99: The Spy

Summary

Darknet Diaries – Episode 99: The Spy

Host: Jack Rhysider
Air Date: August 17, 2021

---

Overview

In “The Spy,” Jack Rhysider delves into a real-world tale of modern espionage involving private intelligence firms, famous journalists, and spy-versus-spy tactics in New York City. The episode follows Igor, a Ukrainian immigrant turned private investigator, who unwittingly finds himself working for nefarious clients—including Black Cube, a notorious Israeli intelligence firm—spying on prominent reporters and cybersecurity researchers. The story escalates into an elaborate sting operation, with both sides deploying intricate surveillance, ultimately unraveling the concealed web of corporate and criminal intrigue behind these operations.

---

Key Discussion Points & Insights

1. Introduction to Tradecraft and Espionage

• Jack sets the stage with classic spy “tradecraft” examples, such as using shoelaces to convey hidden messages.
• Quote:

  “I love a good spy story. It's so intriguing for me to think that someone among us might not be who we think they are.” (Jack, 00:00)

---

2. Meet Igor: Private Investigator in NYC

• Jack is contacted on Twitter by Igor, offering his surveillance skills.
• Igor describes his day-to-day work: conducting insurance fraud surveillance in Queens, New York.
• Details of typical surveillance tactics: working with partners, covering shifts, and waiting patiently for targets to emerge.
• Quote:

  “Sitting in cars, watching people and buildings. That's what he does all day and sometimes all night. He sees a lot.” (Jack, 06:30)

---

3. Enter Black Cube

• Igor recounts doing subcontract surveillance jobs for Black Cube, an Israeli intelligence company known for employing ex-Mossad agents and conducting high-level business and political espionage.
• Initially, Igor is unaware he’s really working for Black Cube, since the jobs are contracted via his boss, Roman Haken.
• Quote:

  “We were doing different types of jobs for them, all involving some form of surveillance. And at some point, they assigned us to follow Ronan Farrow and Jodi Kantor.” (Igor, 08:26)

---

4. The Harvey Weinstein-Ronan Farrow Black Cube Operation

• Igor begins noticing his targets are high-profile journalists: Ronan Farrow and Jodi Kantor.
• Black Cube deploys a social engineering geolocation attack: sending spam texts to Ronan Farrow, which, upon engagement, retrieves Farrow's location.
• Igor reads Farrow’s articles and slowly realizes his surveillance ties into Farrow’s exposure of Harvey Weinstein and Black Cube itself.
• Upon confirmation from his boss, Igor discovers he’s helping Harvey Weinstein’s efforts to discredit journalists and suppress sexual harassment stories.
• Igor, disturbed by the job, attempts to alert law enforcement and ultimately flips, secretly informing Farrow about Black Cube’s surveillance.
• Quote:

  “I felt very uneasy being sent to do surveillance on journalists...these are publications that I respect.” (Igor, 11:58)
  “I decided to call Ronan Farrow. So I contacted Farrow and we met up. And I said, hey, I've been following Jodi Kantor. I was assigned to follow you.” (Igor, 13:29)
  “To be assigned to spy on Ronan Farrow, but then completely flip and actually call Ronan to tell him that you're spying on him. That must have been some meeting.” (Jack, 13:49)

---

5. New Target: Citizen Lab and John Scott-Railton

• Black Cube’s scope broadens. Igor is roped into spying on John Scott-Railton (JSR) of Citizen Lab, who investigates abusive spyware developers like NSO Group.
• Black Cube operatives attempt to target JSR by inventing a bogus persona (“Michel Lambert”) and trying to lure JSR into a recording trap—hoping he’ll say something compromising or damaging about Citizen Lab.
• JSR, catching on, sets up counter-surveillance and enlists Rafael Satter from the Associated Press to help ambush “Michel.”
• Quote:

  “This person is obviously coming under a false pretense, and they may be coming with the objective of...harming me, harming my colleagues' reputations.” (JSR, 25:27)

---

6. The Sting Operation at the Restaurant

• JSR prepares a covert camera in his necktie and arrives at a prearranged meeting with “Michel” at a swanky NYC restaurant.
• Rafael Satter and an AP videographer covertly document the encounter from a nearby table.
• “Michel” tries various tactics, including small talk in French, crude attempts to elicit racist remarks, and persistent questioning about Citizen Lab. He relies on cue cards coded by color for questions.
• JSR quickly realizes the operative is bumbling and his cover is thin.
• After about 90 minutes, Satter confronts “Michel” on camera about his fake identity and company, precipitating the operative’s panicked attempt to escape.
• Memorable Moment:

  “There's almost like a yakety sax moment as he's being followed around by me, by the cameraman, by Satter asking him all these questions...He finally spots an open door...and that's the last we see of this guy.” (JSR, 44:08)

---

7. Aftermath: The Unmasking of Black Cube’s “Bumbling Spy”

• Igor, outside, captures surveillance photos of everyone involved, all while still thinking he's working for Black Cube.
• He later forwards these to Farrow, who identifies everyone for him, completing the circle of spy versus spy.
• Investigative journalism reveals “Michel” to be Aharon Almog-Assouline, a former Israeli intelligence officer.
• Black Cube attempts to distance itself from any illegal actions, blaming the New York subcontractors for unlawful data collection.
• Igor’s decision to refuse a polygraph severs his relationship with the surveillance firm.
• Quote:

  “They had this concept that they believed journalists would pay for a story or pay a source to be a source. So whatever I told him, I said, listen, they didn't pay me anything. I'm worthless.” (Igor, 63:25)

---

8. Themes and Reflections

• Journalism & Whistleblowing: Igor’s personal ethics ultimately lead him to become a whistleblower, switching sides in the battle between press freedom and corporate espionage.
• Surveillance Techniques: Both sides employ classic and modern tradecraft—tinted car windows, phone-based geolocation traps, covert audio and video, and misdirection.
• Spy Culture vs. Modern Reality: The episode exposes the messy and often amateurish reality of private intelligence work.
• Emotional Fallout:

  “I had spent years of my life working with victims of spyware...What this moment gave me was a bit of a sense of what that feels like to be in a city and to not know whether someone is following you.” (JSR, 72:34)

---

Notable Quotes & Timestamps

• “I love a good spy story. It's so intriguing for me to think that someone among us might not be who we think they are.” (Jack, 00:00)
• “I felt very uneasy being sent to do surveillance on journalists...these are publications that I respect.” (Igor, 11:58)
• “To be assigned to spy on Ronan Farrow, but then completely flip and actually call Ronan to tell him that you're spying on him. That must have been some meeting.” (Jack, 13:49)
• “There's almost like a yakety sax moment as he's being followed around by me, by the cameraman, by Satter asking him all these questions...” (JSR, 44:08)
• “They had this concept that they believed journalists would pay for a story or pay a source to be a source. So whatever I told him, I said, listen, they didn't pay me anything. I'm worthless.” (Igor, 63:25)
• “What this moment gave me was a bit of a sense of what that feels like to be in a city and to not know whether someone is following you, to have the sense that there's a well-resourced entity that's trying to dig up dirt on you...” (JSR, 72:34)

---

Timestamps for Important Segments

• Spy Tradecraft & Introduction (00:00–03:00)
• Igor’s Life as a Private Eye (05:01–06:53)
• Black Cube’s Involvement & Targeting Journalists (07:04–11:09)
• Igor Flips, Becomes Whistleblower (13:29–14:48)
• The John Scott-Railton Operation Setup (16:28–20:00)
• Restaurant Sting & Confrontation (25:27–44:43)
• Aftermath, Unmasking, and Black Cube’s Response (59:15–62:42)
• Reflections on Surveillance and Its Toll (68:35–73:51)

---

Memorable Moments

• JSR assembling a DIY video necktie from hotel gadgets (26:24)
• The chaotic, slapstick ending to the restaurant sting as “Michel” flees (44:08)
• Igor’s meticulous tactics for spotting counter-surveillance in NYC (51:17)
• Both spies and journalists ending up in the same photographs, unraveling the web of watchers and watched

---

Tone & Language Notes

Jack’s narration maintains a tone of awe and curiosity, mixed with the dry wit characteristic of Darknet Diaries. Igor brings a streetwise, world-weary candor (“Are you seriously, are you a spy? And then, look, it has his name tag...”). JSR delivers careful, analytical insights tinged with a sense of personal violation and resolve.

---

Conclusion & Teaser

The episode concludes with unresolved questions about the true masterminds and motivations behind these espionage operations—hinting at ties to NSO Group, a subject for the following episode. Jack’s parting words echo both admiration for those under pressure to do the right thing, and the chilling atmosphere of being hunted on digital and physical frontiers.

---

For more on this tale, check out Ronan Farrow’s podcast “Catch and Kill,” and stay tuned for part two, as Jack digs into the NSO Group—the world’s most infamous spyware company.

Transcript

[Jack Rhysider]

I love a good spy story. It's so intriguing for me to think that someone among us might not be who we think they are. They're faking their name, their background, and their purpose, trying to get information of some kind. And it's always interesting to see what kind of methods these people use to communicate right in plain sight. But to the untrained eye, you have no idea that a message is being sent. Like, for instance, there's been times when spies would tie their shoelaces in specific way to communicate certain things. So, like, if your shoelaces had extra knots in them, it could mean something like, don't approach me. Or if the shoe was tied with laces crossed over it or under it, that might mean, okay, all clear, come give me the message. Or maybe if the shoe was untied, it means you've been spotted, get out. And what's cool about this trick is you can have one message on one shoe and a different message on another. This way, the person could send a different message depending on the situation. Like if one shoe said wait and the other shoe said all clear, the person could just put out their shoe that had the right, right message on it at the time and cover up the other shoe somehow, like by sitting.

[John Scott Railton]

On it or something.

[Jack Rhysider]

I love hearing about spy tricks and methods that they call tradecraft. And in this episode, we'll hear a story about a spy and how they operate. These are true stories from the dark side of the Internet. I'm Jack Resider. This is Darknet Diaries. This episode is sponsored by Deleteme. Deleteme makes it easy, quick, and safe to remove your personal data online. At a time when surveillance and data breaches are common enough to make everyone vulnerable, Deleteme does all the hard work of wiping you and your family's personal information from data brokers websites, and then continues to monitor and remove personal information that you don't want on the web. Plus, the New York Times wirecutter has named Deleteme their top pick for data removal services. Privacy is super important topic to me. So a few years ago I signed up and Deleteme immediately got busy scouring the Internet from my name and gave me reports on what they found. Then they got busy deleting things. And it's great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me now at a special discount for my listeners. Get 20% off your delete Me plan when you go to join deleteme.com darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off is to go to join deleteme.com darknetdIaries and enter code DD20 at checkout. That's join deleteme.com darknetDIARIES code-DD20 this episode is sponsored by my friends at Black Hills Information Security. Black Hills has earned the trust of the cybersecurity industry since John Strand founded it in 2008. Through their anti siphon training program, they teach you how to think like an attacker. From soc analyst skills to how to defend your network with traps and deceptions. It's hands on, practical training built for defenders who want to level up. Black Hills loves to share their knowledge through webcasts, blogs, zines, comics and training courses, all designed by hackers for hackers. But do you need someone to do a penetration test to see where your defenses stand? Or are you looking for 24. 7 monitoring from their active SOC team? Or maybe you're ready for continuous pentesting where testing never stops and your systems stay battle ready all the time. Well, they can help you with all of that. They've even made a card game. It's called Backdoors and Breaches. The idea is simple. It teaches people cybersecurity while they play. Companies use it to stress test their defenses. Teachers use it in the classroom to train the next generation. And if you're curious, there's a free version online that you can try right now. And this fall they're launching a brand new competitive edition of Backdoors and Breaches where you and your friends can go head to head hacking and defending just like the real thing. Check it all [e-mail] darknet that's blackhillsinfosec.com Darknet okay, I don't even know where to start with this story. I've got so much tape here to play for you, it's crazy. In fact, I'm pretty sure I'm not gonna be able to fit it all in one episode. So this is just gonna be a two parter. But yeah, seriously, where do I even start? Okay, okay, I'll start with my favorite part, which is not the beginning of the story. Alright, so one day on Twitter, I got this message from a guy named Igor. He said, I listen to your episodes. Very good pods. Then he says, if I can ever help with anything, let me know. I said, okay, thanks. Well, what are you good at? He says he does surveillance in New York City. And while I don't need anyone to do surveillance for me in New York City, I was immediately curious to hear more. So I called him up.

[Igor]

Hello. Hey, this is Jack. How are you?

[Jack Rhysider]

Igor.

[Igor]

Yeah, this is Igor. Nice to meet you.

[Jack Rhysider]

Nice to meet you too. What are you doing now?

[Igor]

Right now I'm sitting in my car in Queens in New York. I'm on the surveillance, just waiting.

[Jack Rhysider]

What are you surveilling?

[Igor]

Oh, this is an insurance defense job. So we're waiting for a guy who has claimed an injury and he's receiving some benefits from the insurance carrier. And they want to see how he's actually physically doing if it's true with what he's claiming. And, you know, their goal is to see exactly what's the real situation, and then if it doesn't match, they have a reason to offer him less money or jam him in a corner and tell him they're not going to give him anything or, you know, decline his claim, etc.

[Jack Rhysider]

And how can you do that and talk on the phone at the same time?

[Igor]

Right now, the person I'm watching, he's inside his house. So I'm waiting for him to leave until he comes out of his house, gets in his car, starts the car. I know him already. So he warms up the car. So I'll have about five, six minutes to react. So I'll be able to say, jack, I'm gonna have to go in a few minutes. But I'm also working with another, with another guy. So we have two sets of eyes on the house and the car.

[Jack Rhysider]

That's how I met Igor. Igor's a Ukrainian immigrant and he's a private eye in New York City. Sitting in cars, watching people and buildings. That's what he does all day and sometimes all night. He sees a lot. So naturally I was curious and fascinated. I asked if he has any interesting stories from doing this kind of work and oh boy, does he ever.

[Igor]

So I, I was working with a friend of mine, a guy I knew for many years as a subcontractor, and we were working for Black Cube, which is an Israeli intelligence company.

[Jack Rhysider]

Wait, what? Black Cube, the Israeli intelligence company. I'm not familiar with them. So let's take a quick detour and listen to some news clips to hear who Black Cube is. Behind a heavy locked door, a high.

[Igor]

Tech environment, and also the salary and.

[John Scott Railton]

Benefits of the group of brilliant people who sit there.

[Igor]

Some of them are graduates of the.

[Jack Rhysider]

Mossad and other classified units, but the product which they are producing can be dark and much more dangerous than what they imagine.

[Igor]

They are called Black Cube, and their.

[John Scott Railton]

Official goal is to provide business intelligence.

[Jack Rhysider]

That was a clip from the Israeli TV show ufta, and the reporter is Ilana Dayan. In that episode, she revealed that Black Cube was hired by people to carry out different spying campaigns. Like, sometimes billionaires hire Black Cube to spy on political opponents. So sometimes foreign countries will hire Black Cube to spy on their adversaries. But in this case, Black Cube was contacting Igor's boss to do some spying for them. This is likely because Black Cube probably doesn't have permission to do surveillance in New York. So they contracted the work to two New York surveillance guys, Igor and his boss. And see, Igor did not know he was working for Black Cube at this point. He was just working for a guy named Roman Hagen. And it was this Hagen guy who was being contracted by Black Cube.

[Igor]

And we were doing different types of jobs for them, all involving some form of surveillance. And at some point, they assigned us to follow Ronan Farrow and Jodi Cantor.

[Jack Rhysider]

Whoa, wait a minute. These are some famous names I recognize. Ronan Farrow and Jodi Cantor are both journalists for the New York Times. And Ronan Farrow's parents are Mia Farrow and Woody Allen. At first, Igor didn't know where these people would be, so he just went to their house and watched their movements from the street.

[Igor]

And my boss, Roman Haken, sent me the pictures with the pin drops.

[Jack Rhysider]

Pin drops are locations on a map where these two people are.

[Igor]

I was sitting on Jodi Cantor's house, and while I was at Jodi Cantor's house, Haken messaged me and says, hey, the client has new information you need to go to. You need to go to the city. We're going to try to get Ronan Farrow's location. So let's meet in the city. I'm at a dentist. Once we get his location, we'll. We'll. We'll go from there. And I said, okay, cool, I'll head to the city. We. We made a little plan. Like, I'll head to Ronan Farah's house, and Haken would come to the city, and he would go to the area closer to downtown. So we would kind of, you know, whenever we got the location, we would not be too far away from any potential spot where Farrell may be.

[Jack Rhysider]

They were expecting more pin drops from Black Cube to know the exact location of where Ronan Farrell was.

[Igor]

You know, Black Cube is a private intelligence company, so they operate in a. In a compartmentalized kind of basis. Haken Wouldn't tell me exactly where they're coming from. But he explained the method, the method to me. And the method was that a text message with some sort of an annoying spam would be sent to Ronan Farrow. Pharaoh would be offered two options. Yes to receive more spam. No to stop receiving spam. He replies yes or no. The geolocation gets received with the reply. So it's not a constant tracking, but whenever a target replies, the geolocation comes with the reply. And they were able to do it a couple of times.

[Jack Rhysider]

So they drive into downtown New York City to look for Ronan Farrow, but they never actually find him. But Igor is a curious person and started trying to figure out why someone might be paying him to spy on Ronan Farrow. So he starts reading all these articles that Pharaoh is putting out. One of the articles he publishes says Ronan thinks he's being watched by Black Cube. This is when Igor connected the dots.

[Igor]

And I went to my boss, my friend, my boss, Roman Haken, and I confronted Haken and he confirmed that we're working for Black Cube and in fact, that we are working on the Harvey Weinstein story.

[Jack Rhysider]

Ronan Farrow was doing a story on Harvey Weinstein, who was accused of sexually harassing women in the Hollywood movie industry. Well, his investigation uncovered that Harvey Weinstein had hired Black Cube to spy on his victims that he sexually assaulted to try to find information on them and discredit them. Somehow Weinstein discovered that Ronan Farrow was working on the story and hired Black Cube to also spy on Farrow to try to discredit him too. Igor realized that he was wrapped up in all this and that, yeah, he was actually working for Harvey Weinstein.

[Igor]

I felt very uneasy being sent to do surveillance on journalists because, you know, these are publications that I respect. The New Yorker and the New York Times. I've been reading the New York Times since I was in high school. It was very. It was a very important thing in my life. Like, I enjoyed it. I thought it's very, you know, it's a very good, informative paper. I always thought it's a cool model, you know, all the news that's fit to print. So I felt uneasy. And in my mind I was thinking, I have to follow through with this. But I think what we're doing could potentially be, you know, a negative thing because I was told that our job was to ascertain their sources. And they knew that if we're looking for sources of two different journalists and two different publications, it's either, you know, it could be used to scoop them, but it could also be probably used to basically kill the story or to damage them in some way. And I already knew that we're working for a company that's a little bit iffy, Kind of was on guard, but I went through with it anyways, and they said, okay, whatever, I'll continue. No problem. We continued working together. We were doing other jobs for Black Cube, and I tried to contact law enforcement with very little success. I tried to get advice from friends who knew people in law enforcement, and, like, nothing panned out of it. So at some point, I felt that there was no outlet for me to go to. To kind of expose this problem of a private intelligence company following journalists for a rapist to be able to kill their story. And I decided to call Ronan Farrow. So I contacted Pharaoh and we met up. And I said, hey, I've been following Jodi Cantor. I was assigned to follow you. Wow.

[Jack Rhysider]

To be assigned to spy on Ronan Farrow, but then completely flip and actually call Ronan to tell him that you're spying on him. That must have been some meeting. And as the two talked, Ronan did confirm he was receiving a lot of spam text. And Igor explained that's how they knew where he was.

[Igor]

So Ronan Farrow, I thought I was going to talk to him and say, hey, we followed you. Your hunch is right. Be careful. Black Cubes seem like bad people. Nice to meet you. Good luck. Maybe next time if I ever see you sign the book that you wrote. I bought his book and he says, I'm writing a book about this Weinstein thing. You want to stay in touch and kind of help me. I said, okay, I'll help you. I said, you seem like a nice guy. But he convinced me a little bit. And I thought it's a very noble cause.

[Jack Rhysider]

So this is how Igor sort of switched sides. One day doing dirty work for Harvey Weinstein and the next, helping journalists like Ronan Farrow out.

[Igor]

After this, you know, after meeting with Farrow, I'm talking to him periodically, and I'm sharing information of what work I'm doing with Haken for Black Cube. And I mean, I'm sharing with him almost like immediately whenever I have something for Black Cube, I share with Pharaoh. He tries to figure out if this is relevant to him or to something he's working on or whatever. One day in January, I get, you know, with Haken, and Haken tells me that he has to cover a job for Black Cube, but he can't make it because he has plans with his Daughter. And I said, hey, you know, I'm free. I could, you know, it's an evening job or whatever. It's a late afternoon job. I said, if you want, I'll fill in for you. He says, no, it's a very important job. I have to be there myself. I said, well, why don't you tell the client you'll go there with me, and when you have to leave, you go hang out with your daughter and I'll go and I'll stay in your place. And we, you know, we agree on this plan. We head into the city to the Peninsula Hotel, and Hagen tells me the agent will be there. You already know him. He's the guy that you saw last summer that wears a goatee and glasses. That's basically kind of how he described him. Because they didn't use names. They never told me any names. They were very secretive about that. And I said, okay, I know that guy. I've seen him multiple times. I said, okay, Roman, I recognize who you're talking about. Then he showed me a picture of John Scott Railton, and he said, this is the target. So this is who is going to be at the meeting. Who? Black Cubist target.

[Jack Rhysider]

Oh, John Scott Railton. JSR is the target. That name is very familiar. Actually, in Darknet Diaries episode 79 called Dark Basin, I interviewed John Scott Relatin to hear about how a private intelligence company tried to hack and steal information from certain targets. John works for Citizen Lab and does investigative work to try to uncover hacking campaigns. And of course, when he publishes this work, those companies he exposes probably get pretty mad for having their cover blown. JSR and Citizen Lab does Amazon amazing investigative work, but still, I'm surprised that he's being targeted by Black Cube. Oh, man, this is just getting deeper. Well, we've got to call JSR now to find out what happens.

[John Scott Railton]

What happened is one of my colleagues was digitally approached by somebody who claimed to be interested in financial solutions and banking for refugees, which is a really important problem. If you're a refugee and you flee a conflict, you probably don't flee with access to your bank account. And so this is a huge problem that refugees face. And my colleague was extremely sympathetic to this issue. So he agrees to a meeting, meets this guy, and what the guy really wants to do is not talk about refugees and banking, but to quiz my colleague on his background, his family, his family history, and then ask a lot of questions about the Citizen Lab. And my colleague, Bahrab Durazzak, is a very thoughtful, smart guy. Immediately Recognized that something was amiss, played it cool, and then as soon as he left the meeting, called me up and said, look, something really strange is going on here. I think I was the target of some kind of an operation. So immediately after this happened at the lab, we began trying to figure out, well, who did Bahar meet with? Who was this guy? And it didn't take long for us to determine that the digital identity that the guy had created was almost paper thin. There was, like, an accommodation address somewhere in Spain. Some company, Flame Tech. But it all looked fake. And this gave us the impression that we were looking at some kind of an operative, some kind of an agent. We began to ask ourselves, like, well, so who would. Who would do this? And going through the questions that he asked Bahar, it seemed like the main objective was learning about Citizen Lab's work and then potentially finding something that could be used against the lab, maybe to discredit our work. As we were sort of moving on with our investigation, we got in touch with a reporter and said, well, you know, we should. This is a really interesting story. You know, researchers working on NSO targeted by this kind of, like, weird attempt, you know, mystery man. And that story was just about ready for publication with Raphael Sater, then of the Associated Press, when I got a message claiming to be from a guy named Michel Vlambert. And Michel pronounced himself extremely interested in the work that I had been doing almost a decade before. Using kites to fly robotic cameras over west africa.

[Jack Rhysider]

See, on JSR's blog, he has this research that he did about using kites to conduct aerial photography. And this guy Michel was acting very fascinated with all the aspects of aerial photography using kites, seemingly wanting to do this method himself to conduct some kind of similar research.

[John Scott Railton]

I immediately sensed that something was off because anybody, even people living under a rock, know that drones have happened in the, you know, sort of in the interim, and there's no real reason to deal with the vicissitudes of the wind and some kite and strings and so on, like, what's that all about? And so I contacted Saturn and said, why don't you hold off on this story? Let's see where this goes.

[Jack Rhysider]

Michel wanted to talk on the phone, so John gave him his phone number.

[Igor]

Hello.

[John Scott Railton]

English as well. And there's this little. There's this crazy little detail. So, like, when the Lombard alias first called me on the phone, there was a strange moment. He just immediately started speaking French to me. And the thing is, I speak French, but I don't like advertising at that point, it wasn't really something that I felt people sort of knew about me. And I remember this moment, this guy sort of picks up, bonjour, and I'm thinking, like, do they have, like, some dossier on me? They must. Maybe he just does it to everyone. But in any case, he immediately launched into this, like, French conversation.

[Jack Rhysider]

And of course, JSR being JSR he's trying to record and document everything that this Michel Lombert guy is telling him. So what you're hearing is the actual phone call between them, because JSR knows something strange is going on here, and having evidence of it might be really helpful at figuring all this out. So the phone call ends with Michel wanting to meet up in New York City in a swank hotel restaurant to talk about how to do aerial photography with kites. And JSR agrees to the meeting. This is when Igor gets told about this meeting, and he needs to watch the agent Michel and keep an eye on the target, jsr.

[Igor]

So in. In my mind, I understand the agent is the operative from Black Cube, and the target is somebody that Black Cube is trying to put in a situation where they're trying to embarrass them or they're trying to get them to say something racist or anti Semitic or something that's embarrassing on tape. And my job is to take pictures with the back of the head of the agent and the face of the target in case that they do get the target to say something negative. They could potentially throw the story to the press with a nice picture of the target, just, you know, kind of for. For. For face value, for. For having a picture on the, you know, with the story. Then once they split up, once the meeting is over, my job now involves a counter surveillance role. So now I follow the Black Cube agent for a few blocks and I make sure to check if he's being followed. Because, for instance, if JSR had suspicions of Michelle and he decided to go to the first meeting without journalists, but he decided to just go there to see what it's about, and he decided to bring surveillance team to figure out who Michelle really is. My job was to make sure that if somebody's following Michelle, I don't get caught. But I tell Michelle through Haken, hey, there's a guy following you. And at that point, you know, Black Cube would be able to make a decision and would be able to understand that the person that they met with did not have full trust of them.

[Jack Rhysider]

You know, oh, man, this is about to get crazy because this is becoming a game of spy versus Spy. Igor will be watching the agents back and JSR is all set up to spy on the spy. Stay with us, because after the break, it all goes wrong. This episode is sponsored by Spy Cloud. With ransomware affecting 85% of organizations in the past year and phishing becoming the top entry point to ransomware, taking action on your company's exposure has never been more critical. I recently visited spycloud.com to check my Darknet exposure and was shocked to discover just how much stolen identity data criminals have at their disposal. Spy Cloud's new identity threat report reveals that nearly half of all corporate users have been infected by Infosteeler malware at Some point. With 63.8 billion distinct identity records now circulating on the Dark web, the scale of this threat is staggering. What's even more alarming is that only 38% of organizations can actually detect these historical identity exposures that create ongoing risk. Knowing what's putting you and your organization at risk, from stolen credentials to session code cookies to pii is critical for protecting against identity based threats like account takeover, session hijacking, and yes, even ransomware. With Spy Cloud, you're never in the dark about your company's exposure from third party breaches, successful phishes or infostealer infections. Read the full report and check your Darknet exposure for [e-mail] darknetdiaries that's spycloud.com A date was set for the meeting between JSR and Michel.

[John Scott Railton]

JSR hatches a plan and the thinking was pretty simple. This person is obviously coming under a false pretense and they may be coming with the objective of sort of you know, harming me, harming my colleagues reputations, but most importantly, probably the. The objective is to deny justice to the victims of hacking by trying to discredit the research in some way or otherwise create problems for the lab. So we decided that the best approach would be to play it into a meeting and actually have an in person sit down with this character, Michel Lambert. But bring some people with us. A reporting team led by Satter who would at the right time confront Humbert while we were meeting and ask him some pointed questions about why he didn't really exist and why his company didn't appear to exist.

[Jack Rhysider]

So JSR meets up with Rafael Sater, the reporter from the Associated Press, and prepares for the meeting.

[John Scott Railton]

The sort of period before the meeting was pretty intense for us because of course you're second guessing everything. You're wondering, well, what on the off chance you do, if actually this turns out to be legitimate knitting. Is the person going to guess that we're onto them? Am I going to be able to maintain this deception? I really wanted it to work, and I felt very strongly that to protect my colleagues, it was important that I do this job really well. So up to, you know, late or up to the early hours in the night beforehand, I was like assembling my own video camera necktie. And the reason was I'd sort of thought, like, maybe I should buy like a pen camera or something like that. You know, something I can some spy tech. And then I thought, well, you know, if I buy something, spy techie, if this guy's any good, he's gonna look at it and he's gonna be like, well, I know what that is, right? He's pointing a pen camera at me. So, you know, I didn't want a scenario where we were both like pointing our pen cameras at each other or something like that. So I thought, well, I'll have to make my own thing. So I, like, buy a necktie, cannibalize a bunch of the things in the hotel room that I'm staying at, disassemble a baby video monitor, a bunch of other things, and create a reasonable approximation of a covert camera video necktie. So the day of the meeting comes and of course, things start going wrong. I had this plan to make a bunch of time available so that I'd get there in due time but not too early. Wouldn't want to be suspicious. Instead, I shamble out and discover that it is pouring rain. And as anybody who's been in New York will tell you, getting a taxi in the pouring rain ain't easy. Finally find myself a ride and get in and I'm already wearing my, like, video necktie and I'm just super jazzed up, but also quite concerned. And I begin to become concerned that I'm going to be late and they're gonna smell a rat and call it off. And we're getting there, getting closer, getting closer. And a couple blocks away, there's just like a complete premium New York gridlock traffic jam. And I just sort of say, well, what the hell with it, and pop out and just run with my pockets filled with recording gear towards the meeting venue. And I had actually managed to break my necktie camera. I had to change out. I brought a spare change out my necktie and make it. And I arrived kind of soaking wet and feeling about as awkward and ill prepared as, you know, I probably felt when I took the SAT as a kid. And, you know, got delayed. So I make it to this swank restaurant, I show up and I'm just like, I'm evaporating, you know, I'm so soaking and exhausted and just sure that the whole game is up, everything's gonna fall apart. And the, you know, Mitraly comes up to me, he's like, well, you know, can I help you? And I said, yes, I'm, I'm. And I realized, like, I don't know what to tell this person. So I said, well, I'm here for a meeting with, you know, Mr. Michel Lambert. Ah, of course, the man says, and walks me to the back. And as we reach the back of the restaurant, a man is sitting at a table, like behind a pillar, not visible from the front. And he stands up and greets me and then walks me to another table right by the window. And so already it's like, you know, an awkward piece of stage direction footwork. Like what is this weird table shift that this guy is doing? But he's very cordial and, you know, we immediately begin on small talk. And I'm sitting there evaporating and hoping I don't mess up.

[Jack Rhysider]

Okay, so where is Rafael Satter at this point?

[John Scott Railton]

Well, so Satter has brought a videographer with him and then we have a sports photographer stationed outside the hotel to sort of catch them if they walk out.

[Jack Rhysider]

Right.

[John Scott Railton]

So we want close and sort of, you know, some long shot cover. And Satter and his colleague didn't like have a budget for this. And so I think they ordered, this is a fancy restaurant. They ordered like a shrimp cocktail and some waters. And they are sitting at a, at a booth, not super far as luck would have it, from where we end up sitting eating their shrimp cocktail. And we had kind of thought about where these operators would have wanted the meeting to take place, figuring that, well, they're going to be recording for sound and audio, so they're going to, you know, they're going to have a certain set of desirables. And we kind of guessed where we should put Satter and his colleague if at all possible to, to record or catch things. And it ended up working quite well. So I get in and scrupulously avoid looking at Satyr and his colleague. The plan was for them to arrive before even this lumber alias got there so he wouldn't necessarily feel a rat and just act normal. And somehow, despite the fact that they were carrying a camera in a duffel bag, like a big production camera, nobody seems to have noticed them.

[Jack Rhysider]

As soon as JSR arrives Michel insists that JSR has a martini with him.

[John Scott Railton]

You know what tea would be great?

[Jack Rhysider]

Black tea. But JSR refuses the drink and asks for tea instead. They sit down near a window where they can both be clearly seen from the street. And together they sit and talk in French about nothing really. Just, like, where they both know French from and what countries they visited. It's meaningless chitchat. And while JSR's camera necktie was broken, he did manage to still record the audio. They order a fancy meal and eat it together.

[Igor]

This can be lobster bisque. Okay, great. Let me tell you this part in detail. We arrive, we park, I park my car in the garage. Haken parks on the hydrant, and I have to jump in Haken's car to keep the car from getting a ticket. Haken goes inside. When you walk inside to the restaurant, there's three sections to the right, and the target and the agent are in the furthest section to the right. To the left, there's a single section, which is a bar. And I've been there before because we've covered a few meetings there before, so I know the layout very well.

[John Scott Railton]

I tried to be very surveillance unaware, so I tried to really never stare and never look. But I did clock a guy holding up his cell phone in a really awkward way and was pretty convinced that he was taking my picture. And he was sort of behind Michel and to the side. They try to have a recorder stationed in such a way that the face of the operative is not included in the video footage, so they don't have to blur it or something, or they don't have footage with an operative's face in it.

[Igor]

Haken comes back out a few minutes later, maybe 20 minutes later, he shows me the pictures that he had already sent me by text message. I show him the pictures I took outside, and Hakin says to me, igor, the meeting is going very well. This is very unusual. So this is like a very interesting point. And, like, my ears kind of point up and I'm like, okay, the meeting is going very well. Igor, I want you to sit at the bar where you're going to have a limited view. You're not going to be able to see the meeting anymore. We don't need to be close to them. We don't need to be in the restaurant. I want you to be in the bar where you're going to have a view of the top of the stairs when the subjects leave, right when the target and the agent leave, you are going to follow them. The meeting is going so well, in fact, they might even go to have drinks somewhere else. They might go hang out. The meeting is going great. Very unusual. Usually these meetings stay split up, and they don't continue hanging out. Usually they have a set time, and once they're done, they leave, and we do the counter surveillance bit, and it's over. I say, roman, I understand totally, totally Cool. I'm gonna sit, watch the top of the stairs. When I see the agent and the target leave, if they stay together, I'm gonna follow them until they split up. When they split up, I'm gonna make sure that the agent is not followed and I'm free to go. Hagen says, igor, it's going so great. I want you to relax again. Something that usually never happens. Usually it's very tense. We're going over possibilities. We're prepping. We're talking about what could happen. We're discussing who's parked outside. Roman says, don't worry. It's going really well. Relax, have a drink, have a burger, have whatever you want. Again, something very unusual, because Black Cube are very cheap. I mean, these guys are such cheapskates. They sent me to a restaurant to do a job that had a prefix menu. They picked the restaurant, and I chose the cheapest prefix option, and they questioned me on the bill, and they took a picture of the menu. Because I had a feeling that somebody's going to ask me, like, why'd you eat so much? You know? But in reality, it's not a lot of food. It's a prefix menu. You don't have any options. Right. So it's very unusual for Black Cube to tell Roman or to Roman to have the liberty to say, hey, go ahead, splurge for a latte today to relax. But I'm thinking that since things are going very well and the client, Black Cube, is very particular about you following instructions. Like, they would get very angry if I deviated a little bit and they took pictures more liberally, including the face of their agent. They would get really pissed at that. So I go in the bar.

[Jack Rhysider]

Can you explain what kind of equipment you have with the pictures and the microphones and stuff?

[Igor]

Oh, yeah. I mean, no microphones, because we can't eavesdrop by law. And for pictures, I use my phone. I use an iPhone.

[John Scott Railton]

Okay.

[Igor]

And I have a video camera. I use a camcorder. It's a. It's like a prosumer Panasonic camcorder. It's about a thousand bucks. So I go in the hotel, and Haken has to leave. He Takes his car off the fire hydrant and he drives home to do his thing with his daughter. As I walk into the hotel, there's a photo shoot with models and professional photographers, equipment, people bringing coffee and water. I'm talking about like a real photo shoot, right? It's in the lobby of the hotel. Hagen just came out of the lobby of the hotel. He didn't say anything to me. And I think to myself, well, it's a professional photo shoot. This is not some kind of a secret photo shoot to catch the agent, right? Because this is a real photo shoot. I talk to the people who are working at the photo shoot and they tell me that they're working for the hotel magazine. It's an internal magazine for their guests. And they're making this photo shoot for that. I'm content because they're working with the hotel management. I do a little bit of amateur photography. So I know that the equipment they're using, it's, you know, they're using lenses that are not like telephoto lenses. They're basically using lenses that are for, you know, for their portrait lenses. And they have a couple of wide angle lenses. I see that they're using nice Canon cameras. Sounds good to me. It's a pro photo shoot. Nothing to do with me. I'm going upstairs to the bar. I get into the bar. I, I, I watch the stairs. I order some stuff and I'm watching the stairs. An hour passes by or so.

[Jack Rhysider]

Now Igor can't see JSR or Michel from the bar. He's just around the corner. But he knows this place well and knows that there's only one way in and out. So he's watching the exit. He sees the people from the photo shoot downstairs come up and have a drink. And he sits there stationed with his eyes on the doorway.

[John Scott Railton]

And within a couple of minutes of the conversation starting, he was using like this weird offensive term to refer to the way that Africans speak French, and trying to get me to, like, laugh along. It was the strangest conversational gambit. And I began to feel at this point that this guy maybe wasn't sure how long he'd have me at that table for or how long the deception would work. And so he wanted to get me saying something perhaps racist or offensive right away, something that, you know, could be laughed about. Then the conversation was an hour of sort of like him semi boasting, semi chatting, trying to get biographical details on me, talking about all the African leaders he'd met, the time that he'd spent in Africa, various other things. But the strangest part of this whole conversation is that the guy had cue cards with him that were like green and yellow and red, like pastel cue cards, like big index cards. And as the conversation is going on, the boring questions to me are like green cue cards. And then right around the one hour mark, as the conversation starts getting a little bit more interesting, as I recall it, the yellow cards come out and then he's starting to, like, you know, ask some sort of questions about, like, Citizen Lab. Up until that point, he's been sort of preserving the ruse that he's just like a. A rich guy who would really like to hire me to, like, like, heights in Africa or something. And then he kind of doubles in for the really good questions, like, oh, tell me more about Citizen Lab. And at various times tries to prompt me to say things like, Citizen Lab's work would be somehow motivated by racism or some kind. I mean, really wild stuff and like, deeply offensive. Who, who would be using that racist element? You said that the 12 minorities, the journalists. Well, that would be very upsetting if it were happening, I think. And I began to feel that he had this kind of list on his little cards that were like, well, if he can't get some good, juicy information about the lab, maybe he can get me to say something offensive. And it felt like he had this sort of shopping list going through it all and going through it all. And so our conversation plods on for, like, must have been about 90 minutes. And he is, you know, he will sort of come in conversationally on a tangent, try to get me to say something about the Lab or NSO and then back right off if I push back a little bit. And for somebody who, you know, at various points in the conversation pretended to sort of have, like, no knowledge of technical stuff, he seems, like, remarkably well informed about, like, you know, export controls. The impression of him as a bumbling spy was kind of cemented by the fact that he had this, like, pen in his hand, big, thick pen. And at various points when I'd be talking, he'd be, like, holding the tip of the pen pointed at me, like, the tip of the pen cap pointed at me. And there was, like a hole in the middle of the pen cap. And I thought it was undoubtedly a camera and he wanted to get me on video. I think I learned later that it might have been a microphone, but it really felt bumbling. And as this is going on, I am getting messages from the, from. From Satter saying, like, you know, everything okay? Is it going all right? Yeah, yeah, it's going all right. And then I get this kind of alarmed message that's like, hey, our batteries are running low. Can you run Wrap it up? And so I have to come up with some pretext to wrap this at this point, ridiculous conversation up. At one point, he invites me to, like, leave with him to go to a cigar bar. We'll go together. It'll be great. And so I find a way to distract him, talking about kites flying in buildings. I kind of point out the window next to us and I say, look out the window. Like, if I was trying to fly a kite on this building, here's what I do. You'd think, like, how could you even use a kite out in this? The answer is it's still possible. You get on the rooftops. And he, you know, dutifully looks out the window. And when he looks back at me, Rafael Satter is pulling up a chair.

[Jack Rhysider]

Hi, my name is Rafael Satter.

[John Scott Railton]

I'm a journalist with the Associated Press in London. I'd like to speak to you about.

[Jack Rhysider]

Your company, CPW Consulting.

[John Scott Railton]

Satter then pressures him, and the guy doesn't really have any good answers about why his company isn't real, why he doesn't appear to be real. And so as Satter is asking him questions about, like, who he is, who he really is, the guy makes a gambit to kind of leave. And then realizing his mistake, he comes back and, like, tries to pay for his lunch. And as he's trying to pay, you know, Satter and the camera are right there asking questions. And by then, like, the restaurant has basically cleared out. The only people left at this point, I think are, like, probably the people on his team, you know, is what I'm thinking. The people on his team are the people on my team and maybe a few lunch stragglers. So it's really like a crazy scenario. And the guy is just, like, trying to avoid the camera, which is really hard to do in a rather, you know, limited space restaurant, while trying to pay. And so is, you know, peppered by questions. And finally, you know, you can just feel his sort of terror grow. And there's almost like a yakety sax moment as he's being followed around by me, by the cameraman, by satyr asking him all these questions. He finally spots an open door in the back to a private dining room and goes inside. And there's a, you know, restaurant staffer there. And he tries to pull the door closed behind him, but he's clearly had Such an adrenaline dump that he's just, like, tunnel vision and doesn't notice that there's a stopper on the door. So he's, like, trying to pull this door closed, doesn't get it, and asks the restaurant employee for help. These people are bothering me. So the restaurant employee dutifully pushes out the stopper and closes the door. And that's the last we see of this guy.

[Igor]

At some point now, my phone starts ringing, and I see taken calling. And now, you know, I'm watching the stairs. Nobody has left, but I see at the top of the stairs a guy with bushy hair and a guy with a camera with, like, a video camera that they use for, you know, for news broadcasting or something, for, like, live news. I think that's a little weird. But considering there's a photo shoot going on here, maybe these guys just are working with the photo shoot, you know? And I pick up the phone, I'm looking at those guys, and I'm thinking, ah, those guys probably doesn't mean anything. And the Roman Haken is screaming into the phone, igor, what's going on? Who are those people with the cameras? And I go, haken, what are you worried about? They're doing a photo shoot for the hotel magazine. I talked to them. He goes, are you sure? I go, yeah, yeah. I'm looking at them right now. There's a dozen people. There's two guys with cameras. They got lights set up. It's a professional photo shoot. He. He's waiting. He's kind of silent that he's like, no, no, no, no, no. Who are the people with the cameras? Who is the journalist? And now it clicks in my mind, and I'm staring at. Basically, I'm staring at Rafael Satter and the AP videographer. But I don't know them, right? I don't know their names. I've never seen them before. But I'm staring at them and I'm like, roman, there is a guy here with a big video camera and another guy with bushy hair. And he's like, okay, the agent is in trouble. He's hiding in the back somewhere. We need to help get him out of there. Help get him out of there. Figure out what's going on. Take pictures of everybody. This is a problem. This is a problem. Where did they come from? I said, roman, I don't know. I'm gonna go figure out. But they must have been here when you arrived, because they never came in and they never came out. This is the first time I'm seeing them. If they're coming from inside the restaurant, clearly they've been there longer than me. And they've been there when you came in, right? Okay. Figure it out. And I'm running around now trying to figure things out. He's still yelling into my ear. I'm calling him back. And I'm taking videos with my phone. I have an apple. Well, this is kind of neat. I have an app on my phone that you could double tap the screen and it turns out the screen off. So it could. It's rolling video, but the screen is blank. It's just a black screen, as if the phone is off. That's the kind of, that's the cool feature about it. So I'm taking video of what's going on, taking identifiable video of people of Raphael Satur, of the videographer from Associated Press, of John Scott Rail. And I'm trying to figure out what's going on. Kind of listening with, with, you know, for all the commotion. Roman tells me, you know, we have to, we have to help get Michelle out of there. But he's not calling him Michelle. He's saying, we have to help get the agent out. The agent is somewhere he's hiding. You need to, you need to help him get out. I said, okay, tell me, you know, tell me where, tell me what to do. I mean, how do I help him get out? What does he need? He goes, I'll call him back. You get the video, figure out what's going on. In the meantime, get pictures of everybody so we could figure out who is who later. So I'm doing that periodically. Haken is calling me, yelling into the phone frantically. And I'm waiting outside. Raphael Satter, John Scott Railton, and the two AP people, the photographer, the videographer gather outside. I get some pictures of them and they split up and they leave. And I take notice that JSR's wearing very professional outfit and he's a very smart looking guy. And you know, I watch people all the time. So I'm thinking, this guy is very smart. I hope I get to meet him one day because it looks like he organized all this. And he clearly looks like the smartest guy in the room and he knows what's going on. So in my mind I put like a check mark. Jsr, smart guy, smart dress, interested. And they look at Rafael Satter and they say, Rafael Satter. He's not prepared for the weather. We're in New York, it's cold, it's wet outside. He's wearing ASICS running shoes. So he must Be the guy who is here doing something else. I don't know what his role is, but we'll put a check mark that he's not prepared to be outside for a while. And then the videographer and the photographer from the Associated Press are dressed like they're ready to hike up Mount Everest. They got hiking boots. They got cold weather gear. They. They got good jackets. They got like, they're ready to spend a lot of time outside. So I say, okay, these guys are the professional photographers that are going to be. That were told to be prepared to wait, and they were ready to wait outside in the cold. I report back to Haken. He says, okay, good. You got their pictures? I got their pictures. Great. Send them to me later. You need to go to the Marriott Hotel around the corner, get your car, pick up the agent. I say, okay, he was able to get out? He says, yeah, he found the back exit somewhere because I'm standing in the front lobby and I'm watching the front. So he found another way to get out of the building. He got out and he made his own way to the Marriott Hotel around the corner. I go get my car, and I have my car stinted out so you can't really see inside. Even the windshield is tinted, so you can't make faces out when you're standing next to my car. I drive to the Marriott Hotel. I tell Haken I'm there. The agent comes out, gets in the back of my car, and Haken tells me on the phone, whatever he needs. Offer him whatever he needs. You're to do whatever he says. And in my mind I'm thinking, yeah, yeah, whatever he says. But I'm not putting no dead bodies in the car. I mean, whatever he says. It's a very wide beaded. But meanwhile, I'm agreeing with Hagen. I said, yeah, of course, Roman. Anything he needs. And the guy gets in the car. He's a very pleasant old man. Kind of reminded me a little bit of like a grandpa character from a movie of some sort. And he's talking either in Hebrew or in French. He's not speaking English. And he's talking to someone. And, you know, I shake his hand. He gets in the back. He doesn't introduce himself. I say, my name is Igor. And he tells me, go to this hotel. And I drive to this hotel and I drive around to make sure that I'm not being followed.

[Jack Rhysider]

Are you good at that? Are you good at seeing if you've been followed and you know the way?

[Igor]

Yeah, I mean, I follow people all the time. So it's easy for me to figure out how to check if I'm being followed. Right. And I guess sometimes we get paranoid, so we just check.

[Jack Rhysider]

Can you explain how to check if you've been followed? If you're being followed, like your kind of, your. Your methods.

[Igor]

So, so I'll tell you about like that specific scenario. We were in midtown Manhattan where the traffic in the evening is pretty heavy. There's a lot of traffic lights and there's a lot of movement. So it's not easy to drive like in a. Like, ideally, if you're driving on the highway, right, if you slow down or you speed up, the person who's following you has to match what you're doing. So that's how you could force, force somebody to show themselves, that they would be distinct from the rest of the traffic. You could get off the highway and see who gets off the highway with you. You could go to a McDonald's, drive through, come out. You could go to a Bing, drive through, come out, and you're seeing who is constantly showing up in the same cars, who's making the same turns. You get back on the highway, who is back on the highway, who was there half hour ago. In Midtown, you can't do that because there's so many cars. You'll never. You can't possibly remember all the cars. So in Midtown, the goal is to drive down quiet streets, forcing somebody to stay behind, and then have to chase you down when you get to the next corner or go into. In Midtown, there's a lot of garages that you enter, let's say at 51st street, but you exit on 52nd street and they're going in, they're one way street, so they're going in opposite directions. The avenues are going in opposite directions also. So if I go into a garage, let's say on 51st, exit on 52nd, and they come out to the avenue. And so I'm changing my direction of travel and I'm forcing someone to go through a garage because there's no way that they could circle that block and get to the corner where I'll come out. You know what I'm saying?

[John Scott Railton]

Yeah.

[Igor]

So I do a couple of those things. And you know, rush hour traffic is dying down now and everything is cool. I'm content. There's no cars following us. He's the professional. He seems content. He's just talking constantly into his phone. And I drive to his hotel, also in Midtown, he gives me a. He gives me a claim check to give to the guy in the lobby to take his luggage out of storage, which immediately in my mind, I say, oh, shit, I'm going to have this guy's luggage in my hand. What are the chances that this professional spy is going to have his name tag on his luggage in case it gets lost? If he has it, I got to get a picture because I'll have his name. And the second thing that I'm thinking, it's PM right? It's in the evening, and his luggage is in the hotel lobby in storage. That means that he stayed at this hotel, but he checked out the same morning. So he had plans to leave the hotel and probably leave New York tonight.

[Jack Rhysider]

I love the way a private investigator thinks when you think about that. I don't think about it like that, but I love hearing the way you think it through.

[Igor]

Yeah, I mean, it's just. For me, it's. It's like. I guess we're overthinking everything. It's just helpful at work. So whatever. I. I give the guy five bucks because I. I want the guy to, you know, get the luggage and not make me wait. I have Michelle in my car. It's parked illegally. It's tinted out. Nobody could see him. And I explained that to him before I leave. I say, look, the car has tinted windows. No one can see your face. Stay in the car. No one will see you. And we were not followed. I get the luggage in the lobby. I look at this guy. This fucker has a name tag on the luggage. And I'm thinking, are you seriously, Are you a spy? And then, look, it has his name tag and his address on the luggage.

[Jack Rhysider]

And his luggage did not say Michel Lombert. It had a completely different name.

[Igor]

I think, all right, I'm gonna snap a picture of this. But I'm not gonna do it in the law because I don't know where Michelle is. Because now I. I left him uncontrolled. He's in my car, but I don't know if he came out, if he's looking over my shoulder. I'm gonna put the luggage in the trunk. When I put the luggage in the trunk, Michelle's head is going to be facing forward because I have an suv. He's not going to see me. I. I put my camera up on with the black screen, and I snap a picture of the luggage when I put it in the trunk. And I close the trunk and I. And I swipe my finger and the app goes away, you know, like it's. It's gone. So When I, when I put my phone back on the, on the magnet on the, on the dashboard, Michelle is not going to see that I had the camera up on. And he tells me to drive him to another hotel in the area. And I drive him to a hotel, but he doesn't like it. He says, where's the lobby? And I say, it's on the second floor, I think. I mean, this, this is New York. So sometimes the lobby is not going to be on the, on the first floor because they have a business there. He goes, no, no, no, I need a hotel with a, with a street facing lobby. And I said, okay, I understand you want to be able to see outside and you want to be able to see what's going on. I said, okay, give me a second. There's another hotel around the corner. And the only thing that he asked me in the car, he asked me who were those people at the restaurant? And I said, I'm not sure, but I think the guy you met with brought the guy with the bushy hair. And they think that they brought those people with them because those people were dressed like paparazzi would dress to wait for a celebrity outside. They might be paparazzi because they had very professional photo equipment. He says, okay, thank you, whatever. And he continues talking on the phone. And the only thing that I picked up from him talking on the phone is that he was trying to get a flight to Israel because he was saying the word direct Tel Aviv and then he was saying some other phrasing and then he would say London or Heathrow, or he would say Berlin or Paris, and then he would say direct Tel Aviv. So I couldn't understand the, the context, but he was offering options of cities where there are airports that you could connect to fly to Israel. And I think he was trying to get somebody, whoever was on the phone to get him home to get them to Israel. And later kind of analyzing this post fact, I realized that they're very, they're very economic company. So what I have a feeling was going on is he probably had another gig lined up. So he had travel plans to go somewhere else. But because the operation went to shit, there were photographers taking his picture and the journalist talking to him. He believed that his face could end up being on TV or in a publication tomorrow. So in a scenario where, you know, an intelligence operative gets his picture taken, it's the worst thing. Intelligence operatives typically don't want their picture taken because it prevents them from doing things covertly. So he needed to get home just in case I don't think that there's a risk that he was gonna get thrown in jail. But I think as a standard operating procedure, when you get your picture taken, you gotta go to a safe place, which for him was Israel. I take him to the RIU Plaza, New York, which has a very big glass lobby. And I thought, right. Once he told me he wants a street facing lobby. I tell him there's a spot around the corner with a big glass lobby and you could sit in the restaurant or the bar and you could see the street and you could be far away, removed from the street that nobody would see you. So I take him there, I shake hands, and that was it. And he went on his way, and I went on my way.

[Jack Rhysider]

Well, after all this, Rafael Sar went back to the Associated Press to investigate this Michel person. At the same time, Igor was sending all this information to Ronan Farrow.

[Igor]

And I sent Pharaoh all the pictures. And I say, ronan, I don't know what happened here. Do you know anybody on these pictures? And he goes, yeah, in fact, I do know them. One of them is a reporter for the Associated Press, Rafael Satter. And one of them is a researcher, John Scott Railton. I go, great. And as me and Pharaoh are talking a couple hours later, Pharaoh tells me that Raphael Sater happened to send all of their media to Pharaoh to review. Just because Saturn knew that Pharaoh is working on the story, they decided to, I guess, share or discuss. And Pharaoh is looking at pictures of Hakan and other pictures from the, you know, that Satter and JSR took. And I asked Pharaoh, I said, pharaoh, is my picture in there or no? He goes, your picture is not in there, but your boss is. I said, good for my boss. I'm glad my picture is not in there. That's awesome.

[Jack Rhysider]

And so Raphael Satter puts all this together and publishes the story in the New York Times titled the Case of the Bumbling Spy. A watchdog group gets him on camera. The story explains that they reached out to ufta, that Israeli investigative journalism show which you actually heard a clip from earlier in this episode. And UFTA recognized the photo of Michel and was able to identify him as someone who works for Black Cube.

[John Scott Railton]

What happened rather quickly after the initial story is that people saw his face, and people saw his face in his home country of Israel and tipped off reporters. And so within a few days, the New York Times had the story that he was a former Israeli intelligence officer or official named Ahon Al Mulgasulin and also was like some kind of a city councilman in his, in his city or had been. And this of course was bad news for the guy because, you know, not only was he named, which is obviously, you know, poison if you're a, an intelligence operative, but also he seemed to be uniquely ill prepared for what was going on and bumbling.

[Igor]

Next day I'm meeting up with Haken and Haken tells me that because of what happened, we're gonna have a team meeting with Black Cube next week on Wednesday. And I say, okay, cool. And I'm thinking in my head, next week, Wednesday I'm gonna get to meet like a manager from Black Cube, which will be awesome. And they're probably going to give us some professional training and explain to us what we did wrong. There's probably going to be a debrief of this situation. This is great. So I get in touch with Pharaoh and I tell him next week on Wednesday there's going to be a manager from Black Cube coming here. We're going to have a team meeting. I can't wait. I'm so excited. So as we get into next week, Hakin tells me, tomorrow you're going to be polygraphed. Don't have any alcohol and don't take any drugs tonight.

[Jack Rhysider]

Long story short, he gets a lawyer who tells him not to take the polygraph.

[Igor]

So whatever, I gave them an excuse why I'm not going to be taking the polygraph. And Hagen was very upset. He tried to convince me to go there. And when I told him, finally, I'm definitely not going there, he asked me the polygraph questions on the phone. And I think somebody from Black Cube was listening in on the call, like kind of on a three way call. And some of the questions they asked me is they wanted to know how much the journalists paid me.

[Jack Rhysider]

They thought that JSR or Rafael Satter paid him to tip them off that Michel wasn't who he said he was. They had no idea how JSR was so prepared and figured all this out.

[Igor]

And that totally made, that totally blew my mind up inside. And, and I wanted to really like throw something at them through the phone. You know, I, I, I got so angry. I was thinking these people are so, so like ignorant of the way that the American system of journalism of, of our, like our freedom. They, they, they don't have this kind concept. They think the journalists pay for stories. It really, it really pissed me off. And of course I didn't show that. I, I told them, I said, hank, and what do you think I'm worth? I said, I don't Know anybody's name. I don't know what we're doing. I. I don't know anything. They said, why would anybody pay me? Plus, I don't even know in advance what we're going to be doing tomorrow. It's always last minute, which is. Which is also like, kind of a. A way to compartmentalize. If I'm the guy on the ground, they don't tell me anything in advance. Like, Haken may know in advance that there's a job for tomorrow, but he's not going to tell me until the day before, so I don't have time to tell anybody else. You know, I was just very offended by that, that they. That they had this concept that they believe journalists would pay for a story or pay a source to be a source. So whatever I told him, I said, listen, they didn't pay me anything. I'm worthless. I said, why would any journalist want to talk to me? What am I going to tell them? My name is Igor. I live in New Jersey? I said, you know, these guys, they. They need to get off their high horse and. And. Or. Or take me down from the pedestal. I forget what I said, but I basically said. I said, this is nonsense. Why would any journalist care about Igor? I said, you know, I thought. And I explained to Haken, because Raphael Satter's story already printed. I explained to him that in the story, Raphael Satter explains how John Scott Railton figured out that he was being kind of targeted by Black Cube because his colleagues were being targeted and other people were being targeted. They were recycling the plot. It was easy for. For JSR to catch on to that. And once they started looking into the fact that this guy's company, that the company, I think it was called CPL Consulting or something, that the company was fake. There was nothing at that address. And, like, all these things. And they figured out that, yeah, this is really. This is truly a, you know, a plot ploy to get information out of John Scott Railton. But Roman didn't want to hear that. He was just. Kept asking me how much the journalist paid me. And, I mean, at some point, I told him, this conversation is going in a circle. So I said, look, I'm not taking the polygraph. You want to fire me, fire me. And he said, well, the client is going to fire me. And I said, well, tell them you fired me, and maybe they wouldn't fire you. But what do you want me to tell you? I said, I gave you a heads up back like three, four months ago or six months ago, I said, when they're gonna need a guy to blame, you're gonna be the blame guy. So you're not seeing that because you're not looking at this from the side. But when Black Cube are gonna need a full guy, when they're gonna need the guy to point the finger and say he broke the law, they're gonna say, you broke the law. You're the guy who has a license in New York. They're going to say that you knew the law and you did something illegal. They're not going to say we did something illegal. They're going to say, we're in Israel. We're a foreign company. We are untouchable in New York. But you guys got Roman over there. He's the law breaker. And it ended up kind of being that way at some point. Later, I talked to Ron and Faro and when they quit, called for comment from Black Cube. Black Cube said all that illegal stuff with the phone track and, oh, we weren't doing that. That was all Roman's idea. So, you know, it's kind of. That's. Anyways, that's how it played out. And I didn't meet JSR for a long time. I kept asking Pharaoh to introduce me to Raphael Satter, but Pharaoh was writing a book and he didn't want to get scooped. So he kept telling me, he'll introduce me to Raphael later. And I just wanted to shake Raphael's hand and just shake John's hand and say, guys, you did a great job. I happened to be there, and I thought it was amazing, and you guys are awesome. I mean, I've been reading about you. I'm your biggest fan. You guys are amazing, guys. And Pharaoh kept delaying the meeting. So at some point, I just messaged. I mean, messaged Rafael, and I started talking to him. I sent him some pictures from that day so he knew that I was, you know, really there. He introduced me to jsr and I said, we should all hang out sometime, have dinner in New York. And at some point, I, We. We. We arranged to do that.

[John Scott Railton]

It's a remarkable thing when you're in a situation like that. Not that I've been in very many, but this one was stressful and fraught. I feel like I remember most of the moments from it better than many things that happened in my life. Yeah, this was a very sort of intense experience for me. And of course, I had spent hours, hours and hours trying to think about the opposition, trying to figure out what kind of put myself in the mind of whoever was planning on the Black Cube side, whoever was doing the organizing and the thinking, you know, who might be responsible for that. And I had another sense of a person outside of the hotel who, when we left and did a regroup, who kind of monitored us and was very attentive to us. And I remembered his clothing really well. That turned out to be Igor. And so during the conversation I had with Igor, there was kind of a moment where I was like, were you wearing this?

[Igor]

I remember you.

[John Scott Railton]

And you were talking to the doorman.

[Igor]

Yes, yes.

[John Scott Railton]

But to sort of set the stage emotionally, like, this was a thing where I had spent a lot of time trying to figure out who was on the other side and what they might have been thinking. And to not only get an opportunity to meet one of them, but one of them who had done a righteous and good thing by turning whistleblower was a profound experience for me. I had deep respect for Igor, and his choice to turn whistleblower when he realized that this was really bad. And so meeting him was in some ways like a beautiful coda to what had been an attempt to try to.

[Igor]

Subvert.

[John Scott Railton]

My work and that of my colleague and the ability of the victims that we support to get justice. And turns out I pick up a friend in the process, so no complaints.

[Jack Rhysider]

Yeah. So what does this mean? That Black Cube was. Was spying on you, I guess.

[John Scott Railton]

Well, I think it raises the obvious question. A lot of money was clearly spent to make this happen. Who spent that money, and what were they interested in? Why was discrediting us so worth it? And as we learned, the story doesn't end there. Others, including lawyers representing victims of NSO group, were also targeted by the same operation, also lured to meetings or attempted to be lured into meetings.

[Jack Rhysider]

Well, so hold on. How does this tie into nso?

[John Scott Railton]

Well, the lawyers representing a group of victims of NSO spyware in court cases brought in Israel and elsewhere, those lawyers were also targeted by spies, by anonymous spies who tried to wine and dine them and get them to say things about the case.

[Jack Rhysider]

So this might have been in connection with the NSO group. It's not clear exactly if it is, and there isn't any hard evidence which definitely links it, but we can infer that it was them. I mean, NSO did come up in their meeting quite a few times, so it's a strong theory. But this means just as we were about to get to the bottom of this story, the bottom just fell out, because JSR has been investigating the NSO Group for years and years and has published multiple reports about what the NSO has done and so yeah, let's talk about them next. Who is the NSO group and why has JSR been investigating them for years? So that's exactly where we'll pick up in the next episode. John, do you have any closing thoughts?

[John Scott Railton]

I think at the end of the day, the experience that I had gave me something really interesting, which is I had spent years of my life working with victims of spyware, people who were targeted by spyware as part of the efforts of their repressive government to mute their voice. And I had heard countless stories of victims and of what it felt like to know that you were being targeted by a government or by spyware in the smallest of ways. What this moment gave me was a bit of a sense of what that feels like to be in a city and to not know whether someone is following you, to have the sense that there's a well resourced entity that's trying to dig up dirt on you, maybe to discredit you, to target your friends and your colleagues. It's a terrible feeling and I wouldn't wish it on anyone.

[Jack Rhysider]

A big thank you to Igor and JSR for sharing this crazy story with us. If you found this episode interesting, you might want to check out Ronan Farrell's podcast called the Catch and Kill. In fact, episode one of that podcast is the story you just heard, but from Ronan Farrell's perspective, it even has JSR and Igor as the guests in it. Igor is who brought me this story, though I only heard the podcast after I did my interviews with him. Anyway, after episode one of the Catch and Kill podcast, it goes into all the Harvey Weinstein stuff, which is a different path than where we're going. We're going to be veering directly into the NSO group in the next episode. Do you get mad when you're all caught up on new episodes and have to wait two weeks for the next one? Look, if that's the case, it obviously means you really like the show and should consider donating to it to help it along. Donations to independent creators really go a long way at helping get new content out to you, so please visit patreon.com darknetdiaries and consider supporting the show. Or you can subscribe to Darknet Diaries plus on Apple Podcasts. Thank you. The show is made by me, the Secret Squirrel Jack Resider Sound Design this episode was done by the Sound of Silence Andrew Merriweather Editing help this episode by the Feline Supernova Damien and our theme music is by the 3D Waffle Breakmaster Cylinder. And even though they never caught the hacker. Why? Well, because he ran somewhere. This is a Darknet Diaries.