The Original Internet Godfather Built Trust Among Cybercriminals

Brett Johnson tells Lex Fridman he had been on the run for four months and stolen about $600,000 when he woke up in Las Vegas. The night before, he says, he had taken $160,000 out of ATMs. He signed on to cardersmarket.com, a site then run by Max Butler, known as the Iceman, and saw his real name with US Most Wanted beside it. In that world nobody had known his real name. They did now, and the post tied him to the Secret Service operation AnglerPhish.

Fridman introduces him as the builder of ShadowCrew, the first organized cybercrime community and a precursor to today's darknet markets. The United States Secret Service later called him the original internet godfather. He was placed on the most-wanted list in 2006, convicted of 39 felonies, escaped from prison, served his time, and now talks about how the crimes worked. Fridman says he will try to empathize without letting guests sugarcoat what they did, because each of us has the capacity to become both predator and prey.

Asked how the career began, Johnson does not start with a keyboard. He was ten, from eastern Kentucky, a place he compares to parts of Texas and Louisiana: if you did not have a job, you might have a scam. His mother, still alive at the time of the taping, was in his telling the captain of the local fraud industry. She stole a 108,000-pound Caterpillar D9 bulldozer and trammed it down the road, staged a slip-and-fall in a convenience store, and pimped a neighbor named Debbie. Johnson laughs that she had an entrepreneurial spirit, something he says he still sees in cybercriminals.

There was no single motive, he says. His mother tested people: how far could she abuse you and still have you come back and love her. She beat Brett and his sister Denise with belt buckles in a single-wide trailer until Denise kicked her through a closet and said she was through hitting them. His father, Ray, was a good man who forgot he was one. He had principles, but he was so afraid of her leaving that he put up with crime, cheating, and men brought home in front of him. When Brett was seven or eight, Ray filed for divorce; she put a knife to his throat, then cried, went to the bathroom, and pretended to slit her wrists so he would attend to that instead of the knife.

After she left Ray, she parked the children with grandparents who rationed bathwater and killed the power if the television made a sound after bedtime. She would vanish for days. Denise, nine, walked in with a pack of pork chops and said she had stolen them. Brett asked her to show him how. They graduated to sandwiches by lifting a hoodie from Kmart, stripping the tags, and stuffing a loaf of bread down the sleeve so it would not get mashed. He was already watching how his parents solved problems. When their mother found the stolen Atari and the rest, she did not stop them. She joined, recruited her own mother, and ran the kids as decoys.

He is adamant that adults own their choices, but he will not pretend childhood did not write on the slate. He did not meet a decent person until he was sixteen. At fifteen, after his father in Florida told him a new marriage meant Brett was staying in Hazard, he walked into a hospital elevator, saw a woman who looked like his mother, and beat her. He knocked down a security guard whose son he had played basketball with, spent three months in solitary in a county jail that had no juvenile wing, and pleaded guilty to first-degree assault. The judge gave him time served and a psychological evaluation in Louisville. Counseling was ordered. His mother said he did not need it. He never went.

Kids at M.C. Napier blocked him at the door. Hazard High would take Denise but not him. A country school fifteen miles away took him in. On the first day he handed papers to Carol Combs, his homeroom English teacher. She heard the voice, looked up, and asked if he had ever done drama. He wanted the academic team. She ran both, so the deal was theater in exchange for a seat on the squad. Under her he became captain and, in his telling, a scourge across eastern Kentucky counties. When his old school showed up, their captain asked if they had that Johnson boy. Combs said that Johnson boy was the team.

His senior year he won best actor and best actress in the state, the only male to do both, then turned the scholarships down because he was scared to leave. Community college brought a California director who invited Edward Emanuel, writer of *3 Ninjas*, down to see a Civil War piece in which Johnson played about eighteen roles. Emanuel offered a San Jose State scholarship: big fish, bigger pond. Two weeks later he drove to the house, went inside for fifteen minutes, and walked out white, silent, and gone. Johnson later learned his mother had pulled a knife and told the man she would kill him before he stole her son. That, he says, broke his spirit. He went full-time into scams, including unpermitted coal pits hauled out at two in the morning.

He still loves his mother and has not spoken to her in about two years. The ultimatum was that she admit the abuse, take responsibility, and be able to talk about it. She spent a year calling to curse him and his wife, then went quiet. Denise had already cut contact for a decade, after drinking and a suicide attempt he had not known about. She once said she always thought someone would come save them. His unthinking reply was that he knew no one ever would. That, he thinks, is where their paths split. She became a teacher and a good, angry parent. He kept going. His wife later told him it was the eastern Kentucky male script: he stepped into the crimes so Denise would not have to.

Fridman reads Johnson's own inventory: thousands of dollars in coins from a family trying to reroof a house, a counterfeit cashier's check that got a victim arrested, lies to everyone he knew. A Ukrainian associate called Script posted photos of a man kidnapped and tortured over a debt. Max Butler flooded enemies' inboxes with child pornography and then called the police. Johnson's confession is blunt. He did not care about the victims. He cared about himself. The coin woman came late, after ShadowCrew had already made the cover of *Forbes* in August 2004 and the Secret Service had arrested 33 people in six countries in six hours on October 26. He was the one publicly named as having gotten away. He needed cash, so he talked a single mother into shipping 80 or 90 pounds of silver coins collect-on-delivery against a fake cashier's check. She told him the money was for a roof. He did not give a damn.

He became a social engineer as a child, he says, because the adults were unpredictable and survival meant reading them and bending them. The expert criminals he has known learned the same tool young and later pointed it at strangers. Fridman notes the paradox: you need extreme empathy to know what someone is thinking, and you need not to care about the pain once you use it. Johnson argues that is not sociopathy so much as justification. He told himself he was doing it for family, for a wife, for a stripper girlfriend, and he believed those stories. Online, trust is laid down first with spoofed numbers, browser fingerprints, and domains, then with a story that makes the victim act on emotion. A lot of the time you are not inventing a plot. You are feeding what the person already wants to believe, and you have seconds to see what is driving them.

His crew was among the first to phish. Nobody had seen those emails, so a message could harvest a full identity file, not just a password. They took about 200,000 E-Trade accounts, logins, Social Security numbers, birth dates, mother's maiden names. For four to six months they ACH'd the money out because E-Trade had no real controls. When withdrawals were locked, they still sat on the accounts. The next move was to find a retiree in blue chips, open a fresh account in a penny stock, dump the retiree into the same stock, and pump it. They wrecked retirement accounts for a few thousand dollars. E-Trade's stance, he says, was that it was not the firm's problem: the customer had given up the password. He still sees the same posture in Zelle scams. Business email compromise is the grown-up version: spear-phish a CEO to read the payroll thread, clone the tone, swap in a Unicode lookalike domain, and tell payroll the account has changed. Large organizations are easier because responsibility is already distributed.

Cybercrime, Johnson insists, is not technically sophisticated. The statistic he repeats is that 90 percent of attacks use a known exploit. Zero-days exist, but a criminal waiting on one to profit will starve. The sophistication sits in the social engineering and in lining the pieces up. Fridman asks about a ransomware hit on a QNAP device, and about the habit of blaming the vendor. Johnson does not agree that incompetence is the crime. He has a 130-page class-action file at home cataloging how SolarWinds, in his reading, lied for years about vulnerabilities and waved off auditors. His view is still that only the attackers are responsible for the crime. Being an idiot is not a crime. Being criminally negligent can be, and he thinks SolarWinds is culpable even if it is not the thief.

SolarWinds, he explains, sat under the security stack of hundreds or thousands of companies, including other security firms, and offered a snapshot of whole environments. A Russian group got in and could see every client: IPs, mail, communications, secrets, and, where Microsoft software was in play, source code. He calls it a nightmare you do not recover from. The delayed harm is that attackers can now walk the source line by line looking for new zero-days, which opens a threat surface that used to be rare. He lists Iran, North Korea, China, and Russia as the big four, with Brazil and others interested too. Russia, he says, is good at working with criminals like the ones he used to be: take the intelligence, let them sell the rest. China wants intellectual property. North Korea steals money, including a great deal of Bitcoin, because it has few other options, and the operators are very skilled.

What actually terrifies him is a line he used to preach on ShadowCrew: the perception of truth matters more than the truth. Deepfakes and fake news scare him more than another software hole, because people need some trust in order to live with one another. Fridman offers a softer frame, a blockchain-style consensus instead of a single scroll of facts. Johnson likes the destination and then the conversation turns back to how he got there. The origin story of ShadowCrew, he says, starts with love.

He faked a car accident to pay for a wedding. He had bought a Chevy Spectrum at auction for about $500. His cousin Ronnie had a tooth pulled that day with no anesthetic and no stitches so the blood would look right, then they ran the car over a hillside after pretending to visit Johnson's mother. Insurance paid. He had met Susan at community college, married her in six months, and taken three 18-hour shifts at Lexmark so she would not have to work. Love, for him, meant expensive gifts and control: he would cook, clean, and carry a 60-hour job plus an 18-hour class load. Something had to give. He quit and went back to telemarketing fraud, selling cemetery plots, Shriners tickets, then Kiwanis food baskets from a stolen phone list until he knocked on a cop's door. Three months in county jail for theft by deception sent the couple back to Hazard, where her parents had an HP desktop and he found eBay.

Low-level bad checks on out-of-state stereos came first. Then one night *Inside Edition* profiled Peanut, a royal-blue elephant Beanie Baby selling for $1,500. He skipped class, failed to find one in Kentucky Hallmark stores, bought an $8 gray elephant, and tried Rit dye. Polyester came out of the bath looking like it had mange. So he posted a photo of a real Peanut, won a bid from a woman, and immediately put her on the defensive: they had never done business, he was not sure he could trust her, she should buy two U.S. Postal money orders totaling $1,500 to protect them both. She asked no questions. He cashed the orders, mailed the mangy creature, and when she called he told her she had ordered a blue elephant and he had sent a bluish one. She kept calling. He learned the first lesson most cybercriminals learn: delay a victim long enough and many get exasperated, walk away, and never complain to anyone.

He lists the reasons they swallow it: exhaustion, embarrassment from a culture that asks why you clicked the link, and a maze of jurisdiction. Local police send you to the feds; the dollar amount is too small; the feds send you local; Kentucky wants you to come in from another state. He kept going, learned to hide identity, sold pirated Sega Saturn and PlayStation discs, installed mod chips, then cable boxes, then programmed RCA satellite DSS cards. A Canadian judge ruled that citizens there could pirate the signal because RCA did not sell the systems in Canada. PayPal arrived at the same time. Overnight, a cottage industry bought $100 Best Buy kits, dumped the hardware in the parking lot, programmed the card, and shipped it to Canada for $500. He made $3,000 to $4,000 a week, then asked why he needed to fill any of the orders. Canadians were not going to complain. PayPal had no idea how to secure itself. Money hit bank accounts in his own name at $4,000 to $6,000 a week, and he got scared enough to want a fake license and an ATM cash-out under someone else's identity. ShadowCrew's later first principle, he says, was that all crime should begin with identity theft.

He did not know where to buy a fake license. After two weeks he found a site run by someone calling himself Fake ID Man, complete with reviews, sent $200 and a photo, and got ripped off. That was the trust trick turned on him. The only criminal hangout then was IRC, a scrolling chat full of people you could not verify. He landed on Counterfeit Library, a degree-mill site with an unused forum, and started posting daily about the ripoff. Two others showed up: Mr. X in Los Angeles and Beelzebub in Moose Jaw, Saskatchewan. After weeks of arguing, Beelzebub got him on ICQ and said he could make a license. Johnson did not want to pay. Beelzebub told him that in this business you have to trust people or you fail: $200, and the card would actually be sent. Two weeks later a Ohio license arrived in the name of Steven Schwake, a real person who Johnson says still worked at ADP. At the time it was the prettiest thing he had ever seen. Looking back, it was only decent.

Beelzebub was right about trust. Successful cybercrime, Johnson says, has three necessities that have to work together: gathering data, committing the crime, and cashing out. One person almost never does all three. Data vendors sell personal information, card numbers, spoofed phones, and remote desktops, but often cannot write the cash-out or launder the proceeds. Geography and skill split the work, so you have to rely on people who are strong where you are weak. Counterfeit Library had a couple of thousand members doing eBay, PayPal, and papers. Johnson became the only reviewer, because he sold nothing and a good review made other vendors rich. Then Dmitry Golubov, a Ukrainian spammer, wondered whether people would buy stolen card details, convened about 150 criminals in Odessa, and launched CarderPlanet, which Johnson calls the genesis of modern credit-card theft. Eastern Europe was so burned that even legitimate cards would not cash. Golubov had data and could commit the crime. He could not put cash in a pocket.

A Ukrainian who went by Script posted on the public forum: give me an address and a burner, wait five business days, order whatever you want. Members assumed he was a cop. Johnson was the reviewer, and he was scared. The first test, $5,000 at Dell, failed. Script asked for one more chance. The second try, $4,000 at Thompson's Computer Warehouse and $5,000 at Dell, landed. Johnson posted the review, and overnight the site ceased to be an eBay-and-PayPal hangout and became a carding forum. Card-not-present fraud, for an experienced thief, paid $30,000 to $40,000 a month buying laptops and flipping them. Script and people like Roman Vega also sold counterfeit physical cards. Johnson sat at the top of the heap after Beelzebub went back to growing pot and Mr. X was arrested cashing out at casinos. If he reviewed you, you made money. If he did not, you did not do business there.

A magnetic stripe has three tracks. Track one is the name, which appears on the cashier's screen. Track two is the dump: card number, a slash, and a 16-digit algorithm, the only data sent out for verification. Track three is unused. The working trick was to encode ten different dumps on ten cards and put the same fake-license name on every track one, so ID matched the screen while the bank saw a different number. Then the Ukrainians found that no bank had implemented the hash on track two. Any sixteen digits after the slash would encode. With a real PIN from phishing, that card worked at an ATM. They called it a CVV1 breach. Card-not-present profits of $30,000 to $40,000 a month became $30,000 to $40,000 a day. The Ukrainians still could not cash out, so Americans took 40 percent and wired the rest by Western Union, then prepaid cards, then e-gold and Liberty Reserve, and eventually crypto. Law enforcement IPs started showing up unshielded. A T-Mobile insider who had leaked Paris Hilton's contacts also dumped Los Angeles Secret Service texts about the ShadowCrew investigation onto the forum. Johnson, at the top of the pile, thought this was not going to end well.

He moved through databases: the Indiana sex-offender registry for bank accounts, the Texas driver's-license file for IDs, then the California Death Index, complete with maiden names, Social Security numbers, and dates of birth. Federal death records, he learned, did not reference state indexes. Before 1998 a family had to file for a $219 death benefit before Washington knew you were gone; after that hospitals and funeral homes could file, but many still did not. Social Security benefits required an in-person interview he could not pass at 32. Tax refunds did. The IRS, then and now in his telling, issues a refund before it verifies that the taxpayer worked for the employer. He kept each return around $3,000, filed one every six minutes by hand, ten hours a day, three days a week, changing IPs and addresses as he went. Day four he mapped ATMs. Days five and six he cashed out. A backpack held $150,000 in twenties; each twenty weighs a gram, which is how federal agents weigh a pallet of cash. He did that for ten months at $160,000 a week, then had to learn to launder because the spare bedroom was filling up.

Laundering meant cash businesses, a production company, detailing shops, thoughts of food trucks, then hops through U.S., Mexican, and Canadian accounts toward a final nest in Estonia. After the Patriot Act, suspicious-activity reports kicked in at $2,500 instead of $10,000, so he multiplied accounts and prepaid cards with ACH. He was arrested on February 8, 2005. The last seizure notice arrived in 2010. Violence arrived with the money. ShadowCrew's house rules had been no child porn, no counterfeit currency, no drugs; only the first was really kept, and even that had Max Butler's exception. Script, rich enough to buy estates he liked on country drives and tied through family to Ukrainian organized crime, posted a photo narrative of a man rammed into a van and tortured. Johnson's first thought was that it was theater. His second was that it was real. He jokes with his wife about hammers and toes and 8,000 bitcoin, then admits that with that much money he might have been persuadable. Ross Ulbricht, he says, was not a violent man, but sitting on $24 million in bitcoin he thought he had hired hit men. Johnson sorts motives as status, cash, and ideology. His people were all cash. Ulbricht was ideology, and ideological operators, including the man who later ran Silk Road 2, are much harder to stop.

What ShadowCrew really left behind, Johnson says, was a trust mechanism: forums you could search weeks later, vouching, reviews, escrow, a screen name that meant something. Instant information about the craft sat next to that trust, and both are still in play. Two later inventions changed the setting. The Tor browser, built by the U.S. Navy so operatives could talk without being identified, is still funded first by the military; it went open source, the Electronic Frontier Foundation sponsored it, and the public story became firewalls and whistleblowers. Someone forgot that the first adopters of anonymous, money-moving tech are criminals. In 2005 and early 2006, while Johnson was already ripping off the Secret Service, a memo warned them about Tor. They fired it up and found it unusable, because almost nobody was on it yet and it was extremely slow. Years later Satoshi Nakamoto proposed Bitcoin and Ross Ulbricht ran with it. Silk Road accepted only bitcoin. The first use case of crypto, Johnson says, is one nobody wants to admit: people wanted to buy pot and needed a way to pay.

As the forum grew he farmed out work. Kim Taylor found a techie who used the handle CumbaJohnny, later Scarface: Albert Gonzalez. Gonzalez stood at a New Jersey ATM in daylight for 40 minutes, feeding cards and stuffing twenties into a backpack, while two cops watched from across the street. In a wig, asked what he was doing, he fell apart and immediately offered to work for the Secret Service. Johnson's verdict on the Service at that time is that they were idiots about the digital world. Gonzalez had to explain what a VPN was. They thought it was a good idea. Johnson had already seen Secret Service texts and unshielded agency IPs and announced his retirement on April 15, 2004, walking away from $160,000 a week because he knew it would not end well. He did not know Gonzalez had been arrested. Gonzalez came back, banned people who suspected him, and told the community all transactions should go through a VPN. The VPN was run by the Secret Service. Over four or five months they cataloged about $7 million in traffic. *Forbes* put ShadowCrew on the cover in August 2004 under the headline "Who's Stealing Your Identity?" On October 26 the Service arrested 33 people in six countries in six hours. Johnson was in Charleston, South Carolina, watching it on the news. He was the one the public was told had gotten away. Another who slipped was Tron, with almost unfettered access to Bank of America; Ukrainian police, warned that Americans were in the air, drove over and told him to run. He made it to South America and stayed free for six or seven years.

The farce that finished his patience was David Thomas, El Mariachi, a Nebraska check-fraud fugitive they took a collection for. Johnson got him work, then asked a Ukrainian friend, Big Buyer, to fund an office in Issaquah, Washington: orders in, eBay out, fifty-fifty. The first outpost.com order was $18,000, the site's largest ever, and it landed. Kim Taylor, 46, a Tattered Cover bookstore clerk in Denver who used a Jason Bourne handle and fancied himself the part, drove a Saturn to Issaquah to cut in. They partied all night and skipped the rule: on delivery morning you log into the real account; if you can still get in, pick up; if you cannot, go back to sleep. Big Buyer placed a second $17,000 order to the same address. Outpost called Issaquah police and agreed to send empty boxes. Taylor walked in and was arrested. Thomas fled, was grabbed on the interstate with three fake licenses plus his real one, and could not be bonded because of Nebraska warrants. Taylor was bonded, parked in Utah, and spent his days on ecstasy until the host demanded he leave. Johnson sent him to another Denver crew; Taylor got those people arrested. Johnson told the remaining admins to ban him and walked away. Cybercrime, he says, often does not end in a courtroom, because most of the millions of people doing it are never caught. It ends in the person you become. He went twenty years without friends, only associates. He lied to a wife every day for nine years until she left. Jonathan James, who as a minor had shut NASA down for six weeks, partnered with Gonzalez, was going to take the blame, and shot himself. The operators of Evolution stole about $24 million, much of it from Ukrainian organized crime, and one was found on a beach without head or hands. A man Johnson had cheated out of $900 emailed that he guessed Johnson needed the money, and to keep it. Johnson still gets chills.

After Susan left, he found a criminal psychologist in the yellow pages, spent four months being told to go into real estate, and then walked into Joe's Roundup, a Charleston strip club, at 34, never having used drugs or been inside one. He fell for the first dancer he saw, Elizabeth, bought a $400 bottle of Korbel, and talked for two hours. She had a degree in religious studies. He moved her in. She came home at 10 or 11 in the morning unable to drive. He went through her purse, found cocaine, then found a forum describing her prostituting to support the habit, and sat there crying. He never told her he knew about the prostitution. He did tell her he could not have the drugs. She quit both the night he left a letter on the pillow: I love you; if you cannot stop, do not be here when I get back. He decided the way to keep her clean was money, $300 to $600 dinners, $1,000 shoes and $2,000 bags each week, while most of his cash sat in Estonia. After the ShadowCrew bust he could not tax-fraud out of season or trust anyone in carding, so he ran counterfeit cashier's checks, including a three-carat Tiffany ring from eBay for $20,000. The wedding was set for February 26, 2005. On February 8 he left at 8 a.m. to pick up rings and was arrested around 11:30 in a controlled delivery with about 30 agents in the parking lot. The Secret Service took the case within 45 minutes. That night he signed a search waiver so he could see her. They ransacked the house, took a watch off her wrist, left the ring, and asked her his real name. Bond was $300,000. In three months she visited twice. At the time he felt like the victim. Now he says she loved him and then found out he was a piece of shit.

Two New Jersey Secret Service agents pulled him from the cell, said they had his laptop, and asked if he could do anything for them. His words were that if they let him get back with Elizabeth, he would do whatever they wanted. They left him in jail three more months to taste it, then his sister Denise, who had disowned him for dating a stripper, paid a bond cut to $1,000. Elizabeth arrived at 11 p.m. in a limo, dumped two plastic bins of his clothes on the pavement, hugged him, said call later, and drove off. He had $30. The agent paid for the first hotel. As soon as the agent left, Johnson walked to Walmart, bought a prepaid debit card, and restarted tax fraud from the room. He promised her he would be hired as a consultant. They moved to Columbia, South Carolina, home of the field office. His official job was four to six hours a day on an outside-line laptop feeding a 50-inch plasma, with two Secret Service officers and a state officer in the room, teaching them how cybercrime worked. For two weeks they were diligent. Then they got bored watching him work fast and started watching pornography. They still ran a keylogger, Spectre Pro, and Camtasia to DVD spindles every night. He gambled they would never review the discs, and for ten months he committed crimes from inside the office.

The relationship with Elizabeth collapsed on trust. She had told a friend he was the only man who had ever asked her to stop using drugs, and she had told him that if she did not marry him she would never marry; as far as he knows she never has. After they started going back to clubs she suggested, drunk, that it would be funny if he got a blowjob from someone else. He took that as the end, started seeing another dancer, and told her it was over. He taught Sean Mims tax-refund fraud and told him never to make contact if Johnson went missing. The first day Johnson reappeared online, Mims did. Mims became a target of Operation Rolling Stone in March 2006. Agents hit an apartment Mims had tiled with $30,000 of Italian stone and emptied with a U-Haul the night before. They demanded a polygraph: had Johnson talked to anyone, used a computer outside the office, talked to the press, or warned targets. He was already sitting with a *New York Times* writer. He failed, and the bond was revoked. Agents Jim Ramone and Bobby Kirby, men he still calls good, had given him chance after chance. Years later he apologized for getting Kirby and another agent fired. Kirby told him they had truly been his friends. When Johnson said he was trying to be a better guy, Kirby said he always was; he just did not know it. A week after the revocation, a judge ruled the bond had been pulled improperly and reinstated it. Nobody called the Secret Service. Johnson walked out.

He called a dancer he had given about $60,000, borrowed $1,000 in Augusta against a promise of $3,000 in two weeks, and drove west on I-20 with no destination. In Dallas he social-engineered a prepaid-card supplier into handing over 60 cards with no license and no payment, pulled about $160,000 in profit, and bought a Jeep Cherokee. The plan was to make enough to set up in Florianópolis, Brazil. Four months and $600,000 later he was in Las Vegas, took $160,000 from ATMs, and the next morning saw his real name on cardersmarket.com. He said out loud, well, Mr. Johnson, you have made the United States most-wanted list, what do you do now? He answered himself: I am going to Disney World. He drove to Orlando, bought annual passes to Disney and Universal, paid $12,900 cash for an unfurnished timeshare off Universal Drive, spent $30,000 on furniture, bought back a seized $30,000 DVD collection, and went to the parks every day for about six weeks.

They found him with a Triggerfish, now called a Stingray. On Saturday, September 16, 2006, around 10:30 a.m., he opened the door on an empty peephole and found Bobby Kirby, another South Carolina agent, and an Orange County officer in the hall. Kirby asked if there was anything in the unit. Johnson said $120,000 in the bedroom, then added an AK-47, watched Kirby's face go white, and said he was kidding. Transport was diesel therapy: two weeks from Orlando to Columbia, stopping at every county jail for a six-hour intake, then moving him as soon as he hit a bunk. An inmate named Yeti told him the only federal time cut was the drug program. Johnson did not use drugs, so at every stop he claimed alcohol and cocaine. A psychologist asked how much he snorted. An eight ball a day, Johnson said, borrowing a line from *Boogie Nights* about not being able to get an erection. It went into the presentence report. The prosecutor screamed that Johnson had manipulated the Secret Service, the government, and now the court, and demanded the top of the guidelines. Johnson had told the jailhouse he would not stay past 60 months. The judge gave him 75 and would only recommend a drug evaluation. He told his lawyer to forget the appeal and get him to a camp. Family looked for a camp without a fence. They sent him to Ashland, Kentucky, which had a 14-foot fence and razor wire.

He asked for work outside the wire, refused the national forest, and took landscaping. Two days later the office wall was a blown-up aerial of the compound and the land around it. His father, silent for years, stood at sentencing and offered him a place to live, then started visiting. On the third visit Ray said he had been reading about the money online and asked if Brett could teach someone. Johnson used to think that was exploitation. He now thinks it was the only language they had. He agreed, in exchange for Ray's last $4,000, a change of clothes, a phone, and a license. The only license Ray had was Brett's own. After six or eight weeks as the hardest worker on the crew, including sweeping a mountainside with a broom, he walked away. Marshals found him two or three weeks later in Lexington, about 250 miles out, because he had to use that real license. He had dyed his hair flaming red and tanned dark. A marshal walked past an open curtain, backed up, knocked, and pointed at the door. The same presentence report, drugs and all, followed him to the escape sentencing. The judge refused to consider uncharged identity-theft evidence, called him a pretty good citizen before the drugs, and gave him 15 months plus the drug program. The program is a year off and six months in a halfway house. By escaping, he got out three months earlier than the original term. The price was eight months in a six-by-nine cell.

The first month of solitary had no books, paper, or pen, then a King James Bible. He slept 16 to 18 hours a day. The law promised an hour out daily; in practice he was lucky to get an hour a week, two showers, and a monthly call. The first week he bounced off the walls. Then he adapted and went through Elizabeth, his mother, everything. They sent him to Big Spring, Texas, a converted Air Force compound so hot the radio warned drivers off melting streets, the opening landscape of *From Dusk Till Dawn*. That is where he learned prisons are run by inmates. Nick Sandifer, treasurer of the Aryan Brotherhood, met him at the door and asked how many white guys had come in, then what he was in for. Johnson smiled and said computer crime. In that dialect, computer crime means child pornography. Real carders say so. For a month they watched him. Then a *Wired* cover story by Kevin Poulsen, whom Johnson had talked to about Max Butler, landed at mail call and named him a Secret Service informant. The warden asked if he felt safe. Saying no meant another eight months in the hole, so he said he was fine. The next day Sandifer was on his bunk with the magazine. Johnson turned to the page for him. Sandifer already knew. The rule was: until someone Johnson had snitched on arrived, they were okay. But Sandifer needed a favor.

Everyone in federal prison has a job. Johnson taught a Wednesday literature class from 6:00 to 8:30 p.m. Every part of the compound signed up. Guards sometimes popped in. They did not teach literature. They taught fraud, which is how he did not get beaten. His other job was to intercept white arrivals he could already sort, walking off the bus, into bank robbers and men with sex charges. The speech was: if you have a fucked-up charge, tell me now and you will be all right; if you hide it and those men find out, they will kill you. Pedophiles, rapists, anyone who harmed children or women sat at the bottom: no talking, no television, library only, associate with your own, accept extortion, never tell. He saw two murders, three riots, and four suicides over his time. Both killings happened at evening recreation on a third-of-a-mile track. The crowd moved like a flock toward the gate while one inmate hammered another's head into pavement. Guards took about fifteen minutes because a guard might get hurt. After lockdown, each man walked into a room for two questions: did you see anything, and if you had, would you say anything. Both answers were no. Anyone who lingered was a suspect. Trust, he tells Fridman, runs prison the way it ran ShadowCrew.

He did five and a half years. A counselor named Keely wanted inmates educated, bought a discounted game-theory course, and was told that if anyone knew the subject it would be Johnson. Johnson rattled off the prisoner's dilemma, taught public speaking, and a week after being told Keely could not help with a transfer was on a bus to the nine-month residential drug program in Fort Worth, 24-hour cognitive behavioral therapy that had almost nothing to do with drugs. He calls it the best thing that could have happened, but only once he chose to use it. Denise had disowned him, then drove seven hours after the escape arrest, told him she loved him in a ten-minute visit, and he did not see her again for five and a half years. That planted the first turn. It still took two and a half years in prison to admit he had not committed crime because of wives or stripper girlfriends. He had committed it because he wanted to. He got out in 2011 on three years of probation that barred computers. Deloitte wanted him to run a cybercrime office in the United Kingdom. A phishing-defense firm wanted him. Fast food used a terminal. Waiting tables meant credit cards. He could not take any of it.

On food stamps, splitting rent, he could feed a cat named Monster and not buy toilet paper. He shoplifted it on Panama City Beach. A friend posted him on Plenty of Fish. Michelle messaged the grim prison photos and asked why he was not smiling. That is my happy face, he wrote. He moved in when the apartment was about to fail. A Craigslist landscaping ad led to Dustin DeRamus, who after twenty minutes asked if he was on the run, because he did not look like the work. Johnson told him everything. DeRamus thought it over from Friday to Sunday night, then asked if he would actually labor. Johnson promised he would work his ass off and showed up at six. He pushed a mower ten hours a day, five days a week, for $400, came home and passed out, and was offered a partnership when DeRamus's brother left. He turned it down for a $1,500-a-week oil-rig training sales job he had already disclosed his record for. The man called back and said he could not hire him. DeRamus had already replaced him. Feeling useless while Michelle worked, he told himself he could at least bring food into the house, ordered groceries on stolen cards from the dark web, then stole clothes for her sons. He was arrested on a food order she did not know about. At sentencing she told the judge he was a better father to her boys than their actual father. The probation officer and prosecutor called it a one-off. The judge gave a year; the officer asked for a year and a day so good time would apply. He served ten months. That was when he learned Michelle had wanted him, not what he could buy. They married. Probation ended. He could touch a computer.

He still could not sell cars: drug dealers sometimes can, identity thieves cannot. He knows his triggers. He sent a LinkedIn message to Keith Mularski, an FBI agent in Pittsburgh who had worked his case, saying he respected the work and wanted to be legal. Mularski answered in two hours with references, advice, and a wing to stand under. The identity-theft council's head did the same. The card-not-present group hired him to speak. Microsoft hired him to consult, and that hire, he says, created enough industry trust that he was all right from then on. Fridman asks how to fight cybercrime. Johnson's first lesson is that you cannot serve two masters. If you love someone addicted to crime, drugs, or gambling, the addiction comes first until that person decides to change, and you have to know when to leave. The other half is that he turned around only because people took a chance. Without Mularski, Denise, Michelle, and the first companies, he is sure he would have gone back for twenty years.

On defense he is almost boring. Companies imagine a lone wolf and do not grasp how freely criminals share. Privacy and competition keep firms from doing the same. Ninety percent of attacks use known exploits, the holes already cataloged, not SolarWinds-class events. Patch, update, and stop pretending a single product is a one-stop solution among 7,500 vendors, many of them snake oil, including RFID-blocking wallets he has rarely seen exploited on the criminal side. Raise the cost until the thief picks someone else. Press charges. He has watched Fortune 50 companies pay insiders, sign NDAs, and bury the case, which leaves the risk-reward ratio untouched. White-hat testing he likes, if it is honest about what is real. He got angry on LinkedIn about ID.me, a firm he calls a marketing company that wants to be seen as identity verification, used by the IRS, Social Security, the VA, and about 23 state unemployment offices. He says he was partly responsible for their losing an $86 million IRS contract. His objection is not that a private firm has ugly policies. It is that a citizen entitled to a government service is forced to hand a complete identity file to that firm for marketing. Stripping so-called PII while keeping biometrics and browsing still lets you ping one person out of the crowd. He laughs that Brett Johnson has become a privacy advocate.

His family worries about cartels and the violence now baked into darknet drug markets. He thinks he may be too close to feel it, and he has built his later reputation by naming companies, people, and crews. To young people he says want money, test systems, even circumvent rules, as long as you do not break the law, but make the life one that helps people rather than hurts them. That hit him walking into Quantico and seeing bright people who had given up market salaries because they believed they were helping, after he had spent a career harming. Hope, for him, is that when things get truly bad, people still group up and rise against injustice. Elizabeth taught him to stop being a news hound; he now understands why she never watched. The meaning of life, asked at the end, is the same as his security advice: everyone worries about themselves, and the only way you solve the security problem is everybody looking out for everyone else. He has done despicable things and would not change them, because he likes who he is and thinks he is finally doing what he is supposed to do. Fridman closes with George R. R. Martin: a good act does not wash out the bad, nor a bad act the good. Each should have its own reward.