Darknet Diaries - 177: National Public Data

Episode Date: July 21, 2026

This is the story of the hacker known as "USDoD". When he was young he had a vengeance on the US, and this lead him down a road of continual data breaches, until he hacked into National Public Data, which is when his spree went one step too far.SponsorsSupport for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.This show is sponsored by Maze. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information.This show is sponsored by Sentry.IO. Sentry wants to help you monitor your environment for problems. They do error tracking, stack tracing, debugging, all so that your developers can diagnose, fix, and optimize the performance of their code. This makes it so developers ship more reliable code faster. Learn more at sentry.io.View all active sponsors.SourcesFull list of sources on the show page: https://darknetdiaries.com/episode/177/

So back in 1988, there was this identity theft incident that happened, which when I read it, it infuriated me so badly. And now I want to infuriate you. So check this story out. This all started in Albuquerque, New Mexico. Like I said, 1988. And there was a hot dog stand there, which seemed to hire people who were really down and out. Like, if you had a past criminal record, that's fine. You hired a homeless.

Okay, here's a job, buddy. Get yourself together. William Woods was the homeless. guy working there. And then they hired Matthew Kierens. Matthew had a long criminal record and was trying to separate himself from that past. And he was new in town, just needed like a little cash to

probably just get him to the next town or something. But as soon as Matthew started working at this hot dog stand, he stole William Woods' wallet, the homeless guy that was also working there. William found out that Matthew stole his wallet and confronted him and he threatened him and he got the wallet back.

But geez, what kind of jerk steals someone's wallet like that? Neither of them lasted long with this hot dog stand. William, the homeless guy, actually left town to find a new job. He went over to Texas for a while. He did some day labor jobs there. Then went over to Las Vegas and worked in a laundromat. And eventually he ended up in Los Angeles, scavenging for gems and metals. But little did he know. While he was struggling to get his life together, Matthew had started calling himself William Woods. See, since Matthew didn't have a house, he carried all his important documents with him. So when Matthew stole his wallet, his birth certificate,

and Social Security card was in his wallet. So Matthew copied those things down and then moved to another state and then started to register stuff in that name. He asked for an official birth certificate from the state and a Social Security card for William Woods and got them. And he got a driver's license

with William Woods' name on it, but it had Matthew's picture on it and he got a job as William Woods. Because remember, Matthew had a criminal pass and he was eager to leave that behind. A fresh start was really, really great for him, but he didn't stop there. Matthew opened a bank account as William Woods, too. By 1994, six years after stealing Williams' wallet, Matthew had completely took on this new identity,

and William had no idea. Matthew even got married to a woman who thought his name was William Woods, and then they had kids, and they called themselves the Woods family. Matthew wanted to know more about William to have a solid backstory and went on Ancestry.com and convinced them that he's William Woods and he learned all about his childhood and his family. And actually, this all had a huge payoff for Matthew. This was great for him because he had a criminal past, but that was essentially erased. And now he got a $100,000 a year IT job at the University of Iowa and a car and even took out a loan for a house under his assumed identity. This fresh start was looking great for him. The real William still had no clue

and was busy scavenging for gems and minerals in California. He was an off-the-grade kind of guy, so he wasn't filing his taxes or opening bank accounts himself, and he only used cash wherever he went and kept a pretty quiet life. And because of that, Matthew was able to use William Woods' name for decades without anyone knowing. In 2019, the real William started getting a hunch

that someone might be using his identity and talk to someone about it and they gave him some money to do a credit check. And that's when William discovered there's loans out, had a bank under his name. So he goes in the bank, identifies himself as William Woods,

shows them his California ID, and they're like, okay, how can we help you? And he's like, well, I don't have an account here. Someone else is using my social security number or name or whatever because that account is not mine.

The assistant branch manager walks over and he looks at Williams' account, and there are some security questions associated with it and a pin William cannot answer any of the security questions and doesn't know the pin obviously so the manager's like okay well there's a phone number here and William's like that's not my phone number so the manager's like well let's see what happens when I call it

so he calls the number and Matthew picks up over in Iowa but Matthew abandoned that name Matthew long ago he's like yeah I'm William Woods what's the problem and they asked him the security questions and he got it right. So now the bank has two people who have authenticated themselves to be the owner of this account

and they have to figure out who's the real owner? The manager is still on the phone with Matthew and since he knows all the answers to the security questions and the real William looks like some homeless guy, he's more convinced that the guy on the phone is the true account holder.

So he tells Matthew, well, there's someone here in the bank claiming to be you and Matthew's like, in California, I'm in Iowa, nobody in California should be accessing my account. So William's standing there. And the manager's looking at him. And the manager starts thinking, this guy in the bank must be faking his identity

to get into this guy's account. So he calls the cops on William for identity fraud. The cops call Matthew, and they ask for proof that he's actually William Woods. And Matthew just sends him his driver's license, Social Security card birth certificate. At this point, Matthew had been using Williams' identity for 31 years, which means he has tons of supporting evidence to prove he's really William.

What do you want? W-2s, electricity bills, library cards, credit cards, a marriage certificate. I can give you supporting documents for days. I am the real William Woods. And in the meantime, the real William Woods has very little to show that he's actually who he says he is. He has an ID from the state of California, but that's about it. he just didn't have much documentation to prove he was actually William. But that's just the beginning. Get this. Matthew must have known what was going on because when Williams went to court in California,

he was tried under the name Matthew Kieran's. So that must mean that Matthew told the cops that William is probably this guy, Matthew Kierens, which is so messed up and backwards. Now, William is going out of his mind. He is disgruntled. He is furious. He's confused. absolutely angry with the cops and the court. I mean, I would be too, but it's not helping his situation

at all. He seems wild and crazy, which makes everyone in the court think he's actually nuts. Even his lawyer doubted the story. He got so wild and furious with everyone that they really did think he was having a psychotic breakdown and decided that he's not fit for court and sent him away to a mental hospital without even having a trial. So poor. William got thrown in the mental ward. And not only that, but they forced him to take psychiatric drugs. The whole time, they were calling him Matthew, and he's like, no, I'm not Matthew.

Matthew stole my identity. I'm William Woods. And he was forced to stay in the mental hospital for five months. And when he finally calmed down, they said, okay, now we can have your trial. And the judge looked at the case and found him guilty for trial. trying to steal William Woods' identity. So they sent him to jail. Not only that, but they charged him

a $118,000 fee for his hospital bill. This is the stuff that makes me furious. I mean, like, absolutely furious that the victim gets treated like this and the actual identity thief got away with it. I'm sure William must have thought he was crazy at times. And it's no fun when you start doubting your own reality and don't even know who you are anymore.

because the court forced him to call himself Matthew. He was admitted to jail as Matthew. The guards called him Matthew, and they made him call himself Matthew. So poor William just had to serve his jail time. He didn't have any resources to fight this. So months go by in jail, a year goes by, and after a year and a half, he served his complete sentence and was able to get out.

And when he gets out, he is mad. so mad at Matthew for putting him through all this that he calls Matthew's work, University of Iowa, to report him. And this makes its rounds to some people at the University of Iowa, and someone decided to do their own little investigation. They thought, what if William is right? And Matthew did actually steal his identity instead of the other way around. And surprisingly, at this point, no one had done a DNA test on either man.

So the person from the University of Iowa figured out who William Woods' real father was, which wasn't easy, I was able to get a DNA sample from the father. And then he went to California and took a DNA sample from William Woods. And bingo, there was a clear match. The investigator called Matthew and asked him what his father's name was, but Matthew had no idea. So after a year and a half in jail and five months drugged in a mental hospital, everyone finally realized that William was telling the truth the whole time.

Ugh. The courts apologized. They exonerated him of all wrongdoing, and they even canceled out his $118,000 medical fee that they charged him with. Like, oops, sorry, that was our mistake. And he was free to go on calling himself William once again. But then the cops turned towards Matthew and Iowa, and were like, uh, bro, you lied to us. You lied under oath and court, and you made a poor man suffer for years, because of this? Not to mention you conducted identity theft, so they arrested Matthew and sentenced him to 12 years in federal prison. His expected release date is 2037. These are true stories from the dark side of the internet. I'm Jack Reesider. This is Darknet Diaries. This episode is sponsored

by Threat Locker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts. There is no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why Threat Locker exists. Threat Locker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment. Because security teams are realizing something important. The problem isn't always unknown software anymore.

Sometimes it's trusted software being used by the wrong person. If you want to see how Threatlocker works, go to Threatlocker.com slash Darknet and book a demo today. That's Threatlocker.com slash Darknet to book a demo. This episode is sponsored by my friends over at Mays. GitHub saw nearly a billion commits last year. This year, with AI agents writing code, they're on pace for $14 billion. code is shipping faster than ever and its vulnerabilities are piling up just as quickly. Legacy SEA and S-AST tools weren't built for this kind of scale.

That's why Maze just launched Maze code. They're using AI agents to investigate every vulnerability in your dependencies and in the code your team writes. The agents use context from your code and cloud to prove what's really exploitable in your environment, not just theoretically risky. Then they go further, catching the business. logic flaws, other tools miss. And when something's exploitable, they find the fix and send it straight

to the right developer or your coding agent. Check out maze at mazehq.com slash darknet. That's maze spelled Maze. MazeHQ.com slash darknet. A few years ago, a friend messaged me and said, look out.

An APT just followed you on Twitter. And I'm like, what? He's like, yeah. The U.S. government is classifying this account as an APT, an active persistent threat to the U.S. government. I'm like, whoa, which account is this? He said, oh, the account name is U.S. DoD. U.S.D., as in Department of Defense, and they're in APT and they're following me?

No, no, that's just their hacker name. Could be a group, could be a solo person, but they're calling themselves USDOD to be funny, edgy and confusing. So this began my relationship with the APT known as USDOD. He was active in the hacking scene. and we post what he's doing right there on Twitter. And I started commenting on his post, and he started commenting online, and we laughed and we giggled.

And we started forming some kind of weird paris social relationship through Twitter. I always had a hard time getting a good read on him. He contradicted himself a lot. He seemed a bit young in the way he was talking. It was really hard to figure out if what he was saying was true or just something he exaggerated or even made up. I think a few times I caught him talking to himself even, like, you know, just some weird gibberish that probably only he understood.

I asked him for an interview. He said, okay. But then I realized his story is just beginning. If I interview him now, I'm sure there's going to be much more that comes. So I just held off, waiting for the story to ripen more. And I think a year went by, and I just watched him do more and more crazy stuff. And it was hard to tell what was real and what wasn't. But then he suddenly disappeared.

The account was banned. and I never heard from him again. Turns out, his story is much more crazier than I realized. Are you ready? So let me give you an example of how strange he is. A few years ago, the reporters at data breaches.net did, in fact, interview him, and this interview is all over the place. Like, here, check out this one story he told them.

Back in 2012, the hacker known as USDOD was living in Brazil and said he went to New York for cancer treatment. During his time there, he felt. in love with one of the hospital employees. They became deeply involved with each other. They started talking about how corrupt the hospital is. So him being the little hacker that he was, he decided to hack the hospital and expose the corruption. She said she would help him. And with an insider, well, it's super easy to hack into a hospital. So she helped him get into the network, and he took incriminating evidence that proved the hospital was corrupt. He said he was going to

to take this to the media and tell reporters and expose the whole hospital. And together, they were going to make a big deal of this. But the day before he was going to meet with the media, she suddenly disappeared. His attention shifted entirely to find her. He became frantic, depressed, emotional. To go from a deeply involved relationship with her to hacking into the hospital together to suddenly being alone in New York, he was distraught. He hired a private investigator.

her to try to track her down, but even the PI couldn't find her. She vanished like a ghost. So with no reason to stay in the U.S., he returned to Brazil and never blew the whistle on the hospital. And this made him extremely bitter with the U.S. It's not entirely clear why he's mad at the U.S. government over this, but says this was the thing that made him upset at the U.S. government. Maybe he thinks they made her disappear somehow or kept them apart. I don't know. But this is what I mean. What a wild story to start with, right? He came to the U.S., fell in love with a hospital worker,

found corruption in the hospital, hacked a hospital, went to expose it, but then she vanished. And he was left holding the smoking evidence that could ruin the hospital but decided not to publish it due to a heartbreak. It sounds like a movie plot, and who knows how much of that is true, since it was just a story he told reporters.

Anyway, he says her disappearance gave him a personal vendetta against the U.S. And this is what started his decade-long campaign to attack the U.S. He says it wasn't politics, which is just wild because you decided to become an APT because you were heartbroken. Okay, I've heard stranger things on this show.

Let's go. Let's see where this goes. He joined dark web communities, met criminals from far off places, Russians, Iranians, North Koreans, and learned more about hacking techniques from them. He trained up by breaking into small companies that made easy targets. He started making a name for himself among the hackers in the hacker community. Unknown to the rest of the world, though, until one day when he was approached by an associate, a Russian who claimed to be developing some kind of AI platform named Tulip.

The Russian needed help. Asked DoD., hey, can you help us collect military data? It would be useful for Tulip. And I want to clarify, whenever I say U.S. DoD in this story, I'm always talking about this hacker from Brazil. That's the name he was going by. So USDOD accepted the job. And over the next six months,

some Russian folks he partnered with were able to build an exploit for an unknown vulnerability in the US Army IT platform called the Programme Executive Office Enterprise Information System, PEO. While the Russians did that, USDOD discovered that a way into this network could be to impersonate one of the developers

who made it. So he discovered who developed PEO and started working on getting closer to them. He tried getting access through the developer using social engineering techniques. And this strategy worked. Humans are always the weakest link. And it was a pincher move, attacking the system from two sides. Together, the Russian hackers and USDOD were able to steal source code and get different databases from agencies that use PEO,

agencies like the Department of Defense's strategic command, central command, Special Operations Command and Defense Technical Information Center, an Army Specialist Operation Center. The defense contractor Lockheed Martin, too. The Russians took what they wanted from the deal, and USDOD got to take credit for the breach. In three days in February 2020, he leaked lists of full military emails and passwords to the dark web.

And that is how he got the hacker name USDOD by breaching the Department of Defense and publishing tons of military emails. Talk about an entrance under the hacker scene, and it was here when the U.S. considered him a threat. You don't attack the military like that and expect them to ignore you. They were working hard to figure out who U.S. DoD was. U.S. DoD didn't stop there.

He went on a roll after that. His next target was InfraGuard. This is basically the tip line to the FBI. If you have an important business, you can register for account in Infigard, and then you can report incidents to the FBI directly and fast. Think critical infrastructure companies like gas companies, dams, water treatment, facilities or banks that might need to contact the FBI quick to take action on an incident. That's what InfraGard is. And that was the site that USDOD was trying to attack.

It's normal for companies to apply to join InfraGard. So USDOD figured, why not try to apply himself? But his plan was to steal someone's identity who would qualify to be accepted and submit them to join. So first, he looked around for a finance company that would qualify, and he looked up to CEO's name, got his personal information, probably just bought it off the dark web, and USDOD filled out an application on their behalf, put in the CEO's information that he knew and just fake the rest. InfraGard replied back. There's some errors on your forms, these parts need fixing, so he's like, okay, and so DoD fixed them and sent it back again, and a few weeks later, he got another reply. His application was accepted. And just like that, he was in the InfraGard system.

not quite hacking his way in, but faking his way in. He tricked the FBI that he was someone else. And once there, he saw that you could talk to other members. So he started chatting them up, and they thought he was a genuine CEO. But then he started poking around the site, trying to test the database or servers to see if there's something weak here. And he found that the site has an API, which is basically a way to query the database, but he uses a different authentication mechanism. And while he was examining the API, he discovered that you can ask it

for all the members' contact information, and it would give it to you, like a big phone book, basically. Well, you had to be a member to see everyone else's details. Nobody knew about this huge vulnerability, maybe because nobody who belonged to Infregard would ever think to attack the site like this.

It was a perfect opportunity. USDOD asked a friend to write him a Python script to grab the data. Then he used it to steal every Infigard member's contact information. 80,000 CEOs, executive. and security officers. And again, he posted it all for sale on the Internet. And it was around here when he started following me on Twitter.

So you can see why they thought of him as an APT. He was advanced enough to sneak into FBI's infragard and persistent to attack the U.S. government again and again, and definitely a threat. Advanced persistent threat title acquired, which means the U.S. government would be actively investigating him. More now than ever. And I'm not sure how they figured it out, but they figured out his name.

And his name was Luann Barbosa. He's from a small city in Brazil. But Brazil doesn't extradite their own citizens. So I think the U.S. government had a hard time figuring out a way to take him down. But despite being actively investigated by the feds, his vendetta was just getting started. He thought he was untouchable, taunting the feds and anyone else. I mean, his Twitter photo was just a picture of the cutest kitty you ever saw. He found a certain formula for hacking, which was working surprisingly well for him.

Step one, search through data dumps on the dark web. For someone, he can impersonate to help him reach his target. Step two, impersonate that target or use their account to get in. Step three, profit. Using this formula, USDOD or Luan, broke into cybersecurity, Defense Center at NATO and a Washington DC club for politicians and the aerospace company Airbus and their 3,000 vendors. In two or three years, Luan breached so many U.S. government and government-related organizations that he was planning on building a business out of it, a

full-on company selling military intelligence. He had some pretty wild access and information, and he knew that people around the world would want to have this or buy it from him. So why not make a business out of stealing this and selling it. To get his business off the ground, though, he needed a steady supply of people to impersonate people with military connections and enough of their information to do it right. He was buying identities from places on the dark web, but this process had friction. I think what he was doing was looking to see who worked in a US military place and then tried to search for their names on the dark web so that he could get their data impersonate them. But time after time, the people he looked for

weren't listed that data wasn't available. So he thought, what if I just had a big list of people's identities and then figured out who on that list worked in the military or intelligence and then I could just go impersonate them? But he didn't have such a list. He knew lists like that existed, though,

and went on a hunt to find one that he could have full access to. We're going to take a quick ad break here, but come back because this story is about to take a whole new turn. This episode is sponsored by sentry.io. Applications break in all kinds of ways. Crashes, slowdowns, regressions, the stuff you only see once real users hit it. Century, that's S-E-N-T-R-Y, catches all of it. You get traces, replays, errors, profiles, and the details around them like stack traces,

commits, releases, and the developers who broke it, all in one connected view. So you're not jumping between tools trying to figure out what happened. Century shows you how the request moved, what ran, what slowed down, And what the user saw? Sear. Century's AI debugging agent takes it from there. It uses all of that Century context to tell you the root cause, suggest a fix, and can open a PR.

It also reviews the PRs for you and flags breaking changes with a fix ready. Try Century and Sear free at Century.io. They have a free dev plan and listeners of the show can use the code Darknet for $100 in Century credits when you go to Century.io. That's spelled S-E-N-T-R-Y. Go to century.io and tell them I sent you by using code Darknet for $100 in century credits. There's a new character who comes into our story now. His name is Salvatore Verini Jr., but I'm just going to call him Sal.

He wanted to get into the entertainment business and decided to produce and star in his own TV shows. And he was swimming in it. He owned a mini mansion near Miami with palm trees and a three-car garage, had a hot red 57 Chevy Bel Air and a hot wife. He was a successful guy. But I went and watched his biggest show, which is called Country Days with a Z. It streams on Amazon Prime.

It's a staged reality show starring him and his friends. Here's a clip from two minutes into the first episode. See what you think. Hey, everyone. I'm Sal, the CEO of Everything Country. You know the best part about owning your own business? You get to hire all your friends. Yeah, baby. Don't look good.

Hey, what's up, Sal? What's going on, Big Mike? Nothing, much, man. What are you up to? Ah, nothing. What are you doing? Nothing. Hey, man, I got to tell you something.

I got a video. I got 100% proof the Earth is flat. You got to take a look at this. Okay, so a little backstory on Mike. Mike is what they call a flat earther. And, well, they think that the Earth is actually flat. I mean, like, really? Dude, again with this...

I'm telling you. It's round. It ain't round. Mike. Just take a look. No. I'm going to lose five minutes of my life watching this again. You'll probably gain five minutes.

Oh, dude, come on. I'm telling you. I promise you you will. Copernicus, it's round. Perkernicus is the guy that... That guy... He can't even say it. Whatever.

That guy I know... He's the guy who thinks it's round. I'm the guy who knows his flat. Okay, I have to stop there because they just keep going on and on like this for a long time, like way longer than they need to. But I played this clip for you to give you. to give you a sense of what Sal is like. And I think Sal is not only the star of the show,

but also the writer, the director, the producer, the editor. He did it all. I was curious, so I checked. Turns out, nobody watches this show. If you go on IMDB, reality shows usually have like five, maybe 10,000 reviews. Country Days has 11 reviews. Nobody's watching it. Sal's personal IMDB page lists his other shows in movies.

Some of them don't even exist. There's a few pictures. of him in an action movie, except if you go on his Instagram, he admits that those pictures were just taken in a photo shoot that he paid for, which, I think about it. I admit I did that once, too. In high school, I somehow faked my way into the picture with the football team. So if you opened up the yearbook that year, it looked like I made the football team, but I was never on the team. So who even is this Sal guy, though? Where is all this money coming from? If his shows don't have any audiences, how has he got that big house and all the money to run a

film studio. Well, here's the truth. He always wanted to be an actor. He was in school plays and got on a Burt Reynolds show as an extra. He studied theater in college, but he didn't work out for him at all. But his dad, Sal Sr. is a prominent lawyer in Florida. And when Sal crashed out as an actor, Sal Senior probably hooked him up with his next gig in a sheriff's office as a deputy. Yeah, Sal became a cop. And it was a huge setback for his dream. But Sal didn't give up. He believed in himself and he hatched a new plan to rekindle his Hollywood dreams. And I think it was here while working in the sheriff's office that he noticed something which gave him an idea to make money to pursue his dreams again. Years ago, if you wanted to get someone's photo or know their daily

routine or who they're in a relationship with or get their phone number, stuff like that, you'd have to hire a private investigator who would tail the person and gather what they can. but today everyone is posting their own private data voluntarily online especially social media we see photos of people's kids their accomplishments their vacation photos we see them with their new lover or their new home renovation sometimes you just see people post their whole day on social media we don't need a private investigator to get information about where people are and what they're doing and what they look like or any of that stuff anymore it's just all there on social media and so there are companies that go on social media and scrape all that data to provide it to cops. Like I remember a few years ago, there was a whole controversy about a company called Clearview AI,

and they were rating major social media websites. They'd take Facebook, for example, grab every picture and bit of information they could off of everyone's account and then add it to a file that was created about them. Then they'd repeat for Twitter and LinkedIn and wherever, automatically. Of course, the social media companies got mad. They're like, hey, that's our data.

You're profiting off our data. Then they sent Clearview AI a cease and desist letter. But even those megacorporations can't stop it. If anything, Clearview is bigger today than they've ever been before. I just saw that they signed a $10 million contract with ICE. So keep that in mind. Your social media posts are likely scraped and processed through AI and are easily accessible by ICE agents, even if you delete your post.

And for the record, I don't think this is right. The Fourth Amendment says we should have a reasonable, expectation of privacy. It says the government has to have a warrant to conduct a search, yet ICE is able to get tons of data about us without a warrant. And the loophole they found is that they're allowed to just buy data from data brokers. It's the data broker loophole. And the thing I hate most about this is we never gave them permission to exploit this loophole. We never voted on this. We never collectively agreed that data brokers are cool and it's totally fine for the government to buy data from them and get around having to have a warrant to conduct.

to search. This was all decided without our input or support. And the government hides all this from us. They hide how much they pay data brokers to get information on us. I'm disgusted by how much the government spies on us without a warrant when it's clearly a violation of the Fourth Amendment. The thing is, this business model is very profitable for data brokers. They are incentivized to gather as much private data about us as they can, since the more they have, the more the government will spend on it. They are in the business of brokering your personal data. And I think Sal saw how important these data brokers are to law enforcement. And maybe he even caught a glimpse of how much the contract was with one of these. And he might have been like,

whoa, I'm in the wrong business. So Sal quit his job as deputy and decided to start his own data broker service. He created three almost identical websites. records check, criminal screen, and the flagship site, National Public Data. He hired some cheap programmers in Bangladesh to code the initial website for him. Then he started collecting everyone's data. You can think of the data he collected in two buckets. There's what the government publicly posts about us, such as bankruptcy filings, court records, motor vehicle records, death records.

You'd be surprised how big this bucket is. You ever buy property? Yeah, you're in a public database. You got married? Yep, that's public data. too. Registered to vote in some states, you're in a public database. Then there's bucket two, the dirty work, scraping it, sneaking it, stealing it, buying it. I'm not sure what the rules are here, but it seems like data brokers treat rules more like guidelines than actual rules,

because they'll go to great lengths to get private data from people. Sal either bought or scraped data from other data brokers, subscription and marketing list, loyalty and rewards programs, social media, and other apps. Some brokers even collected the data leaked by hackers. like US DoD. Eventually, Sal had collected not thousands, not hundreds of thousands, not millions, but hundreds of millions of Americans' personal data records. Then he packaged it into individual profiles and sold access to law enforcement or whoever wanted to do people search. And it worked unbelievably well. In 2002, Sal made $750,000 from selling our data. And in 2023, he made $1.20,000, he made 1.15 million.

And he almost instantly turned around and used the money to make his own TV shows. Here's what he spent his money on. I'm telling you. It's round. It ain't round. Mike. Just take a look. No. You ever watch those NASA videos?

CGI. No, please. They're sitting there flying over to Earth. You see the Earth below. You see the Aurora Borealis. You see it cruising around. Green screen. Green screen. It's all fitting.

The green screened Aurora Boreale. They proved it on here. Would you just take a look at it? Trust me on this. I'm getting dumber by the minute. I'm looking at Sal's financial records now. And there's something telling about the way he spent his money. The data broker company's total cash in the bank is $563.

Insurance expense, $1,327. Cybersecurity budget, zero. Salaries? Yeah, there were no salaries. He ran it all by himself with two desktops, a laptop, and file servers in his home office. To me, the way I see it, Sal's data broker business was only set up for him to make as much money as possible,

and didn't spend a lot of effort protecting this data or securing it. So now that you know what Sal was cooking up, let's go back and focus on Luan, aka USDOD. By this point in 2023, Luan was trying to get his military intelligence business set up and needed a lot of military identities to impersonate, more data and decided to hunt around for vulnerable data brokers. He found Sal's data broker site called Records Check. Records Check advertised instant background checks, social security number traces, and more.

Perfect. Luan was now laser-focused on this site, locked in, trying to look behind the curtain to see everything the site had on people. He used the tool to try to scour the site and see every file and image that was publicly viewable on this site. and one file stood out, Members.zip. What is this file, and why is it just in the open for anyone to grab and look at? He grabbed it and looked at it.

Members.zip had Sal's site's source code and buried inside the code were admin credentials. Luan just got the email and password to access any corner of this site and all the data in it. So Luan logged in to records check as Sal, but then done. discovered the site was connected to two other sites. And guess what? Sal reused passwords, which allowed Luan to log in to national public data, which gave Luan access to the biggest set of data that Sal had.

And Luan took everything, 2.9 billion lines of data, 277 gigabytes worth, personal information about 100,000, hundreds of millions of people. If you're listening to this and you're American, chances are you were likely in this database. Then Luan does what Luan does,

and he posts it for sale online as USDOD with the cute little kitty picture, and he put the data up for sale for $3.5 million. TikTok was outraged. This is a public service announcement to remind you to check your credit files. I just received an alert from my

credit card and also from my credit reporting agency about my data being leaked online. 2.9 billion records, one of the largest data breaches in recent time. Why is this one important? Because you're not a subscriber to this service. This is for running background checks and fraud prevention, and so they just randomly collect data about billions of people without your consent. We have to protect ourselves now. Although we're going to have a lawsuit against MPD, they did not protect our data sufficiently. The problem is the data still got out into the public domain.

The problem with the MPT data breach is that it is a scraping company that was designed to find out everything it can about you. Now, if they're a data brokerage company that has other information about you, a hacker can start to put together an identity profile on you, and then with that identity profile, breach your security. We all know that data breaches happen all the time, but the most recent one has been with national public data. It was over 3 million people's data was breach.

That's from the UK, US, and Canada. At the beginning of this episode, I told you about how that guy Matthew Keirons stole William Woods' wallet and later his identity. And all it took was for him to get Williams' name, birthday, and social social security number, and from there, it was enough to impersonate William for decades. National public data leaked full names, birthdays, social security numbers, home addresses, past addresses, email addresses, and phone numbers, all in plain text. A lot of it had errors, but most of it was accurate.

The ramifications of a data broker having a data breach is huge, catastrophic to some people listed in the breach. Researching this episode, I came across all kinds of horror stories of people who had their identities stolen after a data breach, like a bunch of people in Oakland, California. After the city was attacked with ransomware, they interviewed one guy who was on the news and he said that criminals had impersonated his identity and they were taking tens of thousands of dollars and loans out and making purchases in his name and he was on the hook to pay it all back. And so you can imagine the huge nightmare that he had to try to convince the bank that he

didn't spend any of this money. That hardly compares to this other girl I read about. She was in Florida and she tried to sign up for her first credit card when she went to college. But she got denied because they told her that she already owes one and a half million dollars and she's in huge debt. Apparently someone had been using her identity since she was nine years old. Another crazy story happened to an LA Times reporter. After her wallet was stolen out of bar, she knew it was gone minutes after it happened. So she thought there was enough time to act before something bad happened.

So she called the bank, she called the police, she called everyone. but it didn't matter. The thieves used her info from her wallet to get her social security number online, and for a whole year, they opened dozens of credit cards in her name, they rented cars in her name, got new iPhones and wrote tons of checks,

sometimes more than $10,000. And that's just a couple of things criminals can do if they get your information. We've already talked on the show about SIM swaps. If a scammer knows enough about you, they can convince the phone company to transfer them your phone number, Then they can log into your bank account or crypto accounts and steal all your money.

I read about multiple people who have lost millions of dollars this way. So I'm sure the victims exposed in the National Public Data breach have faced a lot of similar nightmare scenarios. And despite victims being hit with this, they might not even have a clue that National Public Data is what leaked their data. It's really hard to know how a thief got your info, you know? And the worst part is Sal isn't going to be on the hook for any of the damage done to the the victims, because how can you prove that the criminals got their data from this data breach

when these criminals hide in the shadows of the internet and are seldom caught? This is one reason why I despise data brokers. They mistreat our private data and don't care how negatively it impacts us. They're incredibly greedy for our data, and then it gets abused in the worst way possible. This is why I've become a privacy freak over the course of making this show. I know these data brokers exist and are trying so hard to get my information, and I know there's nothing I could do once they get it. I can't opt out or ask them to delete me. God, I would love to send a cease-and-diss letter to Equifax and tell them, please, delete all my data and stop spying on me.

But no. And I know it's just a matter of time before criminals get their hands on my data, either from a data breach or buying the data somehow. There's just no way to protect it. And since I know if someone gets my data, it could be catastrophic to my life. So that's why I take extreme steps to hide from these data brokers, even so much as wearing a disguise when I go. in public sometimes. In fact, many of you even have met me in disguise and only know what I look like in my disguise. It's the only way that I feel like I can empower myself

to stay safe in today's internet age. I use fake personas, burner phones, burner emails, even burner credit cards, and I'm super secretive about my personal life when I go online. Anyway, God, these episodes always get me ranting about privacy. Sorry, I know some of you don't care about your privacy, so I'm going to move on, but someday I hope to get through to you.

I mean, I just want you to understand this one thing. Most companies won't protect your privacy, even if they say they do. They share it with data brokers, and they'll profit off of it, or they'll just lose it in a data breach. The only one who can protect you is you. A couple of months after this leak, he taunted CrowdStrike, a cybersecurity company, claiming he hacked into them and he got all their threat actor lists and their indicators are compromised, and he has it up for sale. Well, the thing is, CrowdStrike has some pretty impressive cybersecurity

researchers and investigators. So they started looking to see who USDOD was. And they discovered he uses the same email address for GitHub, all the blogs and social media accounts he has everywhere. It turned out that for years, Luan only used one email for everything

he did, hacking or non-hacking. So CrowdStrike was able to figure out his name, address, phone number, tax registration ID, and more. Basically, Luan got doxed, but privately. Crowdstrike, law enforcement, Some news outlets had his details.

And Luan admitted to what he had done, and the docs were true. But he wasn't done. I saw him tweet, This is not my end. And then he offered his services to the Brazilian government, but that didn't go well. Now that law enforcement knew his name and location, the Brazilian police swarmed in on him and arrested him and took him to jail.

Sal was docs too by reporters. But he just lawyered up. It went silent. It didn't go well for him. Congress wrote him a letter calling National Public Data's lack of transparency staggering. Now he's being sued for everything he's got, and then some. Multiple class action lawsuits are against him by people who are in the data set. Unless Country Days takes off this year, he will not be able to pay off even a fraction of that.

And you would think after having a catastrophic incident like this, Zal would just shut down National Public Data, maybe go back to action or something. but if you visit NationalpublicData.com, it's still there. The site's still up, collecting our data and selling it. Sal tried to declare bankruptcy,

to wipe out his debt to society, but the judge just saw right through that and did not accept his bankruptcy plea. So then Sal supposedly sold his data broker company to another company, which is ironically called Perfect Privacy LLC. But you won't find much about Perfect Privacy LLC Online, but you'll find plenty about yourself if you search your name on their website.

The revamped National Public Data advertises that you can find pretty much anything you need from someone's contact information, location, age, and birthday to workplace, relatives, and criminal records. Which has to be the craziest thing about this whole story. Like a data broker can have a total breach and then continue operating, scraping my data, storing it without my consent, like nothing happened. So what's the solution here? I don't think politicians are an ally here. They aren't going to enforce any kind of data privacy law since they're the customer for many of these data brokers themselves. I mean, the government is who mandates that Equifax must be allowed to collect data off of all U.S. citizens without their consent.

And even if the government wasn't using data brokers, they'd claim that they need our data for national security reasons. So I think they are no help here. But then I was caught off guard when I read that age. 35% of the members of Congress were also included in the national public data breach? And a lot of them seemed pretty upset about this breach and wanted to do something about it. So in April 2024, they did. Weeks after Luan put the 2.9 billion records up for sale, Congress and the Senate proposed a nationwide privacy law called the American Privacy Rights Act.

It listed protections Americans should have, but also had a rule where anybody could file a form with the government to prevent data brokers from collecting their information. That is, submit a single form and all the American data brokers would have to delete your information if you want to opt out. Democrats and Republicans like this bill. It went up for a vote. But then the day before they voted on it, it was sabotaged. Lovies came in and put pressure on politicians who then started watering down the bill

until most of the useful privacy protections were gone. And after that, the whole thing died. So the American Privacy Rights Act never got off the ground. And this is what I mean. No one is going to save you. No one is going to protect your privacy. You have to do it. And lucky for you, there are easy steps that you can take to protect it.

I mean, just thinking right off the bat, stop using text messages. Those things historically have been insecure, and they typically are end-to-end encrypted, and they can be monitored by phone companies. So a chat app, like Signal takes extreme steps to never be able to see chats. Even if someone pointed a gun to their head, They would not be able to read your messages.

And the same goes for end-to-end encrypted email providers like Proton or Tudah. They cannot see what's in your emails. Compare that to something like Google, who looks through all your emails to provide ads for you. I also highly recommend a web browser that cares about your privacy. Google Chrome is the worst on the list. Every character you type into the address bar gets key logged and sent to Google. They want to know everything about you. So I use the Brave browser, which makes enormous,

effort to not collect anything from me. So those are three quick and easy wins. Use signal, use an encrypted email provider, and use a privacy-focused browser. Because it's not just about stopping Sal or Luan from grabbing at your data and exposing you. You want a future-proof yourself from tyrannical regimes that are also trying to hoard your data.

You might be okay with who's in charge now in the world, but that's going to change one day. And whoever inherits your data next might decide that you're a criminal, then it's too late for you to do something about your privacy. In the end, Luan, aka USDOD, is still in a jail in Brazil. Since Brazil doesn't extradite their citizens to the U.S., he'll probably just serve his jail time in Brazil, and he's likely never going to go to the U.S. And one newspaper speculated that he's facing about four years in prison,

but we don't quite know what his prison sentence was. you a premium subscriber of Dark Netires? If not, why not? Listen, I'm certain that you've bought a book or paid to go see a movie before you knew if that book or movie was any good. I don't want to do that to you. I want to give you this show for free in order to prove its value to you and show you that I'm worth pitching a few bucks at. Have I done that? Does this show bring you value? Do you learn from it? Do you get entertained? Does it help you get through a long car, ride without being too bored. If so, I want to ask you to become a premium subscriber to show your things. And hey, if you do, you'll get ad-free episodes and bonus episodes. There's actually 12 episodes

in the premium feed that don't exist anywhere else. So please consider signing up. Go to plus. darknetdires.com. I really appreciate it. This show is made by me, the pasta poner, Jackree Sider. This episode was written by the D-D-Doss, Attack Dog, Nate Nelson's sound designed by the VHS Vandall, Garrett Tiedeman. And this episode was assembled by the cruise controller, Tristan Ledger, mixing by proximity sound or theme music is by the mysterious breakmaster cylinder. My data has been in many data breaches. And once a hacker messaged me saying,

I have everything, bro. I have your name, are your password? I'm like, no way. Oh my God, thank you. I've been looking for that password for years. This is Darknet Diaries.