Hacked - Campus Security

Episode Date: October 16, 2022

The story of the software that monitors school safety amongst other things. Featuring data journalist Ari Sen. Network access security that scales with your business — NordLayer secures your organization’s traffic and data to provide your colleagues with safe, reliable, remote access. nordlayer.com/hacked Learn more about your ad choices. Visit podcastchoices.com/adchoices

There's definitely this idea of concept creep. So there's this data journalist named Ari. He's with the Dallas Morning News, and back when he was a student at UNC Chapel Hill... There were these protests going on over this Confederate statue called Silent Sam. Silent Sam is a statue of a Confederate soldier. The statue has faced protests since the 1960s, but those protests reached an inflection point when Ari was at school there.

And Ari started asking these questions. Not necessarily what was happening on the ground at the protests, but what was happening behind the scenes, right? What were the police saying to each other in emails back and forth? What were the administrators saying? And so I put in a public records request at UNC for documents related to the protests. He waits for a response. And that records request basically got denied by the university.

And so I was a little bit angry about that. But Ari is not a lot of. not a data aficionado. He is a data journalist. So he kept digging. UNC has a public poker records log so you can see what other people have requested. So I requested everything that other people had requested about the statue. Which ends up being hundreds of different requests. So in turn, it ended up with like thousands and thousands of pages of documents. And buried inside of those documents was this contract for this service, this social media monitoring service, social sentinel.

Which today goes by the name, Navigate 360 detect. There's a sort of motto and investigative journalism, which is to turn every page, and we've really turned every page. But slowly, tediously, a picture of this software, how it works, how it's marketed, and importantly how it's actually used, starts to emerge. So I wrote a story about that. So the pitch for this is pretty simple. Bad stuff happens on campuses all the time,

and sometimes the folks who do those things post about it online beforehand. And what if you had an AI tool that could parse the open internet for any content that connects those subjects with the campus? That would be a very powerful way to prevent maybe those bad things from happening. That's how this product is marketed publicly. It's how it's marketed on their website and very slick promotional videos. It's how it's marketed on their blog. This is a safety tool for schools.

It's not for anything else. It's not for monitoring those protests that Ari mentioned at the start of the show. It's not for anything related to free speech, critical speech, or the First Amendment. But as Ari's research started to show, there's another promotional channel, another way this software is being marketed. and how it's being sold over there raises all of these really interesting questions about data and surveillance and security and all the stuff that you and I like to talk about. There's two different promotion channels. There's what they are telling the press and the public and what's on their website and what they are saying to, you know, potential clients and to clients and emails behind the scenes. And so what they say in public is that, you know, this is a really sophisticated AI service that will flag threats of suicides and shootings, that it is respectful of people's First Amendment activity, that it doesn't have the capability to monitor for protests. But if you look at the emails that they were sending to colleges from, you know, 2015 onward, you know, we were seeing a lot of emails from salespeople talking about how they could mitigate protests and forestall protests.

You have one product, two sales pitches. Sold a safety to the public and something else to the buyer. So I had a conversation with Ari to ask him how he gathered and parsed through all of this data, these emails and posts and messages so that you and I could talk about it, Scott. To try and learn more about the software that itself gathers and parses huge volumes of data. But what this is for, who is using it and to what end? And then one of us will say, here on hacked. Here on Hacked.

Here on Hacked. Okay, the first thing I want to talk about is the name of this product. Okay. Do you want to repeat it because I don't remember it, but it was ridiculous. It was like Connect 360. Oh, man. Okay, so throughout this story, it's gone through a bunch of different renamings. Namings and renamings.

So for the sake of convenience, we're just going to refer to it kind of all by, like, it and the company all by its, what's been its name for a long time, which is, Social Sentinel. It has since been renamed Navigate 360 Detect. I believe it was sold to a company called Navigate 360 and they've rebranded this product as Detect. Okay, that makes sense. But I hate that name and I don't want to, yeah, I just don't want to say that name. Navigate 360 Connect. The second you said it, I was like, what? Detect. Yeah, detect sounds better, but like Navigate 360 detect is just a bit too much, you know? Like we work in advertising.

We know it's too much. Navigate 360. Okay. Navigate detect. Okay. Navigate 360 detect. Too much. One step too far.

Even 360 detect. You can really mix and match all of those words. And I'm fine with it. But when you string them all together, it's a little much. I know that's a crucial crux of this story is the name of the product. So I'm glad that we're getting this covered right away. I like that we're establishing that our biggest, like, issue. with this software is in the name.

There's nothing substantive. There's no real problem we have with what is being done here. It's just marketed very, very sloppily. Before we really get into the meat potatoes, I just want to touch on. We got an email from Mad Mowgli, aka Joel, who gave us some more details about the actual hack of the base of mafia. Oh, yeah.

It passed us over a YouTube video that kind of covered it that we hadn't seen, didn't know about. So appreciate that. It was, it was, it looks like it was, you know, a contract kind of hack to get a little bit of online cyber revenge. So pretty neat. So maybe we'll tweet that video out so that people could see it. The other thing we should do is maybe thank some of our new patrons. So I think we got a few new patrons since the last show.

So appreciate that. If you feel the need and you want to support the show, feel free to go to patreon.com slash hacked podcast. We appreciate and love you all. Love you all. No pressure though. A little bit of pressure. No, high pressure. High pressure sales tactics.

Scott, bully them. That's what we're all about here. On hacked. Cyberbullying. Cyberbullying. For a Patreon. We always knew it was going to end up here. Yeah, if you become a patron and stop being a patron, you get 10 times more show callouts than you do if you become a patron.

Today's podcast is brought to you by Nordler. Nordlayer safeguards your companies network, but it's also a lot more than just a VPN for business. As you already know from this podcast, business networks today are more vulnerable than ever due to where do we start? Remote work, ransomware attacks, and data leak incidents. Nordlayer secures and protects both remote workforces as well as business data, and it can even help you ensure security compliance. Simply go to Nordlayer.com slash hacked and get an entire month free. Nordlayer is easy to start. It takes less than 10 minutes to onboard your entire business onto a secure network.

Nordlayer is easy to combine as it's hardware free and it's compatible with all major operating systems. And finally, Nordlayer is easy to scale as you can choose a plan unique to your business requirements and your rate of growth. If you want to secure your business network, go to Nordlayer.com slash hacked to get your first month free. That's Nordlayer.com slash hacked. Question. Were you on the Facebook when it was still the Facebook? This is relevant, I promise. I joined Facebook when it came to Canada,

and I want to say that was like 2003, so I don't actually remember if it was the Facebook. I think it might have just, I think when they did their global launch out of the USA, it was, they had migrated from the Facebook to Facebook by then. So I think you had to be in a. American university student to really get in on the Facebook. So no, I don't believe I was.

I don't think I was either. I think I caught it right as it was coming to high schools. Like right as it dropped out of you need a university email to, you need someone from your high school to invite you, I think was the criteria back when I joined. If anything that demonstrates the idea of manufactured scarcity, you know, it's like everybody can have an account, but you can't have an, it was like Google did that when they launched.

Gmail, remember? They sent everybody five invites and then it kind of spider web grew out from there. It's like such an interesting thing. Manufactured scarcity. That's the name of Jordan I's marketing podcast that we're never going to launch, but it's a great idea and a great name. This is just gradually becoming a podcast about all the other podcasts that we should start and we like kick one of these out every two weeks. We did get some love on Twitter about the idea of starting a gaming podcast, so that would be hilarious. idea. Yeah. Social Sentinel. And as we said, it's gone through about a Jillian namings and renamings, but for the sake of convenience, I'm just going to refer to the company,

the product. I'm just going to refer to this whole thing as Social Sentinel. The co-founder of this company is a guy called Gary Margolis, and he was a police chief at a university. So I thought that was really interesting that, you know, he sells this service to police chiefs at universities, but he himself was a police chief at a university. In fact, The other co-founder was also a police chief at a university at Wellesley and at Princeton. So it started by these two guys, these two former police chiefs. But the real heart of that story is a dispatcher named Diane. And so the story that Margolis likes to tell when he's interviewed on podcasts in blog posts,

these sorts of things, is that one day he was leading a, you know, leading a, you know, sort of police debrief meeting. And there was a sergeant named Jimmy who's like giving him all this, this crazy information. And he asked Jimmy, you know, Jimmy, where did we get all this stuff, right? Like, how did you get all this new information? And he said, well, you got to go talk to this overnight dispatcher. Her name's Diane. And so he goes and he talks to the overnight dispatcher.

And apparently she had gotten all this information from what was then called. the Facebook? The Facebook. You got your MySpace, you got your, I don't know, your Nexopia. Friendster. NexOpe. Your friendster. Canadian reference there, I think mostly. Canadian reference. I forget that that's not international. That was, that was big in Western Canada. It was huge. Well, it came out of Edmonton, Alberta, which is, you know, very 2000s hip. So this is, you know, sort of dates this reference back to the early 2000s. So she was looking at these online forms and the Facebook and apparently all this information was out there. And what he says is, well, you know, what this means is we need like a, you know, we need something

or someone to be monitoring this information because it could be really useful for police purposes. Margolis wrote in a 2015 blog post on Social Sentinel's website, quote, it became clear that we needed a digital beat cop, someone with an ear to the social landscape. So they say, let's start a conversation. company. Let's create this product to be that digital beat cop to patrol this vast new frontier of the Facebook. And pretty immediately there's like a really big audience for this, this social media monitoring service for schools, this digital beat cop. In an email to a UT Dallas police

lieutenant, Margolis said that like right now, the product was used by hundreds of colleges and universities in about 36 states across the U.S. The data that Ari was digging through contained just a tiny, tiny chunk of that. We found 37 colleges in the U.S. that have used this service since 2015. And what the company says is that this is a social media monitoring service for people posting threats of like suicide or shooting. So if I was to, you know, I went to UNC. If I was to say, you know, hey, I'm going to go jump off a bridge. And I had Chapel Hill, North Carolina in my bio, they might send that tweet to the UNC Police Department, and UNC police in theory could go and stop me from, you know, killing myself the same thing for

a shooting, right? If I say I'm going to go shoot up a school, the UNC police could prevent me from doing that. What our reporting found is that actually campus police are using it not only for, you know, shootings and suicides, but also for tracking protests and activists. as well. We'll talk a little bit later about how many schools total are using this or other products offered by the manufacturer because depending on where you set that boundary, it's a lot more than 37. As already mentioned, social sentinel starts to get picked up.

A school here, a school there. The contracts we looked at ranged from about $9,800 to $51,000 a year, which is a lot of money for you and I, but for a university that's not a ton of money, right? kind of a drop in the bucket. Social Sentinel starts to spread, kind of like the Facebook from campus to campus to campus. And all the while, you've got generally the same story in the way this is being publicly marketed. We're going to scour the internet for content posted about the school and service of preventing school shooting suicides. The things that everyone going to this school and paying for the school can agree that the school should want to stop. They use these

two terms on their website. Harmful intentions and behavioral warning signs. The software is looking for behavioral warning signs online of those harmful intentions. The natural question then is how does the software work? How do you actually use it and what is the AI that's powering it kind of doing? So it's interesting because Social Sentinel is very opaque about how their technology works, you know, you know, what specific models and training data they're using. But basic, like, what we've been able to piece together from the colleges, you know, the campus police who have talked to us and, you know, their marketing material is that, so a college will buy this service, right?

And then they'll set it up. And then Social Sentinel will ask for a list of words to enter into the service, you know, into something called the Local Plus list. And sort of the benign reason for this is like, you don't want to get all the threats of suicides and shootings for all of the world from Twitter. You only want the ones that are locally specific. So you would say like, you know, you might input the name of your administration building. So, you know, instead of getting, I'm going to shoot up the building, I'm getting, you know, I'm going to shoot up the Kerr administration building or whatever it is. So it's a way of narrowing.

It doesn't sound super AI. No, it sure doesn't. As somebody that's studied, researched, and done a lot of things in the AI space, I'm by no means an expert, but I got the A-plus in the 400-level AI class in university. I just want you to top grade in the class, so that gives me the credibility to answer this question. Usually AIs work with training sets. You train them. You give them information.

They learn to identify patterns that humans can't. And then they go from there. You could choose your learning algorithms. You can choose all kinds of stuff. But eventually they kind of figure out cause and effect, causation, I guess, in like an end-dimensional space. And then kind of draw an end-dimensional plane through it and say when things cross this plane,

they potentially could have the outcome that we're looking for. So having a bunch of keywords in a hot search doesn't hit me as a serious AI system. No, it doesn't strike me as that either. And I don't want to say definitively that there isn't buried somewhere in some piece of marketing and explanation of not even the specific AI model that they're employ, really any AI model that they're employing,

I'm not saying that doesn't exist somewhere, but I sure couldn't find it. Think about that premise. If you're looking for communications online that have led to an undesired outcome, and then you make that into a training set. And also communications online that lead to no outcome. So essentially the ante of what you're looking for.

Sure, red herrings. Yeah, there's so much of that training set. Like literally all the communication that goes on on the internet or like not all of it, but like, you know, almost all of it has no impact. So the training set for no is huge. And the training set for yes is tiny. And like, you know, obviously there's a lot of bad things that happen. But like when you compare it to the scale of the amount of discussion that just happens

organically on the internet every day, that's insane. Like that training set would be huge. A monstrosity. Yeah. Yeah. Yeah. My question is, it was the exact same thing that you just said. Are they looking back at previous instances where a harmful intention occurred,

where say a school shooting or a suicide did actually happen, to reverse engineer and say take everything that person did previously and including that as their data set? Because that kind of would make sense to me. You could maybe derive some patterns of, well, you wouldn't think it, but a person who is going to do that maybe does X, Y, and Z in the time leading up to it, you could build out, you know, some, some patterns for predicting it.

I don't have any reason to think that's what the software does. Though maybe it does behind the scenes. They sure don't talk about it, though. What they talk about is this seems like it's a keyword-based system. It feels like, and this is just a touchback to previous episodes, we've done on, I think, TikTok. We talked about this in online advertising in general, like the psychographic profiling that advertising,

has been able to do. Yeah. I bet you'd be way better off making a model. That's a really good point. Of who commits these acts and then plugging that into, you know, like all of these large advertising networks, you know, Facebook, Google, these people have the goods. You know what I'm saying?

Yeah, for sure. They know what you're into. Like, I get ads in my pop-ups and my, in like, just my Google news items of, like, things I own. And, like, I haven't Googled them. years and they're like, you'd probably like this in case you missed it. And I'm like, oh my God, these people, like they're tuning in on me. They're like, hey, check out this cool headphone amplifier. I'm like, oh yeah, I bought that three years ago. And clearly, clearly not in my thing,

but you now know that I like boutique audio equipment. And it's like cool. It's like they're really dialing in on who I am as a person. And they're like, yeah, we can feed them this ad. Yeah. If it has to do with like buying a new pair of socks off Amazon, Amazon, they can make astonishing predictions about what you will do based on what you've previously done. But if it's about whether or not you're going to commit a horrible, violent act, it seems like it's pretty much it like, did you tweet that you were planning on committing a horrible act? If not, there's not much we can do for you. Yeah, like I would love to, you know, maybe the cost of all of this removal of online privacy is that we take some of this data and do good with it. Maybe the positives could outweigh the negatives in this one.

You know what I'm saying? Yeah, I think that's where I have the exact same question, and I keep bouncing back on forth on what my answer of it is. And I think that's what's so interesting about this story. Oh, this sounds philosophical. I think it's going to get real philosophical. All right, well, let's go there. So what the marketing is saying is mostly to do with keywords.

Not so much about AI, mostly do with keywords. But as long as I'm not as I'm going to do with keywords. those keywords have to do with those, quote, harmful intentions. You are using Social Sentinel according to what's on the box. You're using it as it is being marketed. You're using it sort of as the manufacturer intends it to be. But that local plus list functionality that Ari mentioned, the sort of the system that you're punching those keywords into. So now what we found is that that local plus list could also be used to narrow for specific terms related to like protests and you know, sort of these contentious events.

So like at UNC Chapel Hill, where I went, you mentioned earlier that there are these protests over this Confederate statute called Silent Sam. And we know that from the emails that UNC police were entering keywords into this local plus list to surface posts related to Silent Sam. And this was something that, you know, they could do at any point in time.

So you could enter local plus list keywords, you know, what they would do. do is they would email the social sentinel representatives. The representatives would enter the keywords. And then you would start to see posts related to these sorts of events. Let's just hold there for a sec and talk about if you're a communications liaison for a university who knows the media is going to be calling and asking you about this protest. It's like social media monitoring, like in the ad and marketing space is very common. We've seen some very nasty products in the last 10 years.

Ones that get past privacy filters, ones that get onto private. Like if you mark your profiles as private and stuff, they're used to be. I'm not sure if they still do. We obviously did use them because they're ethically gray. Of course. Maybe not even gray. They're bad. But yeah, there's been tons of, like, your data is for sale.

people are paying for it. And it's like social media monitoring to whether it's sentiment around things. You know, like communications people, people that deal with crisis management and stuff. They need that stuff. They need to know what people are saying about it because they're going to have to respond to it because the media is reading Twitter. They're reading Facebook. So when they go to a press conference about it,

they're going to be getting pinged about these topics of conversation that are coming from the internet. So it's like, to me, if I was the VP comms at that university, I would be doing the same. I would be adding terms to that list to make sure that I was prepared for the conversation coming up. So that's just me being an apologist for them and waiting to see where this story goes. The motivations of everyone in that anecdote all makes sense, even if maybe some interests between campus leadership and the students on campus aren't necessarily aligned. I get why everyone is doing what they're doing in that story. I would agree with you there.

Hooray, we have unity. So let's branch out a little bit then. UNC wasn't the only school that was showing up in these reams of data. It's just where Ari went, so it's where he started. So he starts to sort of follow, you know, starts to sort of navigate through this data. He starts to find some situations that didn't happen at UNC. And importantly, he started to find some situations where protests weren't the only kinds of keywords

that people were punching into this software. There's another school in North Carolina, North Carolina, NT, where they were surfacing posts about a cheerleader who had complained that, you know, she had reported that she had been raped to her coaches. Her coaches allegedly mishandled that complaint. And so there was a lot of criticism over the coaches and of the university administration. And we, in fact, we have a document. We can see exactly what was entered at that point, you know, the specific keywords and hashtags that were entered into the system. a tool for identifying harmful intention and keeping students safe

being used to track criticism and protest of the school which to my mind is not a harmful intention that is a very unconventional use for a hammer in this situation I don't know because it's like I can go to Twitter and search for anything right and if it's in a public post it pops up

so like if somebody's critical of like and you know this is by no means of justification but it's like adding something to an automated system that's going to deliver me an email with a media report versus me going to Twitter every hour and checking it? Like I'm getting the data no matter what, probably. Unless this tool is doing something to the back end,

it's just essentially automated information gathering. Again, if I'm the VP comms, and I know that this is a media story, I want to be apprised of the most recent points of discussion because the media will be going to Twitter and searching for the, if not using a tool like this, that maybe isn't secure, police focus, but is media gathering and like media tracking is is is as old as time in that

marketing. So it's like they used to pay services that would read every newspaper in the world and like cut cut out articles and reput them and then fax them to you. Like no joke. Like that's that that was a real thing. And it's like that has progressed and progressed. Like if you deal with any big age like big companies in Fortune 500s, they all pay me. media services and they get a morning report of everything that was talked about in all forms of media about their company the day before. And it's like, I don't think that's a bad practice. Like if I'm the CEO or CMO or whatever, some senior person at some big company, I want to know what the world's saying about us because at some point I'm going to have to maybe stand in

front of a microphone and talk about it. Sure. So redirecting a tool that's essentially just doing keyword searches to look up information that I could look up just by going to Twitter and typing in the search bar is just making my life easier. So maybe I am a full apologist on this topic. I get the appeal of it as a tool. Like, I would agree with that. I get the appeal of it as a tool. But then I try and switch perspectives a little bit. I'm imagining it from the student's perspective.

For sure. to find out that their tuition is being spent on a piece of software that is used to follow them, for lack of a better word online, to see if they're posting anything critical of the administration. For as much as I can empathize with the person wanting to use that tool, I'm not sure how I would feel in the position of the person being monitored to know that it was being employed. But I take your point. Well, it's a very interesting topic. Totally.

Well, here's the other side of that. you don't like that the money is being spent on this tool. Yeah. But the money could be spent on three administrative staff who just fit them on Twitter all day. So it's like, you know, maybe you're a good guy and you're big on that. But yeah, exactly. So it's like it's more efficient, it's more effective and it's automated. But like by no means do I think that it like I'm not letting anybody off the hook for their bad behavior.

No, no, no. I love this. of mishandling things, but it's like, if you're posting things to a public forum being critical of something, something you're being critical of has the right to know of the criticism.

Sure, sure. And respond if they choose to. Yeah, yeah. Like, I prefer open dialogue as a means to a solution. Mm-hmm. But I don't hate it. Like, obviously, by no means,

am I giving anybody a pass on what happened? No, no, no. It's like, I don't think it's, as far as if you just reform it from like a protest quashing tool to a media monitoring tool, to me it's pretty basic. It is. How many people have Google alerts for their name? Probably a ton. Yeah. And it's like, is that any different? So I'm just going to keep, I'm going to keep peppering you with stuff already learned during his investigation because I find a, I, a quote.

quite enjoy this back and forth. Yeah, go. So let's add another thing. Yeah. We've got keywords for protests. We've got keywords for criticism of school leadership. Let's toss in a new type of thing. Let's get names into it.

Going back to that local plus list, say, you want to track any chatter about, say, the school chancellor, right? You want to make sure nothing bad is going to happen. No threats have been levied against them specifically. You need functionality, not just for tracking keywords, but, you know, say names. Names are keywords. Names are keywords. I think that's kind of the thing is that

Social Sentinel likes to talk about this not really being for tracking individual people, but I cannot for the life of me figure out the difference between a keyword and a name, which means if you have a good system for tracking a keyword, you have a very good system for tracking an individual. Of course.

The names are keywords. If I type hacked podcast, you know, they're just keywords. So on the tracking of individuals, we did find evidence that some schools would enter the names of individual people into that local plus list. So now the benign reason for this is like, okay, you put in your chancellor's name. So you're getting tweets about like, you know, I'm going to go shoot the chancellor or whatever. Now the more sinister reason, so say you have prominent activists, you know, leading a protest movement, you plug in their name, you start to get all the information about them.

You can almost collect like a file or a dossier about them, in addition to getting all of their tweets. So we did find evidence that students' names were getting plugged into this service. There's a college here in Dallas, UT Dallas, that was putting students' names into the list, and we asked for the contents of their list, and they said, we can't give that to you because it has students' names on it. So we sort of were able to infer, you know, what, you know,

what was on that list because they wouldn't give it to us. And yeah, so there was that. We also found evidence that they were using something called the filter management interface to enter specific social media users, like account information. I don't know if that's the same as the local plus list or different from the local plus list. This was very early on. This was in 2015. There were some emails to NC State where they're talking about tracking specific social media users

for these so-called threat assessments. And, yeah, so there definitely was an element of, like, tracking individual users, either with the Local Plus list or with, you know, some other feature of the service. So they're actively monitoring specific students. Yeah, they're actively tracking specific students. That's an interesting one, because there's two sides to that. One, it's a bit creepy. And two...

And then two, if you've got somebody who's actively critical, you know, maybe they're a protest organizer, you know, somebody who's constantly putting out content that maybe is even newsworthy. Like if they're starting to get followed by local reporters and, you know, other syndications and things that you'll have to start responding to in official channels, again, makes it more efficient the process of gaining the information so that you're well prepared to answer the questions, but again, it is a bit of a, I think that this really all boils down to information privacy. And when you post something in a public forum, it's public. And, you know, whether somebody wants to add your name to a keyword list or not, it's still public information. It's incredibly public information. It's not like they're tracking the GPS coordinates of your cell phone and like stuff like that. It's all legal. Like it's, it is stuff that you have posted for the world being amalgamated inside of this one piece of software.

I kept coming back to that where I was like, oh, no, yeah, that's, like, Twitter could make that functionality, right? Like, Twitter could have a pro-type account that you pay for that allows you to track stuff related to your, like, to certain subjects. Like, some versions of that functionality is already built into Twitter. Well, the functionality is inherently there. you just have to hit new user, create a burner account, and follow everybody that you want to see their content on.

It's public information. You're just figuring out how to filter it out the best. I think where it gets interesting comes back to, as a lot of these stories do marketing, which is a good transition for us. And something we also oddly know about. There's what this software can do, which is certainly legal.

And I really like the conversation. we're having about whether or not it's cool or okay or good or necessary. It's like I find that a very fascinating conversation. But then over here there's the way they talk about it, which is a separate thing. So I think we need to talk about that here now. Social Sentinel has said in so many words, this is not software for tracking protests. A value we hold deeply is First Amendment rights on campus. They quote, according to their site, scan while respecting constitutional rights.

the privacy freedom speech and the right to assemble, which is, I'm certain, legally true. But very regularly they talk about how this is not for tracking individual users across the internet. They regularly talk about how this is not for monitoring protests. The entire brand of this product is safety. It's not monitoring. It is not data kind of tracking. It is for safety. It's not about protests. which is where we get to have this thing is marketed on other channels, not publicly, not in the promotional videos. 2017, a guy named David who works in the marketing at the company reached out to UNC Charlotte administrator named Christine to try and sell the service. And in his correspondence, we see that David contacted Christine multiple times saying the service could be used for forestalling, quote, disruptive demonstrations and protests.

Right around that same time, representatives from the company use the same language. of mitigating and forestalling protests in a message to Stephen F. Austin University. Another same message to UNC Asheville. In another instance, quote, I hear that you are interested in uploading usernames, user accounts, etc., to follow known threats. One of their employees wrote to a university police chief

in Carolina State. Quote, we recently released that feature. You can now upload a list of Twitter authors. Wove in through that data, Ari was parsing, now writing for the Dallas Morning News. We're case after case of this. And that's where I think the real tension of this starts to emerge. Publicly, this is not software for tracking protests.

This is not software for monitoring individuals on the internet. Back channel, this is an incredible way to monitor protests. This is an incredible way to follow individual users across the internet. Can I ask you a question? Please do. As somebody who's been involved in protests, has seen them from the inside, from the outside. As of you, as of you, how does this software forestall a protest? I don't think this software can do much of anything to forestall a protest.

I think this software can empower, in no way more than Twitter could, a school police force to forestall a protest. If that police force doesn't know the protest is happening, they can't go out and forestall it. They can't go out and do anything, respond to it any kind of way. But if they go out and try to for stall it, then they're in violation of people's fundamental rights. They sure would be. There's an expectation that the campus and the security force will be prepared to respond.

And by response, I don't mean squash the protest and like, you know, break it up. I mean, preserve the school capital. Yeah, sure, sure. What cops are there for is to make sure that the capital to be damaged. Yeah, and also, and like, you know, and not just,

the capital, but the human capital. It's like there's other students and people that will be around and come into interaction with this protest. They need to make sure that those people's safety is, you know, secured. So it's like if I'm a, if I'm somebody who's liable for a ton of, like a ton of people's safety, I want to know that an incident, be it peaceful or violent, is about to occur because peaceful ones can turn violent and violent ones can turn extra violent. So it's like, I don't know. To me, maybe I am a full apologist on this topic because it's like to me, I just feel like preparation isn't a bad thing.

Risk mitigation isn't a bad thing. And I don't think that you should use it to, like I'm a diehard fundamentalist when it comes to fundamental freedoms and rights, and you should know that. But it's like at the same time, I think that people who need to, who have other liabilities and things to manage need to be equipped to best manage those. And in today's world where everything is digital,

having access to that digital information is critical. And I would actually say that it would be, you would be mishandling people's safety if you weren't reviewing it. Bold statement. Bold statement. So to my mind, there are two different questions here. One is should any version of this exist?

And I appreciate the argument that some version of it should. and maybe a kind of dumb, ineffective version that just sort of amalgamates keywords off the open internet is the best version. Maybe a crude version is good. And maybe that should really exist so that the people that are tasked with safety have the most relevant information necessary. I would put that question over here. And there's another question.

It has to do with the specific tool they're using. And it's what does it mean when the manufacture of that product publicly is, saying we don't want you to use our software for that. We don't think that's a good thing. That's not what this is for. It's for safety. But then privately, they're going out into the world and saying this is a great way to do that. This is a very powerful tool for the thing that we're publicly saying you should not use this for. To me, that delta between what they're saying publicly and what they're saying privately, that's kind of what I'm interested in. Does that make sense?

Yeah, completely. I think I, I think deceptive marketing is shitty. Here's the thing. I actually like this sort of threat of giving them the benefit of the doubt. And to follow it, I have no clue how many salespeople, social sentinel employees, probably a lot. And I don't know that I would hold the entire company accountable if there were some overzealous salespeople. If the company really does believe in those guardrails to protect that privacy, if they really do hold those values about right to assemble. But there's just some rogue salespeople that saw and in and took it.

That sounds plausible to me. I get that. They could have said, well, these were rogue salespeople, right? These are just two guys who were, you know, working, you know, going to, go. a little beyond what they were told, right? Unless, of course, there was some sort of document buried in all of that data that revealed that the company was from the top down, endorsing and marketing this as software for surveillance and monitoring

beyond matters of pure safety. A document in that data proving that this was not rogue salespeople, it was institutional. For Ari, that'd be the smoking gun. The white paper really shows us that, This was company policy. This was like officially the company's line that this service could be used for monitoring demonstrations and monitoring protests. That document right after the break.

Think about the last time you heard a breach story on this show. It always starts the same way. Someone somewhere saw something too late. An alert buried, a signal missed, an SOC that just couldn't keep up. Arctic Wolf set out to solve that problem by rebuilding security operations from the ground up for a work. where attackers are already using AI. They created the Aurora superintelligence platform, a fully agentic system powered by the swarm of experts.

Instead of single-purpose bots or lucky-guess LLMs, this swarm is full of deterministic agents that handle whole entire workflows. Humans stay in the loop and on the loop to validate the critical decisions and keep everything trustworthy, and all of this is just off running on their secure operations graph. A constantly updating intelligence engine fueled by more than 9 trillion telemetry events every week and over a decade of real-world incident response. The system reasons on real signals and real context not synthetic training data. And the result is the new Aurora Agent SOC. It's the first

SOC that is agent led by design. You get agents that coordinate, agents that investigate, agents that respond at machine speed, and hundreds more that automate the repetitive work that normally buries human analysts. Arctic Wolf didn't try and bolt AI onto an old model. They rebuilt the model entirely. What makes it even more effective is how it works with Arctic Wolf's concierge experience. The team brings customer-specific context directly into the platform so every AI-driven decision reflects your environment instead of generic assumptions. The automation frees your concierge security team to focus on higher value strategy and proactive risk reductions while the agents handle the grind.

If you want to see what trustworthy, production-ready AI and security operations actually looks like, go to Arcticwolf.com slash hacked. Ever feel like cyber threats are evolving faster than anyone can keep up? Last year, 2025 was nothing short of a record-breaking year for major breaches, from sophisticated ransomware operators to AI-enabled attacks that turn defenses on their head. Organizations around the world saw headlines they never expected, and cybersecurity teams were tested like never before. But here's the thing.

These incidents aren't just news headlines. They're learning opportunities. And that's why Arctic Wolf is hosting a live webinar on February 5th, diving into the most impactful breaches of 2025. Their field CTO and security leaders are going to unpack not just what happened, but why these attacks succeeded. And most importantly, what businesses can do to fortify their defenses for it's too late. You're going to walk away with real insights in how threat actors are evolving, how defenders are responding, and what strategies can help you stay ahead of the next big breach. It's not fearmongering. It's practical,

actionable, intelligence from experts in the trenches. Register now at arcticwolf.com slash act. Yeah, so I really think the white paper is our smoking gun document. And it was funny, you know, the white paper, we kept seeing this attachment on emails. It was like HD protests white paper, you know. And we saw it like three or four times. And, uh, but they wouldn't include the actual attached document, uh, in the documents that they were sending us. And it was really frustrating. I was like, this, that sounds like really juicy. Um, and, uh, and, uh, but they wouldn't include the actual attached document, uh, in the documents that they were sending us. And so, you know, I was going back through my documents towards, you know, I think this was probably in April or something, like towards the later stage of the process. And I figured out that actually we had this document all along.

It was like buried in some pages that we had gotten not through FOIA, not through the public records laws, but through like just downloading stuff on the internet. And those were two separate folders. So I was searching in one folder, but not the other folder. And so we found that we had this protest white paper. And the reason I say it's sort of the smoking gun is because, you know, in theory, if we had just published without the white paper Social Sentinel, you know, or, you know, the company is now called Navigate 360, they could have said, well, these were rogue salespeople, right?

These were just two guys who were, you know, working, you know, going a little beyond what they were told. right. But the white paper really shows us that this was company policy. This was like officially the company's line that this service could be used for monitoring demonstrations and monitoring protests. And so once I, you know, was able to find that document in all the records we had collected, it sort of really proved the case that this was a service that was explicitly marketed and advertised for surveilling protests. We've talked a lot about what this software is.

We've talked a lot about whether it's good or bad that some version of this exists. We know that at least several schools are using it in a way that is seemingly off-label but is in some sense endorsed by the manufacturer. Students are paying money and a little blip of that money is going to pay for the software that's monitoring them, however you feel about that, whatever. But here's the thing. This story about Social Sentinel is one product made by this larger company Navigate 360 that sells this giant suite of different software navigating these themes of digital monitoring and real life safety. University social media may have been the start. The Facebook may have been the beginning, but it is certainly not the end. Let's zoom out a little bit. We've been

talking about social media on campus. Let's talk about something less intuitive. public, like say, a university email account. In the beginning, Social Sentinel was a social media monitoring service, but in sort of 2019, they started offering colleges like, hey, do you want to sign up for our email monitoring feature as well? So we know now that Social Sentinel, or as it's now known, Navigate 360 Detect, has this email monitoring capability. And so originally they were advertising an integration with the Gmail and, like, the

G Suite of services. And then soon they were advertising that they had an integration with Outlook as well. So it's not only just a social media monitoring service. Now it's also an email monitoring service as well. And assuming, you know, it works in a similar way to the social media monitoring service, you know, this would pick up on emails that had these sort of keywords, you know. And what we've seen from the tweets that have been flagged by this service is that oftentimes it's not very sophisticated, right?

Like, it would pick up on something like you killed it in the presentation yesterday, you know, like sports related words, like shooting the ball, you know, things like that, you know, where it might have one of these like words in what they call their language of harm. But, you know, it's obviously not threatening or not dangerous, right? So, you know, in the email context, you're surfacing private stuff as well. I would love to jump in and say that I think there's just a fundamental switch there between something that you're posting on a public forum versus something that's going into a private email box.

Even if there's terms and conditions that allow it, it's still skeezy. I don't like it. There is an expectation of privacy there that does feel kind of materially different than social media. You can say, like you said, it's terms and conditions, man. it's a university-run account where the admins were allowed, but there is an expectation of privacy there. 100%.

But that's my, those are my strong feelings on that. Also, I can throw in a cool reference there. Sick. Cointel Pro, which is like one of the first theoretical email surveillance systems for like the FBI, apparently way back when. I think this is the 60s Cointel Pro. And I think I forgot who it was. I think it was one of the OG text-based Unix email editors used to have like a little preference that you could flip on that would include like a huge list of keywords at the bottom of the email.

And then every email you sent got flagged. So they would just overload the monitoring people with like just tons of garbage. Just because it would just like throw 60, you know, obvious keywords at the bottom of an email and just bang, everything got flagged. Oh, clever. It's overloading the system. And I'm pretty sure if I remember the story correctly, and this is me digging deep. But they essentially got sued and had to remove it. Had to remove the feature by the government, if I recall correctly.

Maybe I've made this entire thing up. Maybe it's a premise of a great fiction novel. But I'm pretty sure that's true. But that's still presumably university emails. Should an adult presume anything they post on social media is read? Yes. Should they presume their university hosting? email is not private, maybe technically.

Maybe not every adult knows that, but every adult should start thinking that way. I feel like... It's a little skeezy. It's a little skeezy. I feel like there needs to be a flashing red box when you log in every time that is this like the university is reading this if it's not private. Because you say my email. It's like possessive.

This is my email. It's my mailbox. I think the expectation of privacy is huge. on email and I just think that whether you slide something into the transit conditions that says we're allowed to read your messages or not just... I would agree with that. I don't like it.

It would be prudent for every adult to know that but not every adult does. I was saying the word adult a lot there to transition us to the next market that the company crossed into. Not adults. And I should say that social sentinel is not just used by colleges but it's also used by

K-12 schools and the email monitoring thing has been going on for a very long time in the K-12 environment. There's a lot of services that do this. There's three others that we looked at last summer called Gaggle, Go Guardian and securely. And I think all of them have some sort of email Gmail G-suite monitoring technology. So this is really just offering colleges the ability to do something that it was already in place for K-12. I wonder how many parents are aware of that? Probably not a lot. one in four schools in the country, you know, use some sort of navigate 360 product.

And if you've cornered K to 12 schools and then you've cornered the kind of university where those students graduate into, why would you stop there? What about the workplaces where they go to work after graduation? We've also seen marketing material that, you know, they're selling to businesses as well, like moving into the workplace and out of schools. So it's really hard to, you know, parse through that material and make coherent sense of, you know, what's going on. K-12, universities, offices, and it all started with, wow, there sure is a lot of useful stuff on this, the Facebook. I think for me, the big ethical line in the sand here is public versus private. And if you're shouting in private forums or standing in the middle of the campus quad screaming,

People have the right to listen and, you know, respond. And if you're saying it privately, then it should be held to the people that you disclose it to and whomever they share it with. But it's by no means should people have access to it. That's my big thing is. Yeah. I think I am a diehard fundamentalist when it comes to fundamental rights and freedoms.

And I think that that's the preservation. And if you're using this information to violate, people's fundamental rights and freedoms, then you're a bad person. There's definitely this idea of concept creep, right? That a service, you know, that might have started for one purpose, gets repurposed for another purpose, and then it's, you know, way less effective. You've seen that a lot with machine learning systems where, you know, there's a great investigation from ProPublica, I think, you know, six, seven years ago about this algorithm

called Compass, which, you know, they were using first for pre-trial release and then some judges started using it for, you know, after the person was convicted to determine sentence. You know, like, and it became, you know, beyond what the company was selling it for. So there's definitely this idea that, you know, the services are going beyond even what their purposes is. And so, you know, Social Sentinel could have been a case of that, right? you could have had two guys who, you know, genuinely believed that, you know, like they were going to create AI that could help save students' lives and, you know, stop school shootings. And, but what we found is, you know, obviously it had this dual purpose, right? They were marketing it for suicides and shootings, but they were also, you know, marketing it for protests.

So it wasn't just universities going rogue. it was also, like, this was an explicit push by the company. And, you know, the experts I've talked to said that this is very often the case, you know, even with these sort of good intention systems that, you know, sometimes they can be used for nefarious purposes. And just the nature of machine learning is like you're scraping up so much data, right? You know, you're surfacing so much stuff. Like, you know, it's very hard to filter out like what's really actionable and what's not. even with the most sophisticated sort of machine learning systems that are out there today. Well, the unasked question here is, does it work?

None of this is worth it if it doesn't work. There's no bargain to be struck if there's nothing to be gained. And Ari was quite coy with me about that, because it sounds like it's the subject of his next story that he's still working on. We're going to publish a story pretty soon answering this question. But I think if you, you know, what I've been telling people is that, you know, if this is an AI service that's supposed to save, you know, people from shootings and suicides, I feel like you would get a lot more people saying publicly, you know, how great this tool was and how it stopped the shooting or suicide on my campus. And, you know, you don't really see a lot of that. So, you know, I think that is highly suggestive that this service may not be as a lot of. And, you know, you know, I think that is highly suggestive that this service may not be as a lot of. So, you know, effective as the company claims it is. I had like a question pyramid

and it's like should any version of this exist? Should this version of this exist and is this the company to do it? And I'll get philosophical though. Starting at the top, should any version of this exist? The privacy and like first amendment

minded side of me, my gut wants to say no. But theoretically, if there was some way to both preserve privacy while using openly available information to stop terrible things from happening, I couldn't say no to that deal outright. It's too much bad stuff to just say no, it's not worth it. If you could do that, we need to have that conversation.

Next tiered down, is this the version of it? Is this what it would look like? This being a keyword-based system operated by campus police, there seems to be a relatively high potential for abuse. I don't know what a better version of it is, but when a person can punch in, oh, this girl sure is making a ruckus about how a campus handled a rape case, better follow what she's doing across her social media and her email. I don't think that's it. And then my last question is, is this the company to do it? And that one's tough. Companies change. They get new leadership, reputations become out of date. But if the answer to that question is rooted as it is in my head in

trust. This company has spent a lot of energy saying publicly, this is not software to do X, while privately saying it's a great way to do X. And I don't think that's how you earn the trust necessary to be the company I want behind this kind of tool. Thanks for listening, everybody. Do I sound weird right now? Do I sound like I'm recording this on a laptop microphone? That is because I'm in a hotel room in Germany. I'm on the vacation we talked about last episode. I did help. edit this on the red eye flight here. So I hope everything is where it's supposed to be. Shout out to our new patrons on Patreon. Since the last episode, as Scott mentioned earlier, we really do appreciate you. Oliver Ashby and Eric Fargus. Thank you so much.

Patreon.com slash hacked podcast. Great way to support the show. Hope Tia enjoyed us getting all philosophical on this lap, this hour-long episode. We will catch you. on the next one.