it appeared that Russian military intelligence had compromised the phone of one of the most senior people in the White House, Jared Kushner.

And this was without the knowledge of the Americans, but the Dutch knew about it.

And by early the next year, 2018, these Dutch spies had apparently found a vulnerability in the phone that also gave them access to it, albeit it was fairly limited access.

So it wasn't the case that they could turn on the microphone or turn on the camera or plant files or plant malware or anything like that.

But what they could do, again apparently, was see Kushner's screen when he was using the phone.

And apparently, again — I have to stress it's according to the book — Dutch intelligence began to capture every single screen image and stored it on their servers, because you never know when it might come in handy to have a little bit of information about someone quite senior in the White House.

I think it's interesting here because British intelligence must have been involved.

There's no way UK intelligence would let Dutch intelligence fully run an operation from our territory without getting the asset for themselves.

But we don't spy on the Americans, and they don't spy on us because of the Five Eyes agreement. There are quite a lot of rules against that.

So we would not have been able to spy on Jared Kushner in this way.

Well, that's the interesting little carve-out that I haven't really seen anyone ask yet. And it's sort of just one for the British diplomacy and spycraft nerds, that.

But presumably UK intelligence would've been aware of this, but not exploiting it themselves, because they would've had to notify the White House if they were doing it.

And I imagine that someone will have had to have a discussion about whether they told the White House about Kushner's phone being compromised in the first place, which I'm guessing they didn't.

Again, if all of this is true.

Well, talking about things becoming a little bit hotter, the allegations continue because according to the book, while they were watching Kushner's screen, the Dutch intelligence agents apparently saw him log into a bank account in the United Arab Emirates and transfer hundreds of millions of dollars from a bank in Azerbaijan.

And initially the Dutch thought, oh, this must be linked to the government of Azerbaijan moving some money.

But the story goes on to allege that the rulers of the UAE and Saudi Arabia had put together a fund of $2 billion into accounts that Kushner had access to, including one in the UAE and one at an Israeli central bank as well, which would be a bit problematic if true.

The allegation is there.

It could be somewhat embarrassing that we have this chap who's currently tasked— one of his tasks is to solve the problems of the Middle East— if he's getting quite a lot of money into his back pocket.

Yes, yes. So Kushner's lawyers, they're denying everything. They're saying it's a whole load of poppycock. They're saying they've got no knowledge of any of this.

Kushner himself has said that he complies with all the legal requirements when dealing with foreign governments, doesn't break laws, claims that there's no evidence been made public.

It's all a load of baloney. He says it's outrageous fabrications. And of course, most Cole's sources are anonymous. It's not like he's saying, well, I was told this by So-and-so.

The Dutch government haven't commented either.

So we're sort of left in this position at the moment of not knowing if any of this is true or whether Cole himself has been given a bit of a tall story and has fallen for it.

But he's been working on this, he claims, for years. Yes, since he had the initial tip-off and initially thought it was very unlikely to be true, but he became convinced over time.

He seems to think he's got quite a few independent sources. I mean, one thing we should say is there's reasons why people might find it plausible.

And one of those is that we know that Jared Kushner's firm, his private equity fund, has received $2 billion from the Saudi Sovereign Wealth Fund.

Now, that's for him to invest on their behalf and give them a return. That's a commercial agreement. But that's not secret. That's not hidden. We know that.

So we know that he has been trading with people with whom he had to maintain political relations on behalf of the US.

To be honest, we're not really the podcast for all of this. You know, we're not into foreign policy and politics and things.

Well, everything's a little bit political, but this is fundamentally a cybersecurity podcast.

And whether or not these allegations turn out to be true, there are interesting security questions to be asked here.

I mean, firstly, if the book is correct in what it claims, then a senior White House advisor was carrying a phone that had been compromised by not one, but at least two foreign intelligence services.

And that's a bit of a worry, isn't it?

I mean, this is why traditionally they always asked senior diplomats and senior officials not to use commercial phones for almost any normal business.

There's only so much you can secure even an iPhone, which is a relatively good phone. It's secure for you and me as far as I understand it, isn't it?

For most things. But traditionally they would always ask senior people dealing with sensitive intelligence matters not to use an iPhone, not to use an Android phone.

And it looks like that advice had a good reason, doesn't it?

Yeah, it absolutely does. And if the story is true, someone was able to access this via a software vulnerability. They didn't have to go through the front door of breaking Face ID.

So just having that perimeter protection there is not necessarily going to completely defend your computing device, of course.

And also, you don't need to entirely compromise a phone to learn quite a lot. So the spies, all they could do is see the screen.

But if you're doing banking and messaging, the screen is going to show you almost everything, isn't it?

We're sort of throwing shade here at the Americans that maybe they didn't have proper cybersecurity in place. Well, what about the Russian cybersecurity?

Because again, if the story is true, the GRU was storing their stolen information on a server that a single one of their agents, this guy who was turned by the Dutch authorities apparently, he was able to unlock that server and give access to Dutch intelligence.

They kind of all do this though, don't they? Because you don't want to lead people straight back to your own servers and your own secure sites.

And so when you're exfiltrating material, you often put it on a staging server somewhere, to almost park it for a while before you sort of do it.

A little bit like, you know, if you steal gold bullion or something, just leaving it somewhere to check that it's not been found or got a tracker in it or whatever before you take it home.

And so some of our lot do this. I think it was, was it called Vault 7?

If the story is correct, it's certainly a fascinating read, and I'll put in a link in the show notes as well so people can find out more about this.

But certainly I think most of us, we're not in the position of moving hundreds of millions of dollars into our bank accounts from the Middle East, but we may still be worried about our own personal security.

So consider that your phone is often the easiest way to find out more information about you.

If someone is able to get into your phone, whether it's an intelligence agency or the police or a hacker or whatever, they will learn a huge amount about you.

So separate, if you can, sensitive work from your personal usage.

And if you think you might be of interest to an intelligence agency, maybe think long and hard as to what means they may be looking for in order to get in and mitigate against those if you can.

Vanta is a trust management platform.

It automates the mind-numbing stuff, the evidence chasing, the questionnaire hell, the sort of thing that makes you want to go and hide away in a cupboard like you have?

So it's essentially about Transport Layer Security, which is the protocol that underlies HTTPS. It's kind of what keeps the web secure, and almost everything now transmits on that.

And before we used HTTPS all the time, essentially quite a lot of what we transmitted to and from websites was in the clear.

And if you ever had advice about open Wi-Fi networks being able to see what you were doing and what you were browsing and maybe your passwords, that was kind of from the pre-TLS era.

I mean, it's still good advice to use a VPN on open Wi-Fi, but the internet's got a lot more secure actually post-Snowden. But the way the protocol works isn't entirely trustless.

Essentially, what you get is something where someone you do trust vouches for each website that you visit and goes, this website's claiming to be hsbc.com.

I've looked at its certificate, the cryptography checks out, it is.

And that might be your web browser, or it might be a sort of national trusted agency, and so there's this kind of tiered network of trust.

And the certificates have sort of been stamped, haven't they, by a certificate authority to say that they're legitimate in some way?

You know, using cryptography, you're able to confirm that they are legit.

And those authorities in turn, they take this very seriously because they've tried to come up with protocols where everything's verifiable.

And so, for example, for secure DNS, every 3 months they do a little ceremony to renew the keys.

And I've stood in and watched one of these for The Guardian years ago, because there's basically these 7 keyholders, and 3 of them have to be physically present and use their keys, and it renews the signature for another 3 months.

And I went to the 17th ever of these, I think it was. And of course, once a journalist was in a room and I had a camera person with me, it all went wrong.

They messed it up, they got locked in a cage, they had to set off the fire alarm to get let out.

It turned into total slapstick. I'll send you a link to the article — maybe you can put it in.

But the thing is, they try to go, we have this core zone that we keep secure in these ways that are publicly verified and verifiable.

And then these core guys verify the next tiers, and then they verify every site that you visit. It's a good system generally, and these keys are very, very long.

Except it turned out this week that we learned that about 8 of these really crucial keys that are built into your browser, that are built into all sorts of bits of infrastructure across the internet as, this is a good key, you can trust this, you could use this — they weren't hundreds of characters long, they weren't hundreds of bits long.

They were, in some cases, single-digit numbers.

One was 155. I mean, it's truly abysmally bad. It's as bad as it could be. And the thing is, it's not something that any hacker around the world can use.

But any sophisticated man in the middle who could get between your traffic and where you want to go using this, they could get everything and they could get it on quite a large scale.

And it's one of those errors — anyone I was hearing from was saying, this is like Heartbleed, which was a quite systemic problem years ago now.

This will be more of a nightmare to fix than Heartbleed. And also people couldn't quite understand how it happened. It's from an Indian ISP.

And of course it does show, why would you ever think that that might apply and affect your security? But it's fixable.

And it was discovered — we don't know how long it's been exploited or if it was deliberately put in there — there are a lot of questions I've got about this, because the point of things like TLS is it's supposed to be invisible infrastructure that you can just trust.

And if we can't just trust it, we've lost the entire basis for why we feel safe to spend money and use the web, which isn't great.

But it was a good reminder that a lot of the internet is essentially built on completely crumbling infrastructure. It's like the XKCD comic.

In fact, you said something good on this one — I always mentioned it to you, didn't you?

I think I said something like, the internet is like an elephant balanced on top of a piece of crockery held up by pipe cleaners or something.

And I said, oh, by the way, the elephant is wearing roller skates.

Well, British listeners might be familiar with the Ratner moment.

You know, Gerald Ratner, CEO of an affordable jewellery and homeware company, was once asked at a press conference, how do you make your product so affordable?

And one of the things that they said was they said that their SSL and TLS business accounted for less than about 1% of its revenue.

And they said the social media attention to this, there's been scrutiny which has been out of proportion, it says.

Well, maybe out of proportion to their income, but it's still a massive, massive fail.

And as a consequence, I don't know, tens of thousands, maybe hundreds of thousands of websites are going to have to get new certificates pretty pronto, otherwise they've got problems.

And quite a lot of browsers have had to update. Quite a lot of infrastructure providers have been having to look at this. You know, if you are a sysadmin type, this was on your mind.

And this would've been enough to have given people a bad week last week on its own, and probably for some a bad several months checking that everything is patched and looked after.

But then, of course, yeah.

So let's just explain first of all what PHP is.

So PHP is basically a programming language and it is used on an awful lot of web servers, things like WordPress, for instance, which is powering a huge proportion of the internet.

Which is odd as it's kind of antiquated. Now, if you were building something new today, you wouldn't use PHP, but it was very flexible. It was good.

It connects up databases with HTML, basically.

Yeah. I love tinkering with my website, which is running on WordPress, which means I'm tinkering with PHP.

I can very easily blow my foot off by leaving out a semicolon or leaving an angled bracket in the wrong place.

Even if you were running the latest version of PHP, it was vulnerable to this huge security hole.

But what was interesting was how this security hole was discovered and how it became front page news.

And in this instance, and this is sort of unusual, I think pretty much everyone did everything right here.

As I understand it, the PHP Foundation sort of went to OpenAI and went, look, we're kind of aware we've got quite an old codebase. We're tiny. Should we do a bit of an audit here?

And, you know, use your tools. And OpenAI were up for it. And some security researchers used their model to help look into it and did indeed find this glaring vulnerability.

As far as I'm aware, it basically lets you go through and escalate privileges through to admin and then get whatever's available.

And the problem with PHP is it's had loads of stuff you wouldn't think about. Your router has a little admin page for its settings.

Your printer will have a little PHP-powered admin page, et cetera. So people will remember the obvious stuff, and that's what they'll have been fixing the last 24 hours.

There's got to be so much little hidden layer infrastructure stuff running it. The PHP Foundation, it turns out its income is less than $1 million a year.

It has fewer than 11 staff, and most of the code updating is done by a small team of volunteers.

You know, this is the classic, again, crumbling infrastructure thing, but they actually got ahead of it and sort of said, well, someone's got to use AI and find any mistakes in the code.

Why don't we do that? And they did. And they found that.

And then essentially they worked to patch it.

And as I understand it, over the last week or so, they've been trying to notify particularly critical infrastructure people, and they were planning on putting it out, I think on the 22nd, but by the 20th, it was obvious that word had got out and the attackers were starting to use it.

And so they disclosed it slightly earlier than they'd intended to.

And maybe someone who was inside the kimono, as it were, of knowledge of, we've got this issue, guys, which we're trying to fix.

And we only really want to make it public once we know we're ahead of it. And that some critical parts of the internet have already been updated and protected.

Because that's the ideal, isn't it? That should happen. News came out earlier than people were expecting. And as a consequence, mad rush.

As we've seen in the headlines, my local chess club, their website went down.

I don't know if that was their ISP or whatever, taking it offline because it was running an old version of PHP. I was lucky with my web hosts. They were ahead of it.

And so we had emails from IT going, still go to your classes, still do your classes, but you can't look up where they are and you can't get the teaching material that's on the intranet.

So it was a tricky day.

So different levels of importance.

There were government websites, there was your university, and there was my local chess club, all impacted to one extent or another with this PHP issue.

And on top of the TLS issue, you do begin to think, oh my goodness, there are so many vulnerable, flaky parts of the internet which we are so reliant on.

You make the really good point, the PHP Foundation — a bunch of volunteers who are basically keeping these things up and running, which we are also dependent on.

So I'm a little bit more optimistic about the AI era and security than I think others are, in that AI hasn't created these problems.

The fact that we don't properly invest in the infrastructure and we don't update and security test the infrastructure has been a problem.

And the fact that often when spy agencies discover these vulnerabilities, even though they have responsibility for cybersecurity, they often don't disclose them because they'd rather exploit them.

Like our Dutch friends. We've often had vulnerabilities that have existed for, say, a decade that either haven't been found or have been found and exploited in secret.

And if AI leads to a bit of a frenetic era where this sort of critical codebase gets audited very publicly and painfully, but gets audited over the next two years and gets updated — we're probably going to have a horrible two years of breaches and scrambling, but I think we might actually have a much more secure internet at the end of it than at the beginning.

Now, the problem is AI will then create a load of vibe-coded, permission-extending script kiddies. Like, script kiddies weren't making enough vulnerabilities already.

You know, your 94-year-old granddad sort of vibe coding off a sort of institutional computer creates a whole new set of problems. Sure.

But actually, if AI lets them do this kind of code audit of something like PHP and find critical vulnerabilities, and we see that replicate, that might actually be better than the alternative, even if it's going to be awful for anyone working as a sysadmin for the next few years.

Am I being too cheerful there? Do you think that's Pollyanna-ish?

I think what you're really saying is that we've got another two years at least of great stories to report on for Smashing Security.

But after that, once AI has fixed our world, then we'll really be scrabbling around. That's what you're saying. Earlier this year.

Inside the walls of OpenAI. Inside Hugging Face, something was happening.

Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.

And that brings us to you, dear listener. One question, and I want you to think about this.

If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

But not anymore. Because there is a sensor on the machine watching, always recording, capturing everything the agent does as one unbroken trace.

What was asked, what it reached, what it changed, laid out in order, start to finish.

Origin sees the agents that other tools walk straight past. Coding agents in a terminal, local agents, anything whispering to an MCP server on a laptop.

No cloud gateway, no blind spot. Origin is already there.

That's originhq.com/smashing. And thanks to Origin for supporting the show.

And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.

Pick of the Week is the part of the show where everyone chooses something they like.

Could be a funny story, a book that they've read, a TV show, a movie, a record, a website, a podcast, or an app. Whatever they wish. Doesn't have to be security-related necessarily.

Well, my Pick of the Week this week, I watched a documentary last night.

Yeah, rather than reading a book, I watched the telly, but it was a true story, a story of extraordinary rescue.

Have you ever been to the mountainous regions of North Pakistan, James?

Well, I don't know.

I've never been there either, but I can tell you it is spectacular looking and there are these rather makeshift homegrown cable cars, which go from mountaintop to mountaintop.

They're just little sheds basically with a pulley on the top, which are being yanked across huge distances over huge heights for kids to get to school.

Absolutely. And it is quite miraculous.

And in 2023, one of these cable cars suffered an accident, and all but one of the cables holding up a cable car with eight people on board snapped as the cable car was halfway across, and there were a bunch of young schoolboys on it.

And this documentary is about what happened to that cable car, and of course the occupants as well. I am petrified.

I'm this very unfortunate combination of both petrified of heights and utterly drawn to heights.

I'm always wanting to test my fear.

You know, if there is a height or if there's a program about someone who's mountaineering or something, I'm like, oh, I'm gonna have to watch that.

And then I'm watching it from behind my cushion going, oh my God, this is so terrifying. I can't watch this anymore.

It is torture. Anyway, this documentary is not only absolutely heart-pounding because you're thinking, how are they gonna rescue these kids?

They get a helicopter in and the helicopter is causing the cable car to sway too much. The rope from the helicopter gets tangled up in a cable, so they have to cut the rope.

They can't get them out this way.

There are villagers who are there who are panicking, who think the local police aren't doing enough, who begin to sort of mount their own rescue mission along this very, very precarious cable in order to get to the cable car.

And there is extraordinary drone footage of the live incident in incredible detail, where they go right up to the cable car and you can see the people inside it as a way of demonstrating just how utterly petrifying it must have been for these people.

There's nothing like it.

The documentary is called Hanging by a Wire. If your heart can take it, I would recommend it. It's my cup of tea because it's got everything I like.

It's got a bit of emotion, it's got a bit of heart, it's got a bit of humour in it, and it's got absolute sheer terror of a 900-foot drop behind these people who are just dangling on and you think, how are they going to survive?

And so that is my pick of the week.

It does 2 a year, but it's just got this lovely format where it's 5 comedians. They have to do a bunch of very silly tasks, but they do the whole season.

So they do 10 episodes, and so they get to know each other a bit. They're watching the sort of prerecorded ones from a studio, and they do a live task.

And they've just got a very good cast this year.

So you've got Matt Lucas, who's sort of, you know, a bit older now, a bit sort of established, clearly doesn't care that much, but is also a bit competitive. You've got Nina Conti.

She's got this amazing sort of ability to constantly look like she's on the verge of a nervous breakdown, or has just lost her senses entirely, which is wonderful to watch.

And then you've got Chloe Petz, who's a sort of young queer comedian and clearly wildly competitive.

But also this year is the only one who is.

I think everyone else must be in their 40s or 50s and kind of doesn't care, but they can all see how much Chloe Petz cares, and they are really, really winding them up, and it's kind of great.

And then you've got Richard Ayoade, who is actively fighting the show at every opportunity. He's just trying to ruin it, and it's great television as a result.

It can sort of vary from the very simple to the ridiculous. One of the tasks this season was they got a task to measure a tower, and they got a little wooden tower.

There's a little book with mathematical ways of doing it. There's sort of all sorts of things to help them.

But delightfully, 2 of the comedians just measured the little model, and then you get this wonderful pan-out shot where you see this 200-ish-foot-high tower behind them that they have entirely failed to notice at any point in it.

And so you get these sort of visual jokes. So watching them all try and work out if there's a cleverer way to do it and then realise they've screwed it up is part of the joy of it.

It's very silly.

That was the first one, wasn't it?

Yeah, but I think they did call it that briefly, and then realised that, you know, while it was edgy and very Channel 4, it was also not very Googleable.

Well, thank you for that pick of the week, Taskmaster. Now, many of us who work in cybersecurity can tend to think that our world can sort of be neatly divided into separate boxes.

You know, there's cybersecurity, there's privacy, then there's physical security. But the people who want to cause you harm — they're not really respecting those boxes.

For them, it's all one thing, and they can start to harm you with nothing more sinister than a search bar. And to discuss this, I'm delighted to be joined today by a special guest.

Chuck Randolph is the Chief Strategy Officer at 360 Privacy. Welcome to the podcast, Chuck.

So I find this area that you work in really interesting.

Maybe you can tell me, without hacking anything, so just by using the search engines or social media, maybe data brokers, how much could someone find out about a CEO?

I mean, could you find their home address, information about their family, their daily routine?

It's a good question, Graham, and it's frightening. Let me give a little history. I started out in my career as a private investigator here in the States.

Back then, you would have to go dumpster diving where you would go and get in the trash of an organisation or somebody and find out information, or you'd go to a county courthouse here in the States and you'd go in their basement.

This is a true story. And you'd have your flashlight, you're going through old court records because the light doesn't work and they've had some water damage.

It would become so cumbersome that it was extremely difficult.

So if I was suddenly infatuated by you, Graham, you're the CEO of your own company, and I'm like, I want to know more about it. It was very burdensome.

Now, sitting in my house, I can Bing or Google your name. I could start going down rabbit holes and I can get quite a lot of information for free.

And then if I'm willing to give $5 or $10 or $30, I can probably even get a lot more.

So for me, as somebody who started as a private investigator and then went into the physical security side, running executive protection, protective intel, and thinking about how people are targeting — it's become much more rapid and frightening.

Because now anyone with an idea can rapidly get information that might even feed that idea and therefore feeding whatever's percolating inside of them, if that makes sense.

So the reality is that you don't need a zero-day vulnerability or malware. You just need maybe a bit of patience.

You need an internet connection, possibly a credit card, and you can unearth a huge amount of information.

You can go to large-scale data aggregators, companies who sell data bulk business to business, and you can set up your own business and try to navigate that.

Or you could go to people search sites, those consumer sites. We all know them.

You get the pop-up ads when you're looking for Chuck Randolph and you get the pop-up ad that says, hey, go here and I'll tell you their phone number or their last 3 addresses or things like that.

So it's definitely an area that's made it, again, much more approachable, much easier.

And I'll use a cyber word here as I'm an old information operations guy — it's made it also a bit asymmetric, because it's made even the weakest player able to play with the larger players as well.

So think in terms of phishing or some type of harassment campaign. I mean, I could do it myself, or if I'm part of a hacking organisation, I can work right alongside with them.

Knowing where someone lives — that's one thing. Deciding to do something about it is quite another, isn't it? And I think that's where things get really worrying.

Why would someone target a person that they've never met?

Well, that's a great question. And before we turned the mic on, we were joking about the old Chinese axiom, may you live in interesting times. And we do.

But those interesting times have now come with, I would say, societal changes in which people are more prone to speak out, more prone to look and attach themselves to ideas, good, bad, or indifferent.

So the idea that, hey, perhaps you and I are out having a cup of tea and we're suddenly talking about whatever it might be — say it's oil and gas, or water rights, or issues involving minorities — whatever that might be, we can take that to an extreme now to where I could then go home and a casual conversation that you and I had sticks with me.

And the next thing you know, I'm looking up a company and then I see, oh, Graham is a CEO, so now you've embodied everything about that company to me.

And I may have some problems, or I may have had an issue with a certain industry or something at some time.

And I see that, oh, by the way, you're going to be speaking somewhere, and I did a little research and found out that you live in this neighbourhood.

And maybe I just want to go visit you and have a conversation because I'm so enraged or fired up or whatever the appropriate term might be, that I feel the need to come and talk to you.

And I've been fuelled by the ease of the information because there's no friction between my thought of action and the action.

And that's not the only case.

There were also some lawmakers in Minnesota — I think a former House speaker and her husband were killed, a couple of other people were seriously injured.

And the man responsible for those attacks had a list of people search websites alongside his list of targets, so it's just so easy, isn't it?

Yeah.

The incident you're talking about in Minnesota was eye-opening in terms of the assailant there, Vance Bolter — in his car he had, as you said, his notebook, and on the top of the notebook he had some data broker sites listed where he found the information on those representatives.

But the scary thing from that is that means anybody who's involved in politics — say a member of the Parent Teacher Association, or a part-time judicial officer, or part of a city council — and somebody decides that they're not happy with the way something's going, they merely can go to a site like that, find who I am, and then people are dealing with issues that are quite honestly beyond what they signed up for.

And that moment, I think, highlighted that for many people: one, the ease that it could be to go find that information with just a credit card or some open source.

And then also the additional weight that it brought on to someone who says, hey, now I want to do my civic duty, I want to serve society in some sort of way — and now you have to consider, well, what would that mean for me or my family?

How do you tell the difference between someone who's angry online and someone who's actually taken it this step further into violence, or really making it personal and malicious?

Are there warning signs that security teams should look out for?

There are, and that's a whole other podcast to talk about.

The idea is the cycle of violence, or the cycle in which somebody goes through that goes from thought to ideation to action.

And the warning signs — if I said we're driving in a car and somebody cuts us off, Graham, and I go, "Ugh, I just want to kill that guy," that might just be an idiom that I said to you as we're driving.

You might respond like, "Yeah, what's up with that guy?" But if I suddenly change and I just say, "I want to kill that man," and then I'm writing down his licence plate, and then I'm researching it, and then I'm showing up — all because I can't let something go.

That's very nuanced.

And what we do know at the end of the day is you have hunters and howlers, which there's a great piece about that that people could go find and read if they're really fascinated about this.

And a lot of people will howl — I'm not happy, this guy, that company, I don't like Pepsi, I don't like Coke, you know, I prefer this — but then there's hunters who go quiet and they internalise the action and then they start looking for and going after individuals.

I ran protective intelligence teams in my past lives. And what you would find is you'd want to maintain awareness of what is being said, and then do any of those people go silent?

And of course, the dangerous part for many people in security is there are many people out there who are never going to say something openly online.

They're just thinking and they're crafting and they're looking.

So there is a bit of, you know, 3G — guns, gates, guards — but then there's that 4G: guns, gates, guards, gigabytes. Gigabytes meaning, are we monitoring the sentiment?

Do we understand the narrative that's being said around our people or our organisations?

Who's representative of our organisation that by proxy is representative of what the sentiment is, and then what are we doing to create some layers of security or layers of monitoring?

I know that all sounds probably a bit more of a dark art than it actually is, but it's really about understanding what's being said, who are our spokespeople, and then how are we monitoring and protecting those folks when they're out.

And I'm imagining that AI, as it has with everything else, is changing the game or at least speeding it up.

It is. You know, depending on who you talk to, it's the end of the universe or it's the beginning of something new.

I think Kurzweil's Law tells us that with all technology, there's rapid advancements that come with it. And what we can assume is that with that comes rapid risk.

And AI is no different, especially in this space. As we said earlier, I started dumpster diving, and then we made it easy to go to compact discs and white pages.

And now I can go to a data broker website and find things out. Now I can just ask my AI agent, "Hey, I'm really interested in Graham. I love the podcast, I want to know more.

I think he might be my husband." Now I can ask AI, "Hey, how do I find Graham? What do I want to do? How do I interact with Graham? Build a profile on Graham.

Tell me where he goes, what he does." And all this is being aggregated and built for you because at the end of the day, an AI has no emotion.

It just wants to fulfil the obligation that we've given it.

Well, exactly. An AI will keep on encouraging, won't it?

And it won't necessarily come back and say, "I don't think you should be doing this," or, "Have you sought some help?" It's more likely to actually be encouraging the behaviour, perhaps.

Look, we've talked a lot about how the threat works. Maybe we should turn a little bit to what organisations can actually do about it.

So if a company does want to make its executives and their families safer, make them harder to find, where should it start?

I'm always somebody who likes to start by trying to think like the adversary. So what I would do is I'd say, Graham, if you said, what can we do here?

I would say, well, let's go find out what's available on you. Let's understand what spaces we're operating in, who might not like us and why.

Do you have any stalkers or persons of interest or groups of interest that are looking at you? And then once we did that, I would go in and say, hey, look, let's remove the obvious.

Let's de-index from sites, let's remove from data broker sites, let's do the things that we can do and create some friction.

Because a lot of what we've been talking about is ease of ideation to targeting to action.

So if we introduce friction, and maybe an interesting way to think about this is if we're driving down the road, we're in a 2-wheel drive vehicle. We like the road.

It's smooth, it's not super loud, it's quick.

But suddenly if we have to turn off and the road is really choppy, there's a lot of rocks, there's a lot of issues, we might not want to do that because our vehicle — it's going to be hard.

It's going to be hard on the vehicle, it's going to be hard on us, we're not going to like it. So, eh, we'll just keep driving down the road.

So the idea of creating friction that says between me and my information or me and my personal life, let's create some issues so that if someone is interested in me or a group is interested in me, we just make it harder, right?

We make it harder to find us. We obfuscate where we can and essentially just send them off somewhere else or send them looking at someone else.

I like the whack-a-mole, especially given the cyber slant, but I also think about information as kind of a garden.

You know, you weed your garden and it looks great, and then some weeds continue to pop up and you still have to tend your garden. Now, can you and I do that? We certainly can.

It takes time, and again, artificial intelligence might help you. You can ask to be de-indexed from sites, you can ask to be removed from sites.

It's laborious, and sometimes data broker sites may or may not pay attention to you, especially in the US.

You can examine like, hey, maybe we shouldn't leave a Google review every time we go to a restaurant because that now makes us time-place predictable.

Let's really kind of stop and think, where are we? What can I do to introduce friction on this?

Maybe, yeah, I want to leave a Google review, but I'm not going to do it every Tuesday night after I go to the pub.

I'm going to do it the following Thursday, or I'm going to do it some other time, or I'm going to create an account that doesn't go back to me, but I can still support my favourite places.

That's an easy way. And another way is simple things like, hey, can I get a PO box?

Are there other places I can send or other places I can move my information through that creates additional friction or touchpoints?

You know, you can get as deep as like, hey, do I have an LLC or trust that I'm purchasing real estate through or other things?

But there are things that you and I and all the listeners can do right now.

And then of course, if you're in an organisation or you're someone of interest in an organisation, then you have teams that you can go to and say, hey, I would encourage those folks to sit down and say, hey, what are we doing about this?

What can I do? And then what do we have in-house that will help me?

And one of the things that 360 Privacy can do is you can actually provide a demo to people. What happens if I go to your site and I ask for a demo?

If my company says, look, we're interested in protecting our executives.

Yeah, absolutely. What will happen is, of course, you want to have a quick call and then tell us a little bit about yourself, what you're looking at.

Is there something imminent or are we just being proactive?

And then tailor that demonstration to help understand: here's where you are, here's where you are based on what you've told us, and then here's what we think can be done to support you and your organisation.

Well, Chuck, this has been a fascinating conversation.

And listeners, if you want to find out more about how 360 Privacy helps organisations protect their executives and their families, head over to 360privacy.io. That's 360privacy.io.

And all that remains is for me to thank you, Chuck Randolph, for joining us on Smashing Security this week.

It's been good fun. Thank you. And that just about wraps up the show for this week. Thank you so much, James, for joining us.

I'm sure lots of our listeners would love to find out what you're up to and follow you online. What's the best way to do that?

I am most active on Bluesky where I'm @jamesrball.com, but I'm on Substack, I'm on LinkedIn. I've probably got a Facebook account and I am still on X, but I don't post there.

I just retweet my articles when they come up because it's a cesspit.

Too true. And of course, you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, the Tok of Tik — the list goes on.

Or follow Smashing Security on Bluesky, Mastodon, or Reddit. And don't forget to ensure that you never miss another episode.

Follow Smashing Security in your favourite podcast app such as Apple Podcasts, Spotify, and Pocket Casts.

For episode show notes, sponsorship info, guest lists, and the entire back catalogue of 490 episodes, check out smashingsecurity.com. Until next time. Cheerio. Bye-bye.

You have been listening to Smashing Security with me, Graham Cluley.

And of course, huge thanks to James Ball for joining me and to this week's sponsors, 360 Privacy, Origin, and Banter.

Please go and check out their services, because it helps keep the show afloat. And of course, big thanks to the other people who help keep the show afloat, which are the patrons.

And the following names have been plucked out at random out of my fictional hat this week.

Ted Wilkinson — I wonder who's had the pleasure of hearing Ted talk and whether he's ever spoken for more than 18 minutes. Hristo V, the Bulgarian answer to MrBeast, probably.

Andrew Davison — that's reassuringly reliable, like a well-stocked airing cupboard. Jack Unverfurf sounds like he solves crime in a cosy Pennsylvanian town.

Pete Smith — if you Google generic English name, that's what you'd get. I imagine in reality he's in a witness protection programme.

Dimitri — truly a man of mystery, one name only. Sabahatin Gukaluk — I still don't know how to pronounce.

And finally for this week, Elbow — all the swagger of an arm joint, but without the letter W at the end.

The names you've just heard belong to the splendid folks who are members of Smashing Security Plus, which is a special tier of listener who gets episodes ad-free, hot off the press before anyone else, often by quite a few days.

And the real jewel in the crown is the privilege of having their name read out at the end of the show and generally. Fancy joining them?

Well, all you have to do is totter on over to smashingsecurity.com/plus, and for less than the price of a cup of coffee each month, you too can bask in the glow of knowing your name may one day be mangled by me on a future episode.

How marvellous is that? And don't worry if you can't afford it — I understand times can be tough.

What you can do, which is absolutely free, is you can badger your friends into listening.

You can write a review, you can tell people it's absolutely fabulous, and if you do that, it means the absolute world to me, and I really appreciate it.

So thank you so much, and until next time, cheerio, bye-bye.