Speaker 1: Don't let your legacy I T systems cost you money,
Speaker 1: innovation and a place at the digital table of the future.
Speaker 1: You can change your systems and the economics of it
Speaker 1: with software from red hat. See how at red hat
Speaker 1: dot com. It's August and Christian Provisionado is in Savona, Italy,
Speaker 1: on the beach with his girlfriend when he gets a
Speaker 1: call from his boss. Christian worked as a bodyguard for
Speaker 1: a security company in Milan. He's got this honor and
Speaker 1: Loyalty tattoo on his biceps. He wears these dark sunglasses.
Speaker 1: He's a burly guy in a little bit intimidating. He
Speaker 1: worked mostly society events in Italy, like Georgia Armani's fort
Speaker 1: anniversary party. This particular job was a little different. His
Speaker 1: boss needed him to fly to Mauritania in West Africa.
Speaker 1: He was told to bring a dark suit and accompany
Speaker 1: someone to a meeting with the government there. His boss
Speaker 1: made it sound like it was an emergency. My brother, uh,
Speaker 1: you don't see any danger, is saying, okay, I haven't
Speaker 1: two good name just for a presentation. That's Mauricio Provisionado.
Speaker 1: He's Christians brother. We just do the demo in thought
Speaker 1: of the Mauritanian development and it seemed like a easy job.
Speaker 1: It turned out that this wasn't an easy job at all.
Speaker 1: Christian was arrested by the Mauritanian government, imprisoned and held
Speaker 1: hostage there and he's still there. What was supposed to
Speaker 1: be a one week assignment has turned into a sixteen
Speaker 1: month nightmare, all because he unknowingly walked into a cyber
Speaker 1: weapons right as it was going bad. Hi, I'm Akito
Speaker 1: on Jordan Robertson, and this week on Decrypted, we're taking
Speaker 1: you deep into the underworld of cyber crime. This is
Speaker 1: a world of offshore bank accounts and meetings that never happened,
Speaker 1: a world where governments and organizations a huge sums of
Speaker 1: money to spy on each other and on their own people.
Speaker 1: As we spend more of our lives on our digital devices,
Speaker 1: the market for these cyber weapons is exploding. But first,
Speaker 1: let's explain why Christian went to Mauritania in the first
Speaker 1: place and the deal that he was supposed to be closing.
Speaker 1: For that, I need to introduce you to Maniche Kumar.
Speaker 1: Maniche is an up and coming entrepreneur in the cyber
Speaker 1: arms dealing world. But he came from humble beginning. He
Speaker 1: watched you to videos to teach himself how to code
Speaker 1: in a rural village in northern India. Yes, so let's
Speaker 1: talk about this market for cyber weapons. It sounds scary
Speaker 1: and it is. You're selling the ability to take advantage
Speaker 1: of someone someone's software or phone or hardware that that's
Speaker 1: that's being targeted. And um, having the ability to is
Speaker 1: very advantageous to lots of individuals. So um, there's a
Speaker 1: lot of money involved for sure to be able to
Speaker 1: purchase in and use these things. That's Andrew Blake, who's
Speaker 1: a researcher at Lookout, which is a company that specializes
Speaker 1: in mobile security. We had him come into our San
Speaker 1: Francisco studio to walk us through how this market works
Speaker 1: and some of the more technical details of our story
Speaker 1: today that we're going to be getting into a little
Speaker 1: bit later. And when he said that there's a lot
Speaker 1: of money at stake, he means a lot of money.
Speaker 1: Researchers estimate that this market is worth billions of dollars. Okay,
Speaker 1: so back to the niche. He's made a bit of
Speaker 1: a name for himself in this world. He wrote a
Speaker 1: book called The Secret of hacking that got the attention
Speaker 1: of the Indian government. They asked me Niche to use
Speaker 1: his hacking skills to crack into China's secret operating system,
Speaker 1: a computer network they were using to spy on countries
Speaker 1: like India. But Maniche is really entrepreneurial. He wanted to
Speaker 1: be more than just the guy who does odd hacking
Speaker 1: jobs for the Indian government. He realized that the market
Speaker 1: for selling offensive technology, as in the technology that a
Speaker 1: government could use to launch an attack, breaking into a
Speaker 1: network or spy on another country. Yeah, that market is
Speaker 1: much bigger. This kind of technology that Meniche was selling.
Speaker 1: People call it all kinds of things like cyber arms,
Speaker 1: cyber weapons, exploits attacks. What you need to know is
Speaker 1: that these are tools to hack and spy on other people. Now,
Speaker 1: Maniche wouldn't talk to us on the record for this episode,
Speaker 1: and I think you will understand why pretty shortly. But
Speaker 1: I did go to India to meet him for some reason.
Speaker 1: He let me a reporter check out the spots where
Speaker 1: he used to meet his clients and learn about how
Speaker 1: he built his business. Menisia's tall was slicked back here.
Speaker 1: He's handsome like he could have ended up on a
Speaker 1: Bollywood set if he had made different life choices. And
Speaker 1: his company, Wolf Intelligence, which is based in Munich, looks
Speaker 1: pretty good too. They have an office in Dubai, another
Speaker 1: in Romania, a Swiss CEO, and booths at every major
Speaker 1: military technology conference around the world. Yeah, these are all
Speaker 1: the trappings of a respectable boutique surveillance company. But when
Speaker 1: you meet Monichian person, it doesn't take along to realize
Speaker 1: only part of the image is real and part is
Speaker 1: for show. He's still learning about this world of enemy
Speaker 1: hunting spy technology. Yeah, like how to be in the
Speaker 1: room when the really big deals go down. So back
Speaker 1: in December, Maniche lies to Doha, Qatar and sets up
Speaker 1: a booth at an industry fair called Millipole Qatar held
Speaker 1: at the Doha Convention Center. I'm reading its website here
Speaker 1: that says it's the leading international exhibition dedicated to homeland
Speaker 1: security in the Middle East, and it's held under the
Speaker 1: authority of the Prime Minister of Qatar. So it's not
Speaker 1: like they're meeting in a dark back alleyway, right, it's
Speaker 1: actually a perfectly legitimate conference. Yeah. Absolutely, Imagine the sixty
Speaker 1: five thousand square foot convention center with buyers from more
Speaker 1: than sixty countries checking out armored vehicles, machine guns, and
Speaker 1: surveillance systems. It's there that Maniche makes the deal of
Speaker 1: a lifetime. So he manages to pique the interest of
Speaker 1: a couple of government officials from the small African state
Speaker 1: of Mauritania. Miniche gives them a more detailed demo. Within
Speaker 1: a month, Mauritanias signs a two point five million dollar
Speaker 1: contract with Maniche. He'll get paid in installments. This is
Speaker 1: certainly the biggest splash in his short career as a
Speaker 1: cyber arms dealer now, but it's very nature. The cyber
Speaker 1: arms market operates under what economists politely call a trust deficit.
Speaker 1: That means that because everyone's trying so hard to cover
Speaker 1: their tracks, it's basically impossible to know who you're dealing with,
Speaker 1: whether your business partner is a thief, a scammer, or
Speaker 1: something more dangerous. If you're going through kind of the
Speaker 1: backdoor channels and the black markets and things like that,
Speaker 1: it's a little bit of the wild West, right You're
Speaker 1: you're selling these things out there, Um, you don't know
Speaker 1: who you're selling them to, really, so you mean you
Speaker 1: might be selling them someone that's trying to set you up.
Speaker 1: You might be selling them someone that wants to use
Speaker 1: them moliciously. You might be selling them to someone that
Speaker 1: just wants to get them and use them for research purposes.
Speaker 1: As these things go, Mauritaneous was pretty close to the
Speaker 1: bottom of the shark tank as a population of only
Speaker 1: four million people, and it's had ten coups since sixty
Speaker 1: when it gained independence. It's one of the last places
Speaker 1: on Earth where slavery still exists, and the government is
Speaker 1: regularly condemned for human rights abuses. But Maniche is a
Speaker 1: hired gun and there's a lot of money on the
Speaker 1: line and deals like these, and he's not particularly bothered
Speaker 1: by that. The way Moniche views the world is if
Speaker 1: he doesn't make these deals, someone else will. But right
Speaker 1: now he's trying to fix a more immediate problem, which
Speaker 1: is that as part of the whole two point five
Speaker 1: million dollar package, monichha agreed to deliver the Mauritanians a
Speaker 1: piece of technology that he actually doesn't have. What exactly
Speaker 1: that technology is that's coming up, But first a word
Speaker 1: from our sponsor. Inside the most successful organizations, i T
Speaker 1: has gone from supporting the business to driving the business,
Speaker 1: but the costs of legacy infrastructure can impede this progress.
Speaker 1: Budgets can't stretch enough to pay for digital ovation at
Speaker 1: the speed required. No one gets a blank check. The
Speaker 1: answer is to change the economics of your I T
Speaker 1: by shifting from ownership to use, from licenses to subscriptions,
Speaker 1: from proprietary to open. Change the economics of it with
Speaker 1: open software from red hat. Learn more at red hat
Speaker 1: dot com. Okay, so, before the break, Miniche had managed
Speaker 1: to close a two point five million dollar deal with
Speaker 1: the Mauritanian government, and included in the deal was a
Speaker 1: piece of highly sophisticated surveillance software. And Jordan's until you
Speaker 1: brought the story to me, I didn't even know that
Speaker 1: this thing existed. Yeah, I didn't know much about it either.
Speaker 1: It's called a silent SMS attack. When you want to
Speaker 1: essentially hack into someone's phone, you need them to execute
Speaker 1: like a piece of software on their device to take
Speaker 1: advantage of the vulnerabilities and install the malicious software on
Speaker 1: the device. Now, how you actually get the user to
Speaker 1: exploit their phone is a number of different ways. You know,
Speaker 1: in the past, there's things like you can install malicious
Speaker 1: application that will take advantage and break the sandbox and
Speaker 1: break the security features of the device, but that requires
Speaker 1: and tricking the user into installing them. Let's just app
Speaker 1: through efficient campaign or something like that. So what Andrew
Speaker 1: is describing here, these are those emails that are like,
Speaker 1: you know, click on this link to win ten million
Speaker 1: dollars right now. Exactly, you as the user, need to
Speaker 1: click on a link that triggers a whole process that
Speaker 1: allows the hacker to take control of your phone. But
Speaker 1: there's also another way. In phone carriers like Verizon and
Speaker 1: a T n T often sent invisible text messages to
Speaker 1: their customers to get them to update their software. It
Speaker 1: says if they have a backdoor into your phone, because you,
Speaker 1: the owner of the phone, don't have to click on
Speaker 1: or download or open anything, it's just happens automatically. And
Speaker 1: because it happens in total stealth, it's called a silent SMS. Now,
Speaker 1: as you can imagine, this pathway is usually guarded with
Speaker 1: tons and tons of security walls. But if a hacker
Speaker 1: manages to find a security hole that allows them that
Speaker 1: secret access to anyone's phone, it's the holy grail for
Speaker 1: hackers because like all of our lives are now on
Speaker 1: our phones in this case right, all of our information, banking,
Speaker 1: personal all on one single device for us now that
Speaker 1: they become these highly valuable targets because everything is in
Speaker 1: one spot now for us to access. Even the way
Speaker 1: in which we log into our systems are two factor
Speaker 1: tokens and things like that are all all located on
Speaker 1: our phone device. So having the ability to get in
Speaker 1: quickly and silently is very advantageous for these kinds of
Speaker 1: targeted attacks that are out there. Once they have their
Speaker 1: software on there and they've you know, they've taken advantage
Speaker 1: of it, they can do whatever they want. They basically
Speaker 1: have a backdoor inteier device to do to do anything.
Speaker 1: So this is really powerful stuff, something only maybe a
Speaker 1: handful of very sophisticated players can pull off. And this
Speaker 1: is the technology Meniche needs to get his hands on,
Speaker 1: so he flies to Israel, the beating heart of cyber warfare.
Speaker 1: Through a network of connections, Minich is told that someone
Speaker 1: called Duty Sternberg, a cyber weapons broker, might have what
Speaker 1: he's looking for, and Maniche goes to Duty's leather appointed
Speaker 1: offices in a high rise inside Tel Aviv to get
Speaker 1: into Duty's office, Miniche has to go through a branch
Speaker 1: of a local bank with metal detectors set up at
Speaker 1: the door. Menich is very impressed. Dot he wants a
Speaker 1: million dollars for this piece of software, and he wants
Speaker 1: a big part of that cash upfront. Now, this is
Speaker 1: a real dilemma for Meniche. In this murky world of cyberweapons,
Speaker 1: the normal rule of business they don't apply. Yes, someone
Speaker 1: violates the terms of a contract if they don't pay
Speaker 1: or if they don't deliver, it's not like you can
Speaker 1: just go see them right. There's nobody enforcing the law.
Speaker 1: And the problem here is manichees starting to suspect that
Speaker 1: the Mauritanian government is probably never going to pay him
Speaker 1: the final one million dollars of his contract. And at
Speaker 1: the same time, Maniche isn't sure if he can trust Duty,
Speaker 1: the Israeli broker, to deliver a real silent SMS exploit.
Speaker 1: So there's a very real risk here that Maniche would
Speaker 1: end up with basically no profit if he pays Duty.
Speaker 1: But Mauritania doesn't pay him, So Maniche decides to buy time.
Speaker 1: He doesn't give Duty the down payment, which means he
Speaker 1: never gets the silent SMS. In the meantime, in Mauritania,
Speaker 1: government officials are getting antsie. They've paid one point five
Speaker 1: million dollars to Miniche, but they haven't received most important
Speaker 1: part of the software that they were promised. And there
Speaker 1: was an Indian technician Miniche had sent to Mauritania to
Speaker 1: help the government use the software that Miniche had delivered
Speaker 1: to them so far. But as soon as the technician
Speaker 1: arrived in Mauritania, the government confiscated that technicians passport, took
Speaker 1: the technician as hostage and Miniche had to find a
Speaker 1: way to get the guy out. At this point, Meniche
Speaker 1: is wondering maybe he can convince them to accept a
Speaker 1: package without the silent SMS. Maybe they'll take a discount
Speaker 1: and to set up another meeting with the Mauritanian government,
Speaker 1: Miniche decides he wants a white European guy with his
Speaker 1: staff to do it now. The reason for this is
Speaker 1: Manich is very concerned about being discriminated against because of
Speaker 1: his ethnicity, so his plan is to get white Europeans
Speaker 1: to accompany him and his staff on important meetings to
Speaker 1: add what he views is additional legitimacy to his company.
Speaker 1: That's when Christian previous Yonnado, our Italian bodyguard comes in
Speaker 1: Minisia had worked with Christians boss in the past, so
Speaker 1: Christians boss called Christian and asked him to fly out
Speaker 1: to Mauritania immediately. My brother has not time to check
Speaker 1: to investigate, because normally when you receive an offer job offer,
Speaker 1: you know you have to prepare and you have to
Speaker 1: study everything. But they wish so hard my brother. They say, oh,
Speaker 1: it is an emergency, you have to fly tomorrow morning,
Speaker 1: so Pizza don't give the time to my brother to
Speaker 1: check to what's really is going on the place alone.
Speaker 1: So this is really a trap and things got weird
Speaker 1: right away as soon as Christian arrived and more at NA,
Speaker 1: a man with no teeth meets him at the airport
Speaker 1: and takes his passport away. Christian was told this was
Speaker 1: just standard procedure, something he needs to do to get
Speaker 1: a visa, but then he doesn't get the passport back.
Speaker 1: And when Christian arrived at the apartment that Miniche had
Speaker 1: prepared for him, there's another Italian there called Leo Ratano
Speaker 1: who's about to leave after staying for a week there,
Speaker 1: and he warns Christian that there's something fishy going on. Now,
Speaker 1: Remember Christian doesn't know any of the background at this
Speaker 1: point that we've been telling you today that he had
Speaker 1: walked into the middle of a high stakes deal that's
Speaker 1: disintegrating by the day. And after he hangs around for
Speaker 1: a week, Miniche calls off the meeting. He just can't
Speaker 1: come up with a solution and he simply runs out
Speaker 1: of time, at which point Christian's boss starts to send
Speaker 1: him a frenzied series of WhatsApp messages. He tells Christian
Speaker 1: to leave the apartment that Miniche's company provided to move
Speaker 1: to commercially run hotel, to try the German embassy because
Speaker 1: there's no Italian embassy there. Then, on September one, two
Speaker 1: weeks after he arrived in Mauritania, Christian disappeared. His boss,
Speaker 1: his girlfriend, his brother, they all lost contact with him.
Speaker 1: You Know, the first twenty four hour, you think, Okay,
Speaker 1: say come because maybe there is UH some problem with
Speaker 1: the network, with the communication, you know, the UH Middle Africa,
Speaker 1: so maybe sometimes it can happen that. But after the
Speaker 1: second day I start to understand that that, yeah, maybe
Speaker 1: some problem h was ongoing. On third September, I received
Speaker 1: a call from the Italian Council in Morocco to tell
Speaker 1: me that my brother was arrested from the Malitanian government.
Speaker 1: That's Maritio Provisionado. Christians brother. Christian was charged with defrauding
Speaker 1: the Mauritanian state and money laundring. His family was allowed
Speaker 1: to visit him a couple of times, and his brother
Speaker 1: was shocked to find out the conditions that Christian was
Speaker 1: held in for the first few months. I had the
Speaker 1: possibility to spoke with him. He say, the condition was
Speaker 1: really bad. Was a room really dirty, the bed was
Speaker 1: really bad. And another point is for six months he
Speaker 1: they did to him just rise and water, rise and
Speaker 1: water and nothing else. So the problem is my brother
Speaker 1: is Gabeti and for a toabatic person, uh, the rise
Speaker 1: it's like a poison. So my brother, in this moment
Speaker 1: is still alive. But it's a miracle and the fight
Speaker 1: to get Christian back has turned into this international affair.
Speaker 1: Top level diplomats from Italy and Mauritania met on the
Speaker 1: sidelines of the UN General Assembly in September and multiple
Speaker 1: other meetings after that. Now that the two governments are
Speaker 1: in talks, Christian's brother says he's held in better conditions,
Speaker 1: but Mauritaneous simply won't let him go. Well, in Jordan's
Speaker 1: we are tired. We are really tired, because it's a
Speaker 1: sixixteen months that we fight every day to found the
Speaker 1: two to try to to understand what has happened there.
Speaker 1: We tried to involve all journalist in Ita, but the
Speaker 1: nine of the media and the journalists in Italy, they
Speaker 1: don't want to talk about this study. Mauritania says that
Speaker 1: the released Christian if they get their one point five
Speaker 1: million dollars back, and there's been some speculation in Italy
Speaker 1: that the government might pay the money. As for mi Niche,
Speaker 1: he's still trying to get Christian back to but he's
Speaker 1: unwilling to give back the one point five million that
Speaker 1: Mauritania has already paid him. And even though Mauritania is
Speaker 1: demanding that he come back to resolve the disputing person
Speaker 1: after seeing what happened to Christian, Maniche won't return himself.
Speaker 1: In October, Minis tried to set up a meeting at
Speaker 1: a neutral location outside of Mauritania, but the government official
Speaker 1: never showed and in the meantime, Minie says that he's
Speaker 1: been busy building his own company. Business has been booming.
Speaker 1: Mini said he just landed a five hundred thousand dollar
Speaker 1: deal with the Egyptian government. And that's it for this
Speaker 1: week's Decrypted. Thanks for listening. We'd love to know what
Speaker 1: you thought of this show. You can send a voice
Speaker 1: message to our producer Pia at p G A D
Speaker 1: K A r I at Bloomberg dot net, or write
Speaker 1: to me on Twitter. I'm at Jordan's are one thousand
Speaker 1: and I'm at aki itso seven. Be sure to subscribe
Speaker 1: to Decrypted on iTunes or wherever you get your podcasts,
Speaker 1: and please leave us a rating and a review. It
Speaker 1: helps more listeners find our show. This episode was produced
Speaker 1: by Pierre get Kari Magnus, Henrickson and Liz Smith. Jim
Speaker 1: Ailey edited Jordan's accompanying Business Week story, which you can
Speaker 1: find at Bloomberg dot com slash business Week and Bloomberg
Speaker 1: dot com slash Tech. Alec McCabe is head of Bloomberg Podcasts.
Speaker 1: We'll see you next week. Don't let your legacy I
Speaker 1: systems cost you money, innovation and a place at the
Speaker 1: digital table of the future. You can change your systems
Speaker 1: and the economics of it with software from red Hat.
Speaker 1: See how at red hat dot com.