The FBI Never Cracked a Password the Day They Took Silk Road

Former agent Chris Tarbell tells Lex Fridman how a timezone setting, a Gmail address, and an undercover admin brought down Ross Ulbricht — and why the best hackers are still out there.

CTChris TarbellInvité
Chaîne
Lex Fridman Podcast
Publié
22 nov. 2022
Vidéo
2:56:02
Lecture
27 min
Original
anglais
Ouvrir sur YouTube
En faisant défiler, la vidéo se réduit en bas à droite et continue. Les sous-titres suivent votre langue de lecture.
Langue de lectureDisponible en 2 langues
Cet article n’est pas encore disponible en français ; il s’affiche dans l’original en anglais.
RÉSUMÉ

En 30 secondes

Chris Tarbell, the former FBI cybercrime agent who arrested Ross Ulbricht of Silk Road and Hector Monsegur of LulzSec, walks Lex Fridman through two of the defining hunts of the early dark web. The case did not turn on breaking Tor or Bitcoin. It turned on a Jabber server left on Pacific time, a help-forum post signed ross.ulbricht@gmail.com, and a three-pronged raid that seized the operator, the coins, and the site at once. Along the way Tarbell talks about the ones who got away, the friend he made of a man he had hunted, and a digital world he still calls the Wild West.

  1. 1Tarbell is blunt about who actually gets caught. The technically elite operators are still free; law enforcement arrests the ones who leave a timezone, a diary, or a Gmail address lying around.
  2. 2People say they will not give up privacy, then post the inside of their house on Facebook and wear a watch that ships their heartbeat to a company. Tarbell argues most people already surrendered the thing they claim to protect.
  3. 3An IRS teammate simply Googled early Silk Road chatter and found a help-forum post from someone starting an onion site. The contact email was ross.ulbricht@gmail.com, posted under the name Frosty — the same name on a backup server in Philadelphia.
  4. 4During the investigation the team believed Ross had ordered six murders and paid in Bitcoin. The killings never happened, and the murder counts never went to trial, but Tarbell says that is where Ulbricht's mind had gone.
  5. 5AV Unit, the infrastructure operator for LulzSec, is the one that still keeps Tarbell up at nightEveryone else in the crew was caught. He still appears online from time to time.
  6. 6Nine months sitting beside Hector Monsegur changed how Tarbell saw defendants. Criminals, he came to believe, are human beings who took a wrong turn — except the child-exploitation offenders, for whom he says he has no place in his heart.
TRANSCRIPTION

Lire la transcription complète par chapitre

01

Silk Road sold almost everything except guns and fake degrees

Lex Fridman opens with the two hunts that made Chris Tarbell's name: Ross Ulbricht, the Dread Pirate Roberts who ran Silk Road, and Hector Monsegur, known as Sabu, of LulzSec and Anonymous. Tarbell, now a co-founder of the investigations firm Naxo and co-host of the podcast *The Hacker and the Fed*, starts where the public story starts. Silk Road was the first real dark-market website. You could buy heroin shipped from Afghanistan, hacking tools, hacks for hire, and murders for hire. Two things were off the menu. Guns lived on a different site. Fake degrees were banned, so nobody was going to become a doctor that way.

Internally, Tarbell still had to sell the case. FBI leadership saw Silk Road as a drug market, so he went looking for the worst listing he could find. He recalls a post offering baby parts: if you had a child who needed a liver, you could ask for a six-month-old one. He never saw anyone shopping for body parts to eat. He did, separately, interview a cannibal while at the Bureau, a story he files under the ones that actually unsettled him. The site's main business, he says, was drugs, and that is where it began: Ulbricht growing mushrooms in the California wilderness and selling them.

The ideology underneath was libertarian. You choose what to put in your own body. Anonymity came from Tor, the onion router built by the U.S. Navy in the mid-1990s and later released to the world; payments came from cryptocurrency. For cybercrime investigators, those two layers blocked the usual paths at once: you could not follow the IP, and you could not follow the cash. Ulbricht called himself captain of the boat and policed the listings. Guns came and went, then moved elsewhere. After the FBI copied the server, Tarbell read the chat logs. He does not remember big debates. There was a CEO, and the CEO's decision was final.

02

Tor still ends cases, and Tarbell will not pretend the privacy trade is clean

The path to Silk Road ran through another arrest. Jeremy Hammond, a hacker picked up for a second time, had used Tor, and that pointed the squad at a pattern. FBI case files kept dead-ending the same way: the lead hit Tor, and the file closed. After the Sabu takedown, old-school Bureau practice was to send a burned-out team home to see their families. Tarbell's group wanted the next hard problem. Other agencies were working Silk Road as a drug case, flipping buyers who had received packages in the mail. The buyers had never met their dealers. The New York cyber squad decided to treat it as a computer case instead.

Tor, Tarbell explains, has two jobs. One is hosting .onion sites that exist only inside the Tor Browser if you know the full address. The other is exiting onto the ordinary internet from a relay so a victim computer never sees the real IP. Even with a live circuit, rebuilding the path would mean visiting each machine in person, which he calls literally impossible. Asked how he feels about that as someone who spent years trying to protect people, he does not reach for a tidy answer. Part of his FBI time was child-exploitation work. Anything that makes that easier, he says, pisses him off, and that work jaded his view of Tor.

Should the tool disappear because some people use it for harm? No. He is a technologist and wants the technology to move forward. People will do bad things with whatever is built. On mass surveillance, he is equally unsentimental. There is no truth, he says, to the claim that NSA collection cracked Silk Road; if there were, he would probably not tell Lex. Nobody wants to give up privacy, and then they post photographs of the inside of their house and wear a watch that reports their heartbeat. Most people, in his view, do not actually need the protection they talk about. The case against mass surveillance is the one Lex presses: when you need to tell the government to go to hell, you should still be able to. Tarbell agrees. He also points at tech platforms that decide what you can say, and at moments when officials and companies appear to line up. Removing the president of the United States from those platforms, he says, is insane.

03

Operation Onion Peeler went after the network instead of one buyer

Rather than chase dead-end cases one at a time, the squad opened a case against Tor itself. They picked 26 .onion sites with a nexus to hacking: tools for sale, hackers for hire, the paid services that would later look like ransomware-as-a-service. Tarbell was on Cy2, New York's premier criminal cyber-intrusion squad. One of the small pleasures of starting an FBI case is naming it, and a surprising amount of time goes into the name. They landed on Onion Peeler: a little humor, a little respect for the thing they were trying to open. Silk Road was about sixth on the list. Everyone knew it was the golden ring. Taking that site down would make a splash, and part of enforcement, Tarbell says, is publicity that makes the next person think twice.

The technology behind the name is layered encryption. To reach a .onion address, a computer builds a path through publicly listed Tor relays, wrapping the data in a package the first hop can forward but cannot read. Each relay knows only the previous hop and the next one. By the time the circuit reaches the hidden service, even the destination knows only the last relay it spoke to. Peel the layers on the way back, wrap them again, and the sender stays hidden. Add enough hops and decryption is not merely hard. It becomes, in Tarbell's telling, mathematically impossible. The cost is speed. Tor is slow, and that slowness is still one of its biggest drawbacks.

04

They did not decrypt the onion. They sat down next to the operator.

Technical attacks on Tor exist in the literature — running huge numbers of relays you control is one idea someone tried — but Silk Road did not fall that way. Tarbell's partner Jared, a Homeland Security Investigations agent, worked his way up until he was a system administrator on the site. From the inside he was talking directly to DPR, Dread Pirate Roberts, a handle with no face attached. The technical clue that narrowed the map was almost mundane. The site's operators used a Jabber chat server, and Ross had left his timezone set to Pacific time. A default setting shrunk the search from a planet to the West Coast of the United States.

Lex calls that clumsy. Tarbell does not disagree. Ulbricht was not a serious computer person, and the gap between the site's ambition and his tradecraft is the point. "The real techy savvy ones we don't arrest," Tarbell says. "We don't get to them, we don't find them." He offers a shout-out to the skilled criminals who are probably watching the episode. The people in cuffs are the ones who can be caught. That is not a small confession from someone introduced as one of the most successful cybercrime agents of his era. It is the frame for everything that follows, including the name that still bothers him.

05

AV Unit got away, and Kayla was never a seventeen-year-old girl

On the Anonymous case, the name that still costs Tarbell sleep is AV Unit. Sabu and Kayla did the hacking. Topiary, in the north of England, handled media. AV Unit did the unglamorous work that makes a crew possible: stand up a VPN in Brazil, fetch a server, build the pipe. Tarbell caught everyone else. AV Unit still pops up online, and it still pisses him off. One of the first things Hector told him after the arrest was that AV Unit was a Secret Service agent. The lifestyle looked like shift work: around for days, then gone for three weeks. Tarbell was not sure he believed it. Early Hector might have been social-engineering his interrogator, planting the idea that law enforcement was already inside. At the time Tarbell was swimming in the deep end — hundreds of hacks, including some 350 against military institutions — and only later looked back and thought he could have had them all.

The Kayla story is the other reminder that nothing in that world is what it claims to be. Sabu was convinced Kayla was a seventeen-year-old girl. He had done his own linguistic analysis and, for a stretch, was almost in love. Kayla turned out to be a thirty-five-year-old man in England, the handle a twist on his sister's name. Crew members, Tarbell says, social-engineer the hell out of each other. If one of them ever gets arrested, the rest want a ready-made legend: a Brazilian ISP owner, someone too powerful and too far away to touch. Living as a cybercriminal means living inside that fiction, on offense and on defense.

Lex wants to interview someone who has not been caught — AV Unit, on the record as AV Unit — without that conversation becoming an arrest. Tarbell's technical advice is spare. Do not advertise it. Tell as few people as possible. Meet in person if you can, do not show the face, alter the recording, destroy the originals, and understand that the other party has to trust you completely. "You're not going to do it without a bag over your head," he says, then admits the line will be taken out of context. He is less sure Lex will get the honest conversation he wants. In Tarbell's interview rooms, the mix was usually lies and half-truths; the good ones can keep a story going for a long time, and you see the relief when the wall finally comes down. He does not object to the experiment. He would love to listen. He also does not want anyone to forget that the person across the table may still be creating real suffering.

The same man who hunted Sabu is now close friends with Hector. When Hector tells old stories, Tarbell hears himself on the other side of them. Then he listened to Lex's episode with Brett Johnson, a fraudster who stole from government welfare programs, and got angry. He cannot fully explain the difference. He did not know Hector at first. He knew Sabu. He hunted the handle, and over nine months he learned the person. Handles and human beings, in his experience, are not the same thing.

06

A Gmail address, a computer named Frosty, and $1.2 billion in Bitcoin

When they finally had the books, Silk Road looked like about $1.2 billion in sales, a number that takes a daily average because Bitcoin's price would not sit still. Everything ran in crypto. Buyers parked funds in escrow until the package arrived. There was chatter, toward the end, that a cartel was starting to sell on the site. Admins had to send Ross a driver's license or passport, which Tarbell still finds absurd: why send a real ID to a market that sells fake ones, and why would the man who profited from fake IDs believe you? Fast-forward, and every admin ID they found on Ross's computer was real. Ross had even bought fake IDs off his own site. Federal agents knocked on his door. He got cocky about it.

Tarbell cannot imagine lasting two days in that life. You cannot tell anyone what you do. He calls his wife ten or twelve times a day. Ross kept counting. The number was growing exponentially, and if he had stayed he might have been one of the richest people in the world. Tarbell is not sure Ross loved the money so much as the rising count; you cannot hold a Bitcoin the way you hold a briefcase. A journal on the laptop gave a little insight. Tarbell's unsolicited advice to criminals, which he insists is not a playbook, is simple: do not write things down, and do not film yourself committing crimes. Logs, from the other side of the glass, are how cases get made. The one time Hector's VPN dropped during a Fox hack — Hector says he was not even hacking, just clicking a link — a single IP address in ten million lines of logs was enough.

The .onion site itself was running on a server in Iceland. Conspiracy corners of the internet still blame the NSA for that discovery; Tarbell repeats that he would not tell Lex if they had. He flew to Iceland for Anonymous, then again for Silk Road, and started joking that all cybercrime routes through Reykjavík. Geothermal power is cheap, the air is cold, and the transatlantic backbone is right there. He loved the place enough to come back later with family and drive the ring road. On the server they found every chat Ross had ever kept, a Facebook of criminal activity. Keep the logs of a criminal enterprise, and you will eventually hand the government its evidence, including the drug weights that supported kingpin-style charges: enough employees, more than ten million dollars, the thresholds that look like a narcotics trafficking case out of Colombia. Ulbricht was sentenced to two life terms plus forty years. In the federal system there is no parole on a life sentence. The only door is a presidential pardon.

07

Snowden, in Tarbell's view, skipped the rules and gave away capabilities

Asked who gets out first, Ulbricht or Edward Snowden, Tarbell has no idea. Asked whether Snowden is a good person or a bad one, he does not hesitate: a bad person. There are lawful ways to be a whistleblower. Snowden did not follow them. Tarbell calls himself red, white, and blue, and he thinks the *results* of Snowden's actions were anti-American even if the inner motive is unknowable. Capabilities that were among the country's best were made public. On the offensive side of cybersecurity — not Tarbell's world, he is careful to say — the disclosures set the United States back. Lex tries to steel-man the other side: a check on government power, a flag for whistleblowers. Tarbell can see the argument. He spent years as a government man and still does not think of himself as a big-government type. The objection is the extra material. Snowden, in this telling, revealed more than he needed to reveal in order to make the surveillance point.

That the government can collect at scale still shocks people, which itself surprises Tarbell. The Snowden leaks included NSA employees who had used the apparatus to look at girlfriends; those people, he says, should be punished. The other picture he reaches for is a terrorism case in which "birthday cakes" was the tripwire for a plot against the New York subway. He had to write fifty-page documents explaining how he arrested someone, which is a check on his own power and also a manual that defendants read in order to change their methods. Tell the public exactly how you surveil, and the next plot goes a different way. Tech companies, meanwhile, monitor everything and monetize it. The balance is real, and he does not pretend it is easy.

08

They seized the operator, the coins, and the site — and left the murder counts behind

The Iceland chats were more than heroin tallies. They mapped infrastructure. The onion address ran on a server in France and reached Iceland through a back-channel VPN. A separate Bitcoin vault, also in Iceland, kept other admins away from the money; only Ross could touch it. Backups sat in a data center in Philadelphia. Putting your criminal infrastructure in the United States is, Tarbell says, another of those mistakes competent people would not make. Jared's own Silk Road case had started years earlier with a strange package at O'Hare. An IRS agent on the team used a tool Tarbell describes with a straight face as Google. Early posts on help forums from someone spinning up an onion site, asking for cryptocurrency advice, listed a contact: ross.ulbricht@gmail.com, under the name Frosty. The computer logging into the Philadelphia backups was also named Frosty. After that, the rest was surveillance: a house in San Francisco, Tor traffic on the home connection at the same moments DPR was online.

Tarbell knew the case was big. They flew him to Washington to brief the director. The president was going to announce the arrest. Then the government shut down two days before, and the document that went public was the affidavit with Tarbell's signature at the bottom. That, he says, is the only reason anyone learned his name. The takedown was three-pronged: get Ross, get the Bitcoins, seize the site and throw up a banner so nobody else could take the wheel. His claimed superpower is putting people smarter than he is on the right jobs. A specialist in Iceland pulled live data out of memory after a colleague in France could not. Ross, it turned out, had dictatorial control. His diary talked about walking away. He could not actually hand the site to anyone else.

People still argue there were never murders on Silk Road. During the investigation, Tarbell's team believed there were six. Someone stole from Ross; the last discussion Tarbell describes is a target with three roommates, and the instruction to kill them too. The murder counts never went forward. A longer-running Baltimore case, a deconfliction meeting in D.C., and a lot of talk about "sweat equity" got in the way. The other team wanted the Iceland data handed over. They sent a picture of the man they thought was Ross. It was an internet meme. Tarbell's regret is not that the drug case moved first. It is that the public shrugs off the fact that Ulbricht paid large amounts of Bitcoin to have people killed, received after-action reports, and believed the jobs were done. Nobody died. Tarbell thanks God for that. He still thinks that is where Ross's mind was.

At sentencing a father stood up and talked about a son who had died after buying drugs on the site, in the window between the moment the FBI could have pulled the plug and the day of the arrest. Tarbell still thinks about that father. He understands the argument that mail-order drugs keep people off street corners. Personally he does not believe legalizing heroin and cocaine would make a better world, and he is satisfied if he made it harder for his own children to get them. Taking Silk Road down, he now thinks, was also an advertisement. Thousands of users became millions of people who had heard of Tor. He thought crypto would crash. He thought two life sentences would scare the copycats. Dark markets exploded instead, some of them just there to steal the escrow. FBI management, he says, would never have had the appetite to leave the site up as a fishing pond. Too many fathers, and at the time they still believed six people were in the ground.

The arrest itself is the part Tarbell wants remembered as human. He does not put the cuffs on. After the search for weapons he puts a hand on the person's chest, feels the heart, and tries to be a conduit rather than a hard-ass. They took Ross to the San Francisco jail after hours. Tarbell had not slept in about four days, bouncing between Iceland, Washington, and New York, and still went out that night to buy him breakfast — granola bars, in his telling — before the morning booking. Ross asked for a lawyer, which ended any case talk. In the car on the way to jail he offered Tarbell twenty million dollars to let him go. Tarbell asked what they were supposed to do with the agent in the front seat. Bitcoin had gone from pennies to about $120; 177,000 coins, even then, was a fortune. They have not spoken since. Tarbell thinks Ross is in Arizona. He would take a conversation. He doubts Ross wants one.

09

The FBI's job is the statute, even when the statute feels smaller than the ethics

Lex brings up Aaron Swartz, who bulk-downloaded paywalled academic papers, faced a harsh computer-hacking case, and died by suicide. In Lex's circle he is a hero: the journals add little and hold scientific work hostage. Tarbell calls it a tough case with a tragic ending. In law enforcement, he says, the job is to enforce the laws you have. If a victim comes forward and the facts fit 18 U.S.C. 1030, you bring the case to the U.S. Attorney's office. He never felt he had the street-cop's flexibility to issue a warning and walk away. He can put a hand on a prisoner's chest and still refuse to sit as the jury of whether a hack was a good hack or a bad one. He agrees that the internet was born to share academic thought. That is not, in his account, the FBI agent's decision to make.

The same logic, awkwardly, is how he talks about the Mar-a-Lago search. The Bureau, he says, has a limited belt of tools, and a search warrant is the only lawful way into those documents. He thinks the FBI has taken a lot of black eyes, and he is not sure it is the same place he remembers. Asked about agents conspiring to undermine Donald Trump, he says that when he was inside he did not believe in those conspiracies: too many people, someone would talk. Watching agents get dismissed for politically motivated actions has surprised him. He hopes there is no quiet pressure from the top that tilts a culture. He also notes he was a low-level case agent who never wanted to be a boss. The puzzle was the point. Managing people was not.

Mark Zuckerberg's account of the FBI warning Facebook about foreign interference — and Facebook treating the Hunter Biden laptop story as the thing being flagged — is another story Tarbell would not have believed from the inside. The charitable reading is a liaison telling a huge platform to watch for shady viral activity. It sounded, to him, like there might have been a wink. Some of that may just be culture: people with the same political lean talking to each other, plus a revolving door. He knows Bureau people who went to Facebook, including a strong agent who later ran child-exploitation work there. FBI pay caps out. Wanting to please a future employer is a real temptation. Lex and Tarbell turn that into a longer talk about bubbles, from pharmaceutical companies to the way ordinary people can talk themselves into thinking they are doing good. Tarbell has his own version of that scar tissue. Child-exploitation cases, including parents who rented out infants, put him in a funk he never took to a counselor, because in the FBI you keep the machismo up or they take your gun.

10

LulzSec hacked for the lulz, then Tarbell sat beside Sabu for nine months

Anonymous, Tarbell says, still calls itself headless. Look a little way in and it is not. Power belongs to whoever can hack, or whoever owns a botnet big enough to DDoS. The hacktivist wave of 2010 collided with HBGary Federal, whose CEO, Aaron Barr, planned to go to a conference and unmask Anonymous based on when people were in IRC and when tweets went out, without what Tarbell considers scientific backing. Anonymous hacked the firm, took Barr's Twitter account, and turned his life over. At the time Tarbell had no room to admire the "fuck you to the man." It was 18 U.S.C. 1030, and it was his job. In retrospect, sure. The philosophy they advertised was going after the corrupt. On the inside, he says, they went after whoever they had an opportunity to hit, including, once, a toilet paper company he still does not understand. From the HBGary work, six people who collaborated well peeled off into private channels and became LulzSec — "laughing at your security." Kayla and Sabu were the hackers. What followed was fifty days of lulz, huge breaches, hundreds of thousands of Twitter followers, and then Fuck FBI Fridays. The Bureau waited every Friday to see what would drop. Looking back, Tarbell calls it a little embarrassing.

Anyone can hang out in Anonymous. Cred comes later, when someone vouches. Lex worries about the slippery slope of the lulz: fun that loses its ethical floor, language that turns everything into a joke, until you cannot tell right from wrong and someone is still the butt of it. Tarbell adds the victims. Dumping personal identifying information is a laugh until you are the person who would rather not have it published. By then the channel had as many reporters as hackers, people hunting an inside scoop. They arrested a journalist who handed over his newspaper's username and password so he could break a story. Trust, in that world, is a bad habit.

The hunt for Sabu started in the spring of 2011. LulzSec was in the news every day and had been pushed out to all fifty-six FBI field offices, but New York did not have many victims in its area. Then a tip came in that a local hacker had broken into AOL. Tarbell and Olivia Olson, now a supervisor in Los Angeles, left a card at a grandmother's house on Staten Island. The kid called, met them at the McDonald's across from 26 Federal Plaza, confessed to felonies, and then said he could give them Sabu. Maybe he knew Sabu in real life. In ten million IP addresses they found one that belonged to Hector. Someone had also doxxed Sabu, and they were afraid he would run. FBI surveillance teams, Tarbell says, are as good as the movies: baby strollers and people who fit the block. The cyber squad raced to a sixth-floor walk-up. Tarbell was in shorts, a white T-shirt, and a vest — Sabu still makes fun of the outfit. They took the stairs because they had been stuck in an elevator on a previous search. A tall man cracked the door, saw the yellow letters, and tried to social-engineer them. There was a laptop charger and a blinking modem. He said there was no computer. About two hours later he admitted he was Sabu.

Other agents around the country called Tarbell in the car to say they had the wrong guy. Tarbell said he did not think so, because the man in the back seat said he was Sabu. Had Hector fought the case, those calls would have been disclosed. He was looking at a stack of charges that added up to 125 years if stacked consecutively, more like under twenty-five in the real world. He chose to work with them. Informant is a clumsy word here: he did not know the others' names, only nicks, but he was an old-school hacker, Cult of the Dead Cow vintage, and he gave the Bureau a guided tour of that world. After nine months a judge thanked him for his service and he walked out a free man. The other five LulzSec members, overseas, got what Tarbell calls slaps on the wrist and went back to college. Sabu, Tarbell says, was a ruthless motherfucker. Hector is a sweet guy who would rather have a one-on-one intellectual conversation. They are, in his telling, two different people, and sitting with the second one for nine months is the thing that humanized the work.

11

Someone put his children's names on a hit list, and most people still reuse a password

After Silk Road, Jared called from Chicago. Tarbell's name and his kids' names were on a site offering an assassination. These listings appear on black markets whether or not they are real; the Bureau has to treat them as real. He and his wife had a one-time code word. He used it. An agent named Evelina drove him lights-and-sirens to the school, which they had asked to lock down. The first thing the school did was let a man with a gun into the building. Kindergarten and fifth grade, a safe house, NYPD around the block, cameras, license-plate readers, an iPad feed of his own front door. His mother-in-law's line was that she thought he did cybercrime. He had not told his family he was working Silk Road. For a stretch the best ten minutes of his day were the 4:30 a.m. drive to the gym, listening to a sports podcast and not thinking about the case. He left the Bureau MP5 at home and showed his wife how to pull and spray. Physical fear, he says, was really only that episode. After Anonymous he tightened the digital side: no social media, no photos of the kids online, no wedding pictures if they might be posted. Convenience still eats security, even for him.

Most people in cybercrime, he thinks, are opportunistic rather than evil. They do not picture the victim. The United States, for all the arguments in this conversation, is still a hard place to be a criminal and a relatively safe place to walk out your front door. State-sponsored probing is another category: more than you can imagine. Put a Windows 7 machine on the internet with a packet sniffer, and in twenty-four hours you will fill a drive. NASA used to be the golden ring in the 1990s. MIT, Lex says, now draws the same kind of trophy traffic. Tarbell's advice to companies starts with a refusal. There is no push-button product that makes you secure. Anyone selling a single solution for every shop is a snake-oil salesman. Tools that are not configured add pain and not much protection. Mid-size firms bury security inside IT, and IT's job is to keep the business moving. Security's job is often to say no. Simple controls do more than new boxes: onboard people without handing them the whole network, kill vendor credentials when the contract ends, turn on two-factor. Tarbell was himself a victim of the OPM breach. Old credentials from a third-party vendor were still live. The Chinese government used them.

Two-factor exists, he argues, because people still reuse passwords. Credential stuffing — taking a leaked username and password and trying it everywhere — is the everyday attack. Ask.fm had just popped, in his telling, with some 350 million credentials tied to other social accounts, a dossier factory for years. The Ring camera hack was stuffing, not some elegant break: two-factor off by default, unlimited login tries, because convenience sells hardware. For households he sounds like a broken record on purpose. Know you are a target. Stand up a guest Wi-Fi you can rotate. Use a password manager. Stop using the same secret everywhere. He once made his parents switch banks over rotten security. Zero-days are mostly out of a user's hands. One-days are not: if you do not patch, attackers can Google-dork their way to a list of machines still running the broken software. Physical access is cheaper than people think. A USB keylogger that sits between a mouse and a computer costs about forty dollars on a black market. One executive Tarbell's partner knew refused to log into a computer at all, so the company hired a person to stand next to it. That, at least, is taking the problem seriously.

12

If a global war starts, Tarbell thinks it starts in cyberspace

There is no forever-most-secure operating system. Macs used to look safer because fewer people had them; that era is over. Tarbell's advice is to take whatever you can actually run a business on and secure the hell out of it. He left government, pulled the people he trusted with him, and was about to launch Naxo the week of the taping. The biggest insider threat in his own house is his children. His son will download Minecraft executables without thinking, so the kids live on a segmented network, the same pattern businesses have used for years. With Hector he had just started *The Hacker and the Fed*; the first episode did about 1,300 downloads in a day and hit the top of Hacker News. Their producer pulled a line out of him that still sounds strange in his mouth: he arrested one of his closest friends. Hector says Tarbell changed his life, pulled him off a dark path, and he now does penetration testing and tells kids not to repeat his mistakes.

Does he worry about cyber war in this century? Absolutely. If there is a global war, he thinks it starts with cyber, if it has not already. Ukraine, a more involved United States, China watching — he does not want to fear-monger, and he hopes smarter people than he is are talking to the right people, but some of the flags look strange. Lex is more worried about panic than about the technical hit: a public that does not know it is already under constant attack will treat the first dramatic incident as a new universe. Tarbell notes that in 2011 LulzSec had access to the water-supply system of a major American city and sat on it. He does not think the picture has gotten much better. Nation-states, he says, are sitting on quiet access, a hundred percent. Attribution after a cyber-triggered explosion would be ugly. The attackers may not claim it. The government on the receiving end can blame almost anyone, and verification is weak. Lex is being tracked, Tarbell says, by big tech if not by the government, and yes, there is an FBI file.

Looking back at forty-four, the professional regret is still AV Unit. The human education was Hector. It took sitting with him for nine months to learn that criminals are not a separate species. Tarbell thinks that is why he had more compassion in the library of Ross's arrest than he would have had earlier. Ninety-nine percent of the people he locked up had a capacity for good. The child-exploitation offenders are the exception. For students he has a labor-market pitch: an $18 billion cyber budget in the then-current U.S. plan, and the industry is about a million people short. It also wants ten years of experience from a new graduate, which he thinks has to change. For personal conduct the advice is colder. New York had begun asking for social media in some gun-license processes. Things follow you. Do not put ross.ulbricht@gmail.com on a help forum. Do not treat a public stream like a private chat with friends. Figure out what you actually stand for before the lulz writes it down for you.

He loved the FBI. He expected to retire with the gold badge in Lucite. That the Bureau is now distrusted and even hated, by some people, kills him. He has even been embarrassed by it, which is hard to say about a place he still loves for the squad-level brotherhood — a social world that also gave him a drinking problem. Walking out of Quantico with a gun and a badge was, he still thinks, pretty cool. The rules can be rigid in the wrong places: a teammate had to leave because his wife matched into a Houston residency and the Bureau would not transfer him. Tarbell grew up in Virginia with a father who was a disabled veteran in a wheelchair, an engineer who had flown helicopters along power lines and scuba-dived dams until he could not walk. The man died in a hospital alone as COVID was starting, not of COVID, and Tarbell never got to tell him the Silk Road stories he had always wanted. Two days before the taping, his mother relayed a wish that maybe in heaven he could tell them. He stood in the shower and sobbed. Love, he tells Lex after all the grief about Lex talking about love, is the greatest thing. He did not know what it was until his son was born. When he was young, arrests were stats. It took a long time, and a man he had hunted, to see the humanity on the other side of the cuffs.

Sur la même chaîne

3:36:56EN
Lex Fridman· 16 sept. 2026PodcastPsychiatry Has Never Found Its PenicillinAnime : Lex FridmanHistorian Andrew Scull tells Lex Fridman why the field can ease symptoms, has never cured a major mental illness, and keeps paying for overconfidence with patients' lives.Mental HealthPublic HealthNeuroscience
5:15:51EN
Lex Fridman· 26 août 2026Podcast · 2 voixDHH Did Not Write a Line of Omarchy QuattroInvité : DHH · Anime : Lex FridmanThirteen months after a skeptical conversation with Lex Fridman, the Rails creator describes how Opus 4.5, a swarm of coding agents, and a one-minute Linux installer ended his era of hand-chiseled Ruby.Agents de codeVibe CodingIngénierie d’agents+3
3:12:58EN
Lex Fridman· 12 août 2026Podcast · 2 voixOne Cold Shower, Twenty Champions: How Khabib Nurmagomedov Was ForgedInvité : Khabib Nurmagomedov · Anime : Lex FridmanIn a Makhachkala school gym, seventy men shared one shower, and the water was only cold.Martial ArtsCombat SportsCoaching+3
3:46:18EN
Lex Fridman· 28 juil. 2026Podcast · 2 voixIf You Take Slavery Out of the Picture, There Is No Civil WarInvité : Gary Gallagher · Anime : Lex FridmanIn 1860, enslaved people were worth more than every railroad and factory in the United States combined.Political PhilosophyLeadershipHistory
3:51:47EN
Lex Fridman· 30 juin 2026Podcast · 2 voixForty-Six Percent of Emperors Were Overthrown. The Empire Lasted AnywayInvité : Anthony Kaldellis · Anime : Lex FridmanHistorian Anthony Kaldellis walks Lex Fridman through 2,200 years of Roman history and argues that what we call Byzantium was Rome itself.Political PhilosophyGeopoliticsLeadership
2:53:42EN
Lex Fridman· 29 mai 2026Podcast · 2 voixThe Moon Is Falling. It Just Keeps Missing.Invité : Biggest Mysteries in Physics · Anime : Lex FridmanFermilab physicist Don Lincoln tells Lex Fridman that the history of physics is a history of unification, and that antimatter, dark energy, and a theory of everything still sit far beyond the experiments we can run.Quantum MechanicsScience CommunicationPhilosophy of Science