C (2:02)

Cuz I love hot dogs. They're one of my favorites. Right? But I was like, I sat down to watch that. Nathan's hot dog or.

B (2:09)

Yeah, yeah, Nathan's. Yeah.

C (2:11)

And every year they have it and I'm like, oh, this is going to be great. And I was so wrong.

A (2:15)

They dip it in water.

C (2:17)

I was like, I never want to see this again.

A (2:19)

Yeah, yeah, I, I agreed. So just, I wanted to make sure that everyone knows that Thomas Jermaine is not the best competitive hot Dog eating tech journalist in the world. So this is made up because again that is between the two of you, I suppose. And that in this blog post that he posted on his personal website, he even cited made up championships that he supposedly won and fake rankings against other tech journalists that he roped in to sort of help him with this, this article that he was writing.

C (2:45)

So the 2019 dog gobbler of the year.

A (2:50)

To be clear, the only place this information existed was on his personal blog post on his website. So this was not, he didn't post it on like BBC.com for good link juice or anything like. Right, because this does sound like SEO scamming and if you're familiar with how those techniques work, yes, put that in your mind because that's exactly where this is going. So within 24 hours of him writing this blog post on his personal website, major AI tools including Google's Gemini and ChatGPT were repeating his claim as a fact. Again, only appears on his personal blog post. But they were like, yep, if you look, if you asked them at that time, who, who are the top hot dog eating tech journalists in the world, they would give you a ranking of several and he would often be number one and they would mention the competitions that he won, none of which actually exist. So all that he needed to do to game this was to publish that one single well crafted article on his personal website that does not have like a super high link ranking, I'm sure compared to, you know, BBC or whatever. And so Thomas's point by doing this was just to drive home the fact that what we should all be aware of is that AI systems, when they do not have built in knowledge, if they haven't been trained on a, on a data set that has information that people are looking for, they do just search the web and as a result they can be easily manipulated by whatever they find. And the thing that I really appreciate about this article, because I used to live in the world of search engine optimization for years in my marketing days, is that he talked to a number of search engine optimization or SEO experts about what's going on here and they all said that gaming Google through AI this way is way, way easier than you would ever think and that it basically sets SEO back 20 years in terms of the security and UX standards. So the stuff that, yes, oh yes. So it's great news isn't is fantastic news for scammers and spammers. So you can publish a post ranking your own product as the number one in the entire world frame it convincingly like put some of your competitors in there to make it look like you did some diligence. And then there is a genuine actual real chance that the AI tools will simply just repeat it. So there was another test that he did that I really love that has just drives a point home that I just wanted to say. Cause it's funny, he did another test with a made up list of the greatest hula hooping traffic cops. And apparently the last time he checked, and I want our listeners to check this too, by the time this goes to air, chatbots were still singing the praises of Officer Maria the Spinner Rodriguez. So I was like that's hilarious. But then my thinking was these are greenfield inquiries. Like if you were doing a good old standard pre AI Google search, it would give you. I only found one website with this information, so that's not terribly hard to game that SEO wise. Right, but what about things where there's a lot of answers, you know, where the search is usually competitive. And again the SEO guys came back and said it's so much easier than you would think. A lot of the SEO spamming guardrails that again that we've had in place since the early 2000s, not just, you know, being able to sniff out fake blogs, but do you remember keyword stuffing where you would see like words at the bottom of a website and you were like, why is that all just being dumped there or stuffed in the metadata, all that kind of. It's almost cutely retro spam stuff. It's all coming back, baby. It's.

C (6:21)

Yeah.

A (6:22)

Apparently AI has just become a giant reset button on a lot of that web and security hygiene stuff that we've had in place. So a good old return to the old ways, but for the worse.

C (6:33)

Well, I will tell you, I have the I pay for the ChatGPT service and I just sat here on my phone and I said, who are the top hot dog eating tech journalists in the world? And it says there isn't a well known official top hot dog eating tech journalist the way there is a ranking for competitive eaters like Joey Chestnut. Most tech journalists don't publicly compete in eating contests, but there are lighthearted lists circling online of tech writers who have been noted for their hot dog eating hobby or at fun events. And then it goes on to say notable hot dog eating tech journalist. Guess who number one is?

A (7:09)

Dave Bittner.

C (7:10)

No, Thomas Jeraine, the guy that wrote this article. BBC technology columnist who reportedly won an amateur hot dog eating contest at a quirky South Dakota event which doesn't exist. Right.

A (7:26)

Yeah. So I think by the time this episode goes to air, given that this article exposing all this is on BBC.com, i imagine I would hope that the AI models will have trained on that article and said, oh, maybe that information's incorrect and they'll frame it as such.

B (7:43)

Let me interject, because I too have a paid version of ChatGPT.

A (7:48)

Okay.

B (7:50)

And I asked the question, is Thomas Germain a top hot dog eating champion? And it says no, Thomas Germain is not a top hot dog eating champion in the real competitive eating world. There's no record of him winning major competitive hot dog eating events like the Joey Chestnut dominated Nathan's famous hot dog eating contest. The idea that Thomas Germain is a hot dog eating champion appears to come from a playful stunt he wrote about on his own site and social posts where he deliberately made AI and search listings report that he was a champion to demonstrate how easy it is to get false assertions propagated, not because he actually holds any official titles in competitive eating. So let's think about this. Joe and I just basically asked the same chatbot the same question and we got different answers.

C (8:39)

I will say this. I was going to go on to this. It says important context on my response. The hum. This list comes from humor, humorous satirical posts on a personal website and isn't a formal ranking of public from a published major outlet. Some of it might even be intentionally exaggerated and the author has indicated parts were playfully fabricated. So there is a warning in here, the chat. So they're already aware of this, I think, and they've probably put this into the context of. Because they know the BBC article's coming out. Right?

A (9:11)

It's out. I mean, it's been out as of recording. It's already been out for over a day. So the jig is up on this specific stunt.

C (9:17)

But I bet yesterday it didn't tell you that.

A (9:20)

I would bet, yeah, I would absolutely bet.

B (9:22)

The other thing that this reminds me of is I've seen stories from people who are running their own websites who talk about just getting hammered by these AI scrapers. They're just chewing up so much data and the, and the, the lengths that people running these sites have to go to. To try to keep them from coming and scraping every minute or.

C (9:48)

Right.

B (9:48)

Because who pays for the bandwidth? The person hosting the site. And it's just relentless.

A (9:55)

Yes, it is. And I was just thinking on a. They've ruined the Internet at least. Yeah, I was, I was having. I have at least a few websites that are still running WordPress and I'm pretty sure. Oh, I need to check how those are doing. Oh no. Yeah, I probably hit the limit pretty recently. Oh boy. So yeah, it's the I think it's fascinating that you both got different flavors of the result on that. I mean it's not entirely unexpected, but those do seem awfully divergent. Yes, I would have expected a little more coherence on that, but that is interesting. Yeah, the jig is up because this article being on the BBC for at least 24 hours, I would not imagine that the LLMs have not trained on that by now. So yes, they're figuring it out. But if he hadn't published it, I do wonder. But what I I'm just going to get cut to the chase about what some of these SEO folks said that when Jermaine talked to them was that we are now and this they they said it several times. We are in a renaissance for spam thanks to this kind of thing. So it it is actually it is not just for greenfield inquiries where there's only one result on the Internet. You they have found many times that AI systems will repeat misleading health claims, product rankings, press releases and SpawnCon sponsored content. Sometimes not always, but sometimes not signaling that the source was promotional because most people don't check or read that fine print. And a lot of times even when you do a simple Google search, you just get that AI summary up top and how many times are you going to really look through beyond that and go actually I really want to dive into where you got this information from. It may not be that big a deal to you and we've also been so conditioned to just take what Google gives us as fact that just may not even occur to us to do that. So yeah, a spam renaissance that's fills me with delight.

B (11:44)

What's old is new again.

A (11:46)

Yeah. So everybody please be especially careful when you're looking up time sensitive medical or financial or business related questions. Really drill into what you're seeing because I really didn't think it was going to be quite this easy to game but apparently it is until otherwise changed.

C (12:06)

Couple of notes on this. Right now a large portion of my family is in grad school, including myself. I am, my son is my daughter is wrapping up a degree and my son in law is also enrolled online at Penn State. But two things. Last night in my class our instructor was talking about robots txt which can keep these things away if and only if the developer of the whatever's going out and scraping these websites is ethical.

B (12:41)

Right.

C (12:42)

Because you can say in the robots txt file, don't scrape this page. Leave me alone. Right. And ethical scrapers will go, okay, we won't eat up your bandwidth. But that doesn't prevent anybody from just going ahead and ignoring it. It's essentially, please don't scan this page. Please don't scrape this page or this website. And it's very configurable. Robots txt is very configurable. And there's a standard. You can look it up if you need to do it. I'm not going to get that.

A (13:08)

And the AI is going, well, I actually have a soul, so that does not apply to me.

C (13:12)

No, right. Yes, that's right. I'm not a robot, I'm an AI. The other one is my son. He's an accountant and he is getting master's in finance, I think. Actually he's at Hopkins, which is really, really cool. Anyway, he had an assignment to look at how AI was going to do journal entries or take over accountants jobs. So he crafted a prompt for his AI, which I think he uses Anthropic's AI. And he said, here's an electric bill. Do a journal entry for this. And it totally messed it up. It didn't get it right. I mean, it got it kind of right. But he said, if I'd have submitted this as a journal entry to my boss, you would have fired me on the spot. So when Maria. And the thing that prompted me to say that is when you said financial information.

A (14:11)

Yep.

C (14:11)

I would absolutely not trust this thing with my taxes.

A (14:16)

Oh, you might.

C (14:17)

No, I do not.

A (14:19)

I meant you might not. You might not. But. Sorry, but other people might and are.

C (14:23)

Don't do that. Don't do that.

A (14:26)

Well, what about openclaw? No, sorry, different. Different topic. I actually really want to talk about that some other time. But yeah, other people are. And I really did not think it would be this easy for someone to game this. I kind of want to try it now.

B (14:41)

Well, it also, it strikes me that a frightening possibility here is what if you wanted to foment civil unrest or something, so that if someone typed in has the President of the United States been assassinated? Right. And you're able to game it in such a way that it came back with the answer yes, or any world leader, a religious leader, whoever, but something where people were looking for a quick source of information for something that had strong emotional resonance with them.

A (15:18)

Yeah.

B (15:20)

It seems to me like you could have a real impact in a negative way with something like this.

A (15:26)

Yeah. I would imagine that would be extraordinarily difficult to get AI to believe you, but I'm sure people who are expert spammers would figure out a way to do it. I'm sure it would not be a matter of just putting up a blog post. It would be.

B (15:38)

Right. Right.

A (15:38)

But. Yeah, but even just the one blog post thing working, that to me is way easier than that should have been. So, yeah, that's a terrifying thought, Dave. Thanks for that. Well, glad I brought that one up.

B (15:53)

Yeah. All right, well, we will have a link to that story in the show notes. Let's take a break right now to hear from our show sponsor. We will be right back after this. Every attacker counts on one thing. Environments that Trust too much. ThreatLocker closes that gap with default deny at execution. Unknown software blocked. Trusted apps contained with ring fencing. Configurations verified with ThreatLocker DAC so you stay secure and compliant. ThreatLocker delivers the visibility and control CISOs need without adding operational pain, making zero trust real for teams of any size. Stop ransomware at its earliest point. Book a demo@threatlocker.com N2K. My story this week. It is unusual for us to come across something that is new. This is new.

C (17:04)

Really?

B (17:05)

Yeah.

C (17:05)

This is.

B (17:06)

Oh, boy, oh, boy. Let me frame that. New to me. I've never heard of this kind of a scam. It is a niche scam, but it is horrifying. So stay with me here. This comes from the New Yorker. This is actually in their book review section, and they're reviewing a new book written by Elizabeth Shambley, or I'm sorry, Elizabeth Shambley Burch. And the book is called the Pain How Conmen Call Centers and Rogue Doctors Fuel America's Lawsuit Factory.

A (17:37)

Oh.

B (17:37)

So buckle up, buttercups. Here we go.

A (17:40)

Okay, I'm strapped in.

B (17:44)

So it starts. The story in this article starts back in 2013. A woman named Sharon Gore got a call from a stranger who was asking her about some medical problems that she had had. And the person on the other end of the line had a lot of information about Sharon's medical history. And the caller warned her that she had what she described as a ticking time bomb inside body. A pelvic mesh implant that evidently Sharon didn't even know she had. This person on the other end of the phone offered to arrange surgery to remove it free of charge if she wasn't alone. Now, I don't know. Are either of you familiar with pelvic mesh implants? What they are, what they do?

A (18:39)

Yeah, a little bit.

C (18:40)

Yeah. I think they're I think I know what they are, but I don't know.

B (18:43)

I'm pretty sure I actually have one. Oh, really? Yeah, I had a hernia surgery 20 years ago and pretty sure that that was part of it, that they put this thing in. It's basically, you know, it's a mesh. And they put it. When they've cut you open or they're trying to splice something up, they'll put this mesh in there, and it's there to help strengthen the place where the cut was. Or if you have a weakness in your. In your body, your abdomen, wherever. In this case, they are quite common or were quite common for women who are having trouble with strength in their pelvis after childbirth. Those sorts of things, your organs can move around and your body might need a little help holding everything where it needs to be. And that's what these things were for.

C (19:33)

That's what I was going to suggest.

B (19:34)

They have since been banned for this particular. For that particular reason.

A (19:40)

Yeah. I remember the news stories when they were banned. That's what I remember hearing about. Cause it sounded pretty horrific when some of the women were going through.

B (19:46)

Yeah. So it wasn't just this woman who got this call. There were lots of other people who were getting these calls. These. In this case, ladies who got this procedure done to treat things like incontinence found out or were told over the phone that these pelvic meshes were defective. And the people on the phone urged them to have a removal surgery at a clinic in Florida. Travel would be covered, loans would be arranged to pay for everything, lawyers would handle everything. But according to this book, the pain brokers, the calls were not coming from doctors, hospitals, or the manufacturers of the product. These were part of a $40 million operation that allegedly used confidential medical information to recruit plaintiffs for mass tort lawsuits. Hmm. So marketing firms identified these women through treatment codes. They would cold call them and then funnel them through layers of telemarketers. And some of them were steered into surgeries that they may have not needed that were financed through high interest loans that were tied to future legal settlements.

A (21:02)

Oh, my God.

B (21:04)

So many of these people didn't realize they were signing away their insurance rights or that they were agreeing to arbitration clauses. So all of this sounds bad enough.

A (21:16)

Yeah, right.

C (21:17)

Does it get worse?

B (21:18)

It does.

A (21:19)

Oh, my God, it gets worse. Oh, Jesus.

B (21:23)

What the part of what makes this despicable. And again, I'm already disgusted.

A (21:33)

Yeah, yeah, we're there with you, Dave.

B (21:36)

Evidently, the lawsuit against the manufacturers of these things, the class Action lawsuit against these pelvic mesh devices are more effective if the person has had it removed. So the lawyers were out there fishing for people who'd had the procedure done, investing in getting them to have the device removed so they were more likely to win their lawsuit.

A (22:11)

This is why people hate lawyers.

C (22:12)

Yeah.

B (22:13)

Yeah.

A (22:13)

Oh, geez. God.

B (22:16)

So in some of these cases, again, the allegations are these people didn't need to have their meshes removed.

C (22:22)

Right.

B (22:23)

You know, like I said, I think I've had one for 20 years or so, and it doesn't give me a lick of trouble. That could change tomorrow, but so far, so good. Right.

A (22:31)

Be careful if you get a phone call about it, Dave.

B (22:33)

Right. Yeah, exactly. Somebody's gonna call me up and tell me, you know, what I need to do here. And of course, any surgery is risky. Going in to take something like this out that was there for it was put in for a reason, risks more trouble. And guess who's not gonna take care of that trouble if you have complications?

C (22:52)

The lawyers.

B (22:53)

The lawyers, Right.

C (22:56)

They'll probably turn around and help you sue the doctor that took it out, though.

B (22:59)

Probably. Probably. But then it gets even worse.

A (23:04)

Oh, my God.

B (23:05)

These lawsuits were bundled and sold to other law firms, reportedly for $40 million. And litigation finance companies backed these deals, again with high interest rates.

C (23:21)

Okay, so this is a market I didn't even know existed.

B (23:24)

Exactly.

A (23:25)

Yeah. It's like when I found out that our mortgages get sold and resold and resold, and it's just right.

B (23:30)

Like, the day after you settle, somebody's bought your mortgage.

A (23:33)

I've had my house for like, a year and a half, and I think my mortgage has changed hands at least three times now. It's like, just don't stop.

B (23:42)

So basically, these lawsuits were being turned into financial instruments. I don't know about you, but that just creeps me out.

C (23:50)

Yeah, right.

A (23:52)

It's just so wrong.

B (23:53)

Yeah. So some of these women, they faced mounting debts. They faced complex legal agreements in years of uncertainty because these procedures were funded through loans that were promised to be paid through future settlements, and not all those settlements were going to happen.

A (24:14)

So it's a giant shell game, essentially.

B (24:16)

But with law at the outset. Yeah. With medicine, law. And people's bodies.

A (24:22)

Oh, Jesus.

B (24:23)

Yeah, Right. So there are some people.

A (24:28)

It's all right.

B (24:30)

Little choked up. There are some people who have found justice here. The book talks about a lawyer from Arkansas whose name is J.R. baxter, who took on many of these cases of the women saying that they'd been misled into unnecessary Surgeries. And one woman won a $2.5 million verdict, and others are still fighting it. But the book makes the point that this isn't just about one scam. It's about this system. It's about a regulatory framework that allowed a medical device onto the market without rigorous trials. So that's one thing. And then you have a litigation system that is so complex that it creates these opportunities for exploitation. But then you have a legal marketplace that's basically shaped by marketers and financiers, people trading around the potential for windfalls as the result of medical errors, as if they're financial instruments.

A (25:29)

That's like the gambling market almost.

B (25:32)

Right? So talk about screwed up incentives. And the lower level of this, that what's propping all of this up are vulnerable people.

A (25:43)

Yeah.

B (25:45)

So like I said, this is something. Joe, to your point, I never heard of anything like this, nor did I ever imagine something like this was possible. I find this heartbreaking and disturbing. And I hope these people, if these allegations turn out to be true, I hope these people get the justice that they deserve and that our regulators are put on notice to make sure that this sort of thing can't keep happening.

C (26:15)

It's awful. I mean, I'm just like. I've been really quiet during this because I'm just. I'm shocked, actually.

A (26:23)

Yeah, yeah.

C (26:23)

That doesn't happen.

A (26:24)

I feel like I need a shower, to be honest with you. I'm just like. It's one of those things where I understand what's going on less and less as it goes. I mean, your explanation was beautiful. It's just the legal part of it. I'm going, I don't understand. Understand. I don't understand that. And it's by design that you, you know, you're not supposed to understand it. And that's how people get hoodwinked. And. And it's just when. When it's not easily understood, that's where. That's just. That's where people get hurt.

B (26:49)

Yeah, yeah.

A (26:51)

And of course, our medical system doesn't make any of this easy either. So it's just all right for people being exploited, isn't it?

B (26:57)

Right, right. No, it. Again, you know, according as I understand these allegations, it just strikes me as being just downright despicable. So heartbreaking. All right, well, tell you what, let's take a quick break, shall we?

C (27:12)

Please, I need a shower.

B (27:15)

Let's take a quick break. We will be right back after this message. Most environments trust far more than they should, and attackers know it. Threat, locker, solves that by enforcing default deny at the point of execution. With ThreatLocker allowlisting, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with threat Locker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. Its powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. And we are back.

C (28:34)

My hair is wet.

B (28:35)

Joe, save us.

A (28:38)

Need something light, Joe? Come on, don't let us down.

C (28:40)

My story.

B (28:40)

Joe's got his bathrobe and his slippers on. He just took a quick shower.

C (28:46)

I'm sitting here. I just wear a towel around my waist.

B (28:48)

Dave. I didn't need to know that.

A (28:50)

It's not creepy at all. Okay?

B (28:52)

Me eliciting the image of you in your bathrobe wasn't just for me. It was for our listeners, too, Joe. Right.

C (28:58)

Well, I'm in a Jim Gaffigan camp of bathrobes. No, I don't like them.

B (29:01)

Okay.

C (29:02)

Are you sure? They got a little belt you can dunk in the toilet.

B (29:05)

They got a little pocket, too, which you can put your phone in and

C (29:07)

then drop your phone and then drop

A (29:09)

that in the toilet. Yeah.

C (29:10)

Not a big fan.

A (29:11)

Okay.

C (29:12)

Anyway, this story, I found a whole mess of different articles about this, but the best one came out of abc, the Australian Broadcasting Company.

B (29:23)

Okay.

C (29:23)

And of course, when I went to the Australian Broadcasting Company, I couldn't help but look to see if they have anything on the kids page about Bluey. And they do, and you can, if you go there. Like right now, they have a dunny roll. Make your own Bluey. And bingo, Dunny rolls. Which I thought was dunny, right? Dunny. Dave, you know what dunny means?

B (29:43)

Nope.

C (29:43)

It's the Australian slang for toilet.

B (29:46)

Oh.

A (29:46)

So then you got to say squish. Squash. Okay.

B (29:49)

Wow.

C (29:50)

Okay. I only learned this by watching Bluey, you know, with the little tykes that run around my house and love the show.

B (29:58)

Yes.

C (29:59)

Anyway, the Louvre has been hit again.

B (30:03)

Oh, no.

C (30:03)

And this has lasted for the past 10 years.

B (30:07)

What?

C (30:07)

Yep.

A (30:08)

What?

C (30:09)

That's where we're going?

A (30:10)

Dapper dressed fedora guy? Is that it?

B (30:13)

I Do love a caper, you know, with a museum. So go on.

C (30:18)

This is not as cool as the jewel heist that happened where everybody was like, all right, just standard old fashioned Italian job style crime.

B (30:27)

Right?

C (30:28)

Right. No, this is nine people who've been arrested after a year of investigation into what. What the article describes as a multinational fraud network. Now, I think that's overstanding it a little bit, but what. What they had was two Chinese tour guides who have been accused of facilitating entry of multiple groups of Chinese tourists by reusing single entry tickets to the Louvre. So you can go to the Louvre. It costs you about €35 if you're outside. It's more expensive if you're not a member of the EU or the European Economic Union.

B (31:08)

Right.

C (31:09)

So, like, people from the UK have to pay more to go into the Louvre now. And I imagine that if you tell them you're American, they're like, oh, that'll be €150.

B (31:19)

See, living as close to D.C. as we do, my default notion is that museums are free.

C (31:25)

Right. You just walk in.

A (31:26)

Yeah, Yeah.

C (31:28)

I was shocked the first time I went into a museum and had to pay for it. Yeah. Because I grew up around here and I would just. Let's go down to the Air and Space Museum. Let's go down the Natural History Museum. Let's see some dinosaur bones. What's that gonna cost us? Nothing.

B (31:39)

Right.

C (31:40)

You know, it just.

A (31:41)

You guys are so lucky. I just.

B (31:43)

It's really nice.

A (31:44)

It's always a treat when I'm in the D.C. area and I just walk

C (31:46)

in and I'm like, you should hit the museums. It's beautiful.

A (31:49)

I always do. I never miss out. Yeah, yeah. Yep.

C (31:52)

And you know what? Every time I go to another museum, I'm not as impressed as I am with the Smithsonians. Oh, you know, they're not as good.

B (32:01)

They're world class. Although I would say people who run the Louvre would probably take issue with that.

C (32:05)

But I've been to the National Portrait Gallery and the Art museum, and I don't know.

B (32:11)

Yeah, no, they're excellent.

C (32:12)

Yeah. And then there's a cork. I mean, there's like three art museums on the mall. Yeah, three of them.

A (32:17)

Yeah.

C (32:18)

Anyway, it's alleged also that there were two tour guides, or these tour guides rather, bribed two Louvre employees to make this possible. So what these guys were doing was essentially they were two Chinese nationals, or I don't know if they're nationals, but they're two Chinese guys. And they would get Chinese tourists together and they'd take them into the Louvre and. And they take them to these Louvre employees who would then just either not scan the tickets or find some way to get around the system that they had. And then they'd walk these people through also. They. They wouldn't have to pay a speaking fee. I guess you can be like a third party Louvre tour guide, but you have to pay the Louvre to do that.

A (33:04)

Okay, yeah, they're everywhere. It's there. You just bump into them all the time.

C (33:08)

I've never been to France, so.

B (33:09)

Oh, well,

A (33:12)

it's a thing. And also, you can skip the Louvre. I will stand by that. I think it's overhyped anyway.

C (33:18)

One of the things everybody says, don't you want to see the Mona Lisa? I'm like, you can get on the Internet and see the Mona Lisa. And from what I understand, it's not that big of a painting. And I mean, seeing it in person is not that much different from looking at it on the Internet.

A (33:29)

Can I tell you my Mona Lisa story? I lived in France, specifically in Paris, for a little while, just for like eight months. So not a super long time, but long enough. And I went late January to the Louvre. The first time there was not a soul there at the Mona Lisa. I got to walk right up to it. There was no lines. And I got to look at it for a long time without a whole mob of people crowding me. And I was like, you know, this is really not that great of a painting. I understand why, in terms of art history, why it's a big deal, but it's just literally everything else at the Louvre is much more impressive. And it's just. It's so depressing seeing people going only for that and missing literally everything else there.

C (34:09)

Yeah, that would not be my hype. I mean, I've seen it a hundred times. I can close my eyes and picture it. It's not, you know, it's.

A (34:18)

Yeah, you've seen it. You've seen it. Many, many great works of art. You see them in person and you find stuff that you never noticed before. And I'm sure if I stared at the Mona Lisa for hours, I would have found something. But it's been done. It's overdone. Go enjoy other things.

C (34:31)

They have lots of Van Goghs there, right?

A (34:33)

Yeah. I mean, they have a lot of. You cannot see the Louvain one day. I went back many times. It's so massive. And I didn't steal any jewels either. I'm really sad about that, but that's

B (34:43)

exactly what somebody who stole some jewels

A (34:45)

would say, I know there are a lot of museums.

C (34:48)

Where were you last October?

A (34:49)

Yeah, not there. There are a lot of art museums in Paris that frankly are worth more people's time. So that's the end of my psa.

B (34:58)

Okay, proceed, Joe.

C (35:00)

So the French police have finally arrested people. They did a raid, or rather they start with an investigation that was launched in 2025, included surveillance and wiretaps, and they were tasked with the investigation of organized fraud, money laundering, corruption, and aiding with illegal entry into France as part of an organized group, and the use of forged administrative documents. Now, I don't know if the forged administrative documents are just like, fake tickets or reusing tickets. I don't know. Or if that has anything to do with the immigration part of it, getting illegal entry into France. It doesn't say in the article. But those. When they started investigating, they found that, yeah, these people were reusing tickets. And the tour guides would also split up groups and pay cash. These accomplices, these guys they bribed to get them into the Louvre and avoid detection. So apparently, if you have a large group going through the Louvre, you have to pay a bigger fee if you have, like a smaller group. So they would just. They'd bring the group in, split it up into two small groups, and walk around the Louvre and give tours. So the investigators who did this estimated that these guys would bring 20 groups of people through this system a day for more than 10 years. 20 groups of people for 10 years. And the estimated losses for the museum were around 10 million euros. And there's a number here that says $16.75 million, but I think those are Australian dollars because this is an Australian article. So there's still. Yeah, still there's no mention.

B (36:40)

Much more than I would have thought.

C (36:42)

Yeah, there's no mention of real money, but the Louvre didn't lose this money. Like, they didn't have 10 million euros and now it's gone. They just never got the $10 million over the past 10 years.

B (36:52)

Yeah.

C (36:53)

So, I mean, still. Yeah, you're stealing from them.

B (36:55)

Opportunity cost.

C (36:56)

Right, But. But if these tourists were going to go to the Louvre, would they have paid the full price of the ticket? That's neither here nor there. This is wrong, obviously, and you shouldn't be doing it. A spokesman for the Louvre has said, by the way, that the Louvre has drawn up plans to prevent this further fraud. Kind of like they changed the password for the camera system from Louvre to something else.

B (37:23)

Right.

C (37:26)

To maybe not.

B (37:27)

Lou, the crack security team at the Louvre whose reputation precedes them.

A (37:33)

It's a shame.

B (37:36)

Wow. I wonder how they ultimately got caught here. I wonder what tipped them off.

C (37:42)

What tipped them off was the Louvre noticed some anomalies back in December 2024 about ticket usage. And then they started investigating it, and they found it out. They did arrest nine people. Two of the employees of the Louvre were arrested, several other people, and several tour guides. And one person that was described as the mastermind of the organization. And I just imagine the cops going in there and finding a bunch of guys, and there's one guy with a big, big head, and he just goes, who's the brains of this operation?

B (38:13)

Like a far side cartoon.

C (38:15)

Yeah, exactly.

A (38:17)

There's a cow there for some reason, right?

C (38:19)

Yeah. When they conducted the raid, they seized and over €950,000, stashes of foreign currency worth about €67,000 and another close to half a million euros that were deposited into bank accounts. And they also got three vehicles, several bank deposit box safe deposit boxes. Well, actually, the vehicles and the safe deposit boxes are being reported by Le Parisian newspaper. I hope I totally botch that.

B (38:52)

Actually, Maria,

A (38:55)

I think we should leave it as it is.

B (38:56)

Okay.

C (38:57)

No, not. That's fine. That's fine.

B (38:59)

Very good.

C (39:01)

Authorities said that they suspect that some of these people have invested their money into real estate assets in France and Dubai, which is a good way to launder money, by the way.

B (39:11)

I never would have thought there was this much money in sneaking people into a museum.

C (39:17)

Right, right.

B (39:19)

But they're playing the long game. Ten years,

A (39:24)

the most touristed city in the world. There are a lot of tourists in Paris, so you can make some big money on these tours. And they are really everywhere. People don't know the difference between official and unofficial. I mean, I don't.

C (39:36)

You know what we should do, Dave, you and me, one weekend is we should go down in the mall with one of those little stands and just sell Smithsonian all access badges.

A (39:46)

Right. There you go.

C (39:48)

Right.

B (39:48)

Just show this at the entrance. They'll let you right in.

C (39:51)

Right? Yeah. You can go to all the museums, Right?

B (39:54)

Right. We'll just stand at the exit to the metro. You know, discount tall access badges, half price. Right here.

C (40:01)

$15. $15. Cash only.

A (40:04)

That's a steal, right? Right.

C (40:06)

Maybe we say $100. I'll take them.

A (40:09)

Okay.

B (40:12)

Oh, my goodness. You know, the park police don't mess around, right?

C (40:15)

Yeah, they do.

A (40:16)

Yeah. They will nab you fast.

B (40:17)

They really don't.

C (40:18)

Yeah, I would like to, you know, with park police permission of Course, Just go and see if I could. If I could do that. And when people try to hand me money, just go. No, no, the museums are all free. I just wanted to see if anybody would be willing to pay.

B (40:30)

Yeah.

C (40:30)

See what would happen. It's a social engineering experiment.

B (40:33)

Okay.

C (40:33)

Right.

B (40:35)

All right, do another research. We will have a link to that story in the show notes. Oh, there's more?

C (40:39)

Yeah, there's one more thing, one more detail.

B (40:41)

Okay.

C (40:42)

That the prosecutor's office said that allegedly the same ring operated a similar scheme at the palace of Versailles.

B (40:49)

Oh, yeah.

A (40:51)

Not surprising either.

C (40:51)

I don't want anything. Any more details, huh?

A (40:53)

Yep.

C (40:54)

Yep.

B (40:54)

So I wonder if you could buy a museum scamming franchise. Right, right. They give you all the. All the details, all the tools you need. You, too, can sneak people into museums for fun and profit.

A (41:06)

It kind of makes sense because both those locations are just so massive, filled with so many different people. You can easily just sort of sneak your way in. Not sneaking, but, you know, like, you could probably operate kind of under the radar very easily there, much more than any other places. So I get why they targeted those two spots. Yeah, it's just, Ooh, iffy.

B (41:29)

All right, like I said, we will have a link to that story in the show notes. Joe and Maria, it is time to move on to our catch of the day.

C (41:45)

Dave, our catch of the day comes from the Reddit, the subreddit R. Scambait. And it says T and T and T, Land and Sea.

A (41:57)

Wow.

C (41:59)

That's the title of this. I don't know what this looks like or what this is. I haven't seen this yet, so.

B (42:03)

All right, so, Joe, why don't you read the parts in green?

C (42:07)

Okay.

B (42:07)

And I will read the parts in gray.

C (42:09)

Hold on, I gotta magnify my.

B (42:12)

There we go. All right, Grandpa.

C (42:14)

Thanks.

A (42:17)

You're not supposed to tell people that, Joe.

C (42:20)

That was an inside thought. Yeah.

B (42:22)

All right, all right. It starts off. It goes like this. Hi, I'm Tim with TNT Land. We're aiming to find the owner of a lot in North Point, and we think that it's you. Would you think about taking something for it if we got you a good number?

C (42:37)

Hi, Tim with TNT Land. What does TNT stand for? Tim and Tim.

B (42:41)

Tim and Tom, actually. Friends who went into business together.

C (42:45)

That's wonderful. What kind of business?

B (42:46)

We buy and develop land and real estate together.

C (42:50)

What do you and Tom develop land into?

B (42:52)

Depends on the land zoning and area. Any interest in selling that parcel?

C (42:57)

Forgive my curiosity. It's just nice to hear Stories of the friendship in these trying times. How did you and Tom meet?

B (43:05)

Appreciate the interest and I'd be happy to tell you more, but if there's not interest in selling the lot in North Point, I'd prefer to spend my time elsewhere. If you're interested in selling, just let me know. Thanks.

C (43:16)

You drive a hard bargain, Tim. I could see what drew Tom to you. I haven't even heard that good number you mentioned, so how would I know? Would you fellas be interested in adding a third to the mix? Tim, hear me out. T and T and T. Land and Sea. We add me to the company, and I handle the waterfront properties. This doubles the property lots. What do you think?

B (43:45)

Nothing better going on in your life? It seems a job might help with that.

C (43:49)

Yeah, that's what I'm thinking. This could be lucrative for all of us. What do you think of expanding to the sea?

B (43:55)

You go have fun drowning.

C (44:00)

So this is interesting. I get these from time to time for my. Or I used to get them for my old house.

B (44:09)

Yeah.

C (44:09)

Hey, are you interested in selling your house? And I would always write back and be like, yes, my starting price is $1 million. And I'd never hear back from them because if somebody gave me a million dollars for that house, I'd have moved out.

B (44:25)

Right.

C (44:26)

But as it turns out, the people who did pay me for that house when I sold it, gave me substantially less. But I was ready to move at that point in time.

B (44:33)

Yeah. So I've gotten these, too.

C (44:36)

Yeah.

B (44:36)

Yeah. And people ask me if I want to sell my old business that is no longer in business. You know, things like that. So somebody's scraping up an old database of homeowners and business owners and things like that.

C (44:49)

I mean, would you sell?

A (44:50)

I've never gotten any of these. I've never. This is. I feel I'm left out. I didn't get. I've never seen this before.

B (44:56)

Well, just give it time, because, you know, you have a mortgage, you're a homeowner.

A (45:00)

I'm on mortgage number three. Never gotten this before.

C (45:03)

And house number two. Right.

A (45:05)

Well, this is my third home.

C (45:08)

Oh, third home.

B (45:09)

Count yourself lucky.

A (45:10)

But I don't own three houses right now. I've bought and sold. I'm now on house number three.

B (45:14)

Yeah. Maria's secretly a slumlord behind the scenes. She just buys up distressed properties and sells them out to poor Bostonians who don't know anybody. Yeah.

A (45:24)

Notoriously lucrative podcasting. That's why I own three properties in the very high cost of living area of Boston. That's right.

B (45:31)

Do you ever get postcards, Maria, asking from your local realtors, asking if you're interested in selling?

A (45:37)

Yeah, the postcards I get, and they're always very funny because they're like, you know, they will either say, call us for a free estimate or they'll tell us what my house is worth. But that's, you know, whatever. Those I don't even register because it's just, it's a realtor. But I've never gotten a scammer texting me this kind of thing that I feel. Oh, man.

B (45:58)

Yeah.

A (45:59)

And I had an LLC and everything for my old freelancing business. Nobody's ever harassed me to sell for them. Come on, cameras get on that.

B (46:07)

It's also possible that Tim and Tom are on the up and up, that they actually do buy land. I mean, that is a thing. But I don't know. I think you're better if someone texts you out of the blue. Your best just ignoring them or doing what the third T here, whoever it was, did, and lead them along, lead them astray.

C (46:26)

Yeah.

A (46:26)

Tim Tams.

C (46:28)

It's irritating to me because, you know, these guys are those, those real estate flippers.

A (46:33)

Yeah.

C (46:33)

When we were buying our house, our last house, you could walk into a house and just look around and go, this is a flip.

B (46:39)

Oh, yeah.

C (46:40)

You know.

A (46:40)

Oh, yeah.

C (46:41)

Because they all look exactly the same.

B (46:43)

Yeah.

C (46:43)

And I would just straight up, if it was an open house, I just straight up ask the agent, is this a flip? And they'd be like, oh, yeah. And I'd turn around and walk out. Also on Zillow that you can look and see when the house last sold.

B (46:59)

Right.

C (47:01)

So that will tell you, give you an indication that it's a flip too. And usually you'll see this, like, this spike, you know, you see that the, you know, the house's value is listed and you'll see that it sells. And now there's this huge spike where it's trying to sell again, Right? Yeah, yeah, yeah, yeah.

A (47:19)

My favorite is when the flipper is the realtor who is trying to sell it. That one I encountered a lot. Oh, look at all this work I did. I'm like, oh my God.

C (47:27)

Yeah, I'm trying to save. Trying to save the commission on this one.

A (47:30)

Yeah, it's the Home Depot special all the way down.

B (47:33)

Yeah. I will say in the flippers defense that there was.

A (47:38)

Do they need defending?

B (47:39)

Well, I know someone who is a flipper and it is on the up and up. And my family, at one point, my Father had a distressed property that he was looking to sell. And our friend who flips properties came in and made an offer. And the offer was, you don't have to do anything. Right. I will buy this property as is. You don't have to clean it out. You don't have to clean it up. You don't have to do anything. And the property was pretty distressed. And so for my father, he was like, yeah, that sounds great. Right?

A (48:13)

See, I can.

B (48:15)

Let me also say my father is a career realtor. Right?

C (48:18)

Right.

B (48:19)

So he's a knowledgeable person or was a knowledgeable person when it comes to this kind of stuff. But I will acknowledge that that is the few and far between the flipper who's in it for the, you know, in the good of their heart and all that sort of thing.

C (48:37)

Well, he's still gonna make a profit on it, but, you know, it's a good opportunity when you can find it. But then there's, you know, the other guys that do the unethical things like call you up and say. And lowball you for your house.

B (48:48)

Right? Yeah, yeah, absolutely. All right. We will have a link to that in the show notes. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans2k.com. Most environments trust too much and attackers know it. Threatlocker enforces default deny at execution, blocks unknown apps and limits what trusted apps can do. Stop ransomware at the source. Get your demo@threatlocker.com N2K and that is hacking humans. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Liz Stokes. Our executive producer is Jennifer Ibin. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

C (49:59)

I'm Joe Kerrigan.

A (50:00)

And I'm Maria Vermazes.

B (50:01)

Thanks for listening.