WEBVTT - Disney's Villain 0:00:01.720 --> 0:00:09.719 Coo Zone Media. In June of twenty twenty four, Michael 0:00:09.760 --> 0:00:14.560 Schuyer had a disagreement with a coworker. It isn't clear 0:00:14.600 --> 0:00:17.599 from the court records, so I couldn't tell you exactly 0:00:17.600 --> 0:00:20.960 what was said. He says there was a difference of 0:00:21.000 --> 0:00:25.520 opinion over a workplace matter. But he's in federal prison 0:00:25.640 --> 0:00:28.680 and two of his coworkers now have restraining orders against him, 0:00:28.720 --> 0:00:31.520 So I'm inclined to believe there may be more to 0:00:31.560 --> 0:00:35.879 the story than that. But that's all we know. That 0:00:36.120 --> 0:00:41.400 minor workplace disagreement ruined Michael Schuer's life. Losing his job 0:00:41.520 --> 0:00:44.720 was not only financially devastating, it was the death of 0:00:44.760 --> 0:00:48.159 his lifelong dream of working for the Walt Disney Corporation. 0:00:49.760 --> 0:00:53.480 And losing a job is never easy. It's a crushing blow. 0:00:54.480 --> 0:00:56.400 You have to figure out how you're going to pay 0:00:56.400 --> 0:00:59.480 the rent, how you're going to get healthcare, how you're 0:00:59.480 --> 0:01:03.240 going to find new job. I can't speak for everybody, 0:01:03.360 --> 0:01:06.000 but I think I'm not alone in saying that it's 0:01:06.040 --> 0:01:10.640 also embarrassing. It hurts your feelings, your ego takes a 0:01:10.640 --> 0:01:16.040 real hit, and for some people that just isn't something 0:01:16.120 --> 0:01:22.440 they can move on from I'm Molly Conger, and this 0:01:23.560 --> 0:01:42.520 is weird, little guys, This is kind of a silly one. 0:01:43.959 --> 0:01:50.400 Nobody gets hurt, nobody dies, nothing really bad actually happened. 0:01:52.160 --> 0:01:54.400 I know. I said last week that I ended up 0:01:54.440 --> 0:01:57.440 with the episode that came out because I was reaching 0:01:57.440 --> 0:02:00.000 around for something quick, because the story I was trying 0:02:00.000 --> 0:02:03.160 trying to write just felt unwieldy and I was having 0:02:03.240 --> 0:02:07.600 trouble forcing it into the right shape. Well that's where 0:02:07.600 --> 0:02:11.400 we still are this week. I'm still really fighting with 0:02:11.480 --> 0:02:13.079 something I think is going to take a few more 0:02:13.080 --> 0:02:16.000 weeks to hammer out into any kind of actual narrative. 0:02:16.080 --> 0:02:19.720 So here we are again at the eleventh hour, and 0:02:20.000 --> 0:02:22.920 I have nothing but a few dozen pages of odds 0:02:22.919 --> 0:02:26.840 and ends about a story that spans fifty years, and 0:02:26.880 --> 0:02:30.880 so I'm scrounging around for something else. I'm not asking 0:02:30.880 --> 0:02:33.840 for your sympathy for anything. You probably have a real 0:02:33.919 --> 0:02:37.360 job where you make something or help people, and my 0:02:37.480 --> 0:02:40.960 job is just telling you a horrible little story. But 0:02:41.000 --> 0:02:42.600 all I can tell you is the truth, and the 0:02:42.639 --> 0:02:45.359 truth is sometimes I have no idea how I'm going 0:02:45.360 --> 0:02:47.560 to force any more words out of my brain and 0:02:47.600 --> 0:02:52.160 into this microphone. So all I've got this week is 0:02:52.200 --> 0:02:59.080 Michael Schueer, And like I said, he didn't really hurt anybody. 0:02:59.160 --> 0:03:01.200 He wasn't a member of any hate groups. As far 0:03:01.240 --> 0:03:04.280 as I can tell, until last summer, he had no 0:03:04.400 --> 0:03:08.200 history of any criminal conduct. I couldn't find so much 0:03:08.200 --> 0:03:13.640 as a speeding ticket. He was squeaky clean. He was 0:03:13.639 --> 0:03:16.520 a family man, married for nearly ten years, and the 0:03:16.520 --> 0:03:20.320 father of three young children. But the course of action 0:03:20.480 --> 0:03:24.200 he decided on after he got fired last summer is 0:03:24.240 --> 0:03:27.359 what makes him a weird little guy. And I think 0:03:27.360 --> 0:03:31.720 he's actually a tiny example of one of the emerging 0:03:31.760 --> 0:03:35.800 weird little guy archetypes. I don't have a name for 0:03:35.840 --> 0:03:38.839 it yet. I don't really have the weird little guy 0:03:38.920 --> 0:03:43.160 taxonomy mapped out, but patterns are starting to appear in 0:03:43.200 --> 0:03:48.400 these stories. There are distinct types of weird little guy, 0:03:49.640 --> 0:03:51.839 and one of them is a kind of guy who 0:03:51.920 --> 0:03:57.119 can't accept when he's wrong. More importantly, he can't accept 0:03:57.840 --> 0:04:02.119 being wronged. And God help you if you have even 0:04:02.160 --> 0:04:06.280 a passing encounter with this kind of guy. For some 0:04:06.360 --> 0:04:10.839 of them, the perceived slight is so minor that it's 0:04:10.880 --> 0:04:13.360 not something I think I would ever think about again, 0:04:14.080 --> 0:04:16.159 let alone devote the rest of my life to getting 0:04:16.200 --> 0:04:21.279 revenge over it. If you've listened to the whole catalog 0:04:21.360 --> 0:04:24.160 of this show, you've heard about some of these guys 0:04:25.040 --> 0:04:28.080 I'm thinking about, people like Frank Sweeney from the pair 0:04:28.120 --> 0:04:34.000 of episodes back in September. Frank was a lifelong neo Nazi, sure, 0:04:35.279 --> 0:04:38.159 but mostly he was a con man. He ended up 0:04:38.200 --> 0:04:41.360 in prison a couple of times for little frauds and cons, 0:04:42.000 --> 0:04:45.680 things like putting ads in gun magazines for fancy guns 0:04:45.680 --> 0:04:48.640 that he didn't actually own, and then accepting numerous buyers 0:04:48.720 --> 0:04:53.200 money for these imaginary collector's items. Later in his life, 0:04:53.279 --> 0:04:56.359 he cut the tails off of stray cats and sold 0:04:56.400 --> 0:04:59.279 them to gullible people who thought they were buying fancy, 0:04:59.360 --> 0:05:03.920 purebread hale as cats. He conned the FBI, the CIA, 0:05:04.080 --> 0:05:07.640 the DOJ, and the Witness Protection Program into thinking that 0:05:07.720 --> 0:05:11.000 he was helping them to apprehend an escaped Soviet spy 0:05:11.160 --> 0:05:14.760 that he'd befriended in prison. He once tricked a mob 0:05:14.839 --> 0:05:17.120 lawyer into flying him across the country and putting him 0:05:17.160 --> 0:05:20.040 up in a nice hotel in exchange for testimony about 0:05:20.040 --> 0:05:22.400 a Chicago mob boss he'd once shared a cell with. 0:05:24.000 --> 0:05:29.200 He loved to lie, but more than that, I think 0:05:29.240 --> 0:05:33.200 the defining characteristic of a guy like Frank Sweeney is 0:05:33.240 --> 0:05:38.479 his sense of self righteous indignation. When he felt like 0:05:38.560 --> 0:05:42.239 someone had wronged him, he made it his life's work 0:05:43.000 --> 0:05:46.440 to get back at them, to hurt them back the 0:05:46.480 --> 0:05:50.560 way they'd hurt him, and he did it in some 0:05:50.680 --> 0:05:55.159 really bizarre ways. In the early nineties, when he was 0:05:55.160 --> 0:05:57.520 living in an apartment in New Jersey, a family with 0:05:57.640 --> 0:06:01.800 children moved into a neighboring apartment, and once he decided 0:06:01.800 --> 0:06:05.960 that the neighbors were intentionally disregarding his request to keep 0:06:06.000 --> 0:06:10.080 their children quiet, he made it his life's mission to 0:06:10.200 --> 0:06:14.479 destroy the entire family. He spread rumors that the father 0:06:14.560 --> 0:06:16.839 had HIV and that he'd given it to his children. 0:06:17.920 --> 0:06:21.080 He shut off their power at random. He filled the 0:06:21.120 --> 0:06:23.279 lock on their front door with staples so they couldn't 0:06:23.279 --> 0:06:26.080 get into their home. He had their mail routed to 0:06:26.120 --> 0:06:29.640 a random address in Iowa. And he subscribed to their 0:06:29.720 --> 0:06:36.080 nine year old son to pornographic magazines. And that's unhinged behavior. 0:06:36.200 --> 0:06:39.320 That is an unnecessary escalation to the problem of a 0:06:39.960 --> 0:06:43.640 noisy fourth grader. And it was all because he felt 0:06:43.839 --> 0:06:49.359 entitled to complete silence in his apartment and total obedience 0:06:50.000 --> 0:06:54.360 from his neighbors, and two decades after that, when he 0:06:54.400 --> 0:06:57.200 was already a very old man, the stranger made a 0:06:57.240 --> 0:06:59.600 passing comment about how he'd parked his car at the 0:06:59.600 --> 0:07:04.560 post parking lot, and instead of just letting it go, 0:07:05.360 --> 0:07:09.279 like almost anyone else on earth would, he spent three 0:07:09.400 --> 0:07:14.120 years stalking that woman and her entire family, sending them 0:07:14.160 --> 0:07:19.360 threatening postcards, spreading rumors that they'd engaged in sexually deviant behavior, 0:07:19.440 --> 0:07:21.920 that they were drug addicts and criminals, and they were 0:07:21.960 --> 0:07:28.240 doing tax fraud. Three years because she commented on how 0:07:28.240 --> 0:07:32.440 he had parked his car. And then there was Walter 0:07:32.440 --> 0:07:36.560 Fitzpatrick from those episodes back in November. He was the 0:07:36.640 --> 0:07:40.200 sovereign citizen who tried to citizens arrest an entire courthouse 0:07:40.240 --> 0:07:43.800 in rural Tennessee because they wouldn't help him indict President 0:07:43.840 --> 0:07:49.040 Barack Obama for treason. And Walter Fitzpatrick had a long 0:07:49.240 --> 0:07:53.240 history of this kind of grievance motivated behavior. He'd been 0:07:53.280 --> 0:07:56.240 banned from his congressman's office after the receptionist had to 0:07:56.240 --> 0:07:59.560 get a restraining order against him because he refused to 0:07:59.640 --> 0:08:03.040 accept that they just couldn't help him get a new trial. 0:08:03.080 --> 0:08:06.960 In his Navy court martial. And then there are the 0:08:06.960 --> 0:08:09.240 weird little guys who try to use the courts to 0:08:09.280 --> 0:08:14.360 get their revenge, becoming vexatious litigants, filing lawsuit after lawsuit 0:08:14.480 --> 0:08:18.400 against anyone who says no to them. Guys like Robert 0:08:18.400 --> 0:08:21.239 Moller from a few weeks ago, the one time arms 0:08:21.240 --> 0:08:23.680 dealer who shipped hundreds of guns to Neo Nazis in 0:08:23.720 --> 0:08:28.520 South Africa. In his quieter older years, he seems to 0:08:28.560 --> 0:08:31.320 work out his anger by filing a constant stream of 0:08:31.400 --> 0:08:35.680 nuisance lawsuits. He filed a lawsuit against the hospital that 0:08:35.760 --> 0:08:38.800 didn't perform his elective surgery at the exact time they'd 0:08:38.840 --> 0:08:42.440 scheduled it. For lawsuits against the guys from the table 0:08:42.480 --> 0:08:45.679 tennis club who asked him to stop coming around because 0:08:45.679 --> 0:08:49.480 his behavior was frightening. A lawsuit against the state because 0:08:49.520 --> 0:08:51.080 he didn't think it was fair that he got a 0:08:51.120 --> 0:08:54.480 traffic ticket. A lawsuit against a restaurant for asking him 0:08:54.480 --> 0:08:56.720 not to let his dog touch the food on the buffet. 0:08:58.679 --> 0:09:01.959 Like I said, I'm still working on the taxonomy here, 0:09:02.840 --> 0:09:06.760 but I think these are all, to some degree, the 0:09:06.800 --> 0:09:11.000 same kind of guy. The common denominator is that they 0:09:11.040 --> 0:09:16.360 can't handle discomfort. They can't handle someone telling them no. 0:09:17.520 --> 0:09:21.000 They can't handle being wrong, they can't handle not being 0:09:21.040 --> 0:09:26.079 the protagonist of reality. This is their story and we're 0:09:26.120 --> 0:09:29.240 just the characters in it. We're supposed to behave the 0:09:29.280 --> 0:09:34.120 way he wants us to, and if we don't, his 0:09:34.240 --> 0:09:39.520 reaction is not going to be normal. And that's the 0:09:39.559 --> 0:09:43.920 mold that I think Michael Schuer fits into. He isn't, 0:09:44.559 --> 0:09:48.160 all things considered, really the kind of guy I'm interested in. 0:09:49.320 --> 0:09:51.840 This isn't the kind of story I would normally choose 0:09:51.880 --> 0:09:55.360 for an episode of this show, because, like I said, 0:09:56.520 --> 0:09:59.319 he wasn't in any kind of hate group and he 0:09:59.360 --> 0:10:04.440 didn't hurt any But I am interested in this kind 0:10:04.559 --> 0:10:08.360 of guy, the kind of guy whose reaction to a 0:10:08.400 --> 0:10:13.120 pretty normal life event is decidedly not normal at all. 0:10:14.280 --> 0:10:17.440 The kind of guy who showed no other outward signs 0:10:17.480 --> 0:10:22.600 of being violent or hateful, but when confronted with an obstacle, 0:10:23.520 --> 0:10:28.960 suddenly reveals a previously hidden and very peculiar interest in 0:10:29.040 --> 0:10:34.680 mass shootings and swastikas. But I guess we should start 0:10:34.679 --> 0:10:41.480 at the beginning. Michael Scheuer loved Disney. It had always 0:10:41.480 --> 0:10:45.239 been his dream to work for the company after graduating 0:10:45.240 --> 0:10:47.760 from Kent State in Ohio. He moved to Orlando to 0:10:47.800 --> 0:10:50.680 try to get us foot in the door. He started 0:10:50.720 --> 0:10:54.160 as a janitor and worked his way up, and on 0:10:54.200 --> 0:10:56.440 this front, I guess you do have to hand it 0:10:56.440 --> 0:10:59.839 to him, it looks like he did the work. He 0:11:00.120 --> 0:11:02.560 had a dream and he did the work to try 0:11:02.559 --> 0:11:05.880 to make it come true. He had a college degree, 0:11:06.640 --> 0:11:08.800 but he was willing to take an entry level job 0:11:09.200 --> 0:11:11.400 making up trash at a theme park if that's what 0:11:11.480 --> 0:11:16.080 it took to be close to Mickey Mouse. He continued 0:11:16.080 --> 0:11:18.720 working at Disney while he earned his business degree, and 0:11:19.000 --> 0:11:22.480 slowly but surely, he worked his way up from groundskeeper 0:11:22.800 --> 0:11:26.160 to cast member and eventually got an office job at Disney. 0:11:27.679 --> 0:11:30.280 By twenty eighteen, he was working as a financial systems 0:11:30.280 --> 0:11:34.439 analyst when COVID hit. His job was one of many 0:11:34.480 --> 0:11:37.199 that were cut by the company, and he spent the 0:11:37.320 --> 0:11:40.280 year that he was laid off trying anything he could 0:11:40.640 --> 0:11:44.400 to get back in and he was eventually rehired as 0:11:44.440 --> 0:11:47.280 part of the team doing technical support for computers installed 0:11:47.320 --> 0:11:51.440 on Disney cruise ships, and in twenty twenty four he 0:11:51.520 --> 0:11:54.319 was working on the team tasked with designing and updating 0:11:54.360 --> 0:11:57.480 the menus and menu signs used at Disney theme parks 0:11:57.480 --> 0:12:02.720 and resorts. In twenty twenty four, Michael Schuer's wife gave 0:12:02.760 --> 0:12:06.360 birth to their third child. I don't know if Michael 0:12:06.360 --> 0:12:08.960 Scheuer took advantage of the full eight weeks of paternity 0:12:09.080 --> 0:12:12.000 leave that Disney claims to offer, but I do know 0:12:12.040 --> 0:12:15.280 that he took paternity leave because it was just a 0:12:15.320 --> 0:12:17.920 few days after returning from that leave in June of 0:12:17.920 --> 0:12:24.280 twenty twenty four that the incident took place. What exactly 0:12:24.400 --> 0:12:30.080 happened is in dispute. According to his defense attorney, his 0:12:30.240 --> 0:12:36.520 version of events is this quote. Shortly after returning to work, 0:12:36.920 --> 0:12:40.080 mister Schuyer voiced a difference of opinion to his supervisor 0:12:40.440 --> 0:12:44.160 about a new process of menu creation. He believed his 0:12:44.200 --> 0:12:48.320 team agreed with him, but his supervisor did not. He 0:12:48.360 --> 0:12:52.360 met with his supervisor and a disagreement occurred. Mister Schuyer 0:12:52.400 --> 0:12:56.000 had a panic attack during the meeting. The next supervisor 0:12:56.080 --> 0:12:59.040 up the chain of command stated to mister Schuyer that 0:12:59.080 --> 0:13:02.480 he did not threaten his supervisor, but that mister Scheuer 0:13:02.559 --> 0:13:06.560 was going to be suspended. A sworn statement from the 0:13:06.559 --> 0:13:10.840 supervisor in question, though, reads in June twenty twenty four, 0:13:11.320 --> 0:13:14.679 Michael Scheuer was terminated from employment due to misconduct against 0:13:14.720 --> 0:13:18.720 me in which he threatened me at work, and the 0:13:18.760 --> 0:13:21.480 government was prepared to present to witness who would testify 0:13:21.559 --> 0:13:24.800 that his behavior had been aggressive and threatening in the 0:13:24.840 --> 0:13:29.200 meeting that led to his termination. And maybe that comes 0:13:29.200 --> 0:13:34.000 down to semantics. Maybe she perceived his conduct as threatening 0:13:34.800 --> 0:13:41.079 without him actually making a direct threat. That is technically 0:13:41.120 --> 0:13:43.760 different in the eyes of the law. But I think 0:13:43.800 --> 0:13:47.679 any reasonable person can understand that if you make your 0:13:47.720 --> 0:14:06.079 supervisor feel like she is in danger, you might get fired. 0:14:07.120 --> 0:14:10.720 He was initially just sent home and suspended, but after 0:14:10.760 --> 0:14:13.760 he sent an email to human resources described only as 0:14:14.160 --> 0:14:19.280 quote twenty four questions pertaining to the suspension, which I'm 0:14:19.320 --> 0:14:23.840 sure had a very normal tone, the decision was made 0:14:23.880 --> 0:14:28.160 to terminate his employment with Disney. And this is the 0:14:28.200 --> 0:14:31.000 point at which he crossed the weird little guy rubicon. 0:14:32.880 --> 0:14:37.600 He was upset. It wasn't fair. This was his dream. 0:14:38.080 --> 0:14:41.040 He loved Disney, he loved working for Disney, and he 0:14:41.120 --> 0:14:44.640 needed that job. He needed the health insurance, he had 0:14:44.640 --> 0:14:46.680 a family to take care of. For God's sake, they 0:14:46.840 --> 0:14:50.160 just didn't understand. If they would have heard him out, 0:14:50.840 --> 0:14:54.240 they would understand that they were wrong to fire him, 0:14:55.680 --> 0:14:59.240 but they wouldn't take his calls. He claims that he 0:14:59.280 --> 0:15:01.560 was unable to find an employment lawyer willing to take 0:15:01.600 --> 0:15:05.680 his case. He says he quote filed a complaint with 0:15:05.720 --> 0:15:09.160 the US Equal Employment Opportunity Commission but did not get 0:15:09.160 --> 0:15:13.680 a quick response. He felt isolated and depressed. He did 0:15:13.720 --> 0:15:18.320 not understand why nobody would speak with him. And this 0:15:18.360 --> 0:15:22.080 is the explanation his attorney offered for what happened next quote, 0:15:22.960 --> 0:15:26.480 he turned to what he thought would get Disney to 0:15:26.680 --> 0:15:30.960 respond to him. I'm not an expert in employment law, 0:15:31.800 --> 0:15:34.040 but I did look up how long it usually takes 0:15:34.080 --> 0:15:37.280 to get a response from the Equal Employment Opportunity Commission 0:15:37.360 --> 0:15:41.200 if you file a complaint online, The law says they 0:15:41.240 --> 0:15:43.720 have ten days to send notice of the complaint to 0:15:43.760 --> 0:15:47.280 your former employer, and then once they do that, the 0:15:47.320 --> 0:15:51.080 employer has thirty days from that date to respond to it. 0:15:52.440 --> 0:15:55.840 The average complaint takes about ten months to resolve start 0:15:55.840 --> 0:16:00.000 to finish. But he didn't even wait thirty days before 0:16:00.080 --> 0:16:03.840 he decided to change tactics. He started trying to get 0:16:03.840 --> 0:16:08.200 Disney's attention his own way less than three weeks after 0:16:08.200 --> 0:16:13.000 he was fired, and so you might be thinking, oh, 0:16:13.000 --> 0:16:16.120 he probably sent some weird emails to his former coworkers, right, 0:16:17.120 --> 0:16:20.640 Maybe he started showing up outside the office or making 0:16:20.720 --> 0:16:24.960 a lot of phone calls. And those are all reasonable guesses. 0:16:25.680 --> 0:16:29.240 Those are things you might do if your stated goal 0:16:29.520 --> 0:16:35.200 was to get someone's attention. No, what he decided to 0:16:35.240 --> 0:16:40.400 do is much weirder, and honestly, I don't understand why 0:16:40.400 --> 0:16:43.600 he thinks we would believe his claim that this was 0:16:43.640 --> 0:16:45.440 the only thing he could think of that would get 0:16:45.440 --> 0:16:50.840 them to call him again. From his lawyer quote, he 0:16:50.920 --> 0:16:54.920 started altering Disney's menus to try to get their attention 0:16:55.480 --> 0:16:59.960 and respond to him. Now, remember that was his job 0:17:00.240 --> 0:17:03.520 before he was fired. He worked on the team responsible 0:17:03.520 --> 0:17:06.960 for designing, editing, and updating the files used to print 0:17:06.960 --> 0:17:10.400 the menus at restaurants and cafes at Disney parks and hotels. 0:17:11.840 --> 0:17:14.240 Once the files were approved by the team at Disney, 0:17:14.320 --> 0:17:17.320 the physical menus were printed by a Minnesota based print 0:17:17.359 --> 0:17:22.520 and marketing company called Tailor Corporation. Just a few weeks 0:17:22.560 --> 0:17:26.320 after being fired, Scheyer logged into the online application used 0:17:26.320 --> 0:17:30.480 by the print company to manage the menu files. A 0:17:30.520 --> 0:17:32.879 lot of the news coverage about this case refers to 0:17:32.880 --> 0:17:36.760 what he did as hacking, in which I didn't realize 0:17:36.800 --> 0:17:40.159 is technically the correct word for what happened. Hacking doesn't 0:17:40.200 --> 0:17:44.800 necessarily require any particular set of skills or you know, 0:17:44.840 --> 0:17:47.680 it's not like a nineties movie where they're tippy tapping 0:17:47.760 --> 0:17:50.080 on the keyboard as all the numbers flash on the screen. No, 0:17:50.119 --> 0:17:54.880 it just means any unauthorized access to a computer device 0:17:55.040 --> 0:17:58.720 or network. And he definitely was not authorized to be 0:17:58.760 --> 0:18:02.560 logging in. But the company had actually just forgotten to 0:18:02.640 --> 0:18:07.320 change the password to the administrative account, and once he 0:18:07.400 --> 0:18:11.240 logged into that administrator's account, he created a new employee 0:18:11.240 --> 0:18:15.160 profile for himself using a fake name, and then using 0:18:15.160 --> 0:18:19.080 that account with a fake name, he logged in and 0:18:19.119 --> 0:18:22.919 he went to town. He replaced all of the font 0:18:23.000 --> 0:18:27.679 files for all of the menus in the system, and 0:18:27.760 --> 0:18:32.760 this sounds like hell. He didn't just change the fonts 0:18:32.760 --> 0:18:35.560 that were used in the text of the menus. He 0:18:35.680 --> 0:18:39.640 changed the source files for all of the fonts in 0:18:39.840 --> 0:18:44.880 every menu, so all of the names of the fonts 0:18:45.040 --> 0:18:48.119 still appeared to be correct, but those names were now 0:18:48.280 --> 0:18:53.520 connected to a corresponding file for a different font, and 0:18:53.680 --> 0:18:57.119 he changed most of those fonts to wing dings the 0:18:57.200 --> 0:19:01.880 font that's just weird little symbols. And because he'd altered 0:19:01.920 --> 0:19:06.119 the files themselves, the system then started pushing out this 0:19:06.320 --> 0:19:10.000 change to every single one of the thousands of files 0:19:10.080 --> 0:19:14.280 ever uploaded to this system, and this rendered the entire 0:19:14.359 --> 0:19:19.320 application completely useless for at least a week. And so 0:19:19.440 --> 0:19:22.680 because this took the entire system offline and rendered every 0:19:22.720 --> 0:19:29.320 single file useless, obviously they noticed this immediately. Disney pretty 0:19:29.359 --> 0:19:31.600 quickly tracked down the source of the problem and they 0:19:31.720 --> 0:19:35.879 changed all the passwords so this couldn't happen again. But 0:19:35.960 --> 0:19:39.840 that didn't really stop him. So now that one avenue 0:19:39.840 --> 0:19:42.879 had been closed off, he just moved to a different strategy. 0:19:44.040 --> 0:19:46.879 If he couldn't log in, he would make sure no 0:19:46.920 --> 0:19:52.360 one else could either. He started small targeting those immediate supervisors, 0:19:52.359 --> 0:19:55.639 the ones who'd fired him, and he used their log 0:19:55.680 --> 0:20:01.080 in names and entered random, incorrect passwords. These repeated bad 0:20:01.119 --> 0:20:04.240 attempts to access the system, which would then trigger the 0:20:04.280 --> 0:20:08.240 accounts to be locked out. At first, he was just 0:20:08.280 --> 0:20:12.240 doing this manually, so you have to imagine him sitting 0:20:12.240 --> 0:20:16.080 alone at his computer while his chronically ill wife is 0:20:16.119 --> 0:20:18.280 trying to take care of their three young children, one 0:20:18.280 --> 0:20:21.000 of whom is a newborn baby, and he's just sitting 0:20:21.000 --> 0:20:24.840 there at his computer again and again and again, typing 0:20:24.840 --> 0:20:28.440 in a random keyboard smash password and hitting enter over 0:20:28.480 --> 0:20:31.679 it over and over again so that his old boss 0:20:31.840 --> 0:20:36.680 can't access her email. Throughout August and September of twenty 0:20:36.720 --> 0:20:40.720 twenty four, these attacks escalated, and he eventually wrote a 0:20:40.720 --> 0:20:44.000 script to automate the process of making these thousands and 0:20:44.119 --> 0:20:49.400 thousands of login attempts. On one day alone, he made 0:20:49.480 --> 0:20:53.720 eight thousand login attempts across accounts belonging to the four 0:20:53.760 --> 0:20:58.000 people that he thought were responsible for firing him, and 0:20:58.040 --> 0:21:00.800 he eventually branched out to fourteen day for An accounts, 0:21:01.359 --> 0:21:03.320 all of which belonged to members of the team he'd 0:21:03.359 --> 0:21:07.119 worked on before he was fired. Over the course of 0:21:07.160 --> 0:21:11.440 about a month, he made one hundred thousand log in attempts, 0:21:12.000 --> 0:21:14.439 locking these employees out of their accounts for days at 0:21:14.440 --> 0:21:18.159 a time. And around the same time he's ramping up 0:21:18.200 --> 0:21:21.800 these attacks on his former coworkers accounts, he found a 0:21:21.840 --> 0:21:26.040 new way to mess with the menus Disney had changed 0:21:26.080 --> 0:21:28.760 all of the passwords, so he couldn't access the application 0:21:28.960 --> 0:21:32.720 that was used by the Disney production team anymore. But 0:21:32.800 --> 0:21:36.160 the company that actually prints the finished menu files had 0:21:36.160 --> 0:21:40.080 their own system. All finished menu files had to be 0:21:40.160 --> 0:21:44.159 uploaded to the print company through a secure file transfer protocol. 0:21:45.600 --> 0:21:48.760 So he made his own menu files and uploaded them 0:21:48.800 --> 0:21:55.280 directly to the printer. His initial attempt to get Disney's 0:21:55.280 --> 0:21:59.679 attention had made the menus unusable. They had nonsense fonts, 0:21:59.680 --> 0:22:02.280 they would load the image files, or they just came 0:22:02.359 --> 0:22:07.000 up as blank pages, so everyone noticed this. This was 0:22:07.000 --> 0:22:11.080 a very obvious attempt, But this time around he was 0:22:11.119 --> 0:22:14.639 a lot more subtle. If you're just looking quickly at 0:22:14.680 --> 0:22:18.920 these files, you wouldn't notice there was anything wrong. Honestly, 0:22:18.960 --> 0:22:20.560 they might have even made it all the way through 0:22:20.560 --> 0:22:25.200 a proofreading process if you weren't being really meticulous. Because 0:22:25.200 --> 0:22:29.320 he's just changing individual words. He's changing the prices by 0:22:29.359 --> 0:22:32.240 a dollar or two. He removed an asterisk, he changed 0:22:32.280 --> 0:22:38.320 the QR codes. They're just little changes, almost like maybe 0:22:38.359 --> 0:22:43.680 he didn't want them to notice this time, And honestly, 0:22:43.760 --> 0:22:47.399 some of them are kind of funny. I mean, overall, yes, 0:22:47.480 --> 0:22:49.720 this is a bad situation. He should not have done 0:22:49.760 --> 0:22:53.520 any of this, But if he'd just stuck with immature 0:22:53.520 --> 0:22:57.159 little jokes, the whole story would have a really different tone, 0:22:58.520 --> 0:23:01.840 because it's hard to be mad about stuff like changing 0:23:02.119 --> 0:23:06.399 cheesy grits to cheesy shits on the menu for a 0:23:06.440 --> 0:23:10.880 cafe at Disney's old Key West resort, or changing shellfish 0:23:10.920 --> 0:23:14.560 to hellfish, or changing the description of an English breakfast 0:23:14.640 --> 0:23:19.000 tea from a psalm tea to just ass tea. Is 0:23:19.040 --> 0:23:22.560 a little bit funny. I'm not mad imagining an old 0:23:22.600 --> 0:23:25.800 couple in Key West seeing cheesy shits on their menu. 0:23:26.720 --> 0:23:30.800 It's whatever. But unfortunately, most of the changes were not 0:23:31.400 --> 0:23:35.840 funny swear words. Most of the changes were modifications to 0:23:35.880 --> 0:23:40.080 the allergen information on menu items across multiple dining locations, 0:23:40.720 --> 0:23:44.600 removing alerts on menu items that contained potentially fatal food 0:23:44.640 --> 0:23:49.560 allergens like peanuts. On other menus, he altered the region 0:23:49.680 --> 0:23:54.280 listed for wine selections. That one sounds mostly harmless to me. 0:23:55.240 --> 0:23:58.160 Not a wine snob, so I don't really care where 0:23:58.160 --> 0:23:59.879 the grapes were grown. I'm not going to pretend I 0:24:00.040 --> 0:24:04.000 can taste the difference. But he swapped out the actual 0:24:04.080 --> 0:24:08.120 locations for places where well known mass shootings have occurred. 0:24:09.359 --> 0:24:13.520 In one case, the shooting had been painfully recent. He 0:24:13.640 --> 0:24:18.560 swapped out Willamette Valley. On one wine for Appalachi High 0:24:19.880 --> 0:24:23.560 an unmistakable reference to a school shooting in Georgia that 0:24:23.680 --> 0:24:25.879 it only just happened the week that he did that. 0:24:27.520 --> 0:24:41.360 On another menu, he uploaded a small image of a swastika. 0:24:45.480 --> 0:24:49.000 He would later claim that he never actually intended for 0:24:49.119 --> 0:24:52.960 any of these altered files to get printed. He said 0:24:52.960 --> 0:24:55.720 that he knew Disney employees reviewed every file and that 0:24:55.760 --> 0:24:58.399 they would catch the alterations before they went to the printer. 0:25:00.119 --> 0:25:04.639 He wasn't actually trying to poison any children with peanut allergies. 0:25:04.680 --> 0:25:08.680 He just wanted Disney to call him. He didn't want 0:25:08.680 --> 0:25:11.080 these menus to end up in anyone's hands. He just 0:25:11.160 --> 0:25:16.520 wanted attention. But that claim falls apart. By the time 0:25:16.560 --> 0:25:20.080 he switched to a new mode of attack, he uploaded 0:25:20.080 --> 0:25:23.439 altered files directly into the server that functioned as the 0:25:23.480 --> 0:25:27.800 print queue for the company that printed the menus. So 0:25:27.840 --> 0:25:30.920 by that point in the process, the printer is receiving 0:25:30.960 --> 0:25:33.359 what they believe to be a file that has been 0:25:33.440 --> 0:25:37.920 proofed and approved and is ready to print. And they did, 0:25:37.960 --> 0:25:42.200 in fact print thousands of these altered menus and signs. 0:25:43.320 --> 0:25:45.960 Although by the time they did print these the investigation 0:25:46.119 --> 0:25:48.520 was coming to an end, and the affected items were 0:25:48.680 --> 0:25:52.760 destroyed before they were shipped out, and he wasn't hard 0:25:52.760 --> 0:25:58.080 to catch. Immediately after the initial unauthorized access was detected, 0:25:58.880 --> 0:26:04.240 Disney launched an internal investigation. Multiple employees interviewed during this 0:26:04.359 --> 0:26:07.800 process brought up the fact that Michael Scheuer had just 0:26:07.880 --> 0:26:12.320 been fired. Further investigation showed the attacks had all been 0:26:12.400 --> 0:26:16.240 made by someone using a VPN to mask their IP address, 0:26:17.000 --> 0:26:20.320 but when they looked further back into company logs, they 0:26:20.359 --> 0:26:23.840 found that before he was fired, Michael Scheuer had accessed 0:26:23.840 --> 0:26:27.159 his work email from home, and when he did that, 0:26:27.200 --> 0:26:31.000 he had his VPN on, so he managed to mask 0:26:31.040 --> 0:26:35.320 the true IP address of his home computer, but because 0:26:35.320 --> 0:26:38.320 he used the same VPN throughout, he was still using 0:26:38.320 --> 0:26:43.960 an IP address that was provably connected to him. On 0:26:44.000 --> 0:26:47.919 September twenty third, twenty twenty four, multiple members of the 0:26:47.960 --> 0:26:51.719 menu production team were locked out of their accounts again. 0:26:53.000 --> 0:26:56.760 Someone was making hundreds and hundreds of attempts to access 0:26:56.800 --> 0:27:01.920 their accounts using incorrect passwords. At twelve forty one pm 0:27:01.920 --> 0:27:06.200 that afternoon, FBI agents knocked on Michael Schuer's front door. 0:27:07.560 --> 0:27:09.639 They had a warrant to search his home and seize 0:27:09.680 --> 0:27:15.080 his computers. At twelve forty six pm, the wave of 0:27:15.119 --> 0:27:21.600