Loading summary
Transcript58 lines
- [00:00]
Jason Kebler
Yubikeys are the original Passkeys. Small, sturdy and easy to use physical security keys that prevent phishing attacks and account takeovers. Yubikeys are manufactured by Yubico, a company with headquarters and manufacturing centers in Sweden and the United States. Unlike basic Multi Factor Authentication or MFA methods such as sms, which is text messages one time passcodes or mobile authenticator apps, Yubikeys provide modern MFA and are a proven security solution that can't be hacked or bypassed by malicious actors. Stopping AI powered cyber attacks, online identity scams, fraud and account takeovers, Yubikeys help businesses of all sizes, from large banks and tech companies to critical manufacturers, energy concerns and government agencies stay ahead of evolving cyber threats and regulatory requirements. They also protect individuals and everyday users by securing email, banking and social media accounts, password managers, productivity tools, developer tools, and more. For more information on how Yubikeys secure applications, services and accounts for both individuals and businesses, visit yubico.com 404media and for a limited time, get $10 off your order of exactly two keys from the Yubikey 5 Series or Security Key Series using the code 404 Media 10 at checkout. That's yubico.com 404 Media use code 404 Media 10.
- [01:31]
Joseph Cox
Hello and welcome to the 404 Media Podcast where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist founded company and needs your support. To subscribe, go to 404 Media Co as well as bonus content every single week. Subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404 Media co. I'm your host, Joseph and with me are 404 Media co founders Sam Cole.
- [02:01]
Emmanuel Mayberg
Hey.
- [02:01]
Joseph Cox
Emmanuel Mayberg.
- [02:03]
Emmanuel Mayberg
Hello.
- [02:03]
Joseph Cox
And Jason Kebler.
- [02:05]
Jason Kebler
What's up?
- [02:06]
Joseph Cox
All right, final warning. The second anniversary party for 404 Media is is happening this Thursday. Well, presumably if you're listening to the podcast when it comes out. August 21st, Thursday 6 to 9pm Sam, are we getting close to sold out? There's a few more tickets left. What's the deal?
- [02:30]
Sam Cole
We're so close to selling out. We're very close. We're like two dozen tickets away, so please get your ticket now. Yeah, it's going to be fun. It's at Farm One in Brooklyn. We're going to have open bar, really good cocktails, really good local beers. We're going to record something short and sweet for the podcast and then also take your questions so please come with questions. Mail us your questions ahead of time if you're not able to be there in person. But if you're there, you can bother us with your questions live and in person.
- [03:08]
Joseph Cox
Yeah, the details are in the show notes. It goes to a post on the website where you can buy the tickets. Again, this is free for paying 4 or 4 meters subscribers. There's a code in there. You then enter it and you get a ticket. You do have to get a ticket to be able to get in, just so we can keep track of how many people are coming and going and that sort of thing. Otherwise it's $20. Or you could subscribe for $10 and then you get access to an open bar. It seems like a very easy sell.
- [03:36]
Jason Kebler
To me, I think. Also, I mean, this is our last podcast before our two year anniversary. So if you're not a subscriber, we recorded a second anniversary podcast which is. It's out now, right? It's on the feed.
- [03:50]
Joseph Cox
Yeah, sure is.
- [03:51]
Jason Kebler
So you can get that if you subscribe. So good, good time to subscribe because we talked about how 404 Media is going and that sort of thing. I thought it was fun.
- [04:00]
Joseph Cox
Yeah, absolutely. All right, we'll leave that and we'll go to this week's stories. This first one is one written by Emmanuel. A really amazing deep investigation here. The headline is how T's founder convinced millions of women to spill their secrets, then expose them to the world again. This is a massive investigation, involves former employees, people directly involved, documents, text messages, all of this other sort of stuff as well. So we're not going to be able to talk about everything. So I'm pulling out some important parts that I think are worth talking about on the podcast. But that said, Emmanuel, could you just remind people what T is exactly and sort of what it promised and then we'll go from there.
- [04:49]
Emmanuel Mayberg
Tea is an app that went viral in late July. It pitches itself as a women's dating safety app. And basically the way it works is women can create an account after they verify that they are in fact women. And they then share information about men that they know or have dated, thereby allowing other women to stay away from them if they're bad or have other women vouch for them if they're safe and good to date. The app was hacked in late July, just like a week after it went viral. Initially, we found out about it on 4chan because they gained access to the back end, got all these selfies and images of IDs that women shared with the app in order to verify that they're women. That was the initial hack. Shortly thereafter, we discovered a second hack via an independent researcher, which was far worse. This one included a lot of private messages between users. Over 1.1 million, I think, is what we could verify was leaked. And these are incredibly sensitive conversation between women talking about very personal, very intimate things like abortions, cheating partners, things like that.
- [06:26]
Joseph Cox
Yeah. And the app is still popular, it seems. I was trying to load the app.
- [06:30]
Emmanuel Mayberg
Store far more popular than it was when these hacks happened. I think at the time when we wrote these stories about these two hacks, they were, at one point, 16 million users after their, like, viral moment in the news, before the hacks, and then now they claim almost 7 million. So many times over. More popular.
- [06:51]
Joseph Cox
It is weird the impact that data breaches can have, even those that put people's safety at direct risk. I mean. Okay, we'll move on from that. So that's what t is. Let's step back a little bit in time. Who is Paola Sanchez, and what did t want with her? Exactly.
- [07:14]
Emmanuel Mayberg
Yeah. So, Sam, not to put you on the spot, but Paula Sanchez is the founder of this movement and community and collection of Facebook groups called are we dating the same guy? And essentially, that does basically exactly what he advertises, but it does it on Facebook. And it kind of grew organically. Initially. The first group was started by Paula in New York, and it became very popular, and people open other groups across the country and in Canada dedicated to different cities, and that just, like, exploded in popularity. Also, there's over 200 groups, 7 million members across all these groups, and Paula is still, like, the administrator of all of it. But we first heard about Are we dating the same guy? From. From Sam, if you kind of want to talk about how that came up for you and, like, why. Why these groups are useful and popular.
- [08:26]
Sam Cole
Yeah. So I think we first started reporting on these, at least when this man sued, like, 27 women and a bunch of different parts of, like, Facebook and meta and Patreon and GoFundMe and all these other entities, because he was included in an Are we dating the same guy? Group in Chicago. So he had started this hoping to be a class action, but started this complaint against Paula and then a bunch of other women saying that these women were in these groups defaming him. His issue with these groups was that these women were calling him clingy and psycho, Specifically accused them of being, like, outrageous and cruel and malicious because they were posting his picture, which was, like, Publicly available on his Facebook, posting his picture in the groups and then asking, like, what are the red flags with this guy? And those are the red flags that came up. People said, oh, yeah, I dated him and he pressured me into sex. Or, you know, like, that's. That's what happened in these groups is people brought up their own experiences that were like, quote, unquote, red flags about a guy. So, yeah, that was the first time we came across this, and it's. It's only gotten bigger from there. That was in 20. Early 2024. Yeah, that complaint didn't go anywhere because that guy went. I think he. He got taken down for, like, tax fraud or something. So, yeah, didn't go very far.
- [10:03]
Emmanuel Mayberg
Yeah. So we write these stories about the T hacks. Sanchez reaches out to us and says, basically, I never talk to the press. I am under a lot of pressure because of lawsuits like this, because of something our friends at Wired covered where there were these groups of men who, again, were upset about the information women were sharing about them on the Are we dating the same guy? Facebook groups. They organized on Telegram to, like, dox women there. She's just been through a lot because she's behind this community, but she said, I need to. I don't want to do this, but I need to tell you some stuff that I know about T. And the gist of that is that beginning in late 2022, people from the Tapp, even before it officially launched, reached out to Sanchez and said, hey, we're doing exactly what you're doing, but we're doing it in an app. We think we could do it better than you. We need a face and founder to kind of go around and present this app to the world. And we think you'd be perfect for this because you're behind the are we dating the same guy? Community. And she. She never responded to that again for the same reason that she doesn't respond to all of requests that she gets. And from there, things got pretty. Pretty weird and I would say, aggressive from. From T's direction.
- [11:37]
Joseph Cox
Yeah. So T is trying to create this app. Obviously, eventually they do create the app. They ask Sanchez, who is the face of this phenomenon, Basically, are we dating the same guy? Hey, we really would like you to come on board with T and be the face of our app. Obviously, there's probably some incentives there in that the CEO of T is a man, and it would probably be useful to have. Well, first of all, a woman. Secondly of all, a very respected woman who's already been doing all this safety work. You can see the reasons why there. You say something changes when she doesn't reply. I mean, I have a short list here of things, and I'll make sure we touch on all of them. But what starts to happen when Sanchez sort of turns down T's request?
- [12:28]
Emmanuel Mayberg
The first thing they begin to notice, not just Sanchez, but this community of moderators that are helping to keep the Facebook groups, like, healthy and useful to women, is that all these users are showing up and posting about T and replying. Like, let's say a woman comes into a group in San Diego posting about a man she's about to go on a date with. Like, does anybody know him? And a bunch of the replies are like, yeah, I know him, and there's nothing about him in this group, but you should check out T. I think I saw something about him there. And this is happening again across, like, 200 groups. And the moderators are noticing that these accounts are behaving like spam. And some of the women are reporting back in reviews on the tapp, on the app stores, and then just like, talking amongst themselves, being like, I signed up because someone told me that I can find information about this man there, and there's nothing there. And to be clear, I did not find any evidence that T itself was behind this, but it was very clear that these accounts were not authentic activity. These are probably accounts that were hijacked by some sort of, like, spam operation. And this is something that is common on Facebook. There's all these accounts that are compromised, then some sort of company, you can pay them to advertise whatever you want, and they just, like, use compromised accounts in mass to promote a certain product or message or what have you. So, again, we couldn't confirm that T was behind us, but it's clear that there was, like, inauthentic marketing of the T app specifically targeted the. Are we dating the same guy groups.
- [14:17]
Joseph Cox
Yeah. That's pretty weird. Pretty suspicious. Jason, maybe just briefly, because you have reported a lot on hijacked Facebook accounts. What does that look like? How can you tell an account on Facebook has been hijacked?
- [14:32]
Jason Kebler
Yeah. So again, we can't say for sure that Te knew that these accounts were hijacked. I feel the most likely mechanism was probably they were paying for boosting on Facebook, which is a service that a lot of companies offer. And it's basically like, promote my company across Facebook or promote my Facebook content by having a lot of likes, a lot of replies, et cetera, et cetera. And I bring this up Just because this has been the case with a lot of the AI slop reporting that I've done, where a lot of the accounts that are commenting on Facebook slop are hijacked accounts. And the way that you can tell that they're hijacked accounts is, well, sometimes the. The name in the URL, like, the name on Facebook and the URL name are totally different. And so someone has, like, taken. I don't have the exact specifics in front of me right now, but they'll take, like, facebook.com Jason Kebler. They will take that account, and then they'll change it to, like, Diane Smith and change the Facebook profile picture. They will then, you know, change all the information on the account as well. But that URL is permanent and can't change. And so that is, like, one way that you can tell. And in one case, Emmanuel was able to find a woman's new account where her first post was. My old account got hijacked.
- [16:01]
Joseph Cox
Oh, yeah.
- [16:03]
Jason Kebler
And so, I mean, that was, like, a really good tell, you know, but basically, it's like, this happens in huge, huge numbers on Facebook. And so it's a. It's a very common thing, you know, super shady and bad that this happened in this case. But there are so many services out there that sort of sell, like, we'll boost your content using our army of Facebook bot accounts. And sometimes they might not even advertise them as bot accounts. They might just say, we'll boost your content on Facebook. But then the way that they're doing it is through, like, a botnet of zombie accounts, more or less.
- [16:43]
Joseph Cox
Yeah, that makes sense. But he did other stuff on Facebook, so again, they couldn't convince Sanchez. So then they start doing these other things like boosting the Tapp. It sounds like potentially misleading some people to join the app and then finding there isn't actually any information about the guy they're looking into or dating or whatever. Why? What's with these fake Facebook groups that look a lot like, are we dating the same guy? But they're not. So what's the deal there?
- [17:15]
Emmanuel Mayberg
Yeah, so one of the former employees I talked to AT T, Veronica Mars, she had a lot of tasks that were related to promoting the app. But one thing she did is she was handed a number of Facebook groups that were started by the CEO of T, Sean Cook, and they were just called are we dating the same guy? And insert name of city. And then at the very end, it said Tapp. So they used the branding of the original grassroots movement, appended the app name to it. So I think, to be fair, like, they had something in there. So you can tell that it wasn't. That it was a TAPP affiliated thing. But she said that many times she had to explain to people who reached out to her that these groups were not related to Paola Sanchez's thing. They just assumed that it was. And people were reaching out to her looking for Sanchez, and they were just confused. This is another thing that you can see in the reviews for the app is that people thought that it was the Are we dating? It was an official are we dating the same guy? App, and that just wasn't the case.
- [18:41]
Joseph Cox
Well, it's funny you bring that up and that confusion, especially in the reviews, because after we posted your investigation today, and obviously I just posted it to bluesky and various other platforms, I think I got a reply from somebody who it seemed, was confused in that respect. And they're like, whoa, but are we dating the same guy? And T are the same thing. It's like, first of all, please read the article because that's the entire point. Second of all, oh, that confusion has permeated where some people believe that. And you can't really blame them because they've been misled by these Facebook groups.
- [19:16]
Emmanuel Mayberg
Yeah. And it was very targeted and there was a lot of effort put behind it and it was going for a long time. And then at some point it shifts. So they definitely had some users, they had some traction. But then tease marketing changes from essentially trying to confuse people that they are part of Are we dating the same guy? To directly attacking are we dating the same guy? And the main way they did this is they went to this company. This is kind of like a side quest on this investigation, but I thought it was very interesting and I knew these existed, but I've just never seen one. Like, I've never followed the operation of one of these companies so closely. But there is this company called SG Social Branding, I believe, and they advertise themselves as having 35 Gen Z influencers. And the whole business plan is basically you come to the company, you pay them to promote your app, and then these 35 influencers kind of spread out and start posting to social media as if they are like real users of your product and they're posting popular vertical video formats as like, oh, I'm holding the phone and I'm talking to the camera as if I'm just a normal user talking about how much the T app rules. And it's so much better than the Facebook groups and so much Easier to use than, are we dating the same guy? Or it's like two young influencers on a podcast talking about some dating ordeal they had and how t saved them from, like, a really bad situation. But there is no podcast. It's a fake. It's a fake podcast that they're pretending to be on because clips of podcasts are very popular on reels. And TikTok.
- [21:15]
Joseph Cox
Yeah, I know that. Well, while we were editing this and I highlighted that, and, you know, it's about halfway through the story, something like that. And then you have some sort of line that says, except the podcast didn't exist. And I'm like, that's crazy. We need to stress that. And as you just rightly said, and I've seen them as well, oh, you get YouTube shorts or anything, or adverts that just look like podcasts all the time. But as you say it, it's different when you're investigating it in the context of a company like this trying to grow it sounds like at all costs or whatever they're able to get away with, essentially. And it's very, very interesting to see that, oh, yes, there's a company behind it, and they were apparently hired to do that.
- [22:00]
Emmanuel Mayberg
Yeah. And I mean, two things about that is the way that I've seen these type of, like, fake podcast clips go around. It's usually some sort of, like, influencer or someone that's selling you, like, a class or like that. It's like individuals realizing that it's a popular format on social media and making one themselves. I've never seen a company, like, turn it into a business like that. So it's like, there's that, like, though there are others. Right. Jason, I'm sure you've seen other companies.
- [22:30]
Jason Kebler
I've seen them. And I mean, honestly, like, this company, super interesting that it exists and that they do this regularly and that they brag about it on their website, where they're like, case study. We did this for. For tea. But I guess it's honestly just how, like, marketing works these days. But they'll do, like, man on the street, quote, unquote, man on the street interviews, which is, like, you know, a very common thing on TikTok, when you're scrolling through and you have people shoving microphones in other people's faces and, like, spoiler alert. Not all of those are real, or at least they're not random people many of the times. But, yeah, I found that part to be, like, really interesting.
- [23:16]
Emmanuel Mayberg
The other reason that it's different, in my opinion, is because through the investigation, we noticed very clearly that there's a pattern. Right. Like, that's why I opened with this message that Sanchez got from T about them wanting to have a face for the app. And there's even stuff that didn't make it into this story that it just like, clearly, Sean Cook was going around and looking like, I need a woman. I need, like, a young, attractive woman to sell this story in order to sell this app. And the thing that finally works, and I think the thing that actually made him viral in late July, was these social videos. And it just like the idea that there's a man paying 35 young women to pretend to, like, authentically engage with this app and talk about how it's so helpful in online dating. And then all these women that signed up because of this, you know, whatever. All marketing is deception, but it is deception. And then, like, be so severely compromised. It just, like, it's a really, really nasty example of this type of marketing, I think.
- [24:22]
Joseph Cox
Yeah. And I think that kind of leads into one of the couple of other things I was going to ask, which is that what did we Learn about THI's CEO during this? This article is not a profile. It's much more about the growth of the company. But, of course, him being the founder and the CEO, he does come into that story. And of course, he's ultimately responsible for everything that's going on here. What did we learn about Sean Cook? I believe in this piece.
- [24:53]
Emmanuel Mayberg
So I would say that Sean Cook is like, stereotypical San Francisco Silicon Valley executive, had what seems like a pretty big job at Salesforce, is like a gigantic company, a gigantic tech company, and was there for many years. And then he leaves, and then he starts this thing, and he's doing, like, the startup hustle thing and is trying to grow it very badly and is bootstrapping it and seemingly has a lot riding on it and just, you know, like, classic move fast and break things situation. And it's all extremely sloppy. You know, he eventually, you know, we found that on a podcast. He says you have, like, a team of developers in Brazil and how great they are. But we looked into that, and that is just like two freelancers that were hired from, like, a software engineer freelancing program in Brazil. And I'm sure they do fine work. Like, I'm not disparaging the platform in general, but if you're looking to find why they had these security issues, it's because he did, like, the quickest, cheapest way that you can develop an app like this. Yeah.
- [26:15]
Joseph Cox
And just to remind people, the security issue for the driver's license one, at least the initial breach was that it was essentially an unprotected bucket of data that anybody could log into without authentication, which is obviously Security 101.
- [26:30]
Emmanuel Mayberg
Right. And he doesn't know anything about programming. He admitted that as well in some other interview and by talking to other people who worked at T. He doesn't know anything about like how to moderate a community which again is focused like on an extremely sensitive, volatile topics. He has no idea how the legal aspect of it, of it works and what he's liable for and what the users are liable for. And I think one of like the. It's not the worst thing, but I think it just indicates how, how desperate he was to. To make this happen is in interviews and on the website and on his LinkedIn, he has like an origin story for the company, which is about how his mom was dating and he was trying to help his mom because she got catfished essentially. But one of the things that the messages show, the messages that he sent Sanchez starting in late 2022 is at the time it was his fiance reaching out on T's behalf. And she says that they started the app together because of her bad dating experiences. And that relationship ends this. His fiance kind of leaves the company and exits the picture. And then like the story changes and it's like again, that's not like the worst thing in the world. Probably the worst thing is once his fiance leaves, he takes over like this Tara Persona that represented T officially on Facebook and in the app. So it's like if you needed, like if you had a support issue and you talk to someone in the T app, you were talking to Tara, which presumably was once his fiance, but then was him. So he's on the app pretending to be a woman, talking to other women who are on the app in order to like weed out men who are being deceptive in some way. And it's just like the dishonesty in that and just betraying people's trust and his users trust I think is pretty bad.
- [28:44]
Joseph Cox
Yeah. How about to round it off, I would just read out what Thi's statement was. Of course you sent a very detailed list of specific questions and specific facts that we were publishing this story. They didn't answer those, but they did say, and this is quite long, so maybe I won't read all of it, but they say, quote, building and scaling an app to meet the demand we've seen is a complex process. Along the way, we've collaborated with many, learned a great deal, and continue to improve T they then say what we know based on the fact that over 7 million women now use tea with over 100,000 new signups per day, is that a platform to help women navigate the challenges of online dating? Has been needed for far too long. Long. And then it repeats. It's one of the top apps in the U.S. all right, should we leave that there? When we come back, we're going to be joined by our intern Rosie Thomas to talk about one of her stories about GPS trackers on TikTok. We'll be right back after this.
- [30:00]
Jason Kebler
If you've ever tried to hire, you know that finding the best candidate can be like trying to find a needle in a haystack. You get lots of submissions, but most of them aren't tailor made for your role. Or people might just be applying at random. But not with ZipRecruiter. ZipRecruiter finds amazing candidates for you fast and right now you can try it for free@ziprecruiter.com 404media ZipRecruiter's smart technology identifies top talent for your role. Starting immediately after you post your job. ZipRecruiter's powerful matching technology gets to work right away, showing you qualified people that will fit your company and your role. ZipRecruiter also lets you be proactive, allowing you to send pre written invite to apply messages to reach top candidates before they know your role is open. It means you get connected with a great candidate for faster than ever. Ditch the other hiring sites and let ZipRecruiter find what you're looking for. The Needle in the haystack four out of five employers who post on ZipRecruiter get a quality candidate within the first day. Try it for free at this exclusive web address. Ziprecruiter.com 404media Again, that's ziprecruiter.com 404media Ziprecruiter the smartest way to hire this is.
- [31:17]
BetterHelp Ad Voice
An ad by BetterHelp. These days, people will seemingly try anything to improve their mental health, but using the Internet these days is like throwing a dart at a dartboard. Is a cold plunge, gratitude, journal or screen detox going to work for you because it worked for someone on Reddit? One thing that's long tested and long trusted is talking to therapists to help you get personalized recommendations and help you break through the noise. Working with A therapist on BetterHelp means that as they get to know you, you'll get stress reduction techniques, coping skills, and proven strategies that are tailored to help you become the best version of yourself. BetterHelp is easy to use and even easier to fit into your life. With more than 30,000 therapists who have helped more than 5 million people globally, you'll be in good company. Join a session with a click of a button, reschedule whenever you need, and switch therapists at any time. As the largest online therapy provider in the world, BetterHelp can provide access to mental health professionals with a diverse variety of expertise. Talk it out with better help our listeners get 10% off their first month at betterhelp.com 404media that's betterhelp h-e lp.com.
- [32:29]
Jason Kebler
404Media one of the scariest parts of building any business is figuring out who's going to be on your team and what tools you're going to use. We know from experience and in our experience, one tool you want to have on your team is Shopify, which makes starting and running your business seamless. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in the US from household names like Mattel and Gymshark to brands that want to be household names like 404 Media. Setting up a shop is simple with beautiful ready to go templates to match your brand style. Their easy to use backend helps you manage your store's inventory, add new products, or do a total redesign at the snap of a finger. Shopify also makes it easy to find new customers so you'll feel like you have a marketing team behind you Easily create email and social media campaigns to find new customers wherever they're scrolling or or strolling. Turn those dreams into and give them the best shot at success with Shopify. Sign up for your $1 per month trial and start selling today at shopify.com media. Go to shopify.com media shopify.com.
- [33:59]
Joseph Cox
And we are back. Rosie, thank you for joining us. This headline for one of your stories is TikTok shop sells viral GPS trackers marketed to stalkers. So there's a lot of video here. We're not going to show it right now. I'm just going to let you describe it. Could you just describe one of these videos? What are we seeing in one of these TikToks?
- [34:24]
Rosie Thomas
Yeah, so the videos are extremely creepy in my opinion anyway, and they basically show kind of repeated shots of a little black tracker being stuck to different areas of a car. So kind of under the mirror or between the seats or like, magnetically to the underneath of the engine. And then there's a lot of these videos, and they all have different voiceovers, but the voiceovers are basically kind of like encouraging people to track their partners if they think their partners are cheating. So it's kind of like, if you think your girl is out with friends every night, you should put one of these on her car. Or, you know, not everybody who uses this is crazy. They just want answers. And so they're very much being framed as a way to kind of calm somebody's suspicions about a cheating partner. One of them says, don't let what happened at the Coldplay concert happen to you. And obviously, Jason has reported on the Coldplay concert in the recent past.
- [35:38]
Joseph Cox
So the way I see this is obviously in the context of, yeah, stalkerware, abusive partners, that sort of thing. Way back at Motherboard, when we worked there, before we launched 404 Media, me and our colleague at the time, Lorenzo, we did a big series about stalkaware, which is where abusive partners would get their partner's mobile phone using Android. They would install spyware on it, which would track their physical location, record their text messages, listen to their phone calls, maybe get their emails, all of that sort of thing. And this just seems to be obviously, very much in the same realm when you first saw the. Well, and so there's that element. And then the second is that it is being marketed so openly on TikTok and TikTok shop that we'll talk about shortly. Rosie, what did you think when you saw this? Not on some weird underground forum, but right there on TikTok, like, what did you make of that?
- [36:42]
Rosie Thomas
I think it's interesting because these trackers exist. I mean, trackers exist in Apple, airtags exist, and people can buy Apple airtags. But the fact is that selling an Apple airtag with a very overt and explicit encouragement that the person who is being tracked by the airtag shouldn't know about it is fundamentally disturbing, I would say.
- [37:18]
Joseph Cox
Yeah. Sam, you've reported on Apple's airtags and how that was used in stalking. Can you just briefly remind us about that? Because everybody knew that was going to be a problem. Apple introduced these mechanisms where, well, your phone should get alerted if an airtag is nearby you and that sort of thing. But, um, but that didn't always work out to be the case. What did you report at the time, Sam, when it came to airtags and Apple?
- [37:46]
Sam Cole
Yeah, I mean, this was a ongoing beat for a couple years, I would say, in, like, 2023, 2022. Obviously it's still a problem that's ongoing. I, I, if I recall correctly and it's been a while, the reason why we started reporting on this originally was because we reached out to a bunch of police departments and got a bunch of like incident reports and narratives back from when people had called the cops or like filed reports about stalkers and ex exes and abusers who were stalking them via air tags and they were leaving air tags like in their cars or like exactly. What Rosie saw on TikTok and what she's describing is taking the air hag and putting it like in the gas like tank door in the wheel wells. I wrote a story about this woman who was fighting for custody of her kids and she, her ex husband was putting the air tags like in her kids clothes to track her and police at the time just kind of like didn't know what to do with that information. They were kind of like well what's an airtag? And even judges in some of these cases were like what are you talking about? That's ridiculous. And now I think it's become so mainstream that it's something that like a TikTok ad is using because they know it gets engagement. I'm sure it gets hate engagement. I'm sure it gets actual authentic engagement where people are like oh I, that's a useful thing that I want. Yeah, it's actually, it's like a real problem that a lot of people have and a lot of people deal with is these tags and it's not just Apple's tags but they are the most popular being put on their stuff to follow them around by like very pinpointed location to see where they are and when they went somewhere.
- [39:43]
Joseph Cox
Yeah, yeah, I have a, I had a researcher who reached out and I'm saying this now to hold myself accountable. I will reply again to you shortly. But they have something very interesting in this area as well where basically people can be tracked and not receiving alerts and I'll get back to that as soon as I can. But there's this other component here Rosie, which is that it's not just people making TikToks and going look at this, I'm being really weird or whatever, there's a TikTok shop. Can you just explain to those who don't know what exactly the TikTok shop is, is the individual user advertising the item for sale? Like what's the deal with TikTok shop?
- [40:21]
Rosie Thomas
I think there are different, there are a couple of different things that can be happening with TikTok shop. So an individual user can be making videos that are for products that they're selling, or they can kind of be like contract, like contracted to make videos for like another user or another organization. And it's basically creating adverts for different products. And so by allowing these videos on the platform, TikTok is saying it is okay to advertise in a way that encourages coercive control.
- [41:03]
Joseph Cox
Yeah, that makes sense. So what's the legality here? I would say that when law enforcement gets a GPS tracker to put on somebody's car, they have to get a warrant, which presumably means that just throwing a GPS tracker into the back of someone's car is probably illegal. But what's the legality as far as you understand it here?
- [41:28]
Rosie Thomas
So as far as I understand it, there are certain states that don't include tracking as a form of stalking, but stalking is obviously a crime in every state. There are 11 US states that have kind of an explicit law that says you cannot track somebody using a GPS enabled Tracker, and then 15 further states which say it's not legal to track a car without the consent of the owner. So the law varies between states. But obviously coercive control and harassment and domestic violence are illegal. Like those are crimes.
- [42:13]
Joseph Cox
Yeah. And again, it reminds me of the stalkaware stuff because sometimes we would cover that. And from a technical point of view, it is very, very boring. There's no fancy exploits, it's not being delivered over the air, it's not delivered via text message. You have to go grab the Android device, plug it in, install the Android apk, or with an iPhone, you have to jailbreak it. And that's very, very difficult if you're using a modern iPhone, if not impossible for an ordinary person, and then you get to spy on the person. And because of that, a lot of people in information security at the time didn't think it was very interesting. They're like, well, you just have to grab the phone. Why do we care about this? You're missing the security context of that. This is happening inside a domestic violence situation where an abusive partner can just demand their spouse to turn over the phone, or they may face physical violence, or they may trick them, or they may coerce them, or anything like that. So I find it pretty shocking that TikTok is openly facilitating the sale of these sorts of things. And I can't remember off the top of my head, but we've done very similar stories where GPS trackers are being sold or PI services are being sold on Fiverr, for example, what did TikTok tell you and what action did they take, if any?
- [43:37]
Rosie Thomas
So one thing that I would say is that we did find reviews of these trackers that said that they basically were alerting the users and that they weren't like, being undetectable in the way that they were being sold. And one of the reviews was like, this defeats the purpose of the reason that I bought it. So I do think that there are people who are buying this kind of credibly and deliberately with the intent to do what is shown in the videos. And TikTok, when we spoke to them, basically said, this isn't allowed. We don't allow. We don't allow content encouraging people to use devices for secret surveillance and have removed this content and banned the account that posted it. We further prohibit the sale of concealed video or audio recording devices on our platform. And so they banned the account that I had shown them. You know, a specific account where I'd said, these videos are very creepy. But then the next day I was able to find a bunch more of the same videos or very similar videos with very similar voiceovers.
- [44:48]
Joseph Cox
Yeah, I guess, just to clarify that, how many accounts are we talking about? And of course you won't have found every single account on TikTok doing this. That would require some sort of systematic research effort. But how many are we talking about? Three, four, five? Half a dozen?
- [45:06]
Rosie Thomas
So I found the next day probably 30 of the same videos, and they're from a bunch of different accounts, and the devices themselves are still for sale.
- [45:19]
Joseph Cox
Yeah, that makes sense. All right, we will leave that there. If you're listening to the free version of the podcast, I'll now play us out. But if you are a paying 404 media subscriber, we're going to talk about how Elon Musk's Grok Chatbot exposed its prompts. And we'll talk about what those prompts are and maybe I'll save what they exactly said for the actual section. I don't even really want to preview it here. Although you could go read the really offensive headline that we decided upon. You can subscribe and gain access to that content at 404 Media co. As a reminder, 404 Media is journalist, founded and supported by subscribers. Subscribers. If you do wish to subscribe to 404 Media and directly support our work, please go to 404 Media co. You'll get unlimited access to our articles and an ad free version of this podcast. You'll also get to listen to the subscribers only section where we talk about a bonus story each week. This podcast is made in partnership with Kaleidoscope. Another way to support us is by leaving a five star rating and review for the podcast. That stuff really helps us out. Here is one of those from Cussy 2344. The 404 crew do great original reporting and every single story on the podcast is worth engaging with. Thank you so much. This has been 404 Media. We'll see you again next week.